Exam SecOps-Pro Topic 1 Question 12 Discussion

Actual exam question for Palo Alto Networks's SecOps-Pro exam
Question #: 12
Topic #: 1

A SOC analyst is investigating a surge in failed login attempts against cloud identities managed by Azure AD, detected by Cortex XSIAM. The analyst needs to quickly block the source IP addresses of these attempts and initiate a password reset for the affected user accounts. Furthermore, they want to log all these actions in an external compliance logging system that accepts syslog messages. Which of the following XSIAM configurations and features are MOST critical to achieve this comprehensive, automated response?

A. Configuring 'Alert Enrichment' to pull user metadata from Azure AD, then manually executing a 'Remediation Action' to block IPs and reset passwords via the XSIAM UI, and finally manually exporting incident logs to the compliance system. B. Creating an 'Automation Rule' that triggers a 'Playbook'. The Playbook would contain an 'Azure AD integration action' for password resets, a 'Firewall/NGFW integration action' for IP blocking, and a 'Custom Integration' or 'Generic Webhook' action to send syslog messages to the compliance system. C. Utilizing XSIAM's 'Incident Grouping' to consolidate alerts, then using a 'Scheduled Report' to list affected users and IPs, which are then manually acted upon by the IT team. Compliance logging is done via a separate SIEM. D. Implementing a 'Threat Hunting' query to identify suspicious logins, then applying 'Suppression Rules' to reduce alert noise, and using XSIAM's built-in email notification for alerting, with no direct integration for compliance. E. Relying on XSIAM's 'Behavioral Analytics' to identify anomalies, and then expecting the system to automatically remediate all issues without explicit Playbook configuration.

Suggested Answer: B Vote an answer

Option B outlines the most effective and automated approach. An 'Automation Rule' is key to triggering the response based on the detected surge in failed logins. The 'Playbook' then orchestrates the multi-step remediation: directly interacting with Azure AD for password resets (using a pre-built or custom integration), leveraging NGFW integration for IP blocking, and utilizing a 'Custom Integration' or 'Generic Webhook' to send the required syslog data to the compliance system. This ensures immediate, automated response and proper logging.

by Miles at Jul 15, 2026, 09:00 AM

Limited Time Offer

15%

Off

Get Premium SecOps-Pro Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business