SecOps-Pro無料問題集「Palo Alto Networks Security Operations Professional」

質問 1

An administrator has configured Cortex XDR to ingest logs from third-party firewalls and is using Cortex XDR agents on endpoints. The goal is to see network connections from the firewalls correlated with the endpoint processes that initiated them. Which feature handles this correlation to form network stories?

（A）Correlation rules

（B）Log stitching

（C）Pathfinder

（D）Identity Analytics

正解：B 解答を投票する

質問 2

Which Cortex XDR component raises an alert when suspicious activity composed of multiple events is detected and deviates from established baseline behavior?

（A）Cloud Identity Engine

（B）XQL Query Engine

（C）Causality Analysis Engine

（D）Analytics Engine

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 3

What is a primary responsibility of an incident responder in a SOC?

（A）Supervising vulnerability assessments and penetration tests

（B）Determining or adjusting criticality of alerts

（C）Mitigating incidents that have been escalated

（D）Developing incident recovery crises communications plans

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

During a routine security audit, it's discovered that a critical server was successfully breached weeks ago by an advanced persistent threat (APT) group. The breach involved sophisticated lateral movement and data exfiltration, yet no alerts were generated by the existing security infrastructure, which includes a Palo Alto Networks Cortex XDR endpoint protection platform and a WildFire cloud- based threat analysis service. How would you classify this scenario from the perspective of the security controls, and what is the primary challenge it presents for a SOC?

（A）True Positive; The controls successfully identified a threat but the SOC failed to respond. The challenge is incident response execution.

（B）False Positive; The controls over-alerted, desensitizing the SOC to the actual threat. The challenge is alert fatigue.

（C）False Negative; The security controls failed to detect an actual breach. The challenge is improving detection capabilities and threat intelligence integration.

（D）This is an unknown state, requiring further investigation to classify. The challenge is lack of visibility.

（E）True Negative; The controls correctly determined there was no threat. The challenge is validating audit findings.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 5

How do sensors function in Cortex XSIAM?

（A）They monitor endpoint agent health.

（B）The monitor data ingestion health.

（C）They assist with log stitching.

（D）They collect logs and telemetry data.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

An automation engineer is using Cortex XSIAM playbooks to create modular, readable, and structured security workflows. The engineer requires a method to clearly delineate the Engagement, Triage, and Containment phases by introducing visual grouping mechanisms into the playbook canvas. Which playbook element is designed to organize the workflow in this scenario?

（A）Script with a "Print" command

（B）Task from the artifacts library

（C）Section header

（D）Standard task with a "Manual" input

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 7

What can be used to triage and determine if an artifact in Cortex XDR is malicious?

（A）MITRE tactic

（B）WildFire report

（C）Alert severity

（D）SmartScore

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

SecOps-Pro 無料問題集「Palo Alto Networks Security Operations Professional」

弊社を連絡する

関連リンク

トップ試験