Free Access PaloAltoNetworks.SecOps-Pro.v2026-03-30.q102 Practice Test (Page 16)

Question 71

A critical server in your environment is suspected of being compromised. You observe unusual outbound connections to a public cloud IP range not typically used by your organization. However, the connections are to common ports (e.g., 443, 80). Cortex XDR has not flagged these as malicious, but your threat intelligence suggests this IP range has recently been associated with command and control (C2) infrastructure. You need to leverage Cortex XDR to confirm the C2, identify the associated process, and understand the data exfiltration attempt. Which of the following Cortex XDR capabilities would you utilize in conjunction to effectively hunt for and confirm this sophisticated C2 activity, even if it's currently evading standard detections?

A.Run an 'IOC Scan' across all endpoints using the suspicious IP address; if found, then terminate the process and revert any affected files.

B.Utilize 'XQL' to query network connection events for the suspicious IP range, filtering by the critical server's hostname and correlating with process execution events. Then, analyze the 'Causality Chain' of any identified processes and use 'Live Terminal' to inspect the associated process memory or retrieve network artifacts.

C.Adjust the 'Behavioral Threat Protection' policy to be more aggressive for all servers, and then monitor the 'Alerts' dashboard for new detections related to the suspicious IP range.

D.Manually add the suspicious IP address to a 'Blacklist' in your network firewall and then perform a 'Full Disk Scan' on the critical server to find any hidden malware.

E.Check 'WildFire' logs for any unknown executables submitted from the critical server and rely on 'Threat Intelligence Management' to automatically block future connections to the IP.

Question 72

A security incident involving a suspected insider threat is being investigated. The incident response lead wants to ensure that all actions taken within the War Room are transparent, auditable, and attributable to specific team members. Furthermore, sensitive information shared (e.g., internal IP addresses, employee IDs) must be handled securely within the War Room environment. How does Cortex XSOAR's War Room inherently address these requirements, and what features contribute to this?

A.The War Room leverages end-to-end encryption for all communications and automatically redacts sensitive data based on pre-configured patterns. Attribution is handled by requiring digital signatures on all entries.

B.Every action within the War Room, including command execution, note additions, and entry modifications, is logged with a timestamp and the user who performed the action. XSOAR's role-based access control (RBAC) restricts who can view or modify sensitive data, and the platform integrates with secure credential management systems.

C.The War Room provides a 'Private Chat' feature for sensitive discussions, which is not logged. Sensitive data is protected by requiring users to manually encrypt portions of their entries before posting them. Attribution is based on 'Assigned To' fields for each War Room entry.

D.All War Room data is stored in a blockchain for immutable logging and distributed ledger for transparency. Sensitive information is automatically tokenized upon entry, preventing direct exposure. Attribution is managed through a 'Trusted Approver' system.

E.The War Room allows for 'GuestAccess' with read-only permissions for external auditors to ensure transparency. Sensitive data is protected by only allowing specific integration commands to fetch it, preventing direct manual input. Attribution relies on 'Last Modified By' timestamps.

Question 73

During a red team exercise, an attacker successfully bypassed the organization's EDR by exploiting a zero-day vulnerability in a popular browser, then used an undocumented technique to perform process hollowing and inject shellcode into a legitimate system process. The EDR, relying on known signatures and common behavioral patterns, missed this highly evasive attack. Which specific characteristic of Cortex XDR's detection engine, as part of its 'Prevention First' approach, would have been most likely to detect and prevent such an advanced, evasive threat, even without a prior signature?

A.Its reliance on a constantly updated threat intelligence feed of known malicious file hashes.

B.Leveraging multiple layers of AI-driven analysis, including behavioral threat protection, machine learning, and static analysis, to detect never-before-seen threats based on their intrinsic properties and anomalous behavior.

C.The ability to quarantine all suspicious files and send them to a cloud sandbox for analysis before execution.

D.Only detecting threats that match pre-defined YARA rules created by the security team.

E.Providing detailed log auditing of all user logins and logouts for compliance purposes.

Question 74

A global financial institution uses Cortex XSIAM to monitor its highly regulated environment. They have a strict policy that no agents can be installed on certain legacy critical production servers due to vendor support agreements. However, network-level visibility for these servers is still required for compliance and threat detection. Furthermore, the institution heavily relies on Microsoft 365 for collaboration and email. Which Cortex XSIAM sensor types would be best suited to address these specific requirements, and what data would they ingest?

A.Deploy Network Sensors (e.g., a dedicated Network Sensor appliance or virtual appliance) to monitor traffic from legacy servers, ingesting NetFlow or full packet capture. Additionally, use Cloud Sensors (e.g., API integration) for Microsoft 365 audit logs and activities.

B.Implement Host Sensors on the legacy servers, despite the policy, as they are the only way to get necessary visibility. For Microsoft 365, rely on Identity Sensors for user authentication data.

C.Utilize Identity Sensors (e.g., Active Directory logs) for the legacy servers, focusing on authentication events, and Orchestration Sensors for Microsoft 365 to pull data on demand.

D.Only rely on third-party SIEM integrations for legacy server network data and Microsoft 365, as XSIAM sensors would not be able to meet these specific requirements without agents.

E.Deploy Container Sensors for the legacy servers, assuming they are containerized, and use specific Microsoft 365 connectors designed for containerized applications.

Question 75

An organization relies heavily on Palo Alto Networks Cortex XSOAR for security orchestration, automation, and response. A major incident involving ransomware has encrypted critical data across multiple departments. During the eradication phase, the incident response team needs to deploy a custom script to remove persistence mechanisms left by the ransomware and distribute a decryption tool. This script needs to run on hundreds of affected endpoints. Which XSOAR playbook command or integration would be most suitable and efficient for this task, ensuring proper execution and feedback?