I85PREP
⌘ K
Palo Alto SecOps Professional study materials
Palo Alto SecOps Professional study resources

Palo Alto SecOps Professional practice questions

One question at a time. Build your Palo Alto SecOps Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Operations Platform Foundations

In Cortex XSIAM, which component is responsible for ingesting, normalizing, and correlating data from multiple sources to produce a unified security dataset?

  1. The agent installer
  2. The Broker service
  3. The Cortex Data Model (XDM) pipeline Correct answer.
  4. The Cortex Gateway

Explanation

The XDM pipeline normalizes raw events into the Cortex Data Model so that detection and analytics operate on a consistent schema across all sources. Broker handles communication and clustering, not schema normalization.

Question 2Security Operations Platform Foundations

Which Cortex XSIAM dataset type stores raw, unparsed events exactly as received before any normalization occurs?

  1. The raw dataset Correct answer.
  2. The issues dataset
  3. The alerts dataset
  4. The enrichment dataset

Explanation

Raw datasets retain the original payload as received so investigators can inspect unmodified evidence. Normalized and enriched views are derived downstream from that raw data.

Question 3Security Operations Platform Foundations

A SOC analyst wants Cortex XSIAM to automatically resolve an alert when the associated endpoint is later confirmed clean by a scan. Which platform capability should be configured?

  1. Alert exclusion policies
  2. Playbook task timeouts
  3. Alert deduplication rules
  4. Bi-directional alert synchronization Correct answer.

Explanation

Bi-directional synchronization lets an alert's state be updated automatically when the underlying source system resolves or closes it. Deduplication and exclusion change how alerts are created, not how they are later closed.

Question 4Security Operations Platform Foundations

Which statement best describes the role of the Cortex XSIAM Broker in a multi-tenant deployment?

  1. It manages communication between services and supports high availability across nodes. Correct answer.
  2. It renders dashboards for analysts.
  3. It stores the normalized event data used by analytics.
  4. It enforces endpoint prevention policies.

Explanation

Broker is the messaging and coordination layer that connects services and supports clustering and HA. Data storage, dashboards, and endpoint enforcement are handled by other components.

Question 5Security Operations Platform Foundations

An engineer needs to give analysts a saved view that groups alerts by MITRE ATT&CK tactic and shows trend over time. Which XSIAM feature is designed for this?

  1. Playbook debugger
  2. XQL query with a saved widget on a dashboard Correct answer.
  3. Agent policy configuration
  4. Dataset schema editor

Explanation

XQL queries can aggregate alerts by ATT&CK tactic and be saved as widgets that display trends on dashboards. Agent policies, playbook debugging, and schema editing do not produce analytic visualizations.

Question 6Security Operations Platform Foundations

Which XSIAM object is used to define the logic that decides whether an incoming event should raise an alert?

  1. Parsing rule
  2. Correlation rule Correct answer.
  3. Agent profile
  4. Role-based access rule

Explanation

Correlation rules evaluate normalized events against defined conditions and generate alerts when matched. Parsing rules transform raw data, and the other options concern endpoint or access configuration.

Question 7Security Operations Platform Foundations

A SOC lead wants every high-severity alert to automatically create an investigation issue and assign it to the on-call analyst. Which mechanism accomplishes this in Cortex XSIAM?

  1. A dashboard widget filter
  2. A dataset retention policy
  3. A correlation rule that only tags the alert
  4. A playbook triggered by the alert with an issue-creation task Correct answer.

Explanation

Playbooks provide the automation layer that can react to an alert and create and assign an issue. Tagging alone does not create issues, and the other options are unrelated to workflow automation.

Question 8Security Operations Platform Foundations

Which statement correctly describes how Cortex XSIAM handles identity and access for analysts across multiple security domains?

  1. Roles and permissions are assigned per user or group and scope what data and actions are available. Correct answer.
  2. Permissions are managed exclusively through the Broker.
  3. Access control is enforced only at the endpoint agent.
  4. All analysts receive full administrative rights by default.

