SOC Operations

An incident response team is analyzing an Advanced Persistent Threat (APT) group that has successfully infiltrated a corporate network. Which THREE characteristics are typically associated with APT campaigns compared to opportunistic malware? (Choose three)

An organization is deploying an explicit Zero Trust micro-segmentation strategy using Palo Alto Networks Next-Generation Firewalls. They want to ensure that if a workstation is compromised in the engineering VLAN, lateral movement to the financial VLAN is blocked, even if both belong to internal corporate subnets. Which firewall feature must be configured to achieve this?

An organization is building a Zero Trust Architecture and deploying Palo Alto Networks Next-Generation Firewalls to enforce micro-segmentation. Which THREE design elements are essential for a successful Zero Trust segmentation deployment? (Choose three)

When mapping adversary behaviors to the MITRE ATT&CK framework within a Cortex XDR incident investigation, an analyst identifies techniques associated with the 'Credential Access' tactic. Which TWO techniques fall under the Credential Access tactic category? (Choose two)

A security analyst is investigating an alert in Palo Alto Networks Cortex XDR where an attacker successfully dumped LSASS memory to harvest credentials. According to the MITRE ATT&CK framework, under which Tactic should this technique be cataloged?

A security analyst is investigating an unauthorized modification of user permissions in a Palo Alto Networks Prisma Access environment. When evaluating the breach under the MITRE ATT&CK framework, which specific Tactic best categorizes the attacker's actions to establish higher-level access?

A SOC analyst is reviewing a Palo Alto Networks firewall traffic log and notices a large number of outbound connections to various IP addresses on port 53. The connections are using UDP and the payload appears to contain encoded data. Which type of malicious activity is most likely occurring?

A security architect is designing a Zero Trust network segmentation model using Palo Alto Networks Next-Generation Firewalls. To prevent lateral movement of malware across internal VLANs, which operational rule must be strictly enforced?

An organization is implementing a Zero Trust Architecture on their Palo Alto Networks Next-Generation Firewall. They want to ensure that access to internal financial databases is granted based on explicit verification of user identity, device health, and application context, rather than implicit trust based on network location. Which core principle of Zero Trust is being applied?

During a threat hunting exercise on a Palo Alto Networks firewall, an analyst identifies an adversary scanning internal subnets to map out open ports and active hosts prior to launching an exploit. According to MITRE ATT&CK, which Tactic describes this phase?

A SOC team is using Cortex XDR to investigate a security incident. The analyst notices that a critical alert was automatically resolved without any analyst action. The team wants to ensure that all high-severity alerts are reviewed by a human before closure. Which Cortex XDR configuration should the analyst modify to enforce this requirement?

An administrator wants to configure User-ID mapping sources on a Palo Alto Networks Next-Generation Firewall to identify users behind IP addresses. Which TWO of the following are valid methods supported by PAN-OS for gathering User-ID mappings? (Choose two)

An administrator wants to configure authentication for firewall administrators using RADIUS. Where in the Panorama Web Interface should the administrator configure the RADIUS server profile?

A SOC analyst is reviewing a Cortex XDR incident involving a suspicious executable that was flagged as malware. The analyst wants to determine the initial infection vector and whether the malware has spread to other endpoints. Which Cortex XDR feature should the analyst use to visualize the process execution chain and related network activity?

An incident responder notices that a threat actor used living-off-the-land binaries (like PowerShell and Certutil) to download malicious payloads onto endpoints monitored by Cortex XDR. Under the MITRE ATT&CK framework, which Tactic encompasses these execution methods?

A security analyst is configuring administrative access on a Cortex XDR platform to ensure that users only have permissions necessary to perform their specific job functions. Which core principle is the analyst implementing?

A SOC analyst is reviewing a Cortex XDR alert for a Windows endpoint. The alert indicates that a process has created a scheduled task to run a PowerShell script that downloads a file from a remote server. The analyst wants to gather additional evidence to determine the scope of the compromise. Which TWO of the following actions should the analyst take? (Choose two.)

A SOC analyst is reviewing a Cortex XDR incident involving a compromised endpoint. The analyst observes that the attacker used 'wmic.exe' to create a process on a remote system. Which of the following is the most appropriate immediate containment action?

