Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
During an investigation, you discover a malicious file hash. To determine the global prevalence and classification of this file, which Palo Alto Networks service should you consult?
Cortex XDR
WildFire
WildFire provides global threat intelligence by executing files in cloud sandboxes and aggregating verdicts across all customers, so a known malicious hash returns a classification and prevalence verdict. This directly satisfies the requirement to determine the file's worldwide prevalence and classification, rather than relying on local endpoint telemetry alone.
Threat Vault
GlobalProtect
In the context of the SOC maturity model, which phase focuses primarily on the formalization of playbooks and the integration of automated threat intelligence?
Defined
The Defined phase of the SOC maturity model formalises documented, repeatable processes, including standardised playbooks and integrated automated threat intelligence feeds. This directly matches the stem's focus, distinguishing it from the earlier ad hoc and reactive stages.
Optimized
Managed
Ad-hoc
A SOC manager wants to track the 'Mean Time to Acknowledge' (MTTA) for critical incidents. Which feature in Cortex XSOAR provides this visualization?
Dashboard Metrics
Dashboard Metrics in Cortex XSOAR aggregates incident timestamps and computes MTTA, visualising it against the critical severity filter the SOC manager requires. It draws directly on incident lifecycle data, so acknowledgement latency for critical incidents is reported without custom scripting or external reporting tools.
Playbook Indicators
War Room logs
Incident Layouts
An analyst needs to correlate logs from multiple Palo Alto Networks firewalls to identify lateral movement. Which tool provides the centralized log aggregation and analytics required for this operation?
AutoFocus
Panorama
Prisma Access
Cortex Data Lake
Cortex Data Lake is Palo Alto Networks' cloud-native logging service, ingesting and normalising traffic, threat, and WildFire logs from every managed firewall into one tenant. Analysts query this aggregated store with Cortex XDR or the logging service UI, enabling cross-firewall correlation of lateral movement that individual firewall local storage cannot provide.
In the SOC structure, which role is typically responsible for the initial triage and validation of security alerts?
Tier 1 Analyst
Tier 1 analysts perform the first-line monitoring and alert triage function within the SOC, validating whether an alert is a genuine incident or a false positive before escalating. This initial validation step is their defining responsibility, distinguishing them from Tier 2 and Tier 3 investigators.
Threat Researcher
Tier 3 Analyst
SOC Manager
A security analyst is investigating a phishing alert in Cortex XSOAR. Which workflow component is best utilized to standardize the response process for repetitive phishing email triage?
Integration instance
Indicator auto-extraction
Playbook
Playbooks encode repeatable triage logic as ordered tasks, so each phishing alert triggers identical enrichment, verdict and containment steps without analyst improvisation. This directly satisfies the stem's standardisation requirement for repetitive triage, unlike ad-hoc scripts or manual queues that vary by analyst and shift.
Dashboard widget
Want more SOC Fundamentals And Operations practice?
Practice this domainYou need to access an array of indicator values stored in a playbook variable called 'indicatorsList'. Which syntax is correct for extracting the first item in the list within a task input?
${indicatorsList[0]}
Zero-based indexing with square brackets retrieves the first element of an array, satisfying the requirement to extract the initial indicator from 'indicatorsList'. The `${...}` wrapper is the required expression syntax for referencing dynamic content in Microsoft Sentinel playbook task inputs, so `${indicatorsList[0]}` resolves correctly at runtime.
$indicatorsList(0)
${indicatorsList.[0]}
indicatorsList{0}
A user reports that a playbook is stuck at a manual task that requires input. What is the most likely cause if the 'Owner' field is populated but the task is not appearing in the user's Inbox?
The task is assigned to a role that the user does not belong to
Playbook task assignment resolves through role membership, not just the Owner field. If the Owner belongs to a different role than the one the task targets, the item never routes to their Inbox, so the task stalls despite appearing assigned.
The system clock is out of sync
The task has no inputs
The playbook is set to 'Silent' mode
When designing a layout, which widget is used to display the timeline of events that occurred within a case?
Incident List
Grid
Timeline
The Timeline widget renders case events chronologically, giving analysts a sequential audit trail of alerts, actions and artefacts. It directly satisfies the layout requirement to visualise event order within a case, unlike overview or graph widgets that aggregate or relate data rather than sequence it.
