Palo Alto Networks Security Operations Professional 認定 SecOps-Pro 試験問題:

1. Which two roles can access data model rules in Cortex XSIAM? (Choose two.)

A) Instance administrator
B) Deployment admin
C) IT administrator
D) Account admin

2. Which attribute applies to script creation in Cortex XSOAR?

A) Can be protected with a password
B) Can be scheduled to run at a later time and day
C) Can be written using XQL
D) Can be executed only with limited permissions

3. An analyst is investigating a complex sequence of malicious activities in Cortex XDR and needs a single, consolidated view of all related processes, network connections, and file changes that resulted in a security alert. Which component of Cortex XDR performs the required data correlation to generate the view?

A) Causality Analysis Engine
B) Analytics Engine for anomaly detection
C) Strata Logging Service data aggregation layer
D) Behavioral Threat Protection (BTP) module

4. A threat intelligence team produces a report on a new APT group known for targeting specific industry sectors using novel obfuscation techniques. This report includes IOCs (Indicators of Compromise) and TTPs (Tactics, Techniques, and Procedures). How should this intelligence be integrated into an organization's incident categorization and prioritization process to maximize its impact?

A) The IOCs should be used to create new detection rules with a 'Critical' severity, and the TTPs should inform playbooks and analyst training for identifying related behavioral anomalies and dynamically assigning higher priority to incidents matching these TTPs.
B) The IOCs should be immediately blocked at the firewall, and the TTPs added to a static incident classification matrix.
C) Only the IOCs should be ingested into the SIEM as watchlists, and TTPs should be ignored as they are too abstract for direct prioritization.
D) The report should be circulated to all IT staff for awareness, and any alerts matching the IOCs should be manually reviewed daily.
E) The intelligence should primarily be used for retrospective hunting exercises and not directly integrated into real-time categorization.

5. With a Windows endpoint, what is required to remove the Cortex XDR agent when the endpoint is no longer online and cannot be managed directly from the management console?

A) An administrator must disable the agent by opening the agent console from the system tray and entering a password.
B) An administrator must use Cytool to disable security protection on the endpoint with an uninstall password.
C) A Cortex XDR administrator must provide the end user with an offline removal tool created in the management console.
D) When running the uninstaller, the administrator must enter an uninstall password from the management console.

質問と回答：