Palo Alto Networks SecOps-Pro Practice Test

SecOps-Pro practice test: what's covered

• SOC Fundamentals
• Incident Response & Threat Intel
• Cortex XDR Investigations
• XSOAR Automation
• XSIAM Analytics

Free SecOps-Pro sample questions

1. A SOC manager is measuring whether analysts are containing intrusions faster after a tooling change. Which metric most directly reflects containment speed rather than detection speed?

   • A. Mean time to detect, measured from initial compromise to first alert generation
   • B. Alert volume per analyst per shift across all severity levels
   • C. False positive rate calculated across the previous quarter of closed incidents
   • D. Mean time to respond, measured from alert acknowledgement to containment action
   Show answer

   Correct: D. Mean time to respond captures the interval in which the analyst actually acts to contain the threat, which is what a containment improvement should move. Mean time to detect measures visibility rather than response, alert volume describes workload, and false positive rate describes tuning quality, so none of those isolate containment speed.

2. An analyst investigating an intrusion maps observed behaviour to ATT&CK and finds the adversary dumped LSASS memory. Which ATT&CK tactic does that behaviour belong to?

   • A. Exfiltration, because memory contents are transferred out of the environment
   • B. Impact, because dumping memory degrades the availability of the target system
   • C. Credential Access, because the goal is to obtain account credentials from the host
   • D. Initial Access, because LSASS is the first process contacted during exploitation
   Show answer

   Correct: C. LSASS holds authentication material, so dumping it maps to Credential Access under the OS Credential Dumping technique. It is not Initial Access because the adversary already has code execution, it is not Exfiltration until the material actually leaves the network, and it is not Impact because the system keeps functioning normally.

3. A SOC lead is defining what belongs in a tier-1 triage runbook versus tier-2 investigation. Select the TWO activities that belong in tier-1 triage. (Choose TWO)

   • A. Rewriting the detection logic to eliminate the alert class permanently
   • B. Negotiating incident disclosure timelines with the legal and communications teams
   • C. Validating whether the alert matches a known benign pattern documented as an exception
   • D. Enriching the alerting host and user with asset criticality and recent activity context
   • E. Reverse engineering the malware sample to extract its configuration and key material
   Show answer

   Correct: C and D. Tier-1 triage is about rapid validation and enrichment so that genuine incidents escalate quickly and known-benign noise is closed with evidence. Reverse engineering and detection engineering are specialist tier-2 or tier-3 work, and disclosure negotiation is an incident management responsibility outside the triage queue entirely.

4. During a tabletop exercise the team debates when the eradication phase begins. According to the standard incident response lifecycle, what must be true before eradication starts?

   • A. Containment has limited the incident so removal will not simply be undone by the adversary
   • B. The post-incident report has been signed off by the executive sponsor
   • C. All affected systems have already been rebuilt from known good images
   • D. Threat intelligence has attributed the activity to a named adversary group
   Show answer

   Correct: A. Eradication follows containment because removing artefacts while an adversary still holds active access simply invites immediate re-entry. The post-incident report belongs to lessons learned, rebuilding systems is part of recovery which comes after eradication, and attribution is useful intelligence but is not a gate for removing the threat.

5. An analyst receives an alert for outbound traffic to a domain first registered four hours ago, with low request volume and regular timing. Which adversary behaviour does this pattern most strongly suggest?

   • A. Bulk data exfiltration to a long-established cloud storage provider
   • B. Internal reconnaissance scanning of the local subnet address range
   • C. Credential stuffing against an externally hosted authentication portal
   • D. Command and control beaconing over a newly registered domain
   Show answer

   Correct: D. Low volume with regular timing to a very recently registered domain is the classic signature of implant check-in traffic. Bulk exfiltration produces large asymmetric transfers, internal reconnaissance stays inside the network rather than reaching an external domain, and credential stuffing generates high request volume against a known service.

Last updated: 2026-09-23

SecOps-Pro practice test FAQ

Related practice tests

• Palo Alto Networks PCXSA practice test
• Palo Alto Networks XSOAR-ANALYST practice test
• Palo Alto Networks NetSec-Pro practice test
• Palo Alto Networks NGFW practice test
• Palo Alto PCCET practice test
• Palo Alto Networks PCCSE practice test