Palo Alto Networks Certified Security Operations Professional Practice Exam

What the Palo Alto Networks Certified Security Operations Professional exam covers

• Security Operations Fundamentals145 questions
• Threat Intelligence and Incident / Case Response97 questions
• Cortex XDR139 questions
• Cortex XSOAR99 questions
• Cortex XSIAM120 questions

Free Palo Alto Networks Certified Security Operations Professional practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 600-question bank.

1. Question 1Security Operations Fundamentals

   At Harlow Pharma, SBAC is enabled and regional analysts report that Command Center totals are far higher than the counts they see after pivoting into the Issues table. What does the documentation recommend?

   • ARefresh the Command Center widgets after each scope change so totals follow scope
   • BRebuild the totals as XQL widgets on the issues dataset, which respect all scopes
   • CSet the Endpoint Scoping Mode to Restrictive so aggregates match the tables
   • DLimit Command Centers to broader-scope users and disable them in RBAC for othersCorrect
   ✓ Correct answer: D

   Command Centers are listed among the areas that do not fully respect SBAC: their aggregate numbers can sum data that is not in the user scope. When the user pivots to the Cases, Issues, Findings and Assets tables, those tables do respect SBAC, which is why the counts drop. The documentation recommends limiting the users who access Command Centers, granting those users a broader scope, and disabling access in RBAC settings for all other users.

   Why the other options are wrong

   • ARefreshing reflects asset group changes in XQL widgets; it does not stop Command Center aggregates from summing data outside the user scope.
   • BXQL widgets respect only the Assets scope, so rebuilding the totals does not make them respect every scope; the guidance is to limit Command Center access.
   • CThe Endpoint Scoping Mode controls how endpoint tags match; the documented response to Command Center aggregates is to limit who can access them.
2. Question 2Threat Intelligence and Incident / Case Response

   Zelah Networks' incident responders are countering a live campaign and need insight into the attackers' motivations, targets and methods. Which type of threat intelligence does Palo Alto Networks describe as integral to incident response teams for this?

   • ATechnical threat intelligence feeds
   • BTactical threat intelligence
   • CStrategic threat intelligence
   • DOperational threat intelligenceCorrect
   ✓ Correct answer: D

   Palo Alto Networks describes four types of threat intelligence. Operational threat intelligence pertains to specific threats and campaigns, providing insight into attackers' motivations, targets, and methods, often in real time, and is integral to incident response teams. Strategic intelligence informs decision-makers about long-term trends, tactical intelligence details TTPs and IoCs, and technical intelligence supports hunting and forensics.

   Why the other options are wrong

   • AOperational intelligence is the type described as integral to incident response teams that need the context of an attack.
   • BTactical intelligence details attacker TTPs for strengthening defences; operational intelligence is the type called integral to incident response teams.
   • CStrategic intelligence focuses on long-term trends to inform decision-makers, not a live campaign's details.
3. Question 3Cortex XDR

   Harwood Freight's analyst reviews a case's Key Assets & Artifacts tab. What verdict information does Cortex XDR show for each key artifact?

   • AThe VirusTotal score, which is shown by default
   • BThe WildFire-issued verdict for each key artifactCorrect
   • CThe SmartScore value that each artifact contributed
   • DThe IOC reliability grade set by the case assignee
   ✓ Correct answer: B

   The Key Assets & Artifacts tab shows the assets and artifacts associated with a case, including hosts, IP addresses, and users. To aid investigation, Cortex XDR displays the WildFire-issued verdict for each key artifact. To add verification sources, you can integrate external threat intelligence services with Cortex XDR.

   Why the other options are wrong

   • AVirusTotal is an external service that must be integrated, not the default verdict shown.
   • CSmartScore scores cases and issues rather than each artifact.
   • DIOC reliability belongs to IOC rules, not artifact verdicts in the case.
4. Question 4Cortex XSIAM

   A Radwinter Council analyst notices explorer.exe is not shown at the start of a Cortex XSIAM causality chain. Why?

