- Explain the function of users, roles, log management, compliance, and data protection in Cortex XDR
- Explain the process of creating and managing reports and dashboards in Cortex products
- Explain the common components and functions of a security operations center (SOC)
- Differentiate between AI and machine learning (ML) in security operations
Palo Alto Networks Certification Training Course
Palo Alto Networks Certified Security Operations Professional Certification Training Course
We'll get you ready for the Palo Alto Networks Certified Security Operations Professional exam, which covers SOC fundamentals and basic use of Cortex XDR, XSOAR and XSIAM.
Course focus: Security operations fundamentals, threat intelligence and case response, Cortex XDR, Cortex XSOAR and Cortex XSIAM, mapped to the official blueprint.
Course Overview
What the Security Operations Professional course covers and who it's for.
Per Palo Alto Networks, Security Operations Professional validates the knowledge and job-ready skills needed for basic use of the Cortex portfolio in a SOC.
We follow the five domains in the official datasheet. SOC fundamentals is the largest at 25%, then Cortex XDR at 23% and Cortex XSIAM at 20%. It's the natural step before the XDR, XSIAM and XSOAR Specialist exams.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of Palo Alto Networks, and this isn't official Palo Alto Networks training. Palo Alto Networks sets exam content, fees and policies, so check paloaltonetworks.com before you book.
Course Objectives
Get ready for Security Operations Professional the way the exam is built.
01
Cover the Whole Blueprint
Work through all 5 domains in the official Security Operations Professional datasheet, weighted the way the exam weights them.
02
Go Deep on Security Operations Fundamentals
Security Operations Fundamentals is 25% of the exam score per Palo Alto Networks, so it gets the most class time.
03
Practice in a Lab
Hands-on lab work on the tasks the Security Operations Professional blueprint lists, not just slides.
04
Be Ready for Test Day
The exam is in person at a Pearson VUE test center with multiple choice, matching and ordering items. We practice all three.
Who Should Attend
- SOC analysts and SOC team leads.
- IT staff moving into security operations.
- Former PCDRA candidates.
- Anyone planning to take an XDR, XSIAM or XSOAR exam.
Prerequisites
- Palo Alto Networks doesn't list a required prerequisite certification, and we don't have enrollment prerequisites either.
- Basic security operations knowledge helps. Cybersecurity Practitioner is a good stepping stone.
Pathway Map
The Security Operations Professional course in 5 modules.
Each module is one domain from the official datasheet, with its exam weight.
Course Content
- Identify and explain the steps of the NIST Incident Response Plan
- Explain the concept of incident management and response
- Explain the role of threat intelligence in incident response
- Explain the function of case categorization and prioritization
- Identify and explain the use of key Cortex XDR elements
- Explain the process of agent management and deployment, including cloud workloads
- Identify use cases in which an organization would benefit from Cortex XDR compared to an endpoint detection and response (EDR) solution
- Explain the features and functionality of Cortex XSOAR
- Differentiate between scripts and jobs in Cortex XSOAR
- Explain the function of key Cortex XSIAM components
- Explain Cortex XSIAM processes, capabilities, use cases, and rules
Course Features
How we teach Security Operations Professional.
Instructor-Led Classes
Live instruction with time for questions, so you aren't figuring out the hard parts alone.
Hands-On Labs
Lab work tied to the tasks in the Security Operations Professional blueprint.
Blueprint Mapping
Every module maps to a domain in the official Security Operations Professional datasheet.
Exam Strategy
Practice with multiple choice, matching and ordering questions, plus test center tips.
Certification Exam
About the Security Operations Professional exam.
Security Operations Professional Exam Readiness
Our students pass at a 98.8% rate across Accumentum courses. We'll get you ready for Security Operations Professional the same way.
Per Palo Alto Networks, Security Operations Professional is a Professional level exam priced at $200 USD, and taxes may apply. Since August 1, 2025, Palo Alto Networks exams are delivered in person at Pearson VUE test centers only. Exams are in English, with multiple choice, matching and ordering questions.
