SecOps-Architect Operationalizing Security Metrics Practice Question
Which TWO methods are best practices for establishing realistic operational baselines in Cortex XSIAM? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ignoring past security incidents when calculating baseline normal behavior
Realistic baselines require accounting for cyclical business variations (seasonality) and using sufficient historical data windows while filtering out known anomalies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ignoring past security incidents when calculating baseline normal behavior
Why this is correct
Wait, option E says ignore past incidents, which is incorrect. Let's make sure option E is a distractor. Ah, let me review the correct options. Options A and B are correct. Let's make sure E is incorrect. Yes, ignoring past incidents is bad.
- ✓
Analyzing sufficient historical data (e.g., 30 to 90 days) to account for business cycles
Why this is correct
Long enough historical windows capture weekly, monthly, and seasonal variations.
- ✗
Hardcoding static thresholds based on vendor marketing whitepapers
Why it's wrong here
Vendor marketing numbers do not reflect organization-specific operational realities.
- ✗
Using a random 5-minute snapshot of log data during peak holiday shutdown
Why it's wrong here
Holiday shutdown data represents anomalous low-activity periods and makes a poor baseline.
- ✓
Segmenting data by environment type (e.g., corporate network vs. production DMZ)
Why this is correct
Different environments have vastly different traffic patterns; segmentation prevents skewed baselines.
About these practice questions
One of 224 original SecOps-Architect practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This SecOps-Architect practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SecOps-Architect exam.