Markdown
You are creating a custom integration. Which file is required to define the integration parameters, scripts, and commands?
script-NAME.py
integration-NAME.json
README.md
integration-NAME.yml
The integration-NAME.yml file is the definition manifest that declares the integration's parameters, scripts and commands, which the platform parses when loading the custom integration. Without this YAML definition, the integration has no declared configuration to execute.
You want to share a playbooks across multiple tenants in a multi-tenant environment. Where should you place the playbook?
Private Content Folder
Child Tenant
Integration Settings
Main Account
Placing the playbook in the Main Account satisfies the cross-tenant sharing constraint, because Microsoft Sentinel's central workspace hosts playbooks that other tenants can invoke through linked tenant configurations. Playbooks stored there remain accessible to all onboarded tenants, unlike those scoped to a single tenant's resource group.
You are configuring a new integration instance for a third-party threat intelligence feed. Where should you verify the connection status and logs for this instance?
Cortex XSOAR Settings > Advanced > Server Configuration
Cortex XSOAR Settings > Integrations > Instances
Cortex XSOAR's Instances page exposes each integration instance's connection status and fetch logs, letting you confirm the third-party feed is reachable and ingesting indicators. This directly satisfies the stem's requirement to verify connectivity and logs for the newly configured instance, rather than editing its parameters or reviewing playbook executions.
Cortex XSOAR Settings > Playbooks > Automation
Cortex XSOAR Settings > Objects > Indicators
Want more Cortex XSOAR And Automation practice?
Practice this domainWhich component of Cortex XDR is responsible for collecting data from non-endpoint sources like network devices or firewalls?
Cortex XDR Collector
Cortex XDR Collector handles data ingestion from non-endpoint sources such as network devices and firewalls, satisfying the stem's requirement for a component dedicated to non-endpoint telemetry. Unlike endpoint agents, which run on hosts, the Collector receives forwarded logs and feeds them into Cortex XDR for correlation and analysis.
Cortex Data Lake
Broker Service
Cortex XDR Agent
You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?
file_hash
target_process_path
process_name
actor_process_command_line
Encoded PowerShell commands appear as base64 text within the process command line, so matching on actor_process_command_line detects the -EncodedCommand argument. This field captures the actual invocation string, satisfying the rule's requirement to trigger on encoded execution.
When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?
The agent will terminate the process chain if suspicious behavior is detected.
Selecting Block mode makes the agent actively terminate the offending process chain once behavioural indicators trigger, rather than merely logging or alerting. This satisfies the stem's requirement to stop suspicious activity outright, containing the threat before it can escalate into lateral movement or payload execution.
The agent will sandbox the process for further analysis.
The agent will report the event but allow the process to continue.
The agent will block only known malicious file hashes.
You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?
Add the script's hash to the Blocklist in IOC management.
Adding the script's SHA-256 hash to the IOC Blocklist lets Cortex XDR block that exact file enterprise-wide, regardless of filename or path. This satisfies the stem's requirement to prevent execution of a specific known script efficiently, since hash-based indicators are enforced by the agent without needing custom BIOC rules or file-path scoping.
Create a manual exception in the Endpoint Policy.
Disable the script execution globally.
Use the Response feature to quarantine the file on one host.
An analyst is reviewing the 'Causality View' of an alert. What does a dotted line between two processes signify?
An alert that has been suppressed.
An indirect association or cross-process activity.
A dotted line in the Causality View denotes an indirect or inferred relationship between processes, such as shared file, registry or network artefacts, rather than direct parent-child process creation. This distinguishes it from the solid line, which represents a direct spawning relationship recorded in the telemetry.
A direct process spawn.
A process that has been quarantined.
A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?
Increase the log retention period in the console.
Run the cytool utility to check the connectivity status on the affected endpoint.
Running cytool on the endpoint verifies whether the agent can reach Cortex XDR infrastructure, distinguishing network or proxy blockage from console-side issues. It is the fastest first diagnostic before checking certificates, services or firewall rules.
Reinstall the Cortex XDR agent via the portal.
Disable the firewall on the endpoint.
Want more Cortex XDR practice?
Practice this domainWhat is the primary function of the 'Indicator Extraction' process in Cortex XSOAR?