Explanation

XSIAM uses role-based access control tied to users and groups to scope data visibility and permitted actions. Full rights are not granted by default, and access control is not confined to agents or Broker.

Question 9Security Operations Platform Foundations

An analyst needs to search normalized endpoint process events for a specific parent-child process chain. Which query language and dataset should they use?

  1. XQL against the XDM process dataset Correct answer.
  2. YARA against the endpoint agent cache
  3. SQL against the raw network dataset
  4. STIX against the threat intelligence dataset

Explanation

XQL is the native query language, and normalized process events reside in the XDM process dataset. The other options target different data types or are not query languages for this purpose.

Question 10Security Operations Platform Foundations

What is the primary purpose of the Cortex Data Model (XDM) in Cortex XSIAM?

  1. To define endpoint firewall policies
  2. To provide a common schema so detections and analytics work consistently across sources Correct answer.
  3. To replace the need for correlation rules
  4. To encrypt data at rest

Explanation

XDM standardizes fields from disparate sources into a common schema, enabling consistent detection and analytics. It does not provide encryption, replace correlation logic, or configure endpoint firewalls.

Question 11Security Operations Platform Foundations

A detection engineer wants to test a new correlation rule against historical data before enabling it in production. Which approach is most appropriate in Cortex XSIAM?

  1. Disable all other rules to isolate results.
  2. Deploy the rule only to a single endpoint agent.
  3. Enable the rule and monitor for false positives in production.
  4. Use the rule testing or simulation capability against historical events. Correct answer.

Explanation

Simulation against historical data lets engineers evaluate rule behavior and false positives before production impact. Enabling directly or disabling other rules introduces risk and does not provide controlled testing.

Question 12Security Operations Platform Foundations

Which XSIAM feature allows enrichment of alerts with external threat intelligence during investigation?

  1. Role-based access control
  2. Agent heartbeat monitoring
  3. Dataset retention settings
  4. Indicator extraction combined with threat intelligence integration Correct answer.

Explanation

Indicator extraction identifies observables in alerts, and threat intelligence integrations enrich them with reputation and context. Retention, heartbeat, and RBAC serve unrelated functions.

Question 13Security Operations Platform Foundations

What distinguishes an issue from an alert in Cortex XSIAM?

  1. An issue is a raw event with no processing.
  2. An issue is a dashboard template.
  3. An issue is a case that aggregates related alerts for investigation. Correct answer.
  4. An issue is a type of endpoint policy.

Explanation

Issues are investigation cases that can group multiple related alerts and evidence for coordinated analysis. Alerts are individual detection outputs, and issues are not raw events, policies, or templates.

Question 14Security Operations Platform Foundations

An engineer must ensure that only events matching a specific normalized field value reach a downstream correlation rule. Where should the filtering logic be placed for efficiency?

  1. In the user role definition
  2. In the correlation rule's query condition Correct answer.
  3. In a dashboard filter
  4. In the agent installer

Explanation

Filtering within the correlation rule's query limits evaluation to relevant events and reduces unnecessary processing. Other options do not affect detection input.

Question 15Security Operations Platform Foundations

Which component of Cortex XSIAM is primarily responsible for storing and indexing normalized events for fast query?

  1. The data layer or data store Correct answer.
  2. The identity provider
  3. The endpoint agent
  4. The playbook engine

Explanation

The data layer stores and indexes normalized events so XQL queries can run efficiently. Agents collect data, the playbook engine automates actions, and the identity provider handles authentication.

Question 16Security Operations Platform Foundations

A security team wants to reduce alert fatigue by grouping alerts that share the same host and detection type within a short window. Which capability should they use?

  1. Agent upgrade schedules
  2. Alert deduplication or grouping rules Correct answer.
  3. Dashboard refresh intervals
  4. Dataset retention policies

Explanation

Deduplication and grouping rules consolidate related alerts into fewer items, reducing analyst workload. The other options affect storage, endpoint maintenance, or display refresh, not alert volume.

