Exam SecOps-Pro Topic 1 Question 54 Discussion

Actual exam question for Palo Alto Networks's SecOps-Pro exam
Question #: 54
Topic #: 1

A Security Operations Center (SOC) using Palo Alto Networks (PAN-OS) Next-Generation Firewalls detects an outbound connection from an internal host to a suspicious IP address (192.0.2.10) identified as a Command and Control (C2) server by a newly ingested threat intelligence feed. The feed also indicates this C2 is associated with the 'Cobalt Strike' adversary group. Which of the following immediate actions, primarily driven by threat intelligence, is most critical during the initial Containment phase of incident response?

A. Initiate a full packet capture on the firewall for all traffic to and from 192.0.2.10. B. Isolate the internal host from the network using a firewall policy change to block all its outbound connections. C. Update the firewall's WildFire subscription to ensure the latest malware signatures are applied. D. Conduct a vulnerability scan on the compromised internal host to identify potential entry points. E. Notify law enforcement immediately about the detected C2 communication.

Suggested Answer: B Vote an answer

The Containment phase prioritizes limiting the incident's scope. Threat intelligence about the C2 IP and its association with a sophisticated adversary like Cobalt Strike necessitates immediate isolation of the compromised host to prevent further compromise or data exfiltration. While other options are valuable, they fall under different phases (e.g., Eradication, Analysis, Post-Incident) or are less immediate for containment. A full packet capture (A) is for analysis, WildFire update (C) is proactive, vulnerability scan (D) is for eradication, and law enforcement notification (E) is a later step.

by Perry at Apr 02, 2026, 02:49 AM

Limited Time Offer

15%

Off

Get Premium SecOps-Pro Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business