Which two types of tasks are supported in Cortex XSIAM playbooks? (Choose two.)
Answer(s): A,C
JustificationA: Sub-playbook – Cortex XSIAM allows a playbook to invoke other playbooks as sub-playbooks. This enables modular design, reuse of common logic, and controlled branching, which is a core capability of XSIAM orchestration.C: Conditional – Playbooks can include conditional branches (e.g., “if alert.severity == ‘Critical’ then … else …”). These conditionals drive decision-making within the workflow and are essential for adaptive response actions.B: Script creation – While XSIAM can execute scripts, “script creation” is not a distinct task type in the playbook editor; scripts are embedded as actions rather than a separate category.D: Data collection – Data collection is typically performed by external integrations or by using built-in data-fetching actions, not as a standalone playbook task type.Therefore, the two supported task types are Sub-playbook and Conditional (options A and C).
Cortex XSIAM Playbooks – Task Types: https://docs.paloaltonetworks.com/cortex-xsiam/10-21/cortex-xsiam-admin/playbooks/task-types.html Building Modular Playbooks – Sub-playbooks and Conditions: https://docs.paloaltonetworks.com/cortex-xsiam/10-21/cortex-xsiam-user/playbooks/playbook-modularity.html
Which scripting language would create a custom widget in Cortex XDR that shows the top five accounts with failed Windows logons in the past 24 hours?
Answer(s): B
Correct choice – JavaScript (B)Custom widgets in Cortex XDR are rendered in the built-in web view and are programmed using JavaScript (or TypeScript) to manipulate the widget’s UI and interact with the XDR API. The scripting environment for widget development is deliberately JavaScript-based; it provides access to the widget’s DOM, event handling, and the ability to call REST endpoints for data retrieval. To display the top five accounts with failed Windows logons, a JavaScript widget would execute an XQL query (via the XDR API) and then format the results for display, which aligns directly with the platform’s widget architecture.Why the other options are unsuitableXQL (A) – XQL is a query language used to retrieve data from the XDR engine; it is not a scripting language for building UI components. Python (C) – Python is supported for automation scripts and playbooks, but it is not executed within the widget runtime and cannot directly render UI elements in Cortex XDR. PowerShell (D) – PowerShell is used for Windows-specific automation and integration tasks, yet it has no role in the client-side widget environment where JavaScript is the only supported scripting language.
Custom Widgets Documentation: https://docs.paloaltonetworks.com/cortex-xdr/12.0/cortex-xdr-admin-guide/Getting-Started/Custom-Widgets.html XQL Query Language https://docs.paloaltonetworks.com/cortex-xdr/12.0/cortex-xdr-admin-guide/Queries/XQL.html
Which solution will minimize mean time to resolution (MTTR) when, as a result of previous malware infection, a company’s Windows endpoint is suffering a small amount of file corruption and modified registry keys?
Answer(s): D
Why option D is the optimal choiceAutomated, policy-driven restoration – Remediation suggestions automatically detect corrupted system files and altered registry values, then pull the correct versions from the trusted baseline repository and apply them without manual intervention. This directly reduces the number of steps an analyst must perform, cutting the elapsed time to a clean state.Minimal disruption – The endpoint remains in production; there is no need to power-cycle, re-image, or physically replace hardware, which would add unnecessary downtime. Consistent with Palo Alto best practices – The feature is part of the integrated remediation workflow in Cortex XDR/Panorama, designed specifically to bring an infected endpoint back to a known-good configuration in the shortest possible time.Why the other options are less suitableA – Issue a new laptop – Replacing the device is a last-resort measure that introduces provisioning, imaging, and deployment overhead. It does not address the underlying corruption and therefore yields a longer MTTR than a targeted fix. B – Use Live Terminal to upload files – Manual file uploads via Live Terminal are error-prone, require detailed knowledge of the correct file versions, and involve multiple round-trips, extending the remediation cycle. C – Push via Group Policy Objects – GPOs are effective for large-scale, proactive configuration but are not designed for rapid, on-the-fly remediation of an already-compromised endpoint. Deploying a GPO requires planning, replication, and may not instantly replace the corrupted artifacts.Conclusion – Leveraging the built-in remediation suggestions (option D) provides the fastest, most reliable path to restore the endpoint to a healthy state, thereby minimizing MTTR.
