A security manager wants to ensure that when a SOC analyst leaves the company, their Cortex XDR access is immediately revoked. The manager also wants to maintain an audit trail of who accessed what. What should the manager do?

Disable the user's account in Cortex XDR and rely on audit logs

Delete the user's account and disable audit logging

Change the user's role to Viewer

Reset the user's password and keep the account active

What is the primary role of log management in Cortex XDR?

To collect, store, retain, and analyze logs for security monitoring and investigation

To encrypt all network traffic within the organization

To provide real-time threat intelligence feeds

To manage user roles and permissions

How do user roles, log management, and data protection work together in Cortex XDR to secure an organization's environment?

Data protection masks logs, while roles determine retention periods

Roles encrypt logs, while log management assigns permissions

Roles control access to logs, which are protected and retained for compliance and analysis

Log management generates compliance reports, while data protection assigns user roles

A large enterprise has multiple SOC teams with different responsibilities: tier 1 analysts handle initial alert triage, tier 2 analysts perform deep investigations, and managers need to view reports and manage team assignments. The security architect wants to implement least privilege access. What should the architect do?

Assign all users the Admin role for simplicity

Disable RBAC and rely on user training

Use the same Analyst role for all teams

Create custom roles for each tier with appropriate permissions

Which activity is a key component of log management in Cortex XDR?

Assigning user roles to log analysts

Encrypting data at rest in the Cortex XDR database

Configuring firewall rules for network segmentation

Retaining logs for a defined period to support compliance and investigation

Palo Alto NetworksCertified Security Operations Professional

Domain 1Objective 1

1.1 Explain the Function of Users, Roles, Log Management, Compliance, and Data Protection in Cortex XDR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Part of the Security Operations Fundamentals domain, which accounts for 25% of the SECURITY-OPERATIONS-PROFESSIONAL exam.

31questions here

7free pages

6concepts

25%of the exam

Questions 21–25

21application · medium
A security manager wants to ensure that when a SOC analyst leaves the company, their Cortex XDR access is immediately revoked. The manager also wants to maintain an audit trail of who accessed what. What should the manager do?
Select an answer first
22foundation · easy
What is the primary role of log management in Cortex XDR?
Select an answer first
23foundation · easy
How do user roles, log management, and data protection work together in Cortex XDR to secure an organization's environment?
Select an answer first
24application · medium
A large enterprise has multiple SOC teams with different responsibilities: tier 1 analysts handle initial alert triage, tier 2 analysts perform deep investigations, and managers need to view reports and manage team assignments. The security architect wants to implement least privilege access. What should the architect do?
Select an answer first
25foundation · easy
Which activity is a key component of log management in Cortex XDR?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SECURITY-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “SECURITY-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.