An analyst is writing a complex XQL (XDR Query Language) query in Cortex XDR to find all process executions where a PowerShell script was executed with hidden window styles. Which syntax structure correctly filters datasets for this query?
A SOC manager wants to review the overall security posture and metrics such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). Which dashboard area in Cortex XDR provides these operational metrics?
During a phishing investigation, a SOC analyst receives an email sample containing malicious URLs. Which tool within Cortex XSOAR can be leveraged to automatically extract URLs, perform reputation checks, and block them on the firewall without manual intervention?
A security engineer is configuring a syslog integration to forward Cortex XDR incidents to a legacy SIEM. Which output format option is standard for ensuring structured, parsable data export in CEF (Common Event Format) or LEEF?
An administrator is configuring log forwarding on a Palo Alto Networks firewall to send data to an external SIEM. Which THREE destination types are supported natively in PAN-OS Log Forwarding Profiles? (Choose three)
A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to determine which internal host communicated with a known malicious IP address over the past 24 hours. Which Cortex XDR query should the analyst use to find this information?
A Tier-1 SOC analyst is reviewing an escalated alert about an internal workstation repeatedly authenticating to a domain controller over NTLM instead of Kerberos. The analyst has no endpoint agent data, only Windows Security event logs forwarded to the SIEM. Which event should the analyst use to determine the source process that initiated the NTLM authentication?
A security analyst is reviewing alerts in a Security Operations Center. The analyst notices a pattern of failed login attempts for a single user account, originating from multiple different geographic locations within a short time window. The analyst wants to determine if this activity is a brute-force attack or a password-spraying attack. Which characteristic should the analyst examine to differentiate between these two attack types?
During a shift handover, a Tier-1 analyst is asked to verify whether a suspicious executable reported by the EDR was actually executed on a Windows 10 workstation. The endpoint agent is installed and forwarding telemetry. Which data source should the analyst consult first to confirm execution and capture the command line used?
A SOC analyst is triaging an alert indicating that a user's credentials were used to log into a critical server from an unusual location. The analyst suspects the account may be compromised. Which TWO immediate actions should the analyst take to contain the incident? (Choose two.)
A security analyst is examining a suspicious email reported by a user. The email appears to be from the company's CEO and urgently requests that the user purchase gift cards for a client. The analyst notices that the sender's email address is slightly misspelled but looks similar to the CEO's actual address. Which type of attack is this?
A Tier-1 SOC analyst is triaging a Cortex XDR alert for a Windows workstation that shows a suspicious process spawned from Microsoft Word, and the process is making outbound network connections to an IP address with a poor reputation. The analyst wants to gather additional context before escalating to Tier-2. Which TWO actions should the analyst take to collect relevant evidence within the Cortex XDR console? (Choose two.)
A SOC engineer is integrating Palo Alto Networks Prisma Cloud alerts into Cortex XSOAR. Which architectural component in Cortex XSOAR is primarily responsible for ingesting these cloud security alerts and triggering automated playbooks?
A SOC analyst needs to create a custom parsing rule in Cortex XSIAM for incoming custom application logs that do not match standard RFC formats. Which component of Cortex XSIAM should the analyst utilize to map these raw log fields to the Common Schema?
During a security investigation, an analyst discovers that a compromised user account is repeatedly authenticating from an impossible travel location. Which Cortex XDR feature enables the analyst to automatically isolate the user's host endpoint upon detection?
An incident responder notices malicious traffic originating from an internal workstation communicating with a known Command and Control (C2) IP address. To prevent further communication across the enterprise network, where should the analyst apply a temporary block rule if using Panorama?
An administrator is configuring log forwarding from a Palo Alto Networks Next-Generation Firewall to an external SIEM using Syslog. Which menu path on the firewall GUI is used to define the Syslog server profile?
A security analyst in a Security Operations Center (SOC) notices a sudden influx of endpoint alerts related to a new ransomware strain. Where should the analyst typically begin their initial triage within Cortex XDR to understand the scope and root cause of the incident?