An administrator is integrating Okta with Palo Alto Networks Prisma Cloud using SAML 2.0 to handle administrative logins. Which component of Identity and Access Management (IAM) is primarily responsible for validating the user's credentials?

A SOC analyst at a company using Cortex XDR notices that several endpoints triggered a behavioral threat alert indicating a process injected code into a remote process and then created a network connection to an unfamiliar external IP. The analyst wants to quickly determine whether this activity is related to a known adversary technique and gather context about the process lineage. Which Cortex XDR feature should the analyst use to view the causal chain and map the activity to MITRE ATT&CK techniques?

A SOC analyst is investigating a Cortex XDR alert for a suspicious PowerShell script execution on a critical server. The analyst wants to determine the script's origin and whether it was executed interactively or via a scheduled task. Which Cortex XDR feature provides the most direct evidence for this determination?

During a Cortex XDR investigation, a SOC analyst notices that a process named 'svchost.exe' is making outbound connections to an IP address in a foreign country. The process path is 'C:\Windows\System32\svchost.exe', but the digital signature is invalid. Which Cortex XDR capability should the analyst use to determine if this is a masquerading attempt?

A security analyst is investigating a suspected lateral movement attempt within an enterprise network protected by Palo Alto Networks firewalls. According to the MITRE ATT&CK framework, which TWO of the following techniques are commonly categorized under the Lateral Movement tactic? (Choose two)

A SOC analyst is investigating a Cortex XDR alert where a user's credentials were used to access a sensitive server from an unusual geographic location. The analyst suspects credential theft but finds no evidence of malware on the user's endpoint. Which Cortex XDR capability should the analyst use to identify the source of the credential compromise?

An enterprise security team is reviewing its Zero Trust Architecture deployment to ensure compliance with modern identity and access management standards. Which TWO practices are fundamental requirements of a true Zero Trust identity strategy? (Choose two)

An administrator is configuring authentication profiles in PAN-OS to integrate an external identity provider. Which TWO of the following server types can be directly configured as authentication server profiles in a Palo Alto Networks firewall? (Choose two)

An enterprise is implementing a Zero Trust Architecture across its cloud and on-premises environments using Palo Alto Networks Prisma Access and Next-Generation Firewalls. Which THREE of the following principles are core tenets of a Zero Trust Architecture? (Choose three)

A SOC analyst is triaging a Cortex XDR alert on a Windows endpoint. The alert indicates that a process named 'svchost.exe' is making an outbound connection to an external IP on port 443, but the process path is 'C:\Users\Public\svchost.exe'. The analyst wants to determine the appropriate next step according to the incident response process. Which action should the analyst take first?

A SOC analyst is investigating a Cortex XDR incident involving a Linux server. The analyst observes that a process named 'kworker' is making outbound DNS queries to a domain that is not in the approved list. The process is running from /tmp/kworker, and its parent process is 'bash'. Which of the following is the most likely explanation?

An analyst investigating an APT campaign notes that the threat group modified Windows registry run keys to maintain persistence. In the context of MITRE ATT&CK, under which Tactic should this specific technique be documented?

While investigating a sophisticated adversary group using the MITRE ATT&CK navigator, a SOC analyst notes that the threat actor leveraged valid accounts to maintain persistence while modifying group memberships to escalate privileges. Which combination of MITRE ATT&CK tactics best describes these observed phases?

A SOC analyst receives a Cortex XDR alert indicating that a process attempted to write to a protected system directory. The analyst wants to quickly gather all related events, including file modifications, registry changes, and network connections, to understand the full scope. Which Cortex XDR feature should the analyst use?

A security operations team is tracking an Advanced Persistent Threat (APT) group that exhibits custom command-and-control (C2) behavior, slow and low data exfiltration, and leverages living-off-the-land binaries. Which characteristic most reliably distinguishes this APT activity from a commodity malware campaign?

An incident responder analyzing an APT intrusion discovers that the attacker compressed and encrypted sensitive files locally on a compromised server before staging them for exfiltration. Under the MITRE ATT&CK framework, which Tactic describes this staging behavior?

An organization is deploying Palo Alto Networks firewalls in a Zero Trust Architecture. The security team wants to ensure that administrative access follows the principle of least privilege by tying administrator accounts to dynamic group memberships managed in an external LDAP directory, rather than maintaining static local accounts. Which feature in PAN-OS supports this?

