Free SecOps-Pro: Palo Alto Networks Security Operations Professional Exam Questions and Answers

Which two statements about correlation rules in Cortex XSIAM are true? (Choose two.)

Select 2 answers.

• AA. They evaluate only telemetry collected by the Cortex XDR agent on managed endpoints.
• BB. They run an XQL query on a schedule and raise an alert for matching results.
• CC. They compare events against a fixed list of file hashes imported as indicators.
• DD. They can evaluate ingested third-party logs, such as firewall or identity data.

A SOC engineer needs custom logic that decodes Base64 strings found in phishing emails. Analysts must be able to run it from the War Room with a command, and playbook tasks must be able to call it. What should the engineer create in Cortex XSOAR?

• AA. A feed integration that imports decoded strings as indicators
• BB. A job that runs the decoding logic on a recurring schedule
• CC. An incident layout that displays the decoded strings to analysts
• DD. A script containing the decoding code

A SOC confirmed a ransomware infection on two file servers, isolated them, removed the malware, and restored the data from backup. Both servers are back in production. According to the NIST incident response life cycle, which phase should the team enter NEXT?

• AA. Preparation
• BB. Post-Incident Activity
• CC. Containment, Eradication, and Recovery
• DD. Detection and Analysis

Which statement describes the War Room in Cortex XSOAR?

• AA. A library of prebuilt integrations and playbooks that can be installed
• BB. A chronological record of commands, task results, and notes for an incident
• CC. A dashboard that aggregates incident metrics and analyst workload for management
• DD. A sandbox environment where suspicious files are detonated for verdicts

A SOC engineer wants Cortex XSIAM to raise an alert when a single user account has at least 15 failed logons against 5 or more distinct hosts within 10 minutes, based on ingested authentication logs. Which rule type should the engineer create?

• AA. An IOC rule that matches the account name against a list of known indicators
• BB. A BIOC rule that matches a single failed logon event on an endpoint
• CC. A correlation rule that uses an XQL query with a threshold and a schedule
• DD. An analytics BIOC rule that the engineer tunes to a custom threshold

A SOC engineer wants to onboard a new SaaS data source in Cortex XSIAM and install its parsing rules, modeling rules, and dashboards together in a single step. What should the engineer install from the Marketplace?

• AA. An integration instance for that data source
• BB. A Broker VM applet for that data source
• CC. A correlation rule for that data source
• DD. A content pack for that data source

A compliance auditor needs to review alerts, incidents, and dashboards in a Cortex XDR tenant. The auditor must not be able to change settings or take response actions on endpoints. Which role should the administrator assign?

• AA. Security Admin
• BB. Investigator
• CC. Responder
• DD. Viewer

A company with a data residency requirement is activating a Cortex XDR tenant that will store endpoint and firewall telemetry in Cortex Data Lake. The security team lists several configuration tasks. Which task directly addresses the requirement that the logs stay within a specific geographic region?

• AA. Enable log forwarding from the tenant to an on-premises syslog server
• BB. Assign analysts a role limited to the incidents for one region
• CC. Select the region for the tenant and its data storage during activation
• DD. Create a Restrictions profile that limits where agents can run

A partner shares a list of 200 malicious domains. A SOC analyst wants Cortex XSIAM to generate an alert whenever any of them appears in ingested network telemetry. What should the analyst do?

• AA. Add the domains to a Restrictions profile
• BB. Create a separate BIOC rule for each domain
• CC. Import the domains as IOCs and assign a severity
• DD. Add the domains to the agent hash exceptions list

In Cortex XSIAM, which component allows playbooks to send commands to a third-party product such as an email gateway or firewall?

• AA. A dashboard widget configured for that product
• BB. A correlation rule configured for that product
• CC. An integration instance configured for that product
• DD. A parsing rule configured for that product