Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
18 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
Which Cortex XSOAR feature should a Security Operations Architect use to automatically calculate, track, and display SLA compliance metrics for incoming security incidents?
Cortex XDR Analytics Engine
Incident SLAs and SLA dashboards
Incident SLAs define response and resolution targets per severity, while SLA dashboards aggregate breach, compliance and remaining-time metrics across incidents. This directly satisfies the requirement to calculate, track and display SLA compliance automatically, unlike playbooks or reports, which execute tasks or present static data without native SLA timers.
WildFire submission quotas
Threat Intelligence Management feeds
You are designing executive dashboards in Cortex XSIAM to report security posture trends over the last quarter. Management requires a metric that shows the reduction in successful phishing compromises resulting from user training. Which metric should you implement?
Average Analyst Playbook Execution Time
Cortex XDR Agent Installation Percentage
Phishing Incident Recurrence and Successful Compromise Rate Trend
This metric directly quantifies both the recurrence of phishing incidents and the rate at which users still fall victim after training, satisfying management's requirement to show compromise reduction over the quarter. It measures training effectiveness rather than raw volume alone.
Total Phishing Payload Extraction Volume
When establishing a baseline for Security Operations Center (SOC) alert volume in Cortex XSIAM, what is the primary purpose of this baseline?
To determine the exact licensing cost for future Cortex XDR expansion
To configure firewall security policies automatically
To replace manual analyst triage with fully automated playbook closures
To identify operational anomalies and deviations that require investigation or tuning
The baseline establishes normal alert volume so that deviations stand out. Its primary purpose is identifying operational anomalies and deviations requiring investigation or tuning, enabling the SOC to distinguish genuine threats from noise and refine detection rules.
While establishing baselines for Cortex XDR alert volume to detect operational anomalies, you notice a massive seasonal spike in alerts that threatens to invalidate your baseline threshold. What is the best practice approach to handle this seasonality in security metrics?
Permanently increase the global alert severity threshold to ignore all alerts during the seasonal window.
Replace all quantitative alert metrics with qualitative analyst feedback scores.
Disable automated alert generation in Cortex XDR until the seasonal window concludes.
Segment historical data and apply contextual rolling baselines that account for expected cyclical business variations.
Segmenting historical data and applying contextual rolling baselines isolates cyclical peaks so seasonal spikes do not distort anomaly thresholds. This satisfies the seasonality constraint by modelling expected business cycles, keeping detection sensitive to genuine deviations rather than predictable volume increases.
Your SOC leadership team needs to measure the operational efficiency of incident containment. Which metric should you track within Cortex XSOAR to evaluate how quickly analysts isolate compromised endpoints?
False Alarm Percentage
Mean Time to Detect (MTTD)
Mean Time to Contain (MTTC)
Mean Time to Contain directly measures the elapsed duration from incident detection to endpoint isolation, matching the requirement to quantify containment speed. Unlike Mean Time to Detect or Mean Time to Respond, MTTC stops at containment completion, so it isolates analyst efficiency at the isolation step within Cortex XSOAR.
Alert Escalation Ratio
You are preparing a security posture report for the board of directors using Cortex XSIAM. The board wants to understand risk exposure reduction over time. Which metric provides the most executive-level strategic value regarding risk posture?
Mean Time to Remediate (MTTR) critical vulnerabilities and associated threat exposure trends
MTTR for critical vulnerabilities, paired with exposure trends, shows the board how quickly exploitable risk is actually reduced over time, giving strategic insight into posture improvement rather than raw detection counts, which satisfies the executive-level risk-reduction requirement.
Total number of firewall rule modifications performed per week
Number of Cortex XDR agent heartbeat failures
Total gigabytes of log data ingested into Cortex Data Lake daily
Want more Operationalizing Security Metrics practice?
Practice this domainWhen designing a threat hunting methodology aligned with the MITRE ATT&CK framework, an architect wants to identify adversary persistence mechanisms. Which tactic category should the analyst focus queries on?
Initial Access
Persistence
The Persistence tactic in MITRE ATT&CK covers techniques adversaries use to maintain footholds across restarts, such as scheduled tasks, registry run keys and account creation. Querying this tactic directly surfaces the persistence mechanisms the architect wants to hunt.
Collection
Execution
An architect is designing an incident response workflow in Cortex XSOAR using the Incident Spooler. Which component is primarily responsible for processing queued events into actionable incidents?
Cortex XSOAR Server engine
The core engine processes the spooler queue to create incidents.
Demisto REST API
Threat Intel Management module
Cortex XSIAM Data Lake collector
An incident response architect is defining severity levels for security alerts in Cortex XDR. Which severity classification typically triggers automated containment playbooks without human intervention?
Debugging
Low
Informational
Critical
Critical severity alerts in Cortex XDR are designed to trigger automated containment playbooks immediately, satisfying the stem's requirement for action without human intervention. This tier represents confirmed, high-impact threats such as active ransomware execution, where containment latency directly increases blast radius, so the platform executes response actions autonomously rather than queuing them for analyst approval.
An organization is integrating Prisma Cloud with Cortex XSOAR to automate cloud incident response. When configuring the Prisma Cloud integration instance in XSOAR, which authentication mechanism is recommended to securely fetch alerts without using static user credentials?
LDAP bind credentials through a Cortex XDR Broker VM
HTTP Basic Authentication with administrative credentials
OAuth 2.0 Client Credentials grant via a dedicated Service Account
OAuth 2.0 Client Credentials lets XSOAR obtain short-lived access tokens from a dedicated service account, so no static API keys or user passwords are stored. This satisfies the requirement to fetch Prisma Cloud alerts securely without embedding long-lived credentials in the integration instance.
