Palo Alto Networks Certified Security Operations Professional Free Sample Questions

A SOC Manager needs to configure Role-Based Access Control (RBAC) in Cortex XDR for a new Tier 1 Analyst team. This team requires the ability to view alerts and investigate incidents but must be strictly prohibited from executing response actions such as Live Terminal or isolating endpoints. Which predefined role or custom configuration best adheres to the principle of least privilege for this requirement?

During a compliance audit, an organization is required to demonstrate that all Cortex XDR logs are retained for a minimum of 365 days. The current default retention is insufficient. Where must the administrator configure the extended retention policy to meet this requirement?

A security architect is designing a dashboard for the CISO that provides a high-level overview of the organization's security posture over the last 30 days. Which TWO widgets would be most appropriate to include in this executive-level dashboard? (Select TWO)

True or False: In the context of Palo Alto Networks Cortex portfolio, 'Machine Learning' primarily refers to static signature matching, whereas 'Artificial Intelligence' refers to the manual creation of correlation rules by analysts.

A SOC team is defining roles for a new incident response workflow. Which SOC role is primarily responsible for proactively searching through data to detect threats that evade automated security solutions?

While configuring a scheduled report in Cortex XDR, an analyst wants to ensure the report is generated every Monday at 8:00 AM and emailed to the compliance team. Which configuration setting handles the timing and distribution?

An organization is using Cortex XDR Analytics. Which of the following best describes how the analytics engine establishes a baseline for 'normal' user behavior?

A SOC team is experiencing 'alert fatigue' due to a high volume of low-fidelity alerts. Which feature in the Cortex portfolio is designed to group related alerts into a single actionable item to reduce analyst workload?

Case Study: An organization has three distinct SOC teams: Tier 1 (Triage), Tier 2 (Investigation), and Tier 3 (Threat Hunting/Engineering).

The Tier 2 team needs access to create and modify dashboards to track specific malware campaigns but should not be able to modify global server configurations.

Which RBAC strategy is most appropriate?

What is the primary function of the 'Broker VM' in a Cortex XDR deployment regarding log management?