SecOps-Architect Practice Test 1 — 10 Questions

Question 1

An architect is configuring User-ID mapping via GlobalProtect. When remote users connect via GlobalProtect, how does the firewall learn the user-to-IP mapping without querying Active Directory domain controllers directly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GlobalProtect gateway directly registers the authenticated username and assigned tunnel IP with the User-ID subsystem.. GlobalProtect portals and gateways natively send user authentication mapping information to the User-ID subsystem upon successful VPN tunnel establishment.

Answer

GlobalProtect stores user mappings inside Cortex XDR cloud databases.

Answer

GlobalProtect relies on DNS reverse-lookup polling every 24 hours.

Answer

GlobalProtect uses SNMP traps to poll local Wi-Fi routers.

Question 2

An enterprise architect is designing an architecture where Prisma Cloud computes compliance for multi-cloud environments (AWS, Azure, GCP). To provide least-privilege access for Prisma Cloud to discover and assess resource configurations across multiple AWS accounts, which deployment method should the architect recommend?

Accepted Answer

AWS IAM Role with a unique External ID and CloudFormation stack sets deployed across all target accounts linked to a master payer account.. Prisma Cloud requires secure cross-account access in AWS. Enterprise architectures use AWS IAM Roles with External IDs and CloudFormation stack sets for scalable, least-privilege onboarding.

Answer

A single hardcoded AWS IAM Access Key and Secret Access Key embedded in the Prisma Cloud console settings.

Answer

Deploying a Prisma Cloud Defender daemonset on every AWS EC2 instance in the enterprise.

Answer

Configuring AWS Security Hub to push JSON dumps via FTP to Prisma Cloud.

Question 3

An architect is aligning a new SOC's response workflow with the NIST SP 800-61 incident handling lifecycle. During the containment, eradication, and recovery phase, the team must decide which activities belong there rather than in later lessons-learned work. Which two activities are correctly performed within that phase? (Choose two.)

Accepted Answer

Rebuilding an affected host from a known-good image after removing the threat. NIST SP 800-61 places containment, eradication, and recovery actions such as isolating hosts and rebuilding systems in the third phase. Post-mortems, policy revisions, and notifications are either post-incident activities or separate governance obligations. Keeping the phase boundaries clear prevents premature closure and preserves evidence integrity during active handling.

Answer

Publishing a public breach notification to regulators before containment completes

Answer

Conducting a post-mortem meeting to update detection rules and response procedures

Answer

Approving the incident response policy revision in the change advisory board

Question 4

An architect is designing an automated containment workflow in Cortex XSOAR. The requirement is to isolate a compromised endpoint running Cortex XDR agent without disrupting critical domain controllers. Which configuration parameter must be validated in the isolation command?

Accepted Answer

Exclusion lists and targeted device IDs to prevent critical asset isolation. When executing endpoint isolation in Cortex XDR via XSOAR, the architect must ensure exceptions or proper scoping are applied to prevent isolating essential infrastructure like Domain Controllers.

Answer

PAN-OS external dynamic list expiration timers

Answer

Global firewall rule bypass codes

Answer

Syslog forwarding facility levels

Question 5

An architect is configuring User-ID mapping via GlobalProtect. When remote users connect via GlobalProtect, how does the firewall learn the user-to-IP mapping without querying Active Directory domain controllers directly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure multiple LDAP Server profiles in Panorama and map them under User-ID Server Monitor / Agent settings for each domain controller.. When multiple AD forests or domains are present, deploying User-ID agents or configuring Panorama/NGFW User-ID LDAP integrations with appropriate server profiles for each domain ensures complete coverage.

Answer

Use Syslog forwarding from local workstations without a domain controller.

Answer

Configure a single static IP address list for all users.

Answer

Rely solely on GlobalProtect portal logs while disabling Active Directory monitoring.

Question 6

An architect is configuring a Palo Alto Networks firewall and wants to inspect outbound traffic for malware. Which security profile should be attached to the security policy rule allowing outbound internet traffic?

