SecOps-Pro 試験問題を無料オンラインアクセス

Which action should an administrator take to create automated response actions when a user account is compromised, allowing attacker to upload data to an external IP address and infect a machine on the company network with malware?

• A.Map the events as type of Cortex XSOAR incident, then run a playbook.
• B.Create a script in Cortex XSOAR that will run a playbook based on the scenario.
• C.Create automation rules in Cortex XDR that will trigger for each alert.
• D.Create playbook triggers in Cortex XSIAM and run playbooks for each alert.

Which task should a threat hunter include in the investigation when a Cortex XDR incident contains alertsout a malicious process?

• A.Add the SHA256 file hash to the Cortex XDR global block list.
• B.Search for the SHA256 file hash on other endpoints in the environment.
• C.Disable the account of the user responsible for initiating the process.
• D.Immediately isolate the endpoint and delete the identified file.

Which list accurately identifies out-of-the-box indicator types that can be queried?

• A.Network Address, Hyperlink, Attacker, Weapon
• B.Infrastructure, URL, Threat Actor, Tool
• C.IPv4, URI, Threat Group, Hacking Tool
• D.IP Address, Web Link, Adversary, Exploit Kit

Which statement accurately describes the relationship and primary difference between AI and machine learning (ML) in cybersecurity?

• A.ML focuses on structured, high-volume data processing, whereas AI is dedicated to unstructured data, such as security logs and threat intelligence reports.
• B.AI is a subfield of ML that specifically handles data labeling and feature engineering for deep learning algorithms.
• C.AI is the science of simulating human intelligence, whereas ML allows a system to learn and improve from experience without programming.
• D.AI refers to the historical approach of using predefined, signature-based rules, while ML represents the modern shift toward unsupervised anomaly detection.

Which two steps belong in the Cortex XSOAR incident lifecycle? (Choose two.)

• A.Incident notification
• B.Incident creation
• C.Preparation
• D.Planning