Palo Alto Networks Security Operations Professional SecOps-Pro Exam Questions

Page: 1 / 14
Total 60 questions
Question 1

Which two statements are relevant to reports in Cortex XDR? (Choose two.)



Answer : A, D

Cortex XDR provides a robust reporting engine designed to communicate security posture and incident trends to various stakeholders.

Security and Delivery (A): When scheduling a report, an administrator can choose to send it via email. To comply with corporate security policies---since these reports may contain sensitive internal data like hostnames or user accounts---Cortex XDR allows the PDF version to be password protected.

XQL-Driven Content (D): The foundation of Cortex XDR reporting and dashboarding is XQL (Cortex Query Language). Reports are built by adding 'Widgets.' These widgets are essentially visual representations (charts, tables, or graphs) of an XQL query. When a report is generated, it captures the current state/screenshot of these XQL-based widgets to provide the data for the requested time period.

Why other options are incorrect:

Option B: While you can send reports via email or download them, there is no native 'push to intranet' (like a direct WebDAV or SharePoint push) feature built directly into the standard reporting module without external automation (like XSOAR).

Option C: Mock data is a feature often used in Cortex XSOAR for building playbook layouts and dashboards before live data exists; however, in the context of Cortex XDR, reports are designed to reflect the actual telemetry and alerts stored in the Data Lake.


Question 2

Where is the data retrieved by an integration task (such as a user's email address or a file's reputation) stored within an incident so that other playbook tasks can access it?



Answer : B

Context Data is a crucial architectural component of Cortex XSOAR. It acts as a temporary, JSON-formatted 'scratchpad' for each incident.

Data Flow: When a playbook task runs (e.g., !ad-get-user), the output is written to the Context Data. Subsequent tasks can then 'read' from this data to make decisions. For example, a conditional task can check if the user's department in the Context Data is 'Finance' before deciding to escalate the incident.

Persistence: Unlike the War Room (which is a chronological log of events), Context Data stores the latest state of information in a structured way that the automation engine can programmatically interact with.


Question 3

Where can an administrator begin to grant a new non-SSO user access to a Cortex XDR tenant? (Choose one answer)



Answer : B

The Cortex Gateway (formerly known as the Cortex Hub) serves as the centralized management plane for all Palo Alto Networks Cortex applications, including XDR, XSIAM, and XSOAR.

User Management: For non-SSO users, the process of granting access starts at the Gateway level. An administrator logs into the Gateway to create the user account and then selects the specific tenant the user should have access to.

Role Assignment: Once the user is added to the Gateway, the administrator can then assign the specific administrative or analyst roles required for that user within the tenant.

Why others are incorrect: While the Customer Support Portal (A) is used for licensing and support cases, and Access Management (C) is where you define the permissions within the tenant, the actual 'beginning' of granting access for a new account typically happens at the Gateway level to ensure the user identity exists in the Palo Alto cloud ecosystem first.


Question 4

In the MITRE ATT&CK framework, which term describes the specific high-level "Why" or goal of an attacker, such as "Initial Access" or "Exfiltration"?



Answer : B

The MITRE ATT&CK framework is categorized into a hierarchy that helps SOC analysts understand attacker behavior:

Tactic (B): This is the objective/goal of the attacker. There are currently 14 tactics in the Enterprise matrix, including Reconnaissance, Persistence, and Lateral Movement. It answers the question 'What is the attacker trying to achieve?'

Technique (A): This is the 'How'---the specific method used to achieve a tactic (e.g., 'Spearphishing Attachment' to achieve 'Initial Access').

Procedure (C): The specific implementation or 'recipe' used by a particular threat actor (e.g., 'APT28 used a specific PowerShell script to bypass AMSI').

Mapping: Cortex XDR and XSIAM natively map alerts to these Tactics and Techniques to help analysts quickly understand the stage and intent of an attack.


Question 5

Which protocol is commonly used by Cortex XSOAR to automatically pull threat intelligence indicators from external TAXII servers?



Answer : C

In the world of Threat Intelligence, STIX and TAXII work together, but they serve different roles:

STIX (Structured Threat Information eXpression): This is the language/format used to describe the threat (the 'What').

TAXII (Trusted Automated eXchange of Intelligence Information): This is the transport protocol used to exchange that information over HTTPS (the 'How').

Integration: Cortex XSOAR uses TAXII integrations to connect to threat feeds (like Unit 42 or ISACs) to automatically ingest indicators (IPs, URLs, Hashes) directly into the XSOAR Indicator repository.


Question 6

An analyst wants to create a detection rule that triggers when any process attempts to perform code injection into the lsass.exe process, regardless of whether the file hash of the source process is known to be malicious. Which type of rule should be created?



Answer : B

In the Cortex XDR environment, rules are categorized by what they monitor:

BIOC (Behavioral Indicator of Compromise) (B): These rules are designed to detect behavioral patterns and techniques rather than specific files. In this scenario, the behavior is the injection into a sensitive system process (lsass.exe). Since attackers constantly change file hashes to evade signature-based detection, a BIOC rule is the most effective defense because it focuses on the 'action' (the 'how') which is much harder for an attacker to change.

IOC (Indicator of Compromise) (A): These are based on static artifacts like specific file hashes, IP addresses, or domain names. If the hash is unknown, an IOC rule would not trigger.

Analytics Alert (D): These are generated automatically by the platform's Machine Learning engine when activity deviates from a baseline. While it might catch this, it is not a 'manually created rule' by an analyst for a specific known-bad behavior.


Question 7

An analyst identifies that a custom internal application is being incorrectly flagged as malicious by the Behavioral Threat Protection (BTP) module. What is the best way to stop these alerts while maintaining security for other applications?



Answer : C

In Cortex XDR, Exceptions are the preferred method for tuning the platform to reduce false positives without creating broad security gaps.

Granular Control: When you create an exception from a specific alert, Cortex XDR allows you to define the scope based on specific attributes like the process name, command line, or file path.

Targeted Tuning: Unlike disabling an entire module (Option A), an exception only ignores the specific behavior for that specific application.

Ease of Use: This can be done directly from the 'Check Action' or 'Alerts' tab within an incident, allowing the analyst to quickly suppress future occurrences of that specific false positive.


Page:    1 / 14   
Total 60 questions