Which Cortex configuration is most directly mapped to the PCI DSS requirement to restrict access to cardholder data?

Role-based access control (RBAC)

What is the main purpose of implementing data retention policies in Cortex?

To restrict data access to authorized users only

To define how long different types of data are stored

To control the geographic storage location of data

A company is subject to both GDPR and PCI DSS. The security architect is configuring Cortex XSIAM and needs to ensure that cardholder data is protected and access is restricted. Which configuration best maps to these requirements?

Enable data encryption and set a retention policy of 1 year for all data.

Set data residency to the EU and disable retention policies.

Use a single role for all users to simplify access management.

Configure RBAC to restrict access to cardholder data and enable audit logging.

A company operates in South Korea and must comply with the Personal Information Protection Act (PIPA), which requires that personal data be stored within the country. The company also has a global presence and uses Cortex XSIAM. What should the security architect do to comply with PIPA?

Use a single tenant in the US and enable data encryption.

Create a separate Cortex tenant in the South Korea region for Korean personal data.

Use a single Cortex tenant in the Asia region to cover all countries.

Configure a retention policy to delete Korean data after 24 hours.

Palo Alto NetworksCertified Security Operations Architect

Domain 1Objective 1

1.1 Design Data Residency, Retention, and Access Control Models Within the Cortex Tenant to Meet Standards (e.g., GDPR, PCI, Local Privacy Laws) SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 4)

Part of the Business Alignment and Strategy domain, which accounts for 22% of the SECURITY-OPERATIONS-ARCHITECT exam.

30questions here

6free pages

7concepts

22%of the exam

Questions 16–20

16foundation · easy
Which Cortex configuration is most directly mapped to the PCI DSS requirement to restrict access to cardholder data?
Select an answer first
17foundation · easy
What is the main purpose of implementing data retention policies in Cortex?
Select an answer first
18application · medium
A company is subject to both GDPR and PCI DSS. The security architect is configuring Cortex XSIAM and needs to ensure that cardholder data is protected and access is restricted. Which configuration best maps to these requirements?
Select an answer first
19foundation · easy
A compliance team needs to ensure that Cortex logs are kept for exactly 12 months to meet a regulatory requirement. Which Cortex feature should be configured?
Select an answer first
20application · medium
A company operates in South Korea and must comply with the Personal Information Protection Act (PIPA), which requires that personal data be stored within the country. The company also has a global presence and uses Cortex XSIAM. What should the security architect do to comply with PIPA?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-ARCHITECT” is a trademark of its owner, used for identification only.