A security analyst needs to verify whether a suspicious file hash uploaded to an internal server was previously analyzed by WildFire. Where can the analyst perform a manual hash lookup in the Palo Alto Networks ecosystem?
An analyst is troubleshooting a situation where Cortex XDR agents are failing to report telemetry back to the Cortex XDR server. Which log file on a Windows endpoint should the analyst check to review the communication status of the Cortex XDR agent service?
A SOC team utilizes Cortex XSIAM for threat detection and response. When analyzing data ingestion health, which dashboard or section should the engineer examine to verify that log collectors are actively receiving and parsing logs from various data sources without dropping packets?
An organization experiences an alert spike from a misconfigured internal vulnerability scanner mimicking a port scan attack. How can a security analyst suppress or tune this specific alert in Cortex XDR to reduce false positives?
A tier-1 SOC analyst receives an alert for a blocked malware execution detected by WildFire on a firewall. What is the standard operational response procedure for this type of high-confidence prevention alert?
An administrator is configuring log forwarding filters in PAN-OS to reduce the volume of unneeded informational logs sent to an external SIEM. Where are these log forwarding filters defined?
A SOC analyst is reviewing real-time firewall traffic in the Application Command Center (ACC). What is the primary purpose of the ACC in a Palo Alto Networks firewall?
An analyst is investigating an endpoint alert in Cortex XDR and wants to see the chronological timeline of process creation, network connections, and file modifications associated with the malware execution. Which tool provides this granular investigative capability?
An incident responder is investigating a suspected lateral movement attack where an attacker utilized stolen Kerberos tickets (Pass-the-Ticket). Which log source in Cortex XSIAM or Windows event collection is essential for detecting abnormal Kerberos service ticket requests (Event ID 4769)?
During a routine audit, a SOC supervisor wants to ensure that all administrative logins to Panorama and managed firewalls are centrally tracked and securely archived. Which log type in the PAN-OS logging architecture records administrator login sessions and configuration changes?
An analyst notices that a specific URL is incorrectly categorized by the Palo Alto Networks URL Filtering database (BrightCloud/PAN-DB). What is the appropriate procedure to request a re-categorization of this URL?
When designing a Security Operations Center (SOC) incident triage workflow, which TWO core principles are fundamental for effective incident management? (Choose two)
A SOC analyst is reviewing the primary log categories generated by a Palo Alto Networks Next-Generation Firewall. Which TWO log types are natively available in PAN-OS for security monitoring and incident analysis? (Choose two)
A security engineer is setting up Cortex XDR data collection on endpoint hosts. Which THREE telemetry types does the Cortex XDR agent collect to enable advanced behavioral analytics and threat hunting? (Choose three)
An administrator is reviewing Cortex XDR investigation tools. Which THREE features are available when investigating an incident in the Cortex XDR Incident View? (Choose three)
A SOC automation engineer is building a playbook in Cortex XSOAR to handle compromised credentials. Which THREE common integration actions or automations are typically included in such a playbook? (Choose three)
When performing threat hunting in Cortex XDR using XQL, an analyst needs to identify anomalous execution chains. Which THREE XQL query stages or clauses are valid and commonly used in building investigative queries? (Choose three)
A security operations team is configuring threat intelligence feeds in Cortex XSIAM. Which THREE indicator types can typically be ingested and correlated against network and endpoint telemetry? (Choose three)
A Tier-1 SOC analyst receives an alert from the endpoint agent indicating that a known malicious hash was blocked during execution. The analyst wants to confirm whether any other endpoints in the organization attempted to execute the same file and whether those attempts were blocked or allowed. Which data source should the analyst query to obtain this information?
A Tier-1 SOC analyst receives an alert from the SIEM indicating a possible brute-force attack against the domain controller. The analyst needs to follow the standard incident response process. According to NIST SP 800-61, which phase of the incident response lifecycle involves determining whether an event is actually an incident and its scope?
