Domain 1: Business Alignment and Strategy
- In Cortex XSIAM ingested data is kept for 31 days by default, so longer searchable log retention needs a hot storage add-on, while cases and issues default to 186 days and audit logs to 365 days.
- Additional Cases and Issues Retention adds 31 days to case and issue data and also extends agentic AI chats and artifacts by 31 days; no Cortex XSIAM tier includes extended per-dataset retention.
- Hot and cold storage are independent: cold storage is fed from the pipeline only from its purchase date, so it must be bought with the base license to cover logs from day one.
- Cortex BYOK uses a dedicated KMS per tenant and two keys, one for the Data lake (BigQuery) and one for all other tenant services, and the encryption method can be selected only when a new tenant is created.
- FedRAMP does not currently support multi-tenant or MSSP environments, so a parent-child hierarchy must be removed from a FedRAMP design.
- Scopes are set on users, user groups and API keys; row-level scoping is supported only on raw datasets, and a Datasets Rows scope with no filter defaults to No rows are accessible.
- Row scoping can be bypassed through dataset views and correlation rules, and scheduled reports run in the scope of the user who created or last updated the template, while SBAC applies to manually generated reports.
- Users with several roles through groups or nesting get the highest combined access; Instance Administrator controls one tenant, while Account Admin spans all tenants, including future ones.
- User groups created in Cortex Gateway are shared across tenants but do not support SAML group mapping or scoping, SAML group mapping is case-sensitive and session-based, and SSO must be set up separately for each tenant.
- Premium includes Threat Intel Management, Attack Surface Management and Extended Threat Intelligence, but Identity Threat Detection & Response remains an add-on on every tier.
- Analytics and Cortex Data Lake each have a minimum, and the Data Lake add-on needs the Analytics minimum met first; a production tenant stores 3 million indicators without TIM and 100 million with it.
- Compute units are consumed by Apps such as a Notebooks instance and by cold storage queries, and queries fail without enough quota; the default daily limit is the annual quota divided evenly.
- In the Command Center an automated case is one that contains at least one playbook, and the open-cases KPI represents every case currently open rather than a time frame.
- The per-severity target MTTR is defined in Server Settings, a timer field can be associated with only one SLA, and issue timer fields need a timer script tagged SLA to act when they time out.
Domain 2: Platform and Data Architecture
- Cortex XSIAM requires data from Cribl to be streamed as-is from the vendor, and Palo Alto Networks firewall data should use dedicated XSIAM collectors because ingesting NGFW data through Cribl omits the Enhanced Application Logging layer.
- Only one Cribl data collector instance can be configured in Cortex XSIAM and every Cribl source shares it; the Cribl destination needs the API URL and authorization token that instance generates.
- Cribl recommends a separate source collector for each data type, and the Palo Alto XSIAM pack applies a dedicated pipeline to each data source and sets the UUID that tells XSIAM which source is streaming.
- A blocked Cribl destination stops the same input reaching other destinations unless the blocked destination uses Persistent Queue with free capacity, and with push Sources a Worker holds in-flight data only in memory.
- Cribl sizing sums inbound and outbound volume, divides by 400 GB per day per physical core, then adds one core per Worker Node for OS overhead.
- In Cortex XSIAM multi-tenant, child tenant alerts can be searched from the main tenant, but no data is stored on the main tenant; enterprise multi-tenant with central licensing segregates subdivision data while keeping central visibility.
- In central licensing a child tenant cannot be unpaired, only deleted, which permanently deletes its data and content, and changing a child tenant's allocations might cause a short downtime of that tenant.
- Integrations that fetch incidents or indicators must be configured on the child tenant, and a child tenant with no labels receives only content labelled all, while content with no labels syncs to no child tenant.
- Cortex XSOAR 8 On-prem supports a standalone node or a three-node cluster with identical node resources, a standalone deployment cannot later be converted into a cluster, and a three-node cluster needs two nodes online.
- Broker VM outbound traffic to Cortex XSIAM is about 25 percent of applet intake but can reach 50 percent, and any proxy in its path must support HTTP/2, gRPC-specific headers and HTTP/2 trailers.
- A Broker VM disconnected for more than 30 days has to be re-registered, and rolling upgrades in a Broker VM cluster run only when the cluster is Healthy, which needs at least two working nodes.
- The Kafka Collector is an active/passive Broker VM applet: in a cluster it runs only on the Primary node while the standby nodes stay synchronized, ready to take over on failover.
- The Local Agent Settings applet supports up to 50,000 agents for the agent proxy on newer brokers but only up to 10,000 for content caching, and a Broker VM proxies XDR Collector traffic without caching XDR Collector installers.
- XDR Collector policies are evaluated top to bottom with the first match active, collectors cannot move between tenants, and with no vendor and product set Filebeat module data lands in a <module>_<module>_raw dataset.
- Engines are x86_64 only, each engine can belong to only one load-balancing group, only Shell-installed engines can be upgraded from the Engines page, and a long-running listener with a custom certificate must run on an engine.
- Use the dedicated NGFW collector by default and the Syslog Collector with CEF only for firewalls in another region or where large logs cause bandwidth problems; log type filtering on the NGFW instance drops unwanted types at the collector.
- IOC and BIOC issues apply to stitched data only, while correlation rules can fire on raw, non-normalized logs, and each INGEST section is standalone, so a log matching two sections is inserted twice.
