SecOps-Pro Exam Questions & Answers

Identity Analytics (formerly part of the Magnifier module) is specifically designed to identify stealthy attacks that traditional signature-based tools miss, such as insider threats, credential theft, and lateral movement.

Behavioral Baselining: It uses Machine Learning to create a 'baseline' of normal behavior for every user and entity in the network. It tracks who they usually communicate with, what time they log in, and what resources they typically access.

Anomaly Detection: If a user suddenly begins accessing sensitive servers they've never touched before or starts transferring large amounts of data to an unusual external IP, Identity Analytics flags this as a 'User Behavioral Analytics' (UBA) alert.

Focus on Identity: Unlike Host Insights (which looks at vulnerabilities) or Forensics (which looks at disk artifacts), Identity Analytics focuses purely on the actions of the user account to find malicious intent.

Modern exploits often bypass Data Execution Prevention (DEP) by using ROP (Return-Oriented Programming) chains. This involves stringing together small pieces of legitimate code (gadgets) already present in memory.

The Defense: Cortex XDR includes specialized EPMs to break these chains. Stack Pivot Protection detects when an attacker tries to redirect the stack pointer to a controlled memory area.

JMP2RET: This specific module monitors for common ROP 'gadgets' like 'Jump to Return' instructions that are used to seize control of the execution flow.

Zero-Day Protection: Because these modules focus on the technique of the exploit rather than a specific file signature, they are highly effective at stopping 'Zero-Day' exploits before a patch is even available.

The MITRE ATT&CK framework is categorized into a hierarchy that helps SOC analysts understand attacker behavior:

Tactic (B): This is the objective/goal of the attacker. There are currently 14 tactics in the Enterprise matrix, including Reconnaissance, Persistence, and Lateral Movement. It answers the question 'What is the attacker trying to achieve?'

Technique (A): This is the 'How'---the specific method used to achieve a tactic (e.g., 'Spearphishing Attachment' to achieve 'Initial Access').

Procedure (C): The specific implementation or 'recipe' used by a particular threat actor (e.g., 'APT28 used a specific PowerShell script to bypass AMSI').

Mapping: Cortex XDR and XSIAM natively map alerts to these Tactics and Techniques to help analysts quickly understand the stage and intent of an attack.

A modern Security Operations Center (SOC) utilizes a tiered structure to manage the volume of incoming alerts efficiently.

Triage Specialist (C): Often referred to as a Tier 1 Analyst, this role is the 'eyes on glass.' Their primary job is to monitor the console for new alerts, regardless of severity. They perform the initial investigation to determine if an alert is a false positive or a legitimate threat. Handling low-severity alerts is a core part of their triage process to ensure no 'bread crumbs' of a larger attack are missed.

Incident Responder (D): Also known as a Tier 2 Analyst, they take over once a Triage Specialist has confirmed a 'True Positive' and escalated the alert. They focus on containment and remediation rather than the initial screening of new, low-level alerts.

Threat Hunter (B): A Tier 3 role that proactively searches for hidden threats. They do not wait for alerts to appear in the console; instead, they use XQL to hunt for anomalies.

SOC Manager (A): Focuses on the strategic and administrative side of the SOC, such as staffing, reporting, and process improvement, rather than investigating individual alerts.

Live Terminal is a powerful forensic and remediation tool built directly into the Cortex XDR and XSIAM consoles.

Direct Access: It provides a secure, web-based terminal session to a remote endpoint (Windows, macOS, or Linux) without requiring RDP or SSH to be enabled on the target.

Capabilities: Analysts can browse the file system, terminate processes, download/upload files, and execute PowerShell or Bash commands.

Auditability: Every action taken during a Live Terminal session is logged and recorded, ensuring that there is a full audit trail for compliance and 'chain of custody' purposes during an investigation.

Why others are incorrect: The Action Center (C) is where you monitor the status of pending or completed actions (like a scan or isolation request), but it is not the interface used to execute the commands themselves.