Palo Alto Networks Cortex XDR – Remediation Suggestions: https://docs.paloaltonetworks.com/cortex-xdr/10-0/cortex-xdr-admin/remediation-suggestions.html Palo Alto Networks Panorama – Managing Endpoint Configurations with GPOs: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/endpoint-security/manage-endpoint-configurations.html
With a Windows endpoint, what is required to remove the Cortex XDR agent when the endpoint is no longer online and cannot be managed directly from the management console?
Answer(s): C
Technical justificationOption C – An administrator must use Cytool to disable security protection on the endpoint with an uninstall password.When an endpoint is offline, the Cortex XDR agent cannot be controlled or uninstalled through the management console. The only supported method to force removal of the agent on an unreachable Windows host is to use theCytool utility, which can issue a remote uninstall command that requires the uninstall password stored in the console. Cytool bypasses the agent’s normal communication path, directly contacting the endpoint’s local services, disabling protection, and executing the uninstaller silently. This is the documented procedure for “offline” removal in Palo Alto Networks’ Cortex XDR Administration Guide.Option A – Incorrect. Cortex XDR does not provide a generic “offline removal tool” that must be manually distributed to users; removal is performed via Cytool with an uninstall password, not by handing a separate executable to the end-user.Option B – Incorrect. The uninstall password is required only when invoking Cytool or the agent’s own uninstaller; it is not entered while running a generic uninstaller that the administrator launches independently. The console does not supply a separate uninstaller executable for offline use.Option D – Incorrect. The agent’s system-tray UI cannot be accessed on an offline endpoint that has lost connectivity to the management server, and there is no supported console-based password prompt that disables the agent remotely without Cytool.Conclusion – Only option C describes the officially supported, password-protected workflow (Cytool + uninstall password) for removing the Cortex XDR agent from a Windows endpoint that cannot be reached through the management console.
Cortex XDR Administration Guide – Remote Uninstall ( https://docs.paloaltonetworks.com/cortex-xdr/10-2/cortex-xdr-admin/cortex-xdr-admin.pdf ) Cortex XDR Knowledge Base – How to uninstall the agent on an offline endpoint ( https://knowledgebase.paloaltonetworks.com/support/?articleId=000020915 )
Which sensor is used by Cortex XSIAM to identify and collect DNS queries, HTTP header, and DHCP information?
Technical justificationPathfinder data collector (Option C) is the dedicated component of Cortex XSIAM that ingests network-level telemetry, including DNS queries, HTTP headers, and DHCP packets, by leveraging the Pathfinder agent on the network sensors. The collector parses these protocols at the packet-level, normalizes the fields, and makes them available for correlation, detection, and enrichment within XSIAM. Windows Event Collector logs (Option A) capture system-level security events on Windows hosts but do not provide direct visibility into DNS, HTTP header, or DHCP traffic across the network. Directory Sync logs (Option B) relate to synchronization of identity data (e.g., Azure AD Connect) and are unrelated to network protocol telemetry.Enhanced application logs (Option D) refer to logs generated by specific applications that have been instrumented for deeper insight, but they are not the primary source for low-level DNS, HTTP header, or DHCP data collection in XSIAM.Therefore, the Pathfinder data collector is the correct and most appropriate sensor for gathering the specified network-level information.
Cortex XSIAM – Data Collection Overview: https://docs.paloaltonetworks.com/cortex-xsiam/1.x/cortex-xsiam-admin/set-up-data-collection Pathfinder – Network Data Collection Guide: https://docs.paloaltonetworks.com/cortex-xsiam/1.x/cortex-xsiam-admin/pathfinder-data-collection-guide
What are two outcomes of threat intelligence in a SOC? (Choose two.)
