Question 1
Which SOC tier is primarily responsible for proactive threat hunting and developing new detection logic rather than working through the alert queue?
Correct Answer:
Tier 3 Threat Hunter
Question 2
According to NIST SP 800-61, which incident response phase comes immediately after Detection and Analysis?
Correct Answer:
Containment, Eradication, and Recovery
Question 3
An adversary uses scheduled tasks and registry Run keys to maintain access across reboots. Which MITRE ATT&CK tactic does this represent?
Correct Answer:
Persistence
Question 4
Which model represents an intrusion event using the four interconnected vertices of adversary, capability, infrastructure, and victim?
Correct Answer:
Diamond Model of Intrusion Analysis
Question 5
A SOC analyst sees an alert chain: phishing email → macro execution → PowerShell download → beaconing to a new domain. Which Cyber Kill Chain phase is the PowerShell download?
Correct Answer:
Installation
Question 1
Exam overview

About this Exam

Prepare with the Palo Alto SecOps Professional Practice Questions - Palo Alto Networks Certified Security Operations Professional Exam practice quiz. This question bank includes 100 questions covering cortex, xsiam, analyst, agent, and alert. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

Palo Alto SecOps Professional Practice Questions - Palo Alto Networks Certified Security Operations Professional Exam

This practice set contains 100 questions from the matching question bank and focuses on cortex, xsiam, analyst, agent, and alert. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions