A security team wants to use a threat intelligence feed that is not available in the Marketplace. They have the feed's API documentation and want to integrate it with Cortex XSOAR. What is the most appropriate approach?

Use a generic HTTP request integration to fetch the feed.

Manually add the indicators to the TIM database using the UI.

Develop a custom integration using the Cortex XSOAR integration framework.

Submit a request to Palo Alto Networks to add the feed to the Marketplace.

A playbook needs to block an IP address on a firewall. The firewall integration is configured and the command 'block-ip' is available. The playbook task that calls this command is failing with an authentication error. What is the most likely cause?

The 'block-ip' command is not available in the integration.

The playbook is not attached to the incident.

The integration instance's credentials are incorrect or have expired.

What is the first step in conducting a case investigation in Cortex XSOAR?

Creating or opening an incident

Palo Alto NetworksCertified Security Operations Professional

Domain 4Objective 1

4.1 Explain the Features and Functionality of Cortex XSOAR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 6)

Part of the Cortex XSOAR domain, which accounts for 16% of the SECURITY-OPERATIONS-PROFESSIONAL exam.

28questions here

6free pages

6concepts

16%of the exam

Questions 26–28

26application · medium
A security team wants to use a threat intelligence feed that is not available in the Marketplace. They have the feed's API documentation and want to integrate it with Cortex XSOAR. What is the most appropriate approach?
Select an answer first
27application · medium
A playbook needs to block an IP address on a firewall. The firewall integration is configured and the command 'block-ip' is available. The playbook task that calls this command is failing with an authentication error. What is the most likely cause?
Select an answer first
28foundation · easy
What is the first step in conducting a case investigation in Cortex XSOAR?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SECURITY-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

4.1 Explain the Features and Functionality of Cortex XSOAR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 6)

Questions 26–28

A security team wants to use a threat intelligence feed that is not available in the Marketplace. They have the feed's API documentation and want to integrate it with Cortex XSOAR. What is the most appropriate approach?

A playbook needs to block an IP address on a firewall. The firewall integration is configured and the command 'block-ip' is available. The playbook task that calls this command is failing with an authentication error. What is the most likely cause?

What is the first step in conducting a case investigation in Cortex XSOAR?

Keep studying — Cortex XSOAR