The certification is valid for two years and you renew by retaking the exam. If you fail, the waits before retakes are 15, 30 and then 90 days. Full details are on the official Security Operations Professional page.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of Palo Alto Networks, and this isn't official Palo Alto Networks training. Palo Alto Networks sets exam content, fees and policies, so check paloaltonetworks.com before you book.
Exam Blueprint
Every Security Operations Professional objective, domain by domain.
Palo Alto Networks splits the Security Operations Professional blueprint into 5 domains and 19 objectives. Here they are in full, with the sub topics the datasheet lists under each one.
Domain 1: Security Operations Fundamentals (25%)
1.1 Explain the function of users, roles, log management, compliance, and data protection in Cortex XDR
1.2 Explain the process of creating and managing reports and dashboards in Cortex products
1.3 Explain the common components and functions of a security operations center (SOC)
- Roles and responsibilities
- Tools, technologies, and analytics
1.4 Differentiate between AI and machine learning (ML) in security operations
Domain 2: Threat Intelligence and Incident / Case Response (16%)
2.1 Identify and explain the steps of the NIST Incident Response Plan
2.2 Explain the concept of incident management and response
2.3 Explain the role of threat intelligence in incident response
2.4 Explain the function of case categorization and prioritization
2.5 Explain how file, IP address, domain, and URL indicator types are used in Cortex products
2.6 Compare and contrast WildFire, Unit 42 intelligence, and VirusTotal
2.7 Evaluate false positive, false negative, and true positive security cases
2.8 Conduct basic threat hunting based on a common indicator types
Domain 3: Cortex XDR (23%)
3.1 Identify and explain the use of key Cortex XDR elements
- Sensors
- Log stitching
- Causality View
- WildFire
- Detection and response
- Behavioral analytics
- Data sources, users, artifacts, and assets in investigations
3.2 Explain the process of agent management and deployment, including cloud workloads
3.3 Identify use cases in which an organization would benefit from Cortex XDR compared to an endpoint detection and response (EDR) solution
Domain 4: Cortex XSOAR (16%)
4.1 Explain the features and functionality of Cortex XSOAR
- Marketplace
- Playbooks
- Third-party system integration
- Indicators and feeds in Threat Intelligence Management (TIM)
- War Room
- Case investigation
4.2 Differentiate between scripts and jobs in Cortex XSOAR
Domain 5: Cortex XSIAM (20%)
5.1 Explain the function of key Cortex XSIAM components
- Sensors
- Log stitching
- Automations and integrations
- Content packs
- Playbooks
5.2 Explain Cortex XSIAM processes, capabilities, use cases, and rules
- Data ingestion
- Key investigation artifacts and assets
- Threat management, detection, and response
- Threat hunting and investigation searches and queries
- Indicators of compromise (IOCs), behavioral indicators of compromise (BIOCs), and correlations
Before You Start
Who should take Security Operations Professional.
Here is who Palo Alto Networks says the Security Operations Professional exam is for and what it expects you to bring, taken from the official datasheet.
Who Palo Alto Networks wrote this exam for
This exam is designed for the individuals with the following job roles:
- Security operations center (SOC) professionals responsible for the basic application of Palo Alto Networks Cortex products and solutions
- Cortex XDR
- Cortex XSIAM
- Cortex XSOAR
Knowledge, skills and abilities
- MITRE ATT&CK framework
- Incident response plans
- Investigative lifecycle
- Cortex XDR, Cortex XSIAM, Cortex XSOAR in the SOC ○ Review dashboards and generate reports (compliance) ○ Identify key components of cases ○ Initiate playbooks ○ Identify indicators of compromise (IOCs) ○ Escalate cases ○ Initiate response actions
- Analytics concepts, such as profiling and entity classification
- Issues and cases
- Interaction with playbook tasks to progress an investigation
Study Plan
How we approach Security Operations Professional prep.
Security Operations Fundamentals carries 25% of the exam, more than any other domain, so we spend the most lab and review time there.
Keep the official datasheet open while you study and tick off each objective as you finish it. That is the simplest way to find your gaps before exam day.
