A company has a mix of data sources: on-premises firewalls, cloud SaaS applications, and endpoints. They need to onboard these sources into their security platform. Which onboarding methods are appropriate for these sources? (Select all that apply.)

Network tap for cloud SaaS applications

Syslog for on-premises firewalls

API for cloud SaaS applications

Which of the following is an example of data enrichment?

Adding geolocation information to an IP address

Converting timestamps to a standard timezone

A security operations team is selecting threat intelligence feeds for their platform. They need to detect threats specific to their industry (financial services) and want to minimize false positives. Which feed selection approach best meets their needs?

Choose a feed that includes indicators relevant to financial services and has a high confidence score

Select a feed with the lowest cost regardless of content

Subscribe to a general-purpose feed with high volume and broad coverage

Use a feed that provides raw, unvalidated indicators for maximum data volume

A security operations team is setting up monitoring for their data ingestion pipeline. They want to ensure they can detect issues and troubleshoot effectively. Which practices should they implement? (Select all that apply.)

Regularly review logs for missing data

Set up alerts for ingestion failures

Palo Alto NetworksCertified Security Operations Architect

Domain 2Objective 3

2.3 Define the Strategy for Data Sources, Integrations, and Feeds, and Select the Appropriate Onboarding Methods SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 3)

Part of the Platform and Data Architecture domain, which accounts for 49% of the SECURITY-OPERATIONS-ARCHITECT exam.

33questions here

7free pages

7concepts

49%of the exam

Questions 11–15

11expert · hard · select all that apply
A company has a mix of data sources: on-premises firewalls, cloud SaaS applications, and endpoints. They need to onboard these sources into their security platform. Which onboarding methods are appropriate for these sources? (Select all that apply.)
Select an answer first
12foundation · medium
Which of the following is an example of data enrichment?
Select an answer first
13application · medium
A security operations team is selecting threat intelligence feeds for their platform. They need to detect threats specific to their industry (financial services) and want to minimize false positives. Which feed selection approach best meets their needs?
Select an answer first
14foundation · medium
Which onboarding method is most appropriate for a cloud service that provides a REST API for accessing its logs?
Select an answer first
15expert · hard · select all that apply
A security operations team is setting up monitoring for their data ingestion pipeline. They want to ensure they can detect issues and troubleshoot effectively. Which practices should they implement? (Select all that apply.)
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-ARCHITECT” is a trademark of its owner, used for identification only.