Palo Alto Networks · Cybersecurity · Associate

Palo Alto Networks Certified Security Operations Generalist exam guide

Exam Security Operations Professional (formerly Security Operations Generalist)

Palo Alto Networks now lists this credential as Security Operations Professional (it appeared earlier as Security Operations Generalist). It validates job-ready use of Cortex XDR, XSIAM and XSOAR in a SOC: security operations fundamentals, threat intelligence and case response. It is the entry point to Palo Alto's security operations track.

QuestionsSee official page

Time limitSee official page

Passing score860 (300-1000 scale)

Exam fee$200 USD

Valid for2 years

DeliveryPearson VUE test center; online proctoring (OnVUE) where offered

Format: Multiple choice, matching and ordering items.

Who it's for

SOC analysts and junior security operations staff who use or will use Cortex products in basic operational roles.

What the exam covers

Security Operations Fundamentals25%

Cortex XDR23%

Cortex XSIAM20%

Threat Intelligence and Incident/Case Response16%

Cortex XSOAR16%

Eligibility & prerequisites

Required: None.

Recommended: Basic SOC experience or training; follow the Palo Alto Networks learning path for Cortex products.

Keeping it active

Valid 2 years from passing. Renew by retaking the current exam before expiry; passing a higher-level certification in the same track also extends active lower-level certifications by 2 years.

Skills & careers

Skills it validates

SOC processes and alert triage
Cortex XDR incident investigation
XSIAM alerts, cases and dashboards
XSOAR playbooks and case handling
Threat intelligence use in investigations
MITRE ATT&CK mapping

Job roles

SOC Analyst (Tier 1-2)Security Operations AnalystIncident ResponderThreat AnalystSecurity Engineer (Junior)

Where it fits in your path

Take before

Palo Alto Networks Certified Cybersecurity Apprentice CompTIA Security+

Go next

Palo Alto Networks Certified XDR Engineer Palo Alto Networks Certified XSIAM Engineer Palo Alto Networks Certified XSOAR Engineer

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

Week 1: SOC fundamentals: alert triage, incident lifecycle, MITRE ATT&CK, threat intelligence basics.
Week 2: Cortex XDR: agents, incidents, causality view, response actions, XQL basics.
Week 3: Cortex XSIAM and XSOAR: cases, issues, dashboards, playbooks and war room.
Week 4: Map every datasheet topic to notes; practice questions and review.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam date Hours per week

Exam-day tips

Confirm the current exam name on Pearson VUE: Palo Alto lists it as Security Operations Professional.
Fundamentals are the largest domain at 25%; know SOC workflows and terminology well.
Know the difference between XDR incidents, XSIAM cases and XSOAR incidents and where each is handled.
Expect basic XQL and playbook-reading questions rather than writing complex code.

Key terms for this exam

WildFire Cortex XDR Agent Cortex XSIAM Cortex XSOAR Cortex XDR Detonation DNS Sinkhole XDR Malware Sandbox MDR

All 10 terms Study with thinQcards™

Frequently asked questions

How much does the Security Operations Professional exam cost?

$200 plus applicable taxes; vouchers are sold through the Pearson VUE voucher store.

What score do I need to pass?

Palo Alto Networks sets the converted passing score at 860 on a 300-1000 scale.

How long is the certification valid?

Two years. Retake the exam before it expires, or earn a higher-level certification in the same track to extend it.

Was this called Security Operations Generalist?

Yes, earlier listings used that name; Palo Alto's certification page and Pearson VUE now list Security Operations Professional.

What comes next?

The specialist XDR Engineer, XSIAM Engineer or XSOAR Engineer exams, depending on the product you work with.

Official page: www.paloaltonetworks.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.

1. Map it thinQguide™ · 409 cert guides 2. Learn it thinQterms™ · 7,491 terms 3. Untangle it 180 look-alike comparisons 4. Prove it thinQready™ · free readiness check

Find your exam