During a routine security audit, it's discovered that a critical server was successfully breached weeks ago by an advanced persistent threat (APT) group. The breach involved sophisticated lateral movement and data exfiltration, yet no alerts were generated by the existing security infrastructure, which includes a Palo Alto Networks Cortex XDR endpoint protection platform and a WildFire cloud- based threat analysis service. How would you classify this scenario from the perspective of the security controls, and what is the primary challenge it presents for a SOC?

• A. This is an unknown state, requiring further investigation to classify. The challenge is lack of visibility.
• B. True Negative; The controls correctly determined there was no threat. The challenge is validating audit findings.
• C. False Negative; The security controls failed to detect an actual breach. The challenge is improving detection capabilities and threat intelligence integration.
• D. True Positive; The controls successfully identified a threat but the SOC failed to respond. The challenge is incident response execution.
• E. False Positive; The controls over-alerted, desensitizing the SOC to the actual threat. The challenge is alert fatigue.

Which list accurately identifies out-of-the-box indicator types that can be queried?

• A. IPv4, URI, Threat Group, Hacking Tool
• B. Infrastructure, URL, Threat Actor, Tool
• C. IP Address, Web Link, Adversary, Exploit Kit
• D. Network Address, Hyperlink, Attacker, Weapon

What is the Cortex XSOAR Marketplace?

• A. Digital storefront where Cortex XSOAR training credits can be purchased and used
• B. Development environment for creating and sharing third-party integrations
• C. Searchable collection of third-party playbooks and data models
• D. Built-in repository of installable content, including integrations and automations

A Palo Alto Networks NGFW with URL Filtering and Threat Prevention enabled flags an internal user attempting to access a 'gambling' category website. The SOC policy strictly prohibits access to gambling sites. However, upon further investigation, it's determined the user was attempting to access a legitimate investment trading platform that was miscategorized by the URL filtering service. From an alert classification perspective, how would you describe this situation, and what mitigation strategy is most appropriate to prevent recurrence?

• A. This is a policy violation, not a classification error. Sanction the user per HR policy.
• B. True Positive; The policy was violated. Isolate the user and block the website globally.
• C. True Negative; The firewall correctly identified benign traffic. No action is needed as the user didn't access a truly malicious site.
• D. False Positive; The site was miscategorized, leading to an incorrect alert. Submit a URL categorization change request to Palo Alto Networks and consider a custom URL category for the legitimate site.
• E. False Negative; The firewall failed to block a prohibited site. Update the URL filtering database manually.

What is required to enable ingestion of on-premises firewall logs into Cortex XDR?

• A. API
• B. Broker VM
• C. Cloud Identity Engine
• D. PAN-OS content pack