   • ASpawner processes are hidden by default, so chains start at their childrenCorrect
   • BThe chain was cut at 24 hours, so earlier processes fall outside the view
   • CThe process was allow-listed, so it is removed from all of the causality chains
   • DThe agent does not record explorer.exe, since it is a signed OS component
   ✓ Correct answer: A

   Some OS processes, such as services.exe and explorer.exe, are used mainly to spawn other processes. Causality chains do not show these spawner processes by default and start from their child processes, since the spawners are only doing their OS job. You can add them manually by right-clicking the Causality Group Owner and adding the parent process. A spawner started by a non-spawner process, such as cmd.exe starting explorer.exe, is not treated as a spawner.

   Why the other options are wrong

   • BThe 24-hour default belongs to the Timeline timespan, not the chain start.
   • CAn allow-listed process is not why spawners are omitted from the chain.
   • DThe data is recorded; the parent can be added manually.
5. Question 5Cortex XSOARSelect all that apply

   Barwick Tech uses a Cortex XSOAR integration installed from a content pack. Which TWO statements about that integration are correct? (Choose TWO)

   • AIt must be duplicated before its source code is changedCorrect
   • BIts source code can be edited from the instance page
   • CIt can be downloaded as YAML without duplicating it
   • DIts instances can be deleted, but it cannot beCorrect
   • EIt can be deleted once all its instances are removed
   ✓ Correct answer: A, D

   If an integration was installed from a content pack, you need to duplicate it before editing or downloading it, and to change its source code and settings. You cannot delete an integration installed from a content pack unless it is a duplicate, but you can delete an integration instance.

   Why the other options are wrong

   • BAn integration installed from a content pack must be duplicated before editing; its source code is not edited in place.
   • CAn integration installed from a content pack must be duplicated before it is downloaded.
   • EAn integration installed from a content pack cannot be deleted unless it is a duplicate; only its instances can be deleted.
6. Question 6Threat Intelligence and Incident / Case Response

   Easington Retail uses Cortex XDR Extended Threat Intelligence (XTI) and plans how long newly added domain indicators keep matching before they need to be seen again. With default settings, when does a domain indicator expire?

   • AAfter 7 days
   • BAfter 14 daysCorrect
   • CAfter 30 days
   • DAfter 90 days
   ✓ Correct answer: B

   Extended Threat Intelligence assigns each indicator an expiration based on its type. By default, IPs expire in 7 days, domains in 14 days and URLs in 30 days. File hashes never expire. An expired indicator is reactivated if it is observed again in a threat feed or through enrichment, or if its verdict or tags are edited. A domain added today therefore stops being active after 14 days unless it is seen again.

   Why the other options are wrong

   • ASeven days is the default for IP addresses; domains expire in 14 days.
   • CThirty days is the default for URLs; domains expire in 14 days.
   • DNinety days is not a default expiration; by default domains expire in 14 days.
7. Question 7Cortex XDR

   Aldbrough Tech wants one Cortex XDR prevention policy rule to cover only part of its protected AWS Lambda workloads. Which criterion can the policy rule's filter use?

   • ADeployment type, such as Embedded or AWS Layers
   • BFunction version of the functions to targetCorrect
   • CModule format, such as ECMAScript or CommonJS
   • DEmbedded default profile chosen in the installer
   ✓ Correct answer: B

   To create a prevention policy rule for serverless functions, you right-click a prevention profile and create a new policy rule using it, then use the filters to define the criteria for the rule to apply. The function parameters you can select are cloud provider, region, runtime, function version and endpoint name. The filter is stored within the policy definition and assessed during runtime to extract the functions that match the filter criteria.

   Why the other options are wrong

   • ADeployment type, Embedded or AWS Layers, is selected when you create the serverless installation package; it is not one of the policy rule's function parameters.
   • CModule format is selected when you create the serverless installation package; it is not one of the policy rule's function parameters.
   • DEmbed Default Profile From is an installer setting whose profile is applied if the security policy cannot be retrieved in real time; it is not a policy rule filter.
8. Question 8Threat Intelligence and Incident / Case Response

   Quainton Health's hunter exports a Cortex XDR forensics hunt collection from the Collections page for offline analysis. According to the export documentation, when is the compressed export removed from the bucket?

