A SOC is seeing an increasing number of false positives from its UEBA system, which is flagging legitimate remote workers who have irregular hours. The SOC manager wants to reduce false positives without losing detection of genuine insider threats. Which approach is most effective?

Tune the UEBA baselines for each user or group to account for the remote work patterns.

Increase the alert threshold globally to reduce all alerts.

Disable UEBA alerts for all remote workers.

Ignore the false positives and focus on other alert sources.

A SOC analyst needs to correlate login events from multiple domain controllers, network flow logs, and endpoint activity to identify a potential lateral movement attack. Which tool is most appropriate for this task?

An endpoint detection and response (EDR) tool.

A network intrusion prevention system (IPS).

A SOC analyst notices a series of failed login attempts followed by a successful login from an unusual geographic location. After confirming the user is on vacation, the analyst isolates the workstation and resets the user's credentials. Which SOC functions did the analyst perform, in order?

Monitoring, reporting, detection.

Analysis, monitoring, containment.

Palo Alto NetworksCertified Cloud Security Professional

Domain 1Objective 1

1.1 Demonstrate Understanding of SOC Components and Functions CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Part of the Security Operations Center (SOC) Fundamentals domain, which accounts for 10% of the CLOUD-SECURITY-PROFESSIONAL exam.

25questions here

5free pages

5concepts

10%of the exam

Questions 11–15

11expert · hard
A SOC is seeing an increasing number of false positives from its UEBA system, which is flagging legitimate remote workers who have irregular hours. The SOC manager wants to reduce false positives without losing detection of genuine insider threats. Which approach is most effective?
Select an answer first
12application · medium
A SOC analyst needs to correlate login events from multiple domain controllers, network flow logs, and endpoint activity to identify a potential lateral movement attack. Which tool is most appropriate for this task?
Select an answer first
13application · medium
A SOC manager is creating job descriptions for a new team. One role will be responsible for maintaining the SIEM correlation rules, managing log sources, and ensuring the platform is running optimally. Which role best fits this description?
Select an answer first
14application · medium
A SOC analyst notices a series of failed login attempts followed by a successful login from an unusual geographic location. After confirming the user is on vacation, the analyst isolates the workstation and resets the user's credentials. Which SOC functions did the analyst perform, in order?
Select an answer first
15foundation · easy
Which SOC function involves the continuous collection and review of security events from various sources to identify potential security incidents?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-SECURITY-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CLOUD-SECURITY-PROFESSIONAL” is a trademark of its owner, used for identification only.

1.1 Demonstrate Understanding of SOC Components and Functions CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

A SOC is seeing an increasing number of false positives from its UEBA system, which is flagging legitimate remote workers who have irregular hours. The SOC manager wants to reduce false positives without losing detection of genuine insider threats. Which approach is most effective?

A SOC analyst needs to correlate login events from multiple domain controllers, network flow logs, and endpoint activity to identify a potential lateral movement attack. Which tool is most appropriate for this task?

A SOC manager is creating job descriptions for a new team. One role will be responsible for maintaining the SIEM correlation rules, managing log sources, and ensuring the platform is running optimally. Which role best fits this description?

A SOC analyst notices a series of failed login attempts followed by a successful login from an unusual geographic location. After confirming the user is on vacation, the analyst isolates the workstation and resets the user's credentials. Which SOC functions did the analyst perform, in order?

Which SOC function involves the continuous collection and review of security events from various sources to identify potential security incidents?

Keep studying — Security Operations Center (SOC) Fundamentals