A SOC analyst is triaging a phishing alert that includes an email attachment. The analyst needs to determine whether the attachment is malicious before escalating. Which TWO actions are appropriate first steps in this triage? (Choose two.)
A security analyst is reviewing a suspicious email reported by a user. The email contains a link to a website that asks for login credentials. The analyst wants to safely determine if the link is malicious without exposing the corporate network. Which of the following is the BEST action to take?
A SOC analyst is reviewing a Cortex XDR alert for a suspicious process. The analyst wants to determine the parent process that spawned the suspicious executable and the full command line used. Which Cortex XDR feature should the analyst use to obtain this information?
A SOC analyst is reviewing a SIEM alert that shows multiple failed login attempts followed by a successful login for the same user account from an unusual geographic location within a short time window. The account is used by a remote employee who normally connects from a single city. Which activity should the analyst prioritize to determine whether this represents a compromised account?
A SOC analyst receives an alert from Cortex XSIAM indicating a possible brute-force attack against a user account. The analyst wants to quickly see the raw log events that triggered the alert. Which Cortex XSIAM component should the analyst use to view the underlying log data?
A SOC analyst is investigating a potential data exfiltration incident. Network logs show a large outbound transfer to an unknown IP address over port 443. The analyst wants to determine if this is malicious. Which of the following actions should the analyst perform FIRST to gather more context?
A security analyst is reviewing a SIEM alert about multiple failed login attempts followed by a successful login from an unusual geographic location. The analyst suspects a compromised account. Which TWO actions should the analyst take to validate and respond to this potential incident? (Choose two.)
A security analyst at a managed security service provider (MSSP) is triaging a phishing alert that was escalated from a customer's email gateway. The customer's environment includes Microsoft 365 and Palo Alto Networks Cortex XDR. The analyst needs to determine whether the potentially malicious URL in the email was ever clicked by any user in the customer's tenant. Which data source should the analyst query first to efficiently identify any user interaction with the URL?
A security analyst is documenting the chain of custody for a hard drive that was seized from a suspect's computer. Which of the following is the PRIMARY purpose of maintaining a chain of custody?
A Tier-1 SOC analyst receives an alert indicating that a workstation's host-based antivirus quarantined a known malware binary. The analyst must follow the organization's standard operating procedure for confirmed malware containment. Which action should the analyst take FIRST?
A Tier-1 SOC analyst is monitoring the queue and receives an alert from the endpoint protection platform indicating that a known malware signature was detected and quarantined on a user's workstation. According to standard incident response procedures, what is the MOST appropriate immediate action for the analyst to take?
A SOC analyst is reviewing a Cortex XSIAM alert for a suspicious PowerShell script execution. The analyst wants to see the full command line and the parent process of the PowerShell process. Which Cortex XSIAM feature should the analyst use?
A SOC analyst is reviewing an alert generated by the SIEM correlation rule for multiple failed logins followed by a successful login from an unusual geographic location. The account belongs to a finance employee who is currently traveling abroad. What is the MOST appropriate next step for the analyst?
A SOC analyst is reviewing a potential data exfiltration alert from a next-generation firewall. The alert indicates a large outbound transfer to an unknown external IP over TCP port 443. The analyst needs to determine if this is malicious or benign. Which of the following actions should the analyst take FIRST to gather the most relevant context?
A SOC analyst is triaging a malware alert in Cortex XDR. The analyst needs to determine the scope of the infection by identifying other endpoints that communicated with the same malicious domain. Which TWO actions should the analyst take to achieve this? (Choose two.)
A SOC analyst is triaging a phishing report submitted by an employee. The email contains a link to a credential-harvesting page that mimics the organization's webmail portal. The analyst has confirmed the URL is malicious. Which action should the analyst take to protect other users while preserving evidence?
