Exam SecOps-Pro Topic 1 Question 11 Discussion

Actual exam question for Palo Alto Networks's SecOps-Pro exam
Question #: 11
Topic #: 1

Consider a Palo Alto Networks Cortex XDR deployment aiming for proactive threat hunting. An analyst observes an alert from Cortex XDR indicating 'Lateral Movement - Anomalous Process Creation' with a confidence score of 85%. Upon investigation, it's determined to be a legitimate administrator activity. How does the distinction between Machine Learning (ML) and Artificial Intelligence (AI) influence the system's ability to adapt and refine such alerts, and what specific Palo Alto Networks feature exemplifies this AI capability?

A. ML models in Cortex XDR can be retrained with the analyst's feedback (labeling it 'benign'), thereby improving future accuracy. This is a core ML function, not an AI distinction. B. The AI component allows Cortex XDR to understand the 'intent' behind the legitimate activity by correlating it with user behavior analytics (UBA) and identity context, proactively suppressing similar future alerts without explicit retraining. This is an AI-driven 'learning from experience' capability, exemplified by Behavioral Analytics in XDR. C. AI enables Cortex XDR to autonomously generate a new custom detection rule for this specific legitimate activity based on its unique process characteristics, preventing future false positives. This exemplifies AI's rule-generation ability. D. ML is responsible for detecting the anomaly, and AI provides the analyst with a natural language explanation of why the alert was generated, aiding in faster disposition. This is an XAI (Explainable AI) feature, but not directly about adaptation. E. The distinction is negligible; both ML and AI refer to the same underlying statistical models used for anomaly detection and are updated periodically by Palo Alto Networks via content updates.

Suggested Answer: B Vote an answer

While ML models can be retrained (A), the 'AI' aspect goes beyond simple model updates. Option B correctly identifies that AI, particularly when integrated with UBA and identity context, allows for a higher-level understanding of user 'intent' and 'normal behavior' for specific entities. This enables the system to proactively adjust its risk scoring and alert generation for similar future legitimate activities without explicit, manual retraining cycles for every new benign pattern. Palo Alto Networks' behavioral analytics, often powered by AI, learns and adapts to specific user and entity behaviors, which is key here. Option C is less accurate as autonomous rule generation for every benign activity is not standard, and D is about explanation, not adaptation. E trivializes the distinction.

by Osmond at Jul 12, 2026, 07:16 AM

Limited Time Offer

15%

Off

Get Premium SecOps-Pro Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business