- An Event Hub should be sized up front for peak plus growth, at up to 1 MB/s per partition, because partitions cannot be changed later, and for AWS BYOB collection the stack must be deployed in the S3 bucket's region.
Domain 3: Automation and Detection Strategy
- A known hash is an IOC, a process and registry behavior is a BIOC, and a sequence of related events is a correlation rule; a BIOC query must filter on event_type and cannot use aggregations.
- Only enabled user-created scheduled correlations count toward the 1,200 limit, and scheduled correlation rules run no more often than every 10 minutes and query at most 7 days.
- A per-type Default Rule Expiration applies to all existing and future IOC rules of that type, and with the Threat Intel Management add-on, indicator rules use TIM's indicators directly.
- When a case's issues match a scoring rule, the rule-based score is assigned; SmartScore is assigned only when no rule matches and there is sufficient data.
- Each Analytics detection lists its own data sources, and some accept any one listed source while others require all listed sources together, so the onboarding plan must match the detections the business needs.
- Only the first matching automation rule runs, automation rules do not act on Low severity BIOC issues, and Quick Actions leave War Room entries but not Work Plan tasks.
- An automation exclusion policy, fed by a list or asset group of critical assets, stops remediation commands on those assets without detaching the playbook.
- Use one integration per content pack and keep related playbooks with the pack; sub-playbook outputs are Private by default, and a script's default timeout is 180 seconds.
- Historical import from a legacy SIEM needs the Period-Based Retention Cold Storage add-on; imported datasets are renamed archive_<name>, and files sent to the HTTP collector must be uncompressed and no larger than 25 MB.
- When rebuilding Splunk logic, functions that Translate to XQL does not support, such as cidrmatch, are rewritten with incidr, incidrlist or incidr6, and XQL evaluates field values case-insensitively by default.
- Development tenants are not intended for performance checks and have fewer ingestion and compute resources than production, and only one development tenant in a cluster is the push tenant.
- Parsing rules and correlation rules are not supported by push and pull, so they must be developed in each tenant or copied to production, and turning the content repository off on production makes the development tenant inactive.
- Agents never automatically execute actions marked sensitive; in Agentic Response they pause and create a pending task in the case Resolution Center for an analyst to approve or deny.
- Custom agents are self-contained, so every action the workflow needs must be assigned to the agent, and they need the Cortex - Run XQL Query action because TextToXQL only generates queries.
- Autonomous rules and playbooks cannot be edited, so you disable the rule and add a custom rule, or rebuild the listed response commands in a custom playbook; the Cortex MCP Server key should use the Standard security level with the minimum role.
Palo Alto Security Operations Architect exam tips
- Start every licensing scenario from what the base tier includes and what is always an add-on: retention beyond the defaults, ITDR and cold storage are bought separately, and cold storage only collects from its purchase date.
- For multi-tenant designs, separate what lives on the main tenant from what must sit on each child: the main tenant searches child alerts but stores no data, and fetching integrations belong on the child.
- Read Broker VM, XDR Collector and engine questions for the hard limit that decides them - node counts for cluster health, agent counts for caching, x86_64 for engines, and one load-balancing group per engine.
- For detection design, pick the rule type from what the logic needs: IOC for a known artifact, BIOC for event behavior with no aggregation, and scheduled correlation for sequences and aggregations within the 10-minute and 7-day bounds.
- When a question offers an agent or a playbook, check which actions are sensitive and which actions the custom agent actually holds, because sensitive actions always wait for an analyst's approval.
Study guide FAQ
What does the Security Operations Architect exam cover?
Three domains from the February 2026 datasheet: Business Alignment and Strategy (22%), Platform and Data Architecture (49%), and Automation and Detection Strategy (29%).
What is the passing score?
Palo Alto Networks sets the passing score at 860 on a 300-to-1000 scale for every one of its certification exams. A scaled score cannot be read as a percentage of questions answered correctly.
How many questions are on the exam and how long is it?
Palo Alto Networks does not publish a question count or seat time for this exam. It notes a 30-minute extension for candidates testing in non-English speaking countries. The length of a CertGrid mock is a practice setting, not a vendor figure.
Who is this exam for, and what should I hold first?
The datasheet targets security operations architects with 5+ years designing security operations, incident response and threat detection solutions and 2+ years with Palo Alto Networks Cortex architecture and solutions. It recommends the XSIAM Analyst and XSIAM Engineer certifications.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Palo Alto Networks - Security Operations Architect datasheetBlueprint revised FEBRUARY 2026 · link and content verified 5 October 2026Three domains totalling 100%: Business Alignment and Strategy 22%, Platform and Data Architecture 49%, Automation and Detection Strategy 29%; leaf objectives 1.1-1.3, 2.1-2.3 (2.2.1 Broker VM, 2.2.2 XDR Collector, 2.2.3 Engine), 3.1-3.4.
- Palo Alto Networks - certification handbooklink and content verified 5 October 2026"For ALL Palo Alto Networks Certification exams, the converted raw passing score is 860 on a scale of 300 to 1000." 700 is CertGrid's own internal threshold, not the vendor figure.
The vendor does not publish this. Palo Alto publishes neither an item count nor an exam length for this exam on its certification page, in the datasheet or in the handbook. So the 90 minutes and 75 questions of the CertGrid mock are practice settings, unverified from Palo Alto's own documents, and the question count is shown as "Varies" rather than as a Palo Alto figure.