Palo Alto Networks Certified Security Operations Architect Practice Exam

What the Palo Alto Networks Certified Security Operations Architect exam covers

• Business Alignment and Strategy95 questions
• Platform and Data Architecture220 questions
• Automation and Detection Strategy117 questions

Free Palo Alto Networks Certified Security Operations Architect practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 432-question bank.

1. Question 1Business Alignment and Strategy

   Harrowgate Freight is sizing a Cortex XSIAM tenant and has not bought any retention add-ons yet. Its policy requires that analysts can fully search the last 90 days of ingested firewall and identity logs during investigations, and that cases and their issues stay viewable for six months. Which purchase does the design need to meet both requirements?

   • AA hot storage retention add-on for the logs, and nothing for the casesCorrect
   • BAdditional Cases and Issues Retention for the cases, and nothing for the logs
   • CA hot storage retention add-on for the logs, plus Additional Cases and Issues Retention
   • DPeriod-Based Retention Cold Storage for the logs, and nothing for the cases
   ✓ Correct answer: A

   In Cortex XSIAM the default retention for ingested data is 31 days, so searchable logs older than that need a hot storage retention add-on, such as Period-Based Retention Hot Storage or Additional Hot Storage for selected datasets, both described as fully searchable storage for investigation and threat hunting. Cases and Issues data has a default retention of 186 days, kept by Last Updated date for cases and by Observation Time for issues, which already covers a six-month requirement. Period-Based Retention Cold Storage is lower-cost storage for long-term compliance with limited search options and a six-month minimum purchase, so it does not fit a fully searchable 90-day window. Only the log requirement therefore drives a purchase, and it calls for hot storage.

   Why the other options are wrong

   • BIngested data is kept for 31 days by default, so the 90-day log requirement still needs a hot storage add-on.
   • CThe cases add-on is unnecessary, because the 186-day default for cases and issues already covers six months.
   • DCold storage offers limited search for long-term compliance and needs a six-month minimum purchase, so it does not meet a fully searchable 90-day investigation window.
2. Question 2Business Alignment and Strategy

   Barnsdale Energy requires firewall logs to reach Cortex XSIAM within 10 minutes of being created. For one 5-minute aggregation period, the ingestion metrics for the firewall source show data_freshness_max_delay = 3600. What can the architect conclude about that period?

   • AThe slowest log arrived exactly one hour after it was created
   • BThe slowest log took between 1 hour and 24 hours to arrive
   • CThe slowest log took between 5 minutes and 1 hour to arriveCorrect
   • DThe slowest log took between 60 seconds and 5 minutes to arrive
   ✓ Correct answer: C

   Cortex XSIAM measures freshness as the difference between log creation at the source (_TIME) and ingestion (_INSERT_TIME), per data source in five-minute aggregation periods. Delays are allocated into buckets, and the recorded value is the top of the bucket, so 5 minutes to 1 hour is recorded as 3,600 seconds. data_freshness_max_delay is the worst case in the period, so this record alone cannot prove a breach of a 10-minute target.

   Why the other options are wrong

   • AFreshness delays are allocated into buckets and recorded as the top value of the bucket, so 3,600 is a range ceiling, not an exact delay.
   • BThe recorded value is the top of the bucket, and a delay of 1 hour to 24 hours is recorded as 86,400 seconds, not 3,600.
   • DA delay of 60 seconds to 5 minutes is recorded as 300 seconds; 3,600 is the top of the 5-minute to 1-hour bucket.
3. Question 3Platform and Data Architecture

   Lowestoft Grain uses QuickConnect to send one firewall source from Cribl Stream to both the Cortex XSIAM destination and an Amazon S3 archive destination, both left at default settings. During a short XSIAM throttling event, the S3 archive also stopped receiving data. Which change keeps the archive flowing during the next XSIAM backpressure event?

