A SOC analyst receives an alert about a user account logging in from a new geographic location at an unusual time. The analyst must perform triage. Which action is most appropriate during the initial assessment?

Block the IP address at the firewall

Immediately disable the user account to prevent further access

Contact the user to verify if they logged in from that location

Escalate the alert to the incident commander without further investigation

After a malware outbreak on several servers, the incident response team has contained the spread and eradicated the malware. The team now needs to restore the servers to normal operation. Which action is part of the recovery phase?

Conduct a lessons-learned meeting with the response team

Restore the servers from verified clean backups and validate their functionality

Update the firewall rules to block the malware's command-and-control IP

Document the incident timeline for the final report

A SOC analyst is triaging an alert about a user account that has been locked out due to multiple failed login attempts. The analyst checks the logs and sees that the failed attempts came from a single IP address over a short period. The user is a high-privilege administrator. What is the most appropriate immediate action?

Disable the user account immediately to prevent unauthorized access

Investigate the source IP and correlate with other alerts before taking action

Block the source IP address at the firewall

Reset the user's password and unlock the account

Palo Alto NetworksCertified Security Operations Professional

Domain 2Objective 2

2.2 Explain the Concept of Incident Management and Response SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Part of the Threat Intelligence and Incident / Case Response domain, which accounts for 16% of the SECURITY-OPERATIONS-PROFESSIONAL exam.

34questions here

7free pages

8concepts

16%of the exam

Questions 16–20

16foundation · easy
Which phase involves removing the threat from affected systems and eliminating the root cause?
Select an answer first
17foundation · easy
Which group in an incident response scenario is primarily responsible for providing business context and approving decisions that affect operations?
Select an answer first
18application · medium
A SOC analyst receives an alert about a user account logging in from a new geographic location at an unusual time. The analyst must perform triage. Which action is most appropriate during the initial assessment?
Select an answer first
19application · medium
After a malware outbreak on several servers, the incident response team has contained the spread and eradicated the malware. The team now needs to restore the servers to normal operation. Which action is part of the recovery phase?
Select an answer first
20expert · medium
A SOC analyst is triaging an alert about a user account that has been locked out due to multiple failed login attempts. The analyst checks the logs and sees that the failed attempts came from a single IP address over a short period. The user is a high-privilege administrator. What is the most appropriate immediate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

2.2 Explain the Concept of Incident Management and Response SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

Which phase involves removing the threat from affected systems and eliminating the root cause?

Which group in an incident response scenario is primarily responsible for providing business context and approving decisions that affect operations?

A SOC analyst receives an alert about a user account logging in from a new geographic location at an unusual time. The analyst must perform triage. Which action is most appropriate during the initial assessment?

After a malware outbreak on several servers, the incident response team has contained the spread and eradicated the malware. The team now needs to restore the servers to normal operation. Which action is part of the recovery phase?

Keep studying — Threat Intelligence and Incident / Case Response