   • ASeven days after it is created, unless it is downloaded first
   • BWhen the forensic investigation it belongs to is closed
   • COnly when a user deletes it with the bin icon in the table
   • DThirty days after it is created, when it shows as ExpiredCorrect
   ✓ Correct answer: D

   You can export a hunt or triage collection for long-term retention or offline analysis, and you can export a collection more than once. The Investigation Exports table shows the status of each requested export, and the compressed export data expires from the bucket after 30 days. The Export expiration column shows when the bucket data will be deleted; after that time the timestamp turns red and the last column shows Expired.

   Why the other options are wrong

   • ASeven days is not the documented period; the compressed export data expires from the bucket after 30 days.
   • BClosing the investigation is not what removes the export; the compressed data expires from the bucket after 30 days.
   • CThe bin icon lets a user delete the export earlier, but the compressed data expires from the bucket after 30 days in any case.
9. Question 9Threat Intelligence and Incident / Case Response

   An Icklesham Pharma playbook closes noisy Cortex XDR issues with the closeInvestigation command, setting closeReason to False positive - admin tool and closeNotes to Approved by IT. What resolution status do those issues end up with?

   • AResolved - False Positive, mapped from the closest defined reason
   • BResolved - Other, as the text matches no defined resolution reasonCorrect
   • CNo status change; the command fails until the reason matches exactly
   • DResolved - Known Issue, the reason applied to automated closures
   ✓ Correct answer: B

   An issue can be closed manually by changing its status to Resolved and selecting a resolution reason, or automatically with the closeInvestigation command in the CLI, a script or a playbook task. The command supports the closeReason and closeNotes arguments, and closeReason accepts free text. If that text does not match one of the defined resolution reasons, whose names take the form Resolved - False Positive or Resolved - Known Issue, the resolution_status field is set to Resolved - Other.

   Why the other options are wrong

   • ANo closest-match mapping is described; free text that does not match a defined resolution reason gives Resolved - Other.
   • CThe command does not fail; closeReason accepts free text, and a value that matches no defined reason sets Resolved - Other.
   • DResolved - Known Issue is for cases or issues related to an existing issue already being handled, not a default for automated closures.
10. Question 10Cortex XDR

    Idbury Council names its finance servers FIN-01, FIN-02 and so on, and wants a Cortex XDR endpoint group that picks up each new one as it registers, without anyone editing the group. Which group type fits?

    • AA dynamic endpoint group whose filter uses a partial hostname of FIN-Correct
    • BA static endpoint group uploaded from a file listing the FIN- hostnames
    • CA dynamic endpoint group based on the servers' Active Directory OU
    • DAn asset group filtered on the FIN- prefix, with the policy assigned to it
    ✓ Correct answer: A

    Cortex XDR endpoint groups can be dynamic or static. A dynamic group is populated automatically using endpoint characteristics, such as tags, partial hostname or alias, domain, IP range, installation type, agent version, endpoint type, user, or OS version, and supports wildcards and AND or OR criteria. A static group is a fixed list of selected endpoints, so new servers would not join it automatically.

    Why the other options are wrong

    • BA static group from a file must match agents that have already registered, and holds a fixed list, so servers that register later do not join it.
    • CActive Directory details can define groups once the Cloud Identity Engine is set up, but an OU does not follow the FIN- naming pattern; a partial hostname filter does.
    • DEndpoint groups are what policy and actions target; asset groups serve asset scoping.

Who this Palo Alto Networks Certified Security Operations Professional practice exam is for

This practice set is for anyone preparing for the Palo Alto Networks Certified Security Operations Professional exam at the advanced level - from first-time candidates building a foundation to experienced Palo Alto practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Palo Alto Networks Certified Security Operations Professional practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Palo Alto Networks Certified Security Operations Professional exam.

Related Palo Alto resources

• Palo Alto Networks Certified Security Operations Professional study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Palo Alto Networks Certified XSIAM Analyst practice examRelated
• Palo Alto Networks Certified XSIAM Engineer practice examRelated
• Palo Alto Networks Certified XSOAR Engineer practice examRelated

Palo Alto Networks Certified Security Operations Professional practice exam FAQ