Exam SecOps-Pro Topic 1 Question 64 Discussion

Actual exam question for Palo Alto Networks's SecOps-Pro exam
Question #: 64
Topic #: 1

An organization is deploying Cortex XSIAM and wants to leverage its full capabilities for detecting sophisticated attacks that involve lateral movement and command-and-control (C2) communication. They have a mix of on-premises data centers, AWS cloud infrastructure, and a significant remote workforce. To achieve comprehensive visibility, which combination of Cortex XSIAM sensor types would be most effective, and what specific types of data would each contribute to identifying such threats?

A. Host Sensors (Endpoint Agents) for network flow and process data, and Cloud Sensors (CloudTrail) for API calls. This combination effectively detects C2 and lateral movement within host context and cloud environment, respectively. B. Network Sensors (NetFlow, Packet Capture) for network conversations and DNS queries, and Host Sensors (Endpoint Agents) for process execution and file access. This combination provides a strong basis for detecting C2 (network layer) and lateral movement (host-to-host activity). C. Identity Sensors (Active Directory logs) for authentication attempts, and Cloud Sensors (VPC Flow Logs) for internal cloud network traffic. This combination primarily focuses on authentication anomalies and cloud network visibility, less on detailed C2 or host-level lateral movement. D. Container Sensors (Kubernetes audit logs) for container activity, and OT/loT Sensors for industrial control system data. While important for specific environments, this combination would not provide broad coverage for general enterprise lateral movement and C2. E. Only Host Sensors (Endpoint Agents) are sufficient, as they can capture all necessary data for both lateral movement and C2 detection, regardless of the environment.

Suggested Answer: B Vote an answer

To detect sophisticated attacks involving lateral movement and C2, a multi-faceted sensor approach is critical. Network Sensors (such as NetFlow or dedicated Packet Capture sensors) are excellent for observing network conversations, DNS queries, and overall traffic patterns, which are crucial for identifying C2 channels. Host Sensors (Endpoint Agents) provide granular visibility into process execution, file system activity, registry changes, and local network connections, essential for understanding how an attacker is moving laterally within a host and between hosts. The combination of network and host telemetry offers the most comprehensive view for these types of threats.

by Theresa at Aug 25, 2026, 11:49 PM

Limited Time Offer

15%

Off

Get Premium SecOps-Pro Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business