Question 17Security Operations Platform Foundations

Which statement accurately reflects the relationship between playbooks and issues in Cortex XSIAM?

  1. Issues must be created manually and cannot be automated.
  2. Playbooks only run on endpoint agents.
  3. Playbooks cannot interact with issues.
  4. Playbooks can be triggered by issue creation and can update issue fields automatically. Correct answer.

Explanation

Playbooks can trigger on issue events and act on issue fields, enabling automated case management. They are not restricted from issues, and issue creation can be automated.

Question 18Security Operations Platform Foundations

What is the function of a parser in Cortex XSIAM data ingestion?

  1. To generate dashboard widgets
  2. To schedule agent upgrades
  3. To convert raw log formats into normalized XDM fields Correct answer.
  4. To assign analyst roles

Explanation

Parsers map fields from raw log formats into the normalized XDM schema so analytics can use them consistently. Roles, upgrades, and widgets are handled by other subsystems.

Question 19Security Operations Platform Foundations

An analyst wants to pivot from an alert to all related events on the same endpoint across the last 30 days. Which action best supports this in Cortex XSIAM?

  1. Export the role configuration
  2. Run an XQL query filtered by the endpoint identifier and time range Correct answer.
  3. Restart the Broker service
  4. Open the agent installer log

Explanation

An XQL query scoped to the endpoint identifier and time range retrieves related events for investigation. The other actions are unrelated to event pivoting.

Question 20Security Operations Platform Foundations

Which design choice best supports high availability of the Cortex XSIAM platform in an enterprise deployment?

  1. Running all analytics on endpoint agents
  2. Clustered Broker and data components across nodes Correct answer.
  3. A single all-in-one node with no redundancy
  4. Disabling correlation rules during peak hours

Explanation

Clustering Broker and data components across nodes provides redundancy and failover for continuous operation. Single-node designs, disabling detections, and offloading analytics to agents do not achieve platform HA.

Question 21Security Operations Platform Foundations

A detection engineer observes that a correlation rule fires on events from a source that uses a nonstandard timestamp format. What is the most likely root cause?

  1. The dashboard widget is misconfigured
  2. The parser is not correctly mapping the timestamp into the normalized field Correct answer.
  3. The Broker cluster is undersized
  4. The analyst role lacks permissions

Explanation

A parser that fails to map the timestamp field correctly leaves events with incorrect or missing normalized time, causing rule evaluation problems. Broker sizing, roles, and widgets do not affect field mapping.

Question 22Security Operations Platform Foundations

Which statement best explains why normalized XDM data is preferred over raw data for writing portable detection rules?

  1. XDM data is stored only on endpoints.
  2. Raw data cannot be queried at all.
  3. Raw data is always encrypted and unreadable.
  4. XDM fields are consistent across sources, so one rule works for many log types. Correct answer.

Explanation

Because XDM standardizes field names and semantics, a rule written against XDM applies across multiple sources without per-source rewrites. Raw data remains queryable but varies by source format.

Question 23Security Operations Platform Foundations

An organization wants to ensure that threat intelligence indicators are automatically matched against incoming events to raise alerts. Which configuration supports this?

  1. An agent upgrade policy
  2. A dataset retention extension
  3. An indicator-based correlation rule using threat intelligence feeds Correct answer.
  4. A dashboard refresh schedule

Explanation

Indicator-based correlation rules compare events against threat intelligence indicators and raise alerts on matches. The other options do not perform detection matching.

Question 24Security Operations Platform Foundations

Which scenario best illustrates the use of a playbook input in Cortex XSIAM?

  1. Setting the dashboard color theme
  2. Configuring the agent heartbeat interval
  3. Defining a user's password policy
  4. Passing the alert ID from a triggering alert into an enrichment task Correct answer.

Explanation

Playbook inputs carry contextual values such as an alert ID from the trigger into downstream tasks. The other options relate to UI, endpoint, or identity configuration.