A SOC manager is reviewing alert triage metrics and notices a high number of false positives from a Cortex XDR BIOC rule. The manager wants to reduce noise without disabling the rule entirely. Which action should the SOC manager take?

A SOC team is using Cortex XDR to monitor for credential dumping attempts. They want to create a BIOC (Behavioral Indicator of Compromise) rule that detects when a process attempts to access the memory of lsass.exe. Which field combination should they use in the BIOC rule to specifically detect this behavior?

A SOC analyst is investigating a Cortex XDR alert indicating that a process attempted to write to a suspicious registry key on a Windows endpoint. The analyst wants to determine if the process is malicious by examining its behavior. Which Cortex XDR capability provides the most comprehensive view of process activity, including command-line arguments and parent-child relationships?

A SOC team is using Cortex XDR to investigate a series of alerts indicating suspicious PowerShell execution on multiple endpoints. The analyst wants to create a custom detection rule that triggers when PowerShell is launched with the -EncodedCommand parameter and the parent process is not a known administrative tool. The analyst also wants to exclude a specific service account that legitimately uses encoded commands for automation. Which approach should the analyst take in Cortex XDR to meet these requirements?

A SOC analyst is investigating a Cortex XDR alert for a suspicious PowerShell script that downloads a file from a remote server. The analyst wants to determine if the file was executed and, if so, what child processes it spawned. Which Cortex XDR data source should the analyst query?

A SOC analyst at a financial institution receives a high-severity alert from Cortex XDR indicating that a user's workstation executed a PowerShell script that downloaded and ran a file from a known malicious IP. The analyst wants to immediately contain the endpoint to prevent lateral movement, but must preserve forensic evidence. Which action should the analyst take first?

A SOC analyst is triaging a Cortex XDR incident where a suspicious process spawned from a Microsoft Word document. The process tree shows WINWORD.EXE launching powershell.exe with an encoded command. The analyst wants to quickly determine the parent-child relationship and command-line arguments across all endpoints in the incident. Which Cortex XDR feature should the analyst use?

During an incident investigation in Cortex XDR, an analyst identifies that an attacker utilized Windows Management Instrumentation (WMI) to execute commands remotely across multiple endpoints. According to the MITRE ATT&CK framework, under which tactic should this activity be categorized?

A SOC analyst is investigating a Cortex XDR incident where an attacker used a signed binary to proxy execution of malicious code. The analyst observes that the binary is a legitimate Windows utility often abused for defense evasion. Which MITRE ATT&CK technique is most likely associated with this behavior?

A SOC analyst is reviewing a Cortex XDR incident that includes multiple alerts across several endpoints. The analyst wants to identify the common root cause and prioritize remediation. Which Cortex XDR feature should the analyst use to visualize the relationships between alerts and affected hosts?

A SOC analyst is investigating a suspected Advanced Persistent Threat (APT) group that exhibits classic characteristics during its operation lifecycle. Which THREE traits are typically associated with advanced persistent threat campaigns? (Choose three)

A SOC analyst is triaging a Cortex XDR incident involving a Windows endpoint. The incident contains an alert for 'Suspicious Process Execution' with the process 'powershell.exe' launched by 'winword.exe'. The analyst wants to quickly determine if this is a malicious macro execution or benign activity. Which Cortex XDR feature should the analyst use to view the full process tree and command-line arguments?

A security analyst reviews a Palo Alto Networks firewall traffic log showing an outbound connection over an encrypted tunnel to an unknown external IP address. The analyst suspects command-and-control traffic. Under the MITRE ATT&CK framework, which Tactic covers this network communication channel?

An enterprise is replacing its traditional perimeter defense model with Palo Alto Networks Prisma Access to enforce continuous verification of every user and device regardless of their network location. Which architectural framework is being applied?

A SOC analyst is triaging a Cortex XDR alert where a process on a Windows endpoint executed 'vssadmin.exe delete shadows /all /quiet'. The parent process is 'cmd.exe', which was spawned by a Microsoft Word macro. Which Cortex XDR artifact should the analyst pivot to first to determine if this is part of a broader ransomware attack?