To manually block IPs on the firewall
To update the threat intelligence database
To parse and identify IOCs from incident descriptions or email bodies
Indicator Extraction parses incident text—descriptions, email bodies, and similar free-text fields—to identify embedded IOCs such as IPs, hashes, and domains, then creates or enriches them in the indicator store. That parsing role is precisely what the question asks for.
To generate reports on threat actors
When creating a custom dashboard in Cortex XSOAR to track threat intelligence trends, which widget type should you use to visualize the distribution of indicator types over time?
Line Chart
A line chart plots indicator counts across a continuous time axis, exposing trends and distribution shifts over time. Pie or bar widgets show composition at a single point, so they cannot satisfy the temporal trend requirement.
Counter Widget
Pie Chart
Table Widget
Which metric in Cortex XSOAR is most effective for measuring the operational efficiency of the Incident Response team over a fiscal quarter?
Total number of alerts generated
Number of active playbooks
Mean Time to Remediate (MTTR)
Mean Time to Remediate directly quantifies how quickly incidents are fully resolved, capturing the operational efficiency of the Incident Response team across the fiscal quarter. Unlike detection or response-time metrics, MTTR measures end-to-end remediation, satisfying the stem's requirement to gauge team efficiency over that extended reporting period.
Number of users trained on phishing
You need to automate the enrichment of IP addresses during incident investigation. Which component in XSOAR facilitates this process?
Playbooks
XSOAR playbooks orchestrate enrichment tasks, calling integrations that query threat intelligence sources and write reputation data back to the incident. This automation satisfies the requirement to enrich IP addresses during investigation without manual analyst effort.
Layouts
Dashboard
Indicator Types
What is the role of a 'Classification' in the context of XSOAR incident management?
To encrypt the alert content
To define the severity of the alert
To list the analysts assigned to the incident
To identify the type of incident and assign it to the correct playbook
Classification determines the incident type, which drives playbook selection in XSOAR. When an incident is created, its classification value maps to the matching playbook, ensuring the correct automated response runs. This satisfies the stem's requirement to identify incident type and route it appropriately, rather than merely labelling severity or assigning an owner.
A security analyst is troubleshooting an integration that is failing to pull data from a threat feed. What is the first place they should check for errors?
The War Room or the Integration Instance logs
The War Room and Integration Instance logs record command executions, API responses, and errors from the failing integration. Checking there first surfaces authentication, connectivity, or parsing failures, making it the correct initial troubleshooting step for a feed pulling no data.
The User Management settings
The Incident Dashboard
The Threat Intel page
Want more Threat Intelligence And Secops Processes practice?
Practice this domainAn analyst is investigating a fileless attack. Which specific Cortex XDR tool is most effective for identifying the process creation events and memory-based execution that occurred on the endpoint?
IOC Search
Vulnerability Protection
BIOC Rules
BIOC rules detect behavioural indicators directly from endpoint telemetry, including process creation and in-memory execution, satisfying the fileless-attack constraint where no file touches disk. They correlate these events across the causality chain, surfacing malicious memory-based activity that signature or file-scanning approaches would miss entirely.
Anti-Malware Policy
When performing triage on a host-based alert, which Cortex XDR agent feature allows an analyst to remotely inspect the file system or run shell commands on the affected endpoint?
Endpoint File Search
Snapshot Manager
Live Terminal
Live Terminal provides an interactive remote shell session directly on the affected endpoint, letting the analyst inspect the file system and run commands without disrupting the user. This satisfies the triage requirement for remote host inspection, unlike passive telemetry or offline forensic collection, which cannot execute commands in real time.
Policy Editor
You are configuring a Palo Alto Networks NGFW to integrate with Cortex XSOAR for automated incident response. To ensure the firewall can trigger an automated playbook when a specific threat signature is detected, which component must be configured to send the log data?
Log Forwarding Profile
A Log Forwarding Profile defines which logs match and where they are sent, so it is the mechanism that delivers threat-signature logs to Cortex XSOAR and triggers the playbook. Without it, the firewall generates logs locally but never forwards them.
App-ID configuration
Security Policy Rule
GlobalProtect Gateway
When using Cortex XSOAR, where do you go to view the real-time execution flow of a specific incident's playbook?
Work Plan
The Work Plan tab displays the live execution graph of the incident's playbook, showing each task's status, inputs and outputs as they run. This gives the real-time execution flow required, unlike the incident's summary or war room views.