Question 25Security Operations Platform Foundations

A SOC wants to measure detection coverage against MITRE ATT&CK techniques. Which XSIAM capability most directly supports this?

  1. Restarting the Broker service
  2. Adding more endpoint agents
  3. Mapping correlation rules to ATT&CK techniques and reviewing coverage dashboards Correct answer.
  4. Increasing dataset retention

Explanation

Associating rules with ATT&CK techniques enables coverage reporting against the framework. Retention, service restarts, and agent counts do not measure technique coverage.

Question 26Security Operations Platform Foundations

In Cortex XSIAM, which component is responsible for collecting and forwarding telemetry from endpoints to the platform?

  1. The broker VM deployed in the data center
  2. The correlation engine running in the cloud
  3. The XDM normalization layer
  4. The Cortex XDR agent installed on the endpoint Correct answer.

Explanation

Endpoint telemetry in Cortex XSIAM is gathered by the Cortex XDR agent, which streams process, network, and file activity to the platform. The broker VM handles local network collection and proxying rather than endpoint event capture, and the correlation engine and XDM layer operate downstream of collection.

Question 27Security Operations Platform Foundations

An analyst queries the XSIAM dataset using the XQL `dataset = xdr_data` syntax. What does this dataset primarily contain?

  1. Configuration changes made in the XSIAM console
  2. Raw firewall syslog forwarded by the broker VM
  3. Threat intelligence indicators from external feeds
  4. Normalized endpoint and network telemetry from Cortex XDR agents Correct answer.

Explanation

`xdr_data` is the core XQL dataset holding normalized endpoint and network events reported by Cortex XDR agents, including process, network, and file activity. Firewall syslogs land in vendor-specific or broker datasets, threat intelligence is stored in separate indicator datasets, and audit/configuration records are kept elsewhere.

Question 28Security Operations Platform Foundations

Which statement best describes the role of the Cortex XSIAM management console in the platform architecture?

  1. It stores all raw event data locally on the analyst workstation for offline querying
  2. It acts as the broker VM that proxies traffic from on-premises log sources
  3. It is the interface for configuration, investigation, and response while data processing occurs in the cloud backend Correct answer.
  4. It replaces the Cortex XDR agent by performing endpoint prevention directly

Explanation

The management console is the analyst-facing layer for configuring detections, running investigations, and launching response actions, while ingestion, storage, and analytics run in the cloud backend. It does not store raw data locally, perform endpoint prevention, or function as a broker VM.

Question 29Security Operations Platform Foundations

A SOC wants to onboard a custom application that writes JSON logs. Which XSIAM capability should the engineer use to define how those logs are parsed into normalized fields?

  1. A custom log ingestion configuration with a parsing rule that maps fields to XDM Correct answer.
  2. An XQL query scheduled to overwrite the raw events
  3. A playbook that reformats the JSON after an alert is raised
  4. A correlation rule that rewrites the raw JSON before storage

Explanation

Custom log sources are onboarded through log ingestion configuration, where a parsing rule extracts fields and maps them to XDM so the data becomes queryable and usable by detections. Correlation rules, playbooks, and scheduled queries all operate on data after it has been ingested and normalized.

Question 30Security Operations Platform Foundations

Which XSIAM concept groups related alerts and events so analysts can investigate them as a single unit of work?

  1. A case, which aggregates alerts and supporting evidence for an investigation Correct answer.
  2. An agent, which enforces endpoint policy
  3. A dataset, which stores normalized event rows for querying
  4. A broker, which forwards logs from on-premises sources

Explanation

A case in Cortex XSIAM consolidates related alerts, events, and evidence into one investigation workspace so analysts can triage and respond coherently. Datasets are storage structures, brokers forward logs, and agents enforce endpoint policy, so none of them serves as an investigation container.

Question 31Security Operations Platform Foundations

An engineer needs to grant a new analyst read-only access to alerts but not the ability to change detection rules. Which XSIAM mechanism enforces this?