   • AReplace the QuickConnect lines with Data Routes that send to both outputs
   • BSet the S3 archive destination's backpressure behavior to Drop instead
   • CAdd an Output Router destination that fans the events out to both receivers
   • DSet the XSIAM destination's backpressure behavior to Persistent QueueCorrect
   ✓ Correct answer: D

   Both destinations default to Block. When the same events go to several destinations and one set to Block enters backpressure, Cribl Stream blocks delivery of those events to every destination fed by that input. With Persistent Queue on the XSIAM destination, Cribl Stream can queue that copy locally while healthy destinations keep receiving data, as long as the queue has capacity.

   Why the other options are wrong

   • ANo routing construct isolates a source from a blocked destination; each destination's own setting decides.
   • BS3 was not exerting backpressure; the XSIAM destination's Block setting still stops the shared input.
   • CAn Output Router is also a routing construct, so it does not isolate the source from the blocked destination.
4. Question 4Platform and Data Architecture

   Brackwell Mining sends all outbound traffic through an explicit proxy that inspects web sessions. A new Broker VM configured with this proxy registers only intermittently and cannot hold a stable session to the tenant, although DNS resolution and TCP 443 are allowed. What does the documentation require?

   • ASwitch the broker's proxy type from HTTP to SOCKS5 to tunnel the session
   • BSelect Enforce TLS 1.3 in the broker's advanced settings for the tenant link
   • CLet the proxy convert the broker's sessions to HTTP/1.1 so it can inspect them
   • DMake sure the proxy supports HTTP/2, gRPC headers and HTTP/2 trailersCorrect
   ✓ Correct answer: D

   The Broker VM communicates with the Cortex XSIAM tenant using TLS 1.2 or higher. Whichever proxy type is configured, HTTP, SOCKS4 or SOCKS5, the proxy must support HTTP/2, gRPC-specific headers and HTTP/2 trailers, and inspection policies must support gRPC traffic; any device in that path must support these standards. Enforce TLS 1.3 is an advanced setting often required to meet regional security standards, and without it the broker uses TLS 1.2 or higher, so it does not address a proxy that cannot carry HTTP/2 and gRPC.

   Why the other options are wrong

   • AThe HTTP/2 and gRPC requirement applies to any proxy type selected, so SOCKS5 does not remove it.
   • BEnforce TLS 1.3 sets the protocol version for regional standards; it does not make the proxy support HTTP/2 and gRPC.
   • CThe proxy must support HTTP/2 and HTTP/2 trailers, so converting the sessions to HTTP/1.1 breaks the requirement.
5. Question 5Platform and Data Architecture

   Ivelford Health installs a Cortex XSIAM engine on RHEL 9 with the Shell installer, then applies the company's container hardening keys to the engine configuration: ```json {"docker.run.internal.asuser": true, "limit.docker.cpu": true, "limit.docker.memory": true, "python.pass.extra.keys": "--pids-limit=256##--ulimit=nofile=1024:8192"} ``` Which part of this hardening will not take effect on this engine?

   • AThe run-as-internal-user key, because rootless containers ignore it
   • BNone of it until an upgrade moves the engine from Podman to Docker
   • CThe CPU, memory and PIDs limits, because the engine runs PodmanCorrect
   • DAll of it, because Shell installs read only the UI configuration
   ✓ Correct answer: C

   The Shell installer detects the container management type; on RHEL 8 and later it installs and configures Podman in rootless mode, and upgrades retain that type. Docker hardening guidelines can be applied to Podman except Limit Available Memory, Limit Available CPU and Limit PIDS, so those three keys have no effect here.

   Why the other options are wrong

   • ADocker hardening guidelines apply to Podman except the memory, CPU and PIDs limits; running as an internal user is not among the exceptions.
   • BEngine upgrades retain the existing container management type.
   • DShell installations can be configured both in the UI and by editing d1.conf directly.
6. Question 6Platform and Data Architecture

   Corvell Bank's Cribl Stream pipelines use Auto Timestamp earliest and latest bounds that reject events more than 24 hours old or more than 10 minutes in the future. After an NTP fault on several domain controllers, their authentication events now fall outside those bounds. Following the CVA timestamp guidance, how should the pipeline handle these out-of-bounds authentication events?

