A company must provide evidence to a regulator that access to personal data in Cortex XSIAM was authorized and monitored. The security architect has enabled audit logging but is concerned that logs may be tampered with. What additional control should the architect implement?

Enable data encryption for audit logs.

Grant all users read access to audit logs to ensure transparency.

Set a retention policy to delete audit logs after 30 days.

Export audit logs to an external, tamper-evident storage system.

A security architect wants to ensure that analysts can only view alerts relevant to their region and cannot modify system configurations. Which access control model should be used?

Role-based access control (RBAC) with least-privilege roles

A company uses Cortex XSIAM and needs to ensure that sensitive data, such as personally identifiable information (PII), is handled in accordance with GDPR. The security architect wants to apply different retention and access controls to PII versus non-PII data. What should the architect do first?

Enable audit logging for all data access.

Configure a single retention policy for all data.

Assign all users the same role to simplify access control.

Classify data to identify which data is PII.

What is the primary purpose of configuring Cortex data residency settings?

To determine the geographic region where data is stored

To control which users can access the data

To define how long data is retained

A company operates in multiple countries, including Japan and Australia. The security architect is designing a Cortex XSIAM deployment and must comply with local privacy laws in each country. What is the most important consideration when configuring data residency?

Use a single tenant in a region that is geographically central to all countries.

Configure a single tenant with data residency set to 'Global' to allow data to be stored anywhere.

Configure separate Cortex tenants in each country's required region.

Use a single tenant in the US and rely on data encryption to satisfy all local laws.

Palo Alto NetworksCertified Security Operations Architect

Domain 1Objective 1

1.1 Design Data Residency, Retention, and Access Control Models Within the Cortex Tenant to Meet Standards (e.g., GDPR, PCI, Local Privacy Laws) SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 1)

Part of the Business Alignment and Strategy domain, which accounts for 22% of the SECURITY-OPERATIONS-ARCHITECT exam.

30questions here

6free pages

7concepts

22%of the exam

Questions 1–5

1expert · hard
A company must provide evidence to a regulator that access to personal data in Cortex XSIAM was authorized and monitored. The security architect has enabled audit logging but is concerned that logs may be tampered with. What additional control should the architect implement?
Select an answer first
2foundation · easy
A security architect wants to ensure that analysts can only view alerts relevant to their region and cannot modify system configurations. Which access control model should be used?
Select an answer first
3application · medium
A company uses Cortex XSIAM and needs to ensure that sensitive data, such as personally identifiable information (PII), is handled in accordance with GDPR. The security architect wants to apply different retention and access controls to PII versus non-PII data. What should the architect do first?
Select an answer first
4foundation · easy
What is the primary purpose of configuring Cortex data residency settings?
Select an answer first
5application · medium
A company operates in multiple countries, including Japan and Australia. The security architect is designing a Cortex XSIAM deployment and must comply with local privacy laws in each country. What is the most important consideration when configuring data residency?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-ARCHITECT” is a trademark of its owner, used for identification only.