Our course follows the same blueprint, with on demand lessons you can pause and replay, and our students pass at a 98.8% rate across Accumentum courses.
Exam Policies
Security Operations Professional retakes, renewal and badges.
Security Operations Professional lasts two years from your pass date, and Palo Alto Networks renews it when you pass the exam again.
Passing a higher level exam in the same track automatically extends your active lower level certifications in that track by two years.
If you don't pass, you get a results report broken down by domain. Palo Alto Networks requires a 15 day wait before a second attempt, 30 days before a third and 90 days before any attempt after that. After a pass you can't sit the same exam again for 18 months.
Exams are delivered in English through Pearson VUE, and candidates testing in non English speaking countries get a 30 minute time extension by default. Your badge and certificate come through Credly.
Career Outcomes
What Security Operations Professional does for your career.
Security Operations Professional fits SOC analysts and team leads, plus IT staff moving into security operations. It covers the Cortex platform at a broad level before you pick an XDR, XSIAM or XSOAR specialty.
For a sense of pay, BLS puts the May 2025 median annual wage for information security analysts at $129,180. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. A median is the midpoint, so half earned more and half earned less, and your own pay will depend on location, experience and employer. Source: BLS Occupational Outlook Handbook.
Funding
Ways to pay for Security Operations Professional training.
Our funding page lays out every way to pay for training, and PathPay lists the courses that qualify for a monthly plan.
Veterans can look at VR&E benefits for career training, and our Veteran Skill Forge programs bundle several courses into one path. Questions about your situation? Contact us and we'll talk it through.
Frequently Asked Questions
Common questions about our Security Operations Professional course.
Palo Alto Networks Certified Security Operations Professional is a Professional level certification from Palo Alto Networks. Details are on the official certification page at https://www.paloaltonetworks.com/services/education/palo-alto-networks-secops-professional.
No. We're an independent training provider and we aren't a Palo Alto Networks partner. Our course follows the public exam blueprint in the official datasheet. Palo Alto Networks offers its own learning paths at learn.paloaltonetworks.com.
Palo Alto Networks lists Professional exams at $200 USD, and taxes may apply. Vouchers are sold through Pearson VUE and expire 12 months after purchase. Check the current price before you buy.
No. Since August 1, 2025, Palo Alto Networks certification exams are delivered in person at Pearson VUE test centers only.
Two years from the date you pass. You renew by retaking the exam, and passing a higher level exam in the same track renews your active lower level certifications.
Palo Alto Networks doesn't list a required prerequisite certification, and we don't have enrollment prerequisites either. Basic security operations knowledge helps. Cybersecurity Practitioner is a good stepping stone.
Instructor-led, with hands-on labs and practice questions. Ask us about upcoming class dates.
Use the registration page linked below, or email info@accumentum.net and we'll follow up with dates and next steps.
5. Per the official datasheet they are Security Operations Fundamentals (25%), Threat Intelligence and Incident / Case Response (16%), Cortex XDR (23%), Cortex XSOAR (16%), Cortex XSIAM (20%).
Security Operations Fundamentals at 25%, per the Palo Alto Networks datasheet.
Palo Alto Networks lists security operations center (SOC) professionals responsible for the basic application of Palo Alto Networks Cortex products and solutions, Cortex XDR, Cortex XSIAM and Cortex XSOAR.
Palo Alto Networks requires a 15 day wait after a first failed attempt, 30 days after a second and 90 days after a third. Once you pass, you can't retake the same exam for 18 months.
Our PathPay page lists the courses that qualify for a monthly plan. For anything else, contact us and we'll go over options.
Enrollment
Enroll in Security Operations Professional training with Accumentum.
Enroll in our Security Operations Professional course to get ready for the Palo Alto Networks Certified Security Operations Professional exam with instructor-led classes and hands-on labs.
For dates and next steps, use the registration page linked below or email info@accumentum.net.
Ready to start on Security Operations Professional?
Tell us your target date and we'll help you plan the path.