  1. The XQL query editor's default read-only mode
  2. The broker VM's network access control list
  3. The Cortex XDR agent's malware protection policy
  4. Role-based access control assigning a role with view-only permissions Correct answer.

Explanation

XSIAM uses role-based access control, where roles define which actions and objects a user can access, so a view-only role restricts rule changes while allowing alert visibility. The XQL editor, broker VM, and endpoint agent policies govern query execution, log forwarding, and endpoint protection respectively, not console permissions.

Question 32Security Operations Platform Foundations

Which statement accurately describes the relationship between XDM and XQL in Cortex XSIAM?

  1. XDM stores raw logs, and XQL converts them into XDM fields at query time
  2. XQL defines the schema, and XDM executes the queries against raw logs
  3. XDM and XQL are independent, and queries can only target raw vendor formats
  4. XDM defines the normalized schema, and XQL queries the datasets that conform to it Correct answer.

Explanation

The Cortex Data Model specifies normalized field names and structures, and XQL queries datasets populated according to that model, which makes queries portable across sources. XQL does not define the schema, and normalization happens during ingestion rather than at query time.

Question 33Security Operations Platform Foundations

A detection engineer needs to run an XQL query that counts failed logon events per host over the last 24 hours and returns only hosts exceeding ten failures. Which XQL construct should be used?

  1. A stage that deduplicates identical raw log lines
  2. A stage that joins the logon dataset with the endpoint dataset
  3. A stage that limits the output to the first ten rows
  4. A stage that groups by host and filters on the aggregated count Correct answer.

Explanation

XQL pipelines apply stages sequentially, so grouping by host with an aggregation such as count and then filtering on that aggregated value returns only hosts above the threshold. Joining, deduplicating, or limiting rows does not compute per-host failure totals or apply a threshold to them.

Question 34Security Operations Platform Foundations

What is the primary function of the Cortex XSIAM broker VM in a hybrid deployment?

  1. It provides the analyst web interface for the console
  2. It stores the full event index on-premises for long-term retention
  3. It runs correlation rules locally when cloud connectivity is lost
  4. It collects and forwards logs and network data from on-premises sources to the cloud platform Correct answer.

Explanation

The broker VM is deployed on-premises to gather logs and network telemetry from local sources and forward them securely to the Cortex XSIAM cloud. It does not run correlation locally, store the primary event index, or serve the analyst console.

Question 35Security Operations Platform Foundations

An analyst wants to understand why a specific alert was generated. Which XSIAM artifact records the detection logic and the events that matched it?

  1. The console's user login history
  2. The alert's detection details showing the rule and matching event context Correct answer.
  3. The agent's policy audit trail
  4. The broker VM's forwarding log

Explanation

Each alert in XSIAM carries detection details that identify the rule or analytic that fired and provide the matching event context, letting analysts validate why it triggered. Broker forwarding logs, agent policy audits, and login history record transport, policy, and access events rather than detection logic.

Question 36Security Operations Platform Foundations

A SOC lead wants to know which data sources are currently feeding Cortex XSIAM and whether any have stopped sending events. Which capability most directly answers this?

  1. The endpoint agent version report
  2. Data source health and ingestion monitoring in the console Correct answer.
  3. The MITRE ATT&CK coverage dashboard
  4. The playbook execution queue

Explanation

Ingestion health monitoring shows each configured data source, its recent event volume, and whether it has gone silent, which directly answers whether feeds are active. ATT&CK coverage measures detection mapping, playbook queues show automation status, and agent version reports cover endpoint software, not source ingestion.

Question 37Security Operations Platform Foundations

Which statement best explains why Cortex XSIAM separates the analytics layer from the data storage layer?

  1. It ensures raw logs are never normalized before being stored
  2. It prevents the platform from applying machine learning to events
  3. It allows detections and queries to scale independently of storage growth and retention Correct answer.
  4. It requires analysts to query each vendor format separately

Explanation

Separating analytics from storage lets the platform scale detection and query compute independently from data volume and retention, so growing ingestion does not degrade detection performance. It does not prevent normalization, force per-vendor querying, or block machine learning.

