A company uses Cortex XSIAM and has a requirement that only the security operations team can access incident data, while the compliance team needs read-only access to audit logs. The company also needs to ensure that no single user can modify access controls. What should the security architect configure?

Use the default 'Analyst' role for both teams.

Create two custom roles: one for the security operations team with full access to incidents, and one for the compliance team with read-only access to audit logs.

Assign all users the 'Super User' role and rely on audit logging to detect misuse.

Create a single role that grants access to both incidents and audit logs.

A company uses Cortex XSIAM and has a team of SOC analysts who need to view and investigate alerts, but should not be able to modify tenant settings. The security architect needs to configure access control to enforce least-privilege. What should the architect do?

Assign all analysts the 'Super User' role.

Grant analysts read-only access to all data and settings.

Create a custom role with permissions to view and investigate alerts but not modify settings.

Use the default 'Analyst' role and rely on audit logging to detect misuse.

What is the primary goal of implementing role-based access control (RBAC) in a Cortex tenant?

To provide users with the minimum access necessary for their job functions

To record all user actions for compliance audits

To ensure data is stored in a specific geographic region

To control how long data is retained

A company operates in multiple countries and must comply with different local privacy laws. What should the architect consider when designing the Cortex tenant?

Apply a single global data retention policy to all data

Ignore local laws and follow only GDPR

Use the same access control model for all users regardless of location

Tailor data residency, retention, and access controls to each jurisdiction's requirements

A global company is deploying Cortex XSIAM and must comply with GDPR (EU data residency) and a new local law in India that requires all personal data of Indian citizens to be stored in India. The company wants to minimize operational overhead and cost. What is the most appropriate design?

Use a single Cortex tenant in the EU and enable data encryption to satisfy both laws.

Use a single Cortex tenant in India and rely on GDPR's adequacy decision for EU data.

Create two Cortex tenants: one in the EU for EU data and one in India for Indian data.

Use a single Cortex tenant in the EU and route Indian data to an on-premises data store.

Palo Alto NetworksCertified Security Operations Architect

Domain 1Objective 1

1.1 Design Data Residency, Retention, and Access Control Models Within the Cortex Tenant to Meet Standards (e.g., GDPR, PCI, Local Privacy Laws) SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 3)

Part of the Business Alignment and Strategy domain, which accounts for 22% of the SECURITY-OPERATIONS-ARCHITECT exam.

30questions here

6free pages

7concepts

22%of the exam

Questions 11–15

11expert · hard
A company uses Cortex XSIAM and has a requirement that only the security operations team can access incident data, while the compliance team needs read-only access to audit logs. The company also needs to ensure that no single user can modify access controls. What should the security architect configure?
Select an answer first
12application · medium
A company uses Cortex XSIAM and has a team of SOC analysts who need to view and investigate alerts, but should not be able to modify tenant settings. The security architect needs to configure access control to enforce least-privilege. What should the architect do?
Select an answer first
13foundation · easy
What is the primary goal of implementing role-based access control (RBAC) in a Cortex tenant?
Select an answer first
14foundation · easy
A company operates in multiple countries and must comply with different local privacy laws. What should the architect consider when designing the Cortex tenant?
Select an answer first
15expert · hard
A global company is deploying Cortex XSIAM and must comply with GDPR (EU data residency) and a new local law in India that requires all personal data of Indian citizens to be stored in India. The company wants to minimize operational overhead and cost. What is the most appropriate design?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-ARCHITECT” is a trademark of its owner, used for identification only.