What is the primary purpose of incident reporting?

To assign blame to responsible parties

To satisfy regulatory requirements

To notify the appropriate personnel so they can respond

To document the incident for legal purposes

After a security incident, the response team completes the post-incident review. The review identifies that the incident was not detected quickly because the SIEM rules were not tuned for the specific attack pattern. What is the most effective improvement to implement?

Update the SIEM correlation rules to detect similar attack patterns

Document the incident in the final report

Increase the number of security analysts on the team

Conduct more frequent incident response drills

Who should be included in communication during a significant incident?

Internal teams and external parties as needed

Only the incident response team

During a malware incident, the response team has identified the infected systems and isolated them from the network. The next step is to remove the malware from the systems. Which action is part of the eradication phase?

Conduct a lessons-learned meeting

Delete the malware files and registry entries from the infected systems

Restore the systems from backups

Monitor the systems for any signs of reinfection

A company's intrusion detection system generates an alert for a possible port scan from an internal IP address. The security team is not sure if this is a real incident or a false positive. What is the most appropriate next step?

Ignore the alert because port scans are often benign

Escalate the alert to the incident commander for immediate response

Perform triage to validate the alert and assess its scope

Block the internal IP address at the firewall

Palo Alto NetworksCertified Security Operations Professional

Domain 2Objective 2

2.2 Explain the Concept of Incident Management and Response SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Part of the Threat Intelligence and Incident / Case Response domain, which accounts for 16% of the SECURITY-OPERATIONS-PROFESSIONAL exam.

34questions here

7free pages

8concepts

16%of the exam

Questions 6–10

6foundation · easy
What is the primary purpose of incident reporting?
Select an answer first
7application · medium
After a security incident, the response team completes the post-incident review. The review identifies that the incident was not detected quickly because the SIEM rules were not tuned for the specific attack pattern. What is the most effective improvement to implement?
Select an answer first
8foundation · easy
Who should be included in communication during a significant incident?
Select an answer first
9application · medium
During a malware incident, the response team has identified the infected systems and isolated them from the network. The next step is to remove the malware from the systems. Which action is part of the eradication phase?
Select an answer first
10application · medium
A company's intrusion detection system generates an alert for a possible port scan from an internal IP address. The security team is not sure if this is a real incident or a false positive. What is the most appropriate next step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.