   • ADrop them at the Worker so that dashboards and real-time alerts stay clean
   • BRoute them to a low-cost object store, tagged with time_skew=trueCorrect
   • CHold them in a source persistent queue until NTP is corrected
   • DForward them to the SIEM tagged with time_skew=true, keeping their own time
   ✓ Correct answer: B

   Auto Timestamp earliest and latest bounds clamp unrealistic timestamps so clock drift does not contaminate dashboards or correlation rules. When an event falls outside that window, the CVA offers two patterns. Drop suits high-volume, low-criticality data such as debug logs or noisy health checks. Route sends the events to a dedicated skewed destination, such as low-cost object storage, tagged with metadata like time_skew=true for forensic audit and troubleshooting, and it is the pattern for high-value security data such as EDR, authentication or CloudTrail logs, where losing data is not an option.

   Why the other options are wrong

   • ADropping suits high-volume, low-criticality data; authentication logs are high-value security data, which the guidance routes instead.
   • CPersistent queues spool data while a downstream is slow or unavailable; they do not correct timestamps or hold events for an NTP repair.
   • DClamping exists so drifted clocks do not contaminate dashboards or correlation rules, so the Route pattern sends skewed events to a dedicated skewed destination, not into the SIEM.
7. Question 7Automation and Detection Strategy

   Elmbridge Group's automation lead wants a Cortex XSIAM dashboard widget that trends failures and retries in automated playbook work week by week, so that recurring problems stand out. Which XQL dataset holds the failure and retry data the widget needs?

   • Aplaybook_tasksCorrect
   • Bplaybook_runs
   • Cscripts_and_commands_metrics
   • Dagentix_agents_actions
   ✓ Correct answer: A

   Cortex XSIAM provides XQL datasets for playbook and script performance. playbook_tasks holds data about failed tasks and tasks that were retried, playbook_runs holds data about playbook runs and statuses, and scripts_and_commands_metrics holds data about the scripts and commands used in playbook tasks. The failure and retry records the widget trends are in playbook_tasks. The trap is choosing the dataset for runs or for scripts and commands, which describe the work but do not record failed and retried tasks.

   Why the other options are wrong

   • Bplaybook_runs holds data about playbook runs and statuses, not about the tasks that failed or were retried.
   • Cscripts_and_commands_metrics holds data about the scripts and commands used in playbook tasks; failed and retried tasks are in playbook_tasks.
   • Dagentix_agents_actions is where agent runs are logged, not playbook task failures and retries.
8. Question 8Automation and Detection Strategy

   Glaisdale Rail keeps its operational technology cases in a custom Cortex XSIAM case domain named OT. An analyst finds that a case in the OT domain and a case in the built-in Security domain describe the same intrusion, and wants to combine them by merging the two cases. What happens?

   • AThe merge succeeds, and the merged case takes the Security domain as the built-in one
   • BThe merge succeeds once the OT case has been reassigned to the Security domain first
   • CThe merge succeeds only for a user with View/Edit permission for Case Properties
   • DThe merge is not possible, as cases that sit in different domains cannot be mergedCorrect
   ✓ Correct answer: D

   Each case and issue is assigned to a single domain, and the assigned domain cannot be changed. Among the points the documentation asks you to consider for case domains is that you can't merge cases with different domains. The OT case therefore cannot be merged with the Security case, and it cannot be moved into the Security domain first to get around the restriction. The View/Edit permission for Case Properties is what an administrator needs to add custom domains; it does not lift the merge restriction.