Accepted Answer

Antivirus security profile. Antivirus profiles inspect traffic traversing security policies for known malware signatures.

Answer

Decryption profile

Answer

Zone Protection profile

Answer

User-ID agent profile

Question 7

An architect is troubleshooting a User-ID deployment where IP-to-username mappings are missing for users on a specific subnet. Which TWO sources or tools can be checked to verify mapping status on the Palo Alto Networks firewall? (Choose two)

Accepted Answer

Run the CLI command 'show user ip-user-mapping all' on the firewall to view current mappings.. Option C is correct because the CLI command 'show user ip-user-mapping all' directly queries the firewall's User-ID mapping table, displaying the current IP-to-username mappings and their source (e.g., User-ID agent, GlobalProtect, captive portal), which is exactly what is needed to verify whether mappings exist for the affected subnet. Option D is correct because the User-ID agent status and connection state shown under Device > User Identification confirms whether the firewall is successfully connected to the User-ID agent (or Windows-based agent) and receiving mappings; a disconnected or unregistered agent would explain missing mappings for that subnet. Option A is irrelevant since the BIOS boot sequence has nothing to do with User-ID mapping. Option B is irrelevant because GlobalProtect client warranty details are unrelated to IP-to-username mapping status. Option E is irrelevant because HA2 fiber transceivers concern high-availability synchronization links, not User-ID mapping.

Answer

Check the BIOS boot sequence of the firewall management plane.

Answer

Check the GlobalProtect client GUI for hardware warranty details.

Answer

Verify the physical fiber optic cable transceivers on HA2.

Question 8

An architect is designing a zero-trust network segmentation strategy using Palo Alto Networks NGFWs. The security team wants security rules to dynamically adapt when workloads spin up or down in a dynamic environment, without needing static IP addresses in rule definitions. Which feature should the architect implement?

Accepted Answer

Dynamic Address Groups (DAGs) populated via tags registered through VM-Series API or User-ID.. Dynamic Address Groups (DAGs) use tags registered via VM-Series, User-ID, or cloud plugins to automatically add or remove IP addresses from security policies.

Answer

GlobalProtect portal static IP pools.

Answer

Panorama Template Stack variables.

Answer

Static address objects grouped into nested address groups.

Question 9

A SOC architect is standardizing how analysts describe adversary behavior across a multinational team. The CISO mandates adoption of the MITRE ATT&CK framework for all incident documentation. Which structural element of ATT&CK should the architect use to map a specific adversary action such as credential dumping from LSASS memory?

Accepted Answer

A technique identified by its Tactic and Technique IDs (for example, T1003 under Credential Access). Techniques are the correct granularity for documenting a concrete adversary action such as dumping credentials from LSASS memory. Each technique has a stable ID under a tactic, enabling consistent detection mapping, coverage measurement, and intelligence sharing. Groups, software, and mitigations are related objects that enrich context but do not describe the observed behavior itself.

Answer

A software entry describing the specific malware family observed on the endpoint

Answer

A group entry representing the tracked threat actor cluster behind the intrusion

Answer

A mitigation entry that prescribes the defensive control for the observed behavior

Question 10

A security operations team wants to report how quickly its detection content is keeping pace with the evolving threat landscape. The architect proposes tracking the median age of detection rules at the time they first generate a true positive. What does this metric most directly indicate about the detection program?

Accepted Answer

The currency and responsiveness of detection coverage relative to emerging threats. Rule age at first true positive measures how fresh detection content was when it proved effective. A low median indicates the team quickly develops coverage for emerging threats, while a high median signals lagging or stale content. This makes it a direct indicator of detection currency and responsiveness, unlike ROI, analyst workload, or traffic inspection coverage, none of which address detection timeliness.

Answer

The percentage of total network traffic inspected by the detection stack

Answer

The average number of alerts each analyst investigates per shift

Answer

The financial return on investment of the detection engineering team