Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
36real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
During an investigation, you discover a malicious file hash. To determine the global prevalence and classification of this file, which Palo Alto Networks service should you consult?
Cortex XDR
WildFire
WildFire provides global intelligence on file reputation and analysis.
Threat Vault
GlobalProtect
In the context of the SOC maturity model, which phase focuses primarily on the formalization of playbooks and the integration of automated threat intelligence?
Defined
The Defined phase focuses on formalizing procedures and integrating tooling.
Optimized
Managed
Ad-hoc
A SOC manager wants to track the 'Mean Time to Acknowledge' (MTTA) for critical incidents. Which feature in Cortex XSOAR provides this visualization?
Dashboard Metrics
Dashboards provide the visualization layer for MTTA and other KPIs.
Playbook Indicators
War Room logs
Incident Layouts
An analyst needs to correlate logs from multiple Palo Alto Networks firewalls to identify lateral movement. Which tool provides the centralized log aggregation and analytics required for this operation?
AutoFocus
Panorama
Prisma Access
Cortex Data Lake
Cortex Data Lake is designed to store and analyze large volumes of security telemetry.
You are designing a SOC operational workflow using Cortex XDR. You need to ensure that alerts from high-value servers are prioritized over workstations. What feature allows for this granular incident management?
BiS Rules
Incident Response Rule
Response rules and incident settings allow for grouping and prioritizing based on asset tags.
Alert Exclusion Profiles
Agent Profiles
While analyzing a breach, an analyst identifies an IOC that is not yet flagged by automated systems. Which tool is used to manually update the global blacklist to prevent further spread across the organization?
Custom Threat Intelligence
Custom TI allows for the manual ingestion and application of IOCs for blocking.
Dynamic Address Groups
Security Profiles
Service Objects
Want more SOC Fundamentals And Operations practice?
Practice this domainWhich component of Cortex XDR is responsible for collecting data from non-endpoint sources like network devices or firewalls?
Cortex XDR Collector
Collectors act as forwarders/intermediaries for non-endpoint data.
Cortex Data Lake
Broker Service
Cortex XDR Agent
You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?
file_hash
target_process_path
process_name
actor_process_command_line
This field contains the full command line arguments, including the encoded script.
When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?
The agent will terminate the process chain if suspicious behavior is detected.
BTP monitors for sequences of activity and terminates processes when a malicious pattern is recognized.
The agent will sandbox the process for further analysis.
The agent will report the event but allow the process to continue.
The agent will block only known malicious file hashes.
You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?
Add the script's hash to the Blocklist in IOC management.
Adding a hash to the blocklist ensures any agent encountering this file will prevent its execution.
Create a manual exception in the Endpoint Policy.
Disable the script execution globally.
Use the Response feature to quarantine the file on one host.
During an investigation, you observe multiple alerts originating from a single endpoint. You want to group these alerts into a single incident to simplify the analysis. Which feature allows this?
Alert Grouping policy
Alert Suppression
Correlation Rule Execution
Manual Incident Creation
Analysts can manually associate alerts into a single incident within the Incident View.
Where do you configure the settings to ensure that the Cortex XDR agent receives regular updates from the Cortex XDR console?
Global Settings
Incident Management Settings
Endpoint Policy
Content Update Policy
The Content Update Policy specifically manages agent updates and content versions.
Want more Cortex XDR practice?
Practice this domainYou need to access an array of indicator values stored in a playbook variable called 'indicatorsList'. Which syntax is correct for extracting the first item in the list within a task input?
${indicatorsList[0]}
This is the standard index-based access for lists in XSOAR automation.
$indicatorsList(0)
${indicatorsList.[0]}
indicatorsList{0}
A user reports that a playbook is stuck at a manual task that requires input. What is the most likely cause if the 'Owner' field is populated but the task is not appearing in the user's Inbox?
The task is assigned to a role that the user does not belong to
Tasks are filtered by user role membership.
The system clock is out of sync
The task has no inputs
The playbook is set to 'Silent' mode
When designing a layout, which widget is used to display the timeline of events that occurred within a case?
Incident List
Grid
Timeline
The Timeline widget tracks all actions performed on an incident.
Markdown
A playbook is failing because a task output field is empty. You need to ensure the task handles this null value gracefully. What is the best way to implement this?
Hard-code the value in the integration parameters
Delete the task from the playbook
Change the integration instance timeout settings
Use a conditional task to check if the field contains data before executing subsequent steps
Conditional tasks allow for branching logic based on the presence or absence of data.
You are creating a custom integration. Which file is required to define the integration parameters, scripts, and commands?
script-NAME.py
integration-NAME.json
README.md
integration-NAME.yml
The YAML file is the manifest for the integration.
You want to share a playbooks across multiple tenants in a multi-tenant environment. Where should you place the playbook?
Private Content Folder
Child Tenant
Integration Settings
Main Account
The Main account acts as the repository for shared content in multi-tenant environments.
Want more Cortex XSOAR And Automation practice?
Practice this domainWhat is the primary function of the 'Indicator Extraction' process in Cortex XSOAR?
To manually block IPs on the firewall
To update the threat intelligence database
To parse and identify IOCs from incident descriptions or email bodies
The extraction engine scans incoming data to pull out IPs, hashes, and URLs.
