Palo Alto Networks Certified Security Operations Professional

Last checked November 10, 2026 against the official Palo Alto Networks exam page.

1. Question 1Security Operations Fundamentals

   A compliance auditor asks which record shows which administrator changed a detection exception in the Cortex XDR console last quarter. Which source should the team provide?

   1. AThe administrative audit log that records console actions by user
   2. BThe Causality View for the most recent alert on that endpoint
   3. CThe local event log on a sample endpoint where the agent is installed
   4. DThe WildFire verdict history for the file tied to the exception
   Show answer and explanationHide answer

   Correct answer: A

   The administrative audit log records changes that administrators make in the console, which is the accountability evidence an auditor needs. The endpoint's local log does not capture console changes, the Causality View shows process chains for an alert, and WildFire verdicts describe files rather than who edited a setting.

2. Question 2Cortex XDR

   An analyst needs to see which parent process started a suspicious PowerShell command and which child processes it launched. Which Cortex XDR view should the analyst use?

   1. AAgent tamper protection, which prevents local changes to the endpoint agent
   2. BThe WildFire report page, which lists verdicts for individual files only
   3. CAsset inventory, which tracks hardware warranty dates for each endpoint
   4. DCausality View, which shows the process chain behind the alert
   Show answer and explanationHide answer

   Correct answer: D

   The Causality View presents the process chain around an alert so analysts can trace parent and child relationships. Tamper protection guards the agent itself, the WildFire report covers file verdicts, and asset inventory does not show process lineage.

3. Question 3Cortex XSIAM

   A team onboards a new log source into XSIAM and wants its events to appear with standard, searchable field names. Which component performs that mapping?

   1. AParsing rules, which turn raw timestamps into dashboard colors only
   2. BModeling rules, which map parsed fields onto the common data model
   3. CPlaybooks, which send each raw log line to an external archive for storage
   4. DCorrelation rules, which compress events before they are ingested
   Show answer and explanationHide answer

   Correct answer: B

   Modeling rules map parsed fields onto the common data model, which lets correlations and analytics work consistently across sources. Parsing rules extract fields from raw events, playbooks do not perform data mapping, and correlation rules build detections rather than compress events.

4. Question 4Threat Intelligence and Incident / Case Response

   During an incident, a team removes the attacker's persistence mechanisms and rebuilds the affected systems. Which NIST SP 800-61 phase does this work belong to?

   1. ADetection and Analysis, where alerts are validated and the scope is set
   2. BPreparation, where playbooks, tooling, and staff training are set up in advance
   3. CContainment, Eradication and Recovery, where the threat is removed
   4. DPost-Incident Activity, where lessons learned are documented after the event closes
   Show answer and explanationHide answer

   Correct answer: C

   NIST SP 800-61 places eradication, such as removing persistence and rebuilding affected systems, in the containment, eradication and recovery phase. The other phases cover validating alerts, preparing capabilities in advance, and capturing lessons learned after the incident.

5. Question 5Cortex XSOAR

   A phishing response must enrich the sender's domain, then pause for an analyst's approval before blocking it. Which XSOAR construct models this flow?

   1. AA single script that blocks the domain at once with no enrichment or approval
   2. BThe Marketplace, which stores the incident history of the phishing case
   3. CA War Room entry that records the analyst's notes about the case
   4. DA playbook chaining enrichment tasks, a manual approval task, then blocking
   Show answer and explanationHide answer

   Correct answer: D

   A playbook sequences tasks with conditional logic and manual steps, which fits enrichment followed by approval and then blocking. A single script lacks the approval gate, the Marketplace distributes content rather than storing case history, and a War Room entry is a note rather than a workflow.