A security operations team wants to automatically isolate a compromised workload as soon as a high-severity alert is generated. The team has already configured the alert rule that detects the compromise. What should the team configure next in Cortex Cloud to automate the response?

A compliance report that includes the workload's security status

A policy that triggers an automated response action, such as workload isolation, when the alert condition is met

A users indicator type to track who last accessed the workload

A log management setting to increase the retention period for the workload's logs

In Cortex Cloud, what does the 'roles' indicator type represent?

The list of applications a user is allowed to access

The functional role or job function of a user within an organization

The IP address ranges assigned to different departments

The specific permissions granted to a user on a cloud resource

A security operations center (SOC) is overwhelmed by alert fatigue. The team wants to reduce the number of low-priority alerts while ensuring that high-severity threats are still responded to automatically. The team uses Cortex Cloud. What should the team do?

Disable all alert rules and rely on manual log review

Create more users indicator types to track analyst activity

Refine rules and policies to suppress low-priority alerts and automate responses for high-severity alerts

Increase the log retention period to keep more data for analysis

How does the URL indicator type help in tracking malicious web resources?

By automatically taking down malicious websites

By encrypting web traffic to prevent interception

By providing a list of all URLs visited by users

By matching user access attempts against known malicious URLs

Which aspect is part of log management in Cortex Cloud?

Automated response to security incidents

Retention policies for stored logs

Masking sensitive data in log entries

Palo Alto NetworksCertified Cloud Security Professional

Domain 2Objective 1

2.1 Explain the Function of Key Components of Cortex Cloud CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 1)

Part of the Cortex Fundamentals domain, which accounts for 15% of the CLOUD-SECURITY-PROFESSIONAL exam.

39questions here

8free pages

11concepts

15%of the exam

Questions 1–5

1application · medium
A security operations team wants to automatically isolate a compromised workload as soon as a high-severity alert is generated. The team has already configured the alert rule that detects the compromise. What should the team configure next in Cortex Cloud to automate the response?
Select an answer first
2foundation · easy
In Cortex Cloud, what does the 'roles' indicator type represent?
Select an answer first
3expert · hard
A security operations center (SOC) is overwhelmed by alert fatigue. The team wants to reduce the number of low-priority alerts while ensuring that high-severity threats are still responded to automatically. The team uses Cortex Cloud. What should the team do?
Select an answer first
4foundation · easy
How does the URL indicator type help in tracking malicious web resources?
Select an answer first
5foundation · easy
Which aspect is part of log management in Cortex Cloud?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-SECURITY-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “CLOUD-SECURITY-PROFESSIONAL” is a trademark of its owner, used for identification only.