A security analyst is reviewing a suspicious PowerShell script that was executed on a user's workstation. The script attempted to download a file from a remote server and execute it in memory. Which TWO Windows event log sources would provide the MOST relevant information to investigate this activity? (Choose two.)
A Tier-1 SOC analyst receives an alert from Cortex XDR indicating that a process on a Windows endpoint attempted to disable Windows Defender real-time protection. The analyst needs to gather the process name, command line, and parent process to decide whether to escalate. Which Cortex XDR console area should the analyst open to review this endpoint telemetry most directly?
A SOC analyst is investigating a potential data exfiltration incident. The analyst observes that a workstation has been communicating with an external IP address using DNS queries that contain long, random-looking subdomains. The volume of these queries is high, and the subdomains change frequently. Which type of attack is most likely occurring?
A SOC analyst notices that an internal server is making repeated DNS queries for randomly generated domain names, and the queries are failing with NXDOMAIN responses. The server is not scheduled to run any new applications. Which type of malicious activity does this pattern MOST likely indicate?
A SOC analyst is triaging an alert for a suspicious login to a cloud-based email service. The alert indicates a successful login from an IP address in a foreign country, but the user typically works from the United States. The analyst checks the user's recent activity and sees that the login occurred outside normal working hours. Which of the following actions should the analyst take NEXT to determine if the login is malicious?
A SOC analyst is reviewing a firewall log where an internal host repeatedly connected to an external IP address on TCP port 4444 every 60 seconds for several hours. The connections transferred only a few bytes each time. Which characteristic most strongly suggests this is command-and-control beaconing rather than normal user traffic?
A Tier-1 SOC analyst is documenting an incident involving a suspicious PowerShell script executed on a user workstation. Which TWO pieces of information are MOST important to capture in the initial incident ticket to support later investigation? (Choose two.)
A SOC analyst is triaging a phishing report where a user received an email with a link to a credential-harvesting page. The analyst wants to determine whether any other users in the organization received the same message. Which action best supports this goal using email security tooling?
A SOC analyst is triaging an alert for a host that beaconed to a known command-and-control domain over HTTPS. The firewall shows the session was allowed because the traffic matched the SSL application with a valid server certificate. Which action should the analyst take to determine whether data was exfiltrated during the session?
A SOC analyst is documenting an incident in which an attacker gained initial access through a phishing email and then created a new local administrator account on a compromised workstation. The analyst must record evidence that supports both the initial access vector and the persistence mechanism. Which TWO artifacts should the analyst collect to support the investigation? (Choose two.)
A Tier-1 analyst receives an alert that a user's credentials were used to authenticate to a SaaS application from an unfamiliar foreign IP address at 03:00 local time, while the user was asleep. The identity provider shows a successful single-factor login. Which immediate containment step best limits further unauthorized access while preserving evidence?
A SOC analyst notices that several endpoint alerts share the same file hash and were triggered on different hosts within a short period. Before escalating, the analyst wants to confirm whether this hash is known malware and gather context about its behavior. Which resource should the analyst consult first for this enrichment?
A Tier-1 SOC analyst is preparing to escalate a confirmed malware infection on a finance workstation to the Tier-2 team. Which TWO pieces of information are most essential to include in the escalation ticket to enable effective response? (Choose two.)
A SOC analyst is investigating a malware alert on an endpoint. The analyst wants to understand the behavior of the malware to determine its capabilities. The analyst has a malware sample and needs to analyze it in a safe environment. Which action should the analyst take?
A SOC analyst receives an alert from Cortex XDR indicating that a user's credentials were used to authenticate to a cloud service from an unusual geographic location. The analyst wants to quickly determine if this is a false positive or a genuine account compromise. Which action should the analyst take first?
A security analyst is investigating a Cortex XDR alert for a Linux server that shows a suspicious script executing from /tmp. The analyst wants to determine the script's origin and whether it has established persistence. Which Cortex XDR feature should the analyst use to trace the script's execution flow and identify any child processes or network connections?