A security operations team is troubleshooting a data ingestion issue. They notice that logs from a specific source are delayed by several hours. The source is configured to send logs via syslog. What is the most likely cause?

The source is generating too few logs

The platform is receiving too many logs from other sources

The syslog server is overloaded

A security operations team is integrating a new data source that generates high-volume logs. They are concerned about the impact on their platform's performance. They want to ensure that the integration is reliable and does not cause data loss. What should they do?

Sample the logs to reduce volume

Use a message queue to buffer logs and process them in batches

Ingest all logs in real-time without any buffering

Increase the platform's processing capacity

When selecting a threat intelligence feed, which criterion is most important to ensure the feed is useful for your organization?

Relevance to your industry and threat landscape

A security operations team is integrating a new cloud service's logs into their platform. The service provides a REST API for log export. The team wants to ensure reliable and scalable ingestion without overloading the platform. What should they do?

Install an agent on the cloud service to forward logs

Manually download logs and upload them to the platform

Configure the service to push logs via syslog

Use the API to pull logs on a scheduled basis and batch them

Palo Alto NetworksCertified Security Operations Architect

Domain 2Objective 3

2.3 Define the Strategy for Data Sources, Integrations, and Feeds, and Select the Appropriate Onboarding Methods SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 1)

Part of the Platform and Data Architecture domain, which accounts for 49% of the SECURITY-OPERATIONS-ARCHITECT exam.

33questions here

7free pages

7concepts

49%of the exam

Questions 1–5

1expert · hard
A security operations team is troubleshooting a data ingestion issue. They notice that logs from a specific source are delayed by several hours. The source is configured to send logs via syslog. What is the most likely cause?
Select an answer first
2foundation · medium
Which of the following is a common method for troubleshooting data flow issues in a security operations platform?
Select an answer first
3expert · hard
A security operations team is integrating a new data source that generates high-volume logs. They are concerned about the impact on their platform's performance. They want to ensure that the integration is reliable and does not cause data loss. What should they do?
Select an answer first
4foundation · medium
When selecting a threat intelligence feed, which criterion is most important to ensure the feed is useful for your organization?
Select an answer first
5application · medium
A security operations team is integrating a new cloud service's logs into their platform. The service provides a REST API for log export. The team wants to ensure reliable and scalable ingestion without overloading the platform. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-ARCHITECT” is a trademark of its owner, used for identification only.