A playbook is designed to run when a new alert of type 'Malware' is created. The team wants to ensure it also runs for alerts created by a specific integration. What should they configure?

Set the playbook trigger to include the specific integration's alert type.

Enable the playbook to run on all alerts by default.

Modify the integration to send alerts directly to the playbook.

Create a new playbook for each integration that generates alerts.

A security operations center wants to enrich alerts with threat intelligence from an external feed and automatically block malicious IPs on their firewall. What should they configure in Cortex XSIAM?

A log stitching rule that correlates threat intelligence with firewall logs.

A content pack that includes the threat intelligence feed and a dashboard.

An integration to the threat intelligence feed and a playbook that uses the enrichment to block IPs.

A sensor integration that forwards threat intelligence to the firewall.

How does an administrator install a content pack in Cortex XSIAM?

By browsing the content pack catalog and selecting the desired pack to install

By manually creating all dashboards and playbooks from scratch

By uploading a CSV file with the pack's content

By contacting Palo Alto Networks support to enable the pack

A security team wants to ingest firewall logs, cloud audit logs, and endpoint telemetry into Cortex XSIAM for centralized analysis. What is the primary method used to collect this data from the various sources?

Installing a third-party SIEM to aggregate logs before forwarding them to Cortex XSIAM

Configuring each source to send syslog directly to the Cortex XSIAM management interface

Deploying Cortex XSIAM sensors that connect to each source and forward normalized data to the platform

Manually exporting CSV files from each source and importing them into Cortex XSIAM daily

A security operations team wants to automatically create a ticket in their ITSM system whenever a high-severity alert is generated, and then run a predefined response sequence. What should they configure in Cortex XSIAM?

A log stitching rule that correlates ITSM tickets with alerts.

An integration to the ITSM system and a playbook that triggers on alert creation.

A sensor integration that forwards alerts directly to the ITSM system.

A content pack that includes a pre-built ITSM connector and a scheduled report.

Palo Alto NetworksCertified Security Operations Professional

Domain 5Objective 1

5.1 Explain the Function of Key Cortex XSIAM Components SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Part of the Cortex XSIAM domain, which accounts for 20% of the SECURITY-OPERATIONS-PROFESSIONAL exam.

32questions here

7free pages

10concepts

20%of the exam

Questions 21–25

21application · medium
A playbook is designed to run when a new alert of type 'Malware' is created. The team wants to ensure it also runs for alerts created by a specific integration. What should they configure?
Select an answer first
22application · medium
A security operations center wants to enrich alerts with threat intelligence from an external feed and automatically block malicious IPs on their firewall. What should they configure in Cortex XSIAM?
Select an answer first
23foundation · easy
How does an administrator install a content pack in Cortex XSIAM?
Select an answer first
24foundation · easy
A security team wants to ingest firewall logs, cloud audit logs, and endpoint telemetry into Cortex XSIAM for centralized analysis. What is the primary method used to collect this data from the various sources?
Select an answer first
25application · medium
A security operations team wants to automatically create a ticket in their ITSM system whenever a high-severity alert is generated, and then run a predefined response sequence. What should they configure in Cortex XSIAM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.