Answer(s): A,D
Technical justificationA – Mitigation of potential risks to systems and data Threat-intelligence feeds provide actionable indicators (IOCs, TTPs, attacker profiles) that enable the SOC to proactively harden assets, block malicious traffic, and apply targeted controls before an incident materializes. This directly reduces the likelihood of compromise and protects critical data.D – Identification and detection of known threat verdicts to improve company security posture By integrating vetted threat-intel into detection rules, SIEM correlations, and endpoint protections, the SOC can more quickly recognize malicious activity that matches known threat-actor behavior. This improves overall visibility and strengthens the organization’s defensive posture.Why B is less suitable Automation of SOC tasks is a benefit of SOAR platforms, not a direct outcome of threat-intelligence itself. Threat intel informs what to automate, but the reduction of workload is a secondary effect, not a primary outcome defined for the SOC.Why C is less suitable While threat intel can improve signal quality, it does not inherently reduce the total number of alerts; it may even increase detections by surfacing previously unknown indicators. The primary goal is better quality of alerts, not a blanket decrease in alert volume.
Palo Alto Networks – Threat Intelligence Management: https://docs.paloaltonetworks.com/cortex-xdr/10-0/cortex-xdr-admin/ threat-intelligence-management.htmlMITRE ATT&CK – Using Threat Intelligence to Enhance Detection: https://attack.mitre.org/resources/guides/using-threat-intelligence/
Which MITRE enterprise tactic will provide more information on the technique used by a threat actor who has successfully used PsExec to upload files to an internal server from a compromised workstation?
Technical JustificationCorrect option – B. Lateral movementPsExec is commonly leveraged to copy and execute payloads on remote hosts, enabling an attacker to move laterally across the network from an initially compromised workstation to internal servers. In the MITRE ATT&CK model, the Lateral Movement tactic encompasses techniques that “move an adversary from one host to another,” which directly matches the described activity of uploading files via PsExec to an internal server.Why the other options are less appropriateA: Privilege escalation – Focuses on gaining higher-privilege credentials or token on the same system; PsExec usage here is not about elevating rights but about reaching another system. C. Execution – Involves running malicious code on a target; while PsExec can execute commands, the primary observable behavior in the scenario is the transfer of files to another host, which is a lateral movement activity. D. Persistence – Concerns mechanisms that allow an adversary to maintain a foothold (e.g., scheduled tasks, registry run keys). The described action does not establish persistence; it is about expanding reach within the environment.Conclusion The activity of using PsExec to upload files from a compromised workstation to an internal server exemplifies Lateral Movement in the MITRE ATT&CK framework, making option B the most accurate choice.
MITRE ATT&CK® – Lateral Movement: https://attack.mitre.org/tactics/TA0008/ Palo Alto Networks Documentation – Threat Hunting with MITRE ATT&CK: https://docs.paloaltonetworks.com/cortex-xdr/10-2/attack-mitigation/using-cortex-xdr-for-threat-hunting.html
What is the main difference between artificial intelligence (AI) and machine learning (ML) in cybersecurity?
Answer(s): A
Correct option: AAI (Artificial Intelligence) – the overarching discipline that aims to create systems capable of performing tasks that normally require human cognition (e.g., reasoning, perception, decision-making, natural-language interaction). In cybersecurity, AI-driven solutions can emulate analyst thought processes, correlate disparate data sources, and generate contextual insights. ML (Machine Learning) – a sub-field of AI that specifically uses statistical algorithms to learn patterns from data and improve performance without explicit programming. In security, ML models are trained on labeled network traffic, logs, or file attributes to detect anomalies, classify malware, or predict threats.Why the other choices are less suitableB – Incorrect; AI and ML are not synonymous, nor are they limited to “pre-programmed rules.” Both rely on learning from data, and AI encompasses more than rule-based detection. C – Incorrect; ML is a subset of AI, not a broader discipline, and AI is not confined to natural-language processing (NLP). D – Incorrect; AI is not solely about automating responses, and ML does not manage hardware or network infrastructure directly—it provides the analytical engine that informs such actions.
Palo Alto Networks – AI & Machine Learning in Threat Prevention: https://www.paloaltonetworks.com/cybersecurity-101/artificial-intelligence NIST – Machine Learning and AI Fundamentals for Cybersecurity: https://csrc.nist.gov/publications/detail/sp/800-212/finalPrepared for certification exam review – concise, technically accurate, and aligned with industry definitions.
Post your Comments and Discuss Palo Alto Networks SecOps-Pro exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SecOps-Pro content, but please register or login to continue.