Question 38Security Operations Platform Foundations

During an investigation, an analyst needs to correlate a suspicious process execution with subsequent outbound network connections from the same endpoint. Which XSIAM approach is most appropriate?

  1. Open the broker VM configuration and inspect forwarding rules
  2. Review the agent policy audit trail for recent changes
  3. Export the raw logs and analyze them in a spreadsheet
  4. Run an XQL query joining process and network events on endpoint and time proximity Correct answer.

Explanation

XQL can join or correlate process and network datasets using shared fields such as endpoint identity and timestamps, which is the direct way to link execution to later connections. Broker configuration, agent policy audits, and manual exports do not perform event correlation.

Question 39Security Operations Platform Foundations

A security architect is designing data retention for Cortex XSIAM and must balance query performance against storage cost. Which consideration is most relevant?

  1. Retention periods determine how far back fast queries reach, so longer retention increases storage needs Correct answer.
  2. Retention is fixed by the platform and cannot be configured per data type
  3. Retention has no effect on query performance or cost
  4. Retention only affects the broker VM's local disk and not cloud storage

Explanation

Retention settings control how long data remains queryable in the platform, so extending retention increases cloud storage consumption and can affect query scope and performance. Retention is configurable and does affect both cost and query reach, contrary to the other options.

Question 40Security Operations Platform Foundations

Which XSIAM feature lets an analyst enrich an investigation by running a query across multiple datasets and pivoting on a suspicious indicator?

  1. The console's user management page
  2. The broker VM's log forwarding configuration
  3. The XQL query console with cross-dataset search Correct answer.
  4. The endpoint agent's malware scan

Explanation

The XQL query console supports searching across datasets, allowing analysts to pivot from an indicator to related events in endpoint, network, and other data. Malware scans, broker forwarding configuration, and user management do not provide cross-dataset investigative search.

Question 41Detection and Data Onboarding

In the Cortex XSIAM data model, which schema type represents normalized network connection events such as firewall traffic logs?

  1. The XDM File schema
  2. The XDM Process schema
  3. The XDM Network schema Correct answer.
  4. The XDM Authentication schema

Explanation

The Cortex Data Model (XDM) defines a Network schema for connection-oriented telemetry, including firewall traffic and flow logs. Authentication covers login activity, Process covers process execution, and File covers file creation and modification. Choosing the schema that matches the event semantics is what lets correlation rules and XQL queries run across vendors.

Question 42Detection and Data Onboarding

An engineer wants to ingest custom CSV-formatted application logs into Cortex XSIAM without writing a parser from scratch. Which built-in capability is designed for this?

  1. The Cortex Query Language join stage
  2. The Custom Log Collector with a CSV parsing template Correct answer.
  3. The endpoint prevention policy profile
  4. The Broker VM high-availability cluster

Explanation

Cortex XSIAM provides a Custom Log Collector where you define the source, choose a parsing template such as CSV or JSON, and map fields into XDM. This avoids building a bespoke parser for semi-structured sources. Broker VMs move data but do not themselves define field mappings, and XQL is a query language used after ingestion.

Question 43Detection and Data Onboarding

Which component is responsible for collecting and forwarding logs from on-premises networks into Cortex XSIAM when direct internet egress is not permitted?

  1. The Cortex Agent installed on each endpoint
  2. The Broker VM Correct answer.
  3. The cloud correlation engine
  4. The management server appliance

Explanation

A Broker VM is deployed in the customer environment to collect logs and forward them to Cortex XSIAM, which is useful when sources cannot reach the cloud directly. Endpoint agents collect endpoint telemetry rather than arbitrary network device logs. The correlation engine operates in the cloud after data arrives.

Question 44Detection and Data Onboarding

A security engineer needs to confirm that a newly onboarded data source is producing normalized events. Which XQL dataset would be queried to inspect raw, pre-normalization records?