   Why the other options are wrong

   • ACases with different domains cannot be merged; there is no rule that a merged case takes the built-in domain.
   • BA case's assigned domain cannot be changed, so the OT case cannot be reassigned to Security before a merge.
   • CView/Edit permission for Case Properties is required to add custom domains; it does not allow merging cases across domains.
9. Question 9Platform and Data Architecture

   Corsham Logistics has Cortex XDR agents on every Windows server. The detection team proposes retiring its log collectors, on the basis that the agents already send every Windows event log channel to Cortex XSIAM, including Sysmon and custom application channels. What should the architect tell the team?

   • AThe agents send every channel once Windows event collection is enabled in the agent profile
   • BThe agents send every channel once the XTH add-on is licensed for the servers
   • CThe agents send only the Security channel, so a collector is needed for all others
   • DThe agents send only a predefined set of events, so a collector is needed for SysmonCorrect
   ✓ Correct answer: D

   The endpoint data collection page lists the Windows event logs that Cortex XDR agents can send to the tenant, and Cortex XSIAM saves them in both xdr_data and microsoft_windows_raw. The list is a fixed set of providers and event IDs across several channels, for example Security events 4624, 4625, 4768, 4769 and 4662, PowerShell 4104 and Windows Defender 1116, plus Application, Task Scheduler and other operational channels. Sysmon is not in that list, whereas the XDR Collector documentation lists Microsoft-Windows-Sysmon among the providers whose events it still ingests into xdr_data.

   Why the other options are wrong

   • AThe agent sends a predefined list of Windows event logs; Sysmon and arbitrary application channels are not in it.
   • BThe documented agent list is a fixed set of providers and event IDs; it does not expand to every channel.
   • CThe list includes channels beyond Security, such as Application, PowerShell, Task Scheduler and Windows Defender operational logs.
10. Question 10Business Alignment and Strategy

    At Kelso Freight, a reporting pipeline uses a Cortex XSIAM API key whose role is Instance Administrator. It must export a custom dashboard that an analyst created and set to Restricted, shared only with the fraud team. The export call is refused. Which change lets the pipeline export the dashboard while it stays Restricted?

    • AGive the API key's role View/Edit on dashboards and reports, because role permissions decide what a key can reach
    • BHave the analyst share the dashboard with the user group that holds the pipeline's service account
    • CReplace the key with an Advanced API key, because advanced keys are exempt from per-object sharing
    • DHave the analyst add the API key itself to the dashboard's access list with the Viewer or Editor roleCorrect
    ✓ Correct answer: D

    Per-object access controls the visibility of objects such as dashboards and saved queries. For API enforcement, the documentation states that public APIs for functional objects strictly enforce these object-level permissions, and that to interact with a Restricted object through the API, for example with GET, INSERT or DELETE methods, the API key must be explicitly added to that object's access list with the required Viewer or Editor role. Account and Instance Administrators have inherent visibility into Restricted objects, but the API enforcement statement still requires the key itself on the object's access list.

    Why the other options are wrong

    • AObject-level permissions are enforced on API calls; the key must be on the dashboard's access list, whatever its role allows.
    • BThe documentation requires the API key itself to be added to the object's access list; sharing with a user group does not add the key.
    • CThe enforcement statement covers API keys without an exception for key type; the key must be on the object's access list.

Who this Palo Alto Networks Certified Security Operations Architect practice exam is for

This practice set is for anyone preparing for the Palo Alto Networks Certified Security Operations Architect exam - from first-time candidates building a foundation to experienced Palo Alto practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Palo Alto Networks Certified Security Operations Architect practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Palo Alto Networks Certified Security Operations Architect exam.

Related Palo Alto resources

• Palo Alto Networks Certified Security Operations Architect study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Palo Alto Networks Certified Security Operations Professional practice examRelated
• Palo Alto Networks Certified XSIAM Analyst practice examRelated
• Palo Alto Networks Certified XSIAM Engineer practice examRelated

Palo Alto Networks Certified Security Operations Architect practice exam FAQ