How many Hard Difficulty Questions questions are on this page?

This page has 20 Hard Difficulty Questions scenario questions for the SecOps-Pro exam, each with detailed explanations and wrong-answer analysis.

How should I approach SecOps-Pro scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Security Operations Professional (SecOps-Pro) questions

Scenario-based practice

Hard Difficulty Questions

Practise Certified Security Operations Professional (SecOps-Pro) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SecOps-Pro

exam code

Palo Alto Networks

vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Full question →

A Cortex XDR administrator is configuring the data sources that will feed XQL queries for threat hunting. The administrator wants to ensure that endpoint process execution events, network connection events, and authentication events from directory services are all available for correlation in a single XQL query. Which TWO of the following data sources must be onboarded to make these event types queryable in Cortex XDR? (Choose two.)

A
Threat intelligence feeds from third-party providers, which supply indicators of compromise for matching.
Why it fails: Threat intelligence feeds provide indicators such as malicious IPs, domains, and hashes that can be used for matching and enrichment. They do not supply the raw endpoint process, network, or directory authentication events that the scenario requires for correlation. Onboarding a threat intel feed adds context but does not make those event types queryable in XQL.
B
Directory services logs ingested through a log collection integration, which provides authentication events from the identity provider.
Authentication events from directory services are not generated by the endpoint agent; they must be ingested from the directory service, typically through a log collection integration or broker. Once onboarded, these events become queryable alongside endpoint telemetry, enabling correlation of process and network activity with authentication events in a single XQL query.
C
Cortex XDR agent telemetry, which collects endpoint process, file, registry, and network events from managed endpoints.
The Cortex XDR agent is the source of endpoint process execution and network connection events. Without agent telemetry onboarded and the relevant event types enabled in the agent policy, XQL queries cannot retrieve process or network activity from endpoints. This data source is required for the endpoint-side events described in the scenario.
D
WildFire sandbox verdicts, which provide file reputation and behavioral reports for submitted samples.
Why it fails: WildFire supplies file verdicts and sandbox behavioral reports, which are useful for file reputation enrichment but do not provide endpoint process execution, network connection, or directory authentication events. Onboarding WildFire does not make those event types queryable, so it does not satisfy the scenario's requirement to correlate process, network, and authentication data.
E
Cortex Data Lake raw log storage, which retains all ingested logs for long-term query and compliance.
Why it fails: Cortex Data Lake is the underlying storage and query layer that holds ingested data, but it is not itself a data source that generates process, network, or authentication events. The events must first come from the agent or a log integration before Data Lake can store and serve them. Selecting Data Lake does not onboard the required event types.

Hard Difficulty Questions

How to approach hard difficulty questions

Quick answer

Related SecOps-Pro topic practice pages

SOC Fundamentals And Operations practice questions

Cortex XSOAR And Automation practice questions

Cortex XDR practice questions

Threat Intelligence And Secops Processes practice questions

Threat Detection And Incident Response practice questions

Cortex XSIAM practice questions

SecOps-Pro fundamentals practice questions

SecOps-Pro scenario practice questions

SecOps-Pro troubleshooting practice questions

Practice scenarios

When creating a custom dashboard in Cortex XSOAR to track threat intelligence trends, which widget type should you use to visualize the distribution of indicator types over time?

Which THREE actions are available when configuring a 'Condition' task?

Which THREE of the following actions can be taken via the Cortex XDR 'Live Terminal' tool?

A Cortex XSIAM administrator is preparing to onboard a new firewall log source and wants to validate that the data will be parsed and mapped correctly before it affects production detections. Which two actions should the administrator take to validate the ingestion and mapping? (Choose two.)

Which THREE factors influence the performance of playbook execution?

A SOC analyst is building an XQL query in Cortex XDR to identify potential credential dumping activity. The analyst wants to detect processes that access the LSASS memory space. Which TWO datasets should the analyst query to correlate process execution with memory access events? (Choose two.)

When integrating an external threat feed into Cortex XSOAR, which indicator field must be correctly mapped to ensure effective lookup and reputation scoring?

When using XQL to join two datasets, which keyword is mandatory for combining information from separate tables?

A security analyst notices that raw log data is reaching the Cortex XSIAM platform but is not being parsed into the unified data model. Which configuration setting should the analyst inspect to ensure log normalization?

Which THREE types of information are typically visible in the XSIAM 'Incident' record?

Which TWO actions can be performed on an indicator object in XSOAR to support the lifecycle management of threat data?

You are troubleshooting a scenario where an incident is not appearing in XSOAR despite an alert in XDR. Which configuration should you verify to ensure the bi-directional sync is functioning?

You are troubleshooting a connectivity issue between an internal log forwarder and Cortex Data Lake. Which command should you run on the log forwarder to verify the ingestion status?

You are creating an XSOAR playbook to automate incident closure. Which step type is required to change the status of an incident to 'Closed'?

You are performing forensic analysis on a host. Which specific Cortex XDR capability allows for the remote collection of volatile memory and system artifacts?

When integrating Palo Alto Networks AutoFocus into XSOAR, which specific field allows you to map AutoFocus 'Tags' to XSOAR 'Labels'?

When designing a custom layout, how do you make a field read-only for specific roles?

You have a custom threat intelligence source that provides data in CSV format. How can you ingest this into XSOAR?