  1. The presets dataset
  2. The incidents dataset
  3. The raw dataset Correct answer.
  4. The issues dataset

Explanation

The raw dataset stores records as received before XDM normalization, so it is the right place to verify parsing and field extraction. The incidents and issues datasets contain aggregated case and health records rather than source events. Presets store saved query definitions.

Question 45Detection and Data Onboarding

Which statement best describes the role of a parsing rule in the Cortex XSIAM onboarding pipeline?

  1. It enforces endpoint malware prevention profiles.
  2. It extracts fields from the incoming log format and maps them to XDM fields. Correct answer.
  3. It assigns analysts to incidents based on workload balancing.
  4. It defines the retention period for each dataset.

Explanation

A parsing rule interprets the structure of the source log and maps extracted values into the appropriate XDM fields so downstream analytics can use them consistently. Assignment, prevention, and retention are handled by other configuration areas. Correct parsing is the foundation for reliable detection.

Question 46Detection and Data Onboarding

An analyst wants to write a Cortex XDR XQL query for endpoint process events. Which dataset name should be used in the dataset assignment stage?

  1. process_events
  2. xdr_data Correct answer.
  3. endpoint_raw
  4. xdm_process

Explanation

Cortex XDR queries endpoint process events from the xdr_data dataset, using a PROCESS event filter to select process activity. XQL selects the source with dataset = xdr_data, rather than a SQL-style FROM clause. A process-specific preset is a separate query source concept.

Question 47Detection and Data Onboarding

Which data source category provides the richest context for detecting credential dumping on a Windows host?

  1. NetFlow records from the core switch
  2. Endpoint telemetry including process and memory access events Correct answer.
  3. Cloud audit logs from the identity provider
  4. DNS query logs from the recursive resolver

Explanation

Credential dumping occurs on the host, so endpoint telemetry that captures process execution and memory access to sensitive processes such as LSASS provides the strongest evidence. Network flow and DNS logs show communication patterns but not local memory access. Identity logs may reveal subsequent misuse but not the dumping itself.

Question 48Detection and Data Onboarding

What is the primary purpose of the data normalization stage in Cortex XSIAM onboarding?

  1. To compress stored logs and reduce storage cost
  2. To enforce role-based access control on datasets
  3. To encrypt data in transit between the source and the cloud
  4. To convert vendor-specific fields into a common schema so detections work across sources Correct answer.

Explanation

Normalization maps vendor-specific field names and formats into the common XDM schema, allowing a single detection or query to work across multiple products. Compression, encryption, and access control are separate concerns handled elsewhere in the platform. Without normalization, every detection would need vendor-specific logic.

Question 49Detection and Data Onboarding

A new firewall log source is onboarded, but a correlation rule that depends on the XDM Network schema never fires. What is the most likely onboarding defect to investigate first?

  1. The Broker VM has too much disk space allocated.
  2. The parsing rule is not mapping key fields such as source and destination IP into the Network schema. Correct answer.
  3. The rule's severity was set too low for the tenant.
  4. The analyst's role lacks permission to view dashboards.

Explanation

If required fields are not mapped into the Network schema, the normalized event lacks the attributes the rule depends on and the rule cannot match. Severity, disk allocation, and dashboard permissions do not prevent a rule from evaluating normalized fields. Checking field mapping against the rule logic is the correct first step.

Question 50Detection and Data Onboarding

An engineer must onboard a JSON-based SaaS audit log whose field names differ from XDM. Which approach correctly aligns it with Cortex XSIAM analytics?

  1. Create a parsing rule that extracts the JSON fields and maps them to the corresponding XDM fields. Correct answer.
  2. Store the log in the incidents dataset so it is searchable.
  3. Rename the source fields at the SaaS provider before ingestion.
  4. Disable normalization and query the raw dataset only.

Explanation

A parsing rule extracts values from the JSON structure and maps them to the correct XDM fields, enabling detections and cross-source queries. Querying only raw data prevents normalized analytics from working. Changing the provider schema is usually impossible and unnecessary.