War Room
Evidence Board
Indicator Tab
An analyst is using Cortex XDR to investigate a potential alert. They notice that the alert indicates a malicious process injection. Which specific tab within the Cortex XDR incident view provides the visual correlation between the alert, the associated file, and the network connection?
Causality View
The Causality View graphically chains the triggering alert, the injected process, the associated file, and any resulting network connections into one timeline. This visual correlation satisfies the stem's requirement to link alert, file, and network activity within the Cortex XDR incident view.
Forensics Tab
Network Activity
Alert Details
You are investigating a lateral movement attempt. The attacker is using SMB to move between hosts. Which Palo Alto Networks feature should be enabled on the security policy to ensure that SMB traffic is inspected for malicious patterns?
DoS Protection Profile
URL Filtering Profile
Vulnerability Protection Profile
Vulnerability Protection profiles inspect SMB traffic for exploit attempts and malicious patterns, satisfying the requirement to examine SMB for malicious content. Applied to the security policy, the profile detects and blocks known SMB vulnerabilities such as EternalBlue, directly addressing the lateral movement constraint in the stem.
File Blocking Profile
Want more Threat Detection And Incident Response practice?
Practice this domainWhat is the primary function of the 'Cortex XSIAM Agent' when installed on an endpoint?
To replace the need for network security
To store all log data locally on the host
To collect data and provide endpoint protection
Installed on the endpoint, the Cortex XSIAM Agent performs both telemetry collection and local prevention, feeding endpoint data into XSIAM while blocking malicious activity. This dual role satisfies the stem's requirement for a single component handling data gathering and active endpoint protection.
To manage firewall rules on the local host
An administrator needs to quickly identify a specific alert type across a massive dataset in Cortex XSIAM. Which query language is primarily used to perform this investigation?
SQL
XQL
XQL is Cortex XSIAM's native query language, purpose-built for fast searching and correlation across its petabyte-scale dataset. It directly satisfies the requirement to identify a specific alert type quickly, unlike generic SQL or SPL, which are not XSIAM's primary investigation interface.
SPL
KQL
You are troubleshooting an issue where a specific detection rule is failing to trigger despite matching log data. Which tool allows you to simulate the detection rule against historical data?
Live Dashboard Preview
Detection Rule Testing Environment
The detection rule testing environment replays a rule against historical log data, showing whether it matches and why it may not fire. This directly simulates rule logic offline, satisfying the need to diagnose a non-triggering rule without waiting for live events.
Playbook Debugger
XQL Query Builder
In Cortex XSIAM, you want to automate the response to a specific type of Phishing alert. Where do you configure the automated execution logic?
Detection Rules
XQL Search Filters
Data Ingestion Pipeline
Cortex Playbooks
Cortex Playbooks hold the automated execution logic, defining triggers, tasks and conditions that run in response to a Phishing alert. Configuring the playbook there lets XSIAM execute the response workflow automatically when that alert type fires.
When setting up an alert threshold in Cortex XSIAM, you want to avoid 'alert fatigue'. Which feature helps aggregate related alerts into a single actionable item?
Incident Correlation and Grouping
Incident Correlation and Grouping merges related alerts into one incident, directly satisfying the stem's requirement to avoid alert fatigue. Rather than flooding analysts with duplicate notifications, it deduplicates and links alerts sharing entities or causality, so each actionable item represents a single investigation.
Alert Suppression Lists
Query Aggregation
Notification Thresholds
You are integrating a custom threat intelligence feed into Cortex XSIAM. Where must this feed be defined to ensure it is utilized by the XSIAM correlation engine?
XQL Global Variables
Threat Intelligence Management
Threat Intelligence Management ingests external feeds and normalises indicators into the Cortex XSIAM data model, making them available to the correlation engine for detection logic. Defining the custom feed here satisfies the stem's requirement that the correlation engine actually consumes the indicators, rather than merely storing them elsewhere.
Data Ingestion Mapping
Detection Rule Editor
Want more Cortex XSIAM practice?
Practice this domainThe vendor does not publish an exact question count for the SecOps-Pro. The passing score is 860 (scaled 300–1,000). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: SOC Fundamentals And Operations, Cortex XSOAR And Automation, Cortex XDR, Threat Intelligence And Secops Processes, Threat Detection And Incident Response, Cortex XSIAM. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks SecOps-Pro exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.