Exam SecOps-Pro Topic 1 Question 6 Discussion

Actual exam question for Palo Alto Networks's SecOps-Pro exam
Question #: 6
Topic #: 1

A Security Operations Center (SOC) analyst is investigating a suspected ransomware incident using Cortex XSOAR. The incident was triggered by a SIEM alert indicating unusual file encryption activity on a critical server. The analyst needs to rapidly gather forensic data, isolate the compromised host, and enrich the incident with threat intelligence. Which of the following XSOAR features and functionalities would be most effective in automating these initial response steps and accelerating the investigation?

A. Manual task assignment within the incident playbook and real-time collaboration via the War Room. B. An out-of-the-box integration with a forensic tool like Velociraptor to collect memory dumps and a custom script to automatically update the host's firewall rules to isolate it, triggered by a playbook task. C. The Case Management dashboard to track the incident lifecycle and the Indicators of Compromise (IOCs) repository for known ransomware signatures. D. Pre-configured dashboards and reports for post-incident analysis and compliance reporting. E. The Asset Management module to identify the server's owner and the Knowledge Base for similar past incidents.

Suggested Answer: B Vote an answer

Option B is the most effective. Cortex XSOAR's strength lies in automation and orchestration. An out-of-the-box integration with a forensic tool (like Velociraptor) allows for automated data collection. A custom script within a playbook can dynamically modify firewall rules for host isolation based on incident context, demonstrating advanced automation. This directly addresses the need for rapid forensic data gathering and host isolation, which are critical initial response steps for ransomware. Options A, C, D, and E are valuable XSOAR features but do not directly address the immediate automation of forensic collection, isolation, and enrichment as effectively as B in the context of rapid initial response.

by Theobald at Oct 04, 2026, 04:59 AM

Limited Time Offer

15%

Off

Get Premium SecOps-Pro Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business