A SOC analyst receives a Cortex XDR alert indicating that a process attempted to modify the registry key 'HKLM\Software\Microsoft\Windows\CurrentVersion\Run' on a critical server. The analyst wants to quickly determine which process made the modification and its command line. Which Cortex XDR artifact should the analyst examine first?

An enterprise is integrating Azure Active Directory (Azure AD) with Palo Alto Networks GlobalProtect for SAML authentication. The SOC wants to enforce conditional access policies so that users logging in from unmanaged devices are blocked from connecting to sensitive corporate segments. Where is the policy evaluating device compliance primarily enforced in this workflow?

A SOC team is analyzing an advanced persistent threat (APT) campaign characterized by long dwell times, custom tooling, stealthy lateral movement, and persistent access designed for continuous espionage. Which attribute best differentiates this APT from a standard opportunistic ransomware attack?

A security team is designing a Zero Trust network access control model using Palo Alto Networks Next-Generation Firewalls. They want to ensure that authentication and authorization policies evaluate device compliance and user identity dynamically on every single connection attempt. Which feature combination best satisfies this requirement?

An administrator needs to ensure that Palo Alto Networks firewall administrators are automatically logged out of the Web Interface after 15 minutes of inactivity to prevent unauthorized access from unattended consoles. Where is this idle timeout configured?

A SOC analyst is triaging a Cortex XDR alert showing a process named 'powershell.exe' that was launched by 'winword.exe' on a finance workstation. The command line includes '-EncodedCommand' with a long Base64 string. The analyst wants to quickly determine if this represents malicious activity or a legitimate macro. Which action should the analyst take first?

An administrator needs to configure administrative access to Panorama so that a junior SOC analyst can view firewall configurations and logs, but cannot make any changes. Which configuration step enforces the principle of least privilege?

A security analyst needs to configure log forwarding from a Palo Alto Networks firewall to an external SIEM using encrypted TLS syslog. Where are the external log receiver settings configured in Panorama?

A SOC analyst is triaging a Cortex XDR alert for a Windows endpoint that shows a process named 'svchost.exe' making an outbound HTTPS connection to a known malicious IP address. The process path is C:\Users\Public\svchost.exe, and its parent process is 'explorer.exe'. Which of the following best describes the appropriate next step for the analyst?

A security analyst is hardening administrative access on a Palo Alto Networks Panorama management server. Which TWO of the following best practices should be implemented to ensure secure administrative access? (Choose two)

During an incident response investigation, a SOC analyst discovers that an APT group utilized scheduled tasks and Windows Management Instrumentation (WMI) to maintain access across reboots in a Palo Alto Networks protected enterprise. Which MITRE ATT&CK Tactic categorizes these techniques?

A SOC analyst receives an alert from Cortex XDR indicating that a user's endpoint has communicated with a known command-and-control (C2) server. The analyst verifies the alert and confirms the communication. According to the incident response process, which step should the analyst take first?

A security analyst is examining an advanced malware sample reported by Cortex XDR. The malware utilizes sophisticated evasion techniques. Which THREE of the following MITRE ATT&CK techniques are commonly associated with the Defense Evasion tactic? (Choose three)

An analyst reviewing Cortex XDR alerts observes an attacker attempting to encode malicious scripts using Base64 to bypass signature-based detection mechanisms on an endpoint. Under the MITRE ATT&CK framework, which Tactic defines this behavior?

An enterprise is enforcing a strict Zero Trust policy where all access requests to internal applications must be authorized via dynamic trust scores calculated by Cortex XSOAR and enforced by Prisma Access. An incident occurs where an administrative account is flagged for anomalous behavior, but the session remains active. Which integration mechanism should be triggered to immediately terminate the active session across all enforcement points?

An administrator is configuring Multi-Factor Authentication (MFA) for Prisma Access administrative access. Which component in the authentication sequence is responsible for validating the secondary MFA token (such as an push notification)?

An auditor is evaluating compliance with the principle of least privilege for Palo Alto Networks administrator accounts. Which TWO of the following practices indicate a failure or violation of least privilege? (Choose two)

A SOC analyst is triaging alerts in Cortex XDR and notices a high volume of false positives from a custom detection rule that triggers on legitimate administrative activity. The analyst wants to reduce noise without disabling the rule entirely. Which action should the analyst take?