SAML 2.0 Federation token exchange
An enterprise security architect is integrating Cortex XSIAM with an external SIEM using the Syslog Export feature. The security team notices that certain sensitive fields need to be redacted before export. Where should the architect configure this transformation?
Magnifier machine learning configuration
Cortex XDR Agent installation parameters
Data Forwarding Rules / Log Forwarding Profiles
Syslog Export transformations, including field redaction, are applied through Data Forwarding Rules and Log Forwarding Profiles. Configuring the redaction there strips sensitive fields before logs leave Cortex XSIAM, satisfying the requirement that data be sanitised prior to external export.
XSOAR automation playbook script tasks
You are deploying Cortex XSIAM and need to ensure that endpoint logs collected from remote agents are normalized into a unified schema before analytics runs. Which feature performs this normalization?
Cortex XDR Agent Collector Engine
Magnifier behavioral analytics engine
Local Analysis Engine (LAE)
XDM (XDR Data Model) mapping and parsing rules
XDM mapping and parsing rules transform raw endpoint logs into the unified Cortex XSIAM schema, satisfying the normalisation requirement before analytics executes. Parsing extracts fields, while mapping aligns them to XDM attributes so detections and correlation run consistently across heterogeneous sources.
Want more Secops Frameworks And Threat Response Architecture practice?
Practice this domainAn architect is deploying Panorama and needs to manage firewalls deployed across different geographic regions with distinct administrative teams. Each team should only be able to view and manage their own local firewalls and policies, but global security rules must apply to all. Which Panorama structural feature should the architect implement?
Device Groups combined with Administrator Roles and Access Domains.
Device Groups scope firewall and policy configuration by region, while Administrator Roles and Access Domains restrict each team's visibility to its own devices. Together they satisfy both constraints: local administrative isolation and centrally enforced global security rules.
Multiple virtual routers inside a single device group.
Separate Panorama virtual appliances for each region configured in an HA mesh cluster.
Dynamic Address Groups with tag-based RBAC.
An architect is configuring User-ID to identify users behind a Microsoft Active Directory domain. Which protocol does the Palo Alto Networks User-ID agent use to query Active Directory security event logs for user login and logoff events?
NetFlow v9 templates
SNMPv3 polling of Active Directory database tables
WMI or Windows RPC/SMB to read Security Event Logs
The User-ID agent reads Active Directory Security Event Logs remotely using WMI or Windows RPC/SMB, parsing logon and logoff events to map IP addresses to users. This satisfies the requirement to identify users behind the domain.
HTTP POST requests sent by the Active Directory DNS service
An enterprise architect is designing an architecture where Prisma Cloud computes compliance for multi-cloud environments (AWS, Azure, GCP). To provide least-privilege access for Prisma Cloud to discover and assess resource configurations across multiple AWS accounts, which deployment method should the architect recommend?
A single hardcoded AWS IAM Access Key and Secret Access Key embedded in the Prisma Cloud console settings.
Deploying a Prisma Cloud Defender daemonset on every AWS EC2 instance in the enterprise.
AWS IAM Role with a unique External ID and CloudFormation stack sets deployed across all target accounts linked to a master payer account.
Cross-account IAM roles with a unique External ID satisfy the least-privilege constraint by granting Prisma Cloud temporary credentials without long-lived access keys. CloudFormation stack sets deploy the role consistently across every account under the master payer, enabling multi-account resource discovery and configuration assessment.
Configuring AWS Security Hub to push JSON dumps via FTP to Prisma Cloud.
When designing a high-availability (HA) architecture for a pair of Palo Alto Networks NGFWs, which interface type must be dedicated and directly connected between the two peers for session and state synchronization?
External zone data interface
Management interface
HA2 interface
The HA2 interface carries session and state synchronisation between peers, satisfying the dedicated, directly connected link the stem requires. It operates separately from the HA1 control link, which handles heartbeats and configuration sync. HA2 must be a direct connection to maintain synchronisation integrity during failover.
Panorama registration interface
An architect is designing an integration between Cortex XDR and an existing third-party SIEM. The requirement is to forward all raw and enriched Cortex XDR incidents and alerts in real time. Which architectural mechanism should be configured within Cortex XDR?
Configure an explicit proxy on Panorama to intercept XDR database traffic and mirror it to the SIEM.
Install a dedicated firewall between the XDR agent and the cloud backend to sniff telemetry.
Deploy an SNMP trap receiver on the SIEM and enable SNMPv1 polling on the XDR agent.
Configure a Syslog Server profile or Cortex XDR Streaming API connector to export log data in CEF or JSON format.
Configuring a Syslog Server profile or the Cortex XDR Streaming API connector exports raw and enriched incidents and alerts in CEF or JSON, satisfying the real-time forwarding requirement to the third-party SIEM. The Streaming API pushes events continuously rather than relying on scheduled polling, which would introduce latency and miss the real-time constraint.
An architect is configuring High Availability (HA) Active/Passive on two PA-5220 firewalls. During a failover event, active TCP sessions are maintained without requiring re-authentication. Which feature makes this possible?
GlobalProtect cookie persistence
HA2 session synchronization
HA2 synchronises session state, including TCP and application-layer session tables, between peers over the dedicated HA2 link. This preserves established sessions during failover, so the stem's requirement that active TCP sessions survive without re-authentication is met.
Dynamic DNS updates
Panorama configuration push
Want more Palo Alto Networks Product Integration And Architecture practice?
Practice this domainThe vendor does not publish an exact question count for the SecOps-Architect. The passing score is 860 (scaled 300–1,000). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 3 domains: Operationalizing Security Metrics, Secops Frameworks And Threat Response Architecture, Palo Alto Networks Product Integration And Architecture. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks SecOps-Architect exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.