To generate reports on threat actors
A security analyst notices that XDR incidents are not being updated with threat intelligence data from AutoFocus. Which menu path should the analyst check to verify the AutoFocus integration status?
Incidents > Threat Intel > AutoFocus Status
Policies > Security Profiles > AutoFocus
Settings > Configurations > Integrations > AutoFocus
This path leads to the specific integration instance settings.
Marketplace > Installed Integrations > AutoFocus
When creating a custom dashboard in Cortex XSOAR to track threat intelligence trends, which widget type should you use to visualize the distribution of indicator types over time?
Line Chart
Line charts effectively display time-series data like indicator trends.
Counter Widget
Pie Chart
Table Widget
Which metric in Cortex XSOAR is most effective for measuring the operational efficiency of the Incident Response team over a fiscal quarter?
Total number of alerts generated
Number of active playbooks
Mean Time to Remediate (MTTR)
MTTR measures the average time to resolve incidents, reflecting efficiency.
Number of users trained on phishing
You need to automate the enrichment of IP addresses during incident investigation. Which component in XSOAR facilitates this process?
Playbooks
Playbooks execute the enrichment tasks using integrations like VirusTotal or AutoFocus.
Layouts
Dashboard
Indicator Types
You are managing IOCs in Cortex XSOAR and need to ensure that expired indicators are purged from the system after 30 days. Where do you configure this retention policy?
Settings > Server Configuration > Retention
Settings > Indicators > Indicator Settings
Indicator global settings allow for the definition of retention and expiration policies.
Playbooks > Indicator Management > Cleanup
Jobs > Cleanup Tasks
Want more Threat Intelligence And Secops Processes practice?
Practice this domainAn analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?
IOC Search
Vulnerability Protection
BIOC Rules
BIOC rules detect behavioral patterns characteristic of attacks.
Anti-Malware Policy
When performing triage on a host-based alert, which Cortex XDR agent feature allows an analyst to remotely inspect the file system or run shell commands on the affected endpoint?
Endpoint File Search
Snapshot Manager
Live Terminal
Live Terminal provides direct remote command execution.
Policy Editor
You are configuring a Palo Alto Networks NGFW to integrate with Cortex XSOAR for automated incident response. To ensure the firewall can trigger an automated playbook when a specific threat signature is detected, which component must be configured to send the log data?
Log Forwarding Profile
Log Forwarding profiles define the destination for security logs.
App-ID configuration
Security Policy Rule
GlobalProtect Gateway
When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?
Work Plan
Work Plan shows the visual progression of the playbook.
War Room
Evidence Board
Indicator Tab
An analyst is using Cortex XDR to investigate a potential alert. They notice that the alert indicates a malicious process injection. Which specific tab within the Cortex XDR incident view provides the visual correlation between the alert, the associated file, and the network connection?
Causality View
The Causality View provides the visual map of process relationships.
Forensics Tab
Network Activity
Alert Details
In Cortex XSOAR, an analyst wants to ensure that a specific indicator (IOC) is blocked across all integrated security tools, including the firewall and endpoint protection. Which feature should be used to automate this blocklist synchronization?
Content Packs
Indicator Auto-Extraction
Incident Layouts
Automation Scripts
Automation scripts perform the enforcement action across integrated platforms.
Want more Threat Detection And Incident Response practice?
Practice this domainWhat is the primary function of the 'Cortex XSIAM Agent' when installed on an endpoint?
To replace the need for network security
To store all log data locally on the host
To collect data and provide endpoint protection
The agent serves as both an EDR/EPP tool and a data source.
To manage firewall rules on the local host
An administrator needs to quickly identify a specific alert type across a massive dataset in Cortex XSIAM. Which query language is primarily used to perform this investigation?
SQL
XQL
XQL is the optimized language for searching XSIAM data.
SPL
KQL
You are troubleshooting an issue where a specific detection rule is failing to trigger despite matching log data. Which tool allows you to simulate the detection rule against historical data?
Live Dashboard Preview
Detection Rule Testing Environment
The testing environment validates rule logic against real data.
Playbook Debugger
XQL Query Builder
A security analyst notices that raw log data is reaching the Cortex XSIAM platform but is not being parsed into the unified data model. Which configuration setting should the analyst inspect to ensure log normalization?
Log Ingestion Data Modeling configuration
Data modeling ensures raw logs map to XDM (XSIAM Data Model) schemas.
Incident response playbooks
Dashboard widgets
Agent Policy Profiles
In Cortex XSIAM, you want to automate the response to a specific type of Phishing alert. Where do you configure the automated execution logic?
Detection Rules
XQL Search Filters
Data Ingestion Pipeline
Cortex Playbooks
Playbooks are designed to automate incident response workflows.
When setting up an alert threshold in Cortex XSIAM, you want to avoid 'alert fatigue'. Which feature helps aggregate related alerts into a single actionable item?
Incident Correlation and Grouping
Grouping mechanisms consolidate alerts into incidents to reduce noise.
Alert Suppression Lists
Query Aggregation
Notification Thresholds
Want more Cortex XSIAM practice?
Practice this domainThe SecOps-Pro exam has 200 questions and must be completed in 90 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: SOC Fundamentals And Operations, Cortex XDR, Cortex XSOAR And Automation, Threat Intelligence And Secops Processes, Threat Detection And Incident Response, Cortex XSIAM. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks SecOps-Pro exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.