Exam SecOps-Pro Topic 1 Question 79 Discussion
Actual exam question for Palo Alto Networks's SecOps-Pro exam
Question #: 79
Topic #: 1
Question #: 79
Topic #: 1
An organization is using a bespoke vulnerability management system that integrates with Palo Alto Networks Panorama for firewall rule management and XSOAR for incident orchestration. A new zero-day vulnerability (CVE-2023-XXXX) affecting a critical web application is disclosed. The vulnerability management system flags all instances of this application. For effective incident categorization and prioritization, what dynamic attributes or processes are crucial to incorporate, going beyond mere vulnerability detection?
Suggested Answer: B Vote an answer
Prioritizing a zero-day vulnerability goes far beyond its static CVSS score or the number of affected systems.
Option B outlines a comprehensive, dynamic approach:
1) Active Exploitation Confirmation: External threat intelligence (like CISA KEV or Unit 42 reports) indicating active exploitation in the wild immediately elevates the threat.
2) Correlated Network Activity: Analyzing Palo Alto Networks firewall logs or other network telemetry for unusual traffic patterns (e.g., specific HTTP requests, C2 communications) that align with known exploitation attempts for that CVE provides high-fidelity in-house detection.
3) Business Impact Assessment: Understanding the criticality of the specific web application (e.g., public- facing, handles sensitive customer data, critical business function) is paramount.
Combining these three dynamic factors allows for truly informed categorization (e.g., 'Active Zero- Day Exploitation on Crown Jewel Asset') and prioritization (e.g., 'Critical - Immediate Containment'). Options A, C, D, and E represent static, overly broad, or negligent approaches.
Option B outlines a comprehensive, dynamic approach:
1) Active Exploitation Confirmation: External threat intelligence (like CISA KEV or Unit 42 reports) indicating active exploitation in the wild immediately elevates the threat.
2) Correlated Network Activity: Analyzing Palo Alto Networks firewall logs or other network telemetry for unusual traffic patterns (e.g., specific HTTP requests, C2 communications) that align with known exploitation attempts for that CVE provides high-fidelity in-house detection.
3) Business Impact Assessment: Understanding the criticality of the specific web application (e.g., public- facing, handles sensitive customer data, critical business function) is paramount.
Combining these three dynamic factors allows for truly informed categorization (e.g., 'Active Zero- Day Exploitation on Crown Jewel Asset') and prioritization (e.g., 'Critical - Immediate Containment'). Options A, C, D, and E represent static, overly broad, or negligent approaches.
by Bard at Jul 27, 2026, 05:03 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).