A multinational company with headquarters in Germany and a subsidiary in Brazil uses Cortex XSIAM. The Brazilian subsidiary processes personal data of Brazilian citizens, and the German headquarters requires that all Cortex data be stored in the EU to simplify GDPR compliance. The company's legal team has determined that Brazilian data must remain in Brazil under local law. What should the security architect do to satisfy both requirements?

Configure a single Cortex tenant in the EU region and apply a data retention policy that deletes Brazilian data after 30 days.

Use a single EU tenant and enable data encryption at rest to satisfy both GDPR and Brazilian data residency requirements.

Create a second Cortex tenant in the Brazil region and route Brazilian data to that tenant while keeping EU data in the EU tenant.

Configure the EU tenant to use a Brazilian region for log storage while keeping all other data in the EU.

A company is subject to GDPR and PCI DSS. The security architect is designing a Cortex XSIAM deployment and must ensure compliance. Which of the following configurations are necessary to meet both standards? (Select all that apply.)

Configure the Cortex tenant in a region that satisfies GDPR data residency requirements.

Set a retention policy of at least one year for audit logs to meet PCI requirements.

Set a single retention policy of 30 days for all data to comply with GDPR's storage limitation.

Disable audit logging to reduce the risk of exposing personal data in logs.

Implement RBAC to restrict access to cardholder data and personal data.

What is the primary purpose of classifying sensitive data within Cortex?

To define how long data is retained

To determine the geographic storage location

To apply appropriate handling procedures based on data sensitivity

To record all access to the data

A company subject to GDPR must provide evidence of compliance to a supervisory authority. The security architect needs to demonstrate that only authorized users accessed personal data in Cortex XSIAM. What should the architect configure?

Set up data retention policies to delete personal data after a certain period.

Enable audit logging for all user actions and regularly review the logs for unauthorized access.

Enable data encryption for all personal data stored in Cortex.

Configure RBAC to restrict access to personal data.

Palo Alto NetworksCertified Security Operations Architect

Domain 1Objective 1

1.1 Design Data Residency, Retention, and Access Control Models Within the Cortex Tenant to Meet Standards (e.g., GDPR, PCI, Local Privacy Laws) SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 2)

Part of the Business Alignment and Strategy domain, which accounts for 22% of the SECURITY-OPERATIONS-ARCHITECT exam.

30questions here

6free pages

7concepts

22%of the exam

Questions 6–10

6application · medium
A multinational company with headquarters in Germany and a subsidiary in Brazil uses Cortex XSIAM. The Brazilian subsidiary processes personal data of Brazilian citizens, and the German headquarters requires that all Cortex data be stored in the EU to simplify GDPR compliance. The company's legal team has determined that Brazilian data must remain in Brazil under local law. What should the security architect do to satisfy both requirements?
Select an answer first
7expert · hard · select all that apply
A company is subject to GDPR and PCI DSS. The security architect is designing a Cortex XSIAM deployment and must ensure compliance. Which of the following configurations are necessary to meet both standards? (Select all that apply.)
Select an answer first
8foundation · easy
A compliance auditor requires evidence of who accessed sensitive Cortex data and when. Which Cortex feature should be enabled to provide this evidence?
Select an answer first
9foundation · easy
What is the primary purpose of classifying sensitive data within Cortex?
Select an answer first
10application · medium
A company subject to GDPR must provide evidence of compliance to a supervisory authority. The security architect needs to demonstrate that only authorized users accessed personal data in Cortex XSIAM. What should the architect configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-ARCHITECT” is a trademark of its owner, used for identification only.

1.1 Design Data Residency, Retention, and Access Control Models Within the Cortex Tenant to Meet Standards (e.g., GDPR, PCI, Local Privacy Laws) SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 2)

Questions 6–10

A company is subject to GDPR and PCI DSS. The security architect is designing a Cortex XSIAM deployment and must ensure compliance. Which of the following configurations are necessary to meet both standards? (Select all that apply.)

A compliance auditor requires evidence of who accessed sensitive Cortex data and when. Which Cortex feature should be enabled to provide this evidence?

What is the primary purpose of classifying sensitive data within Cortex?

A company subject to GDPR must provide evidence of compliance to a supervisory authority. The security architect needs to demonstrate that only authorized users accessed personal data in Cortex XSIAM. What should the architect configure?

Keep studying — Business Alignment and Strategy