SecOps-Architect Practice Test 10 — 10 Questions

Question 1

When designing a high-availability (HA) architecture for a pair of Palo Alto Networks NGFWs, which interface type must be dedicated and directly connected between the two peers for session and state synchronization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HA2 interface. HA1 backup and HA1 primary interfaces are used for control plane state synchronization, while HA2 is used for data plane session synchronization.

Answer

External zone data interface

Answer

Management interface

Answer

Panorama registration interface

Question 2

An incident response team uses Cortex XSOAR playbooks for automated enrichment. Leadership wants to measure how much time automation saves per incident compared to manual lookup tasks. Which methodology should the architect use to calculate this metric?

Accepted Answer

Multiply total successful automated task executions by the estimated manual execution time per task.. To calculate time saved by automation, multiply the number of automated task executions by the estimated time it would take an analyst to perform those same tasks manually.

Answer

Subtract the total number of closed incidents from the number of open incidents.

Answer

Measure the average CPU load of the Cortex XSOAR server during playbook execution.

Answer

Divide total firewall logs by the number of active Cortex XSOAR integrations.

Question 3

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO prerequisites must be met before enabling HA on the firewalls? (Choose two)

Accepted Answer

Both firewalls must be running the exact same PAN-OS software version.. Option B is correct because Palo Alto Networks requires both HA peers to run the exact same PAN-OS software version so that configuration synchronization, HA state negotiation, and failover behave consistently between the two devices. Option D is correct because both firewalls must have identical licenses and support subscriptions (e.g., Threat Prevention, URL Filtering, WildFire, DNS Security) so that security profiles and features remain functional on the passive peer after a failover. Option A is incorrect because HA peers should have management interfaces on the same subnet with matching default gateways to allow proper HA communication and management access. Option C is incorrect because HA pairs must be the same hardware model, not different models, to ensure compatible interfaces and performance. Option E is incorrect because HA ports are dedicated Layer 2/Layer 3 links between the two firewalls (HA1, HA2, HA3) and do not need public IP addresses or internet connectivity.

Answer

Management interfaces must be configured on completely different subnet masks with mismatched default gateways.

Answer

Both firewalls must have different models (e.g., PA-3220 paired with PA-5220).

Answer

HA ports must be connected to the internet via public IP addresses.

Question 4

When designing a Security Operations Center (SOC) tiering model, what is the primary operational responsibility typically assigned to Tier 2 (Incident Responders)?

Accepted Answer

In-depth forensic investigation, root cause analysis, and containment execution. Tier 2 (Incident Responders) in a SOC tiering model is responsible for in-depth forensic investigation, root cause analysis, and containment execution. Tier 1 handles initial triage and false positive closure, while Tier 3 focuses on threat hunting and advanced detection engineering. Tier 2 takes escalated incidents from Tier 1 and performs deeper analysis and response actions.

Answer

Developing custom machine learning detection models and threat hunting hypotheses

Answer

High-volume initial alert triage and closing false positives based on strict runbooks

Answer

Managing physical datacenter security and badge access

Question 5

A SecOps architect is asked to prove that the SOC's automated response playbooks are reducing manual workload. The team already tracks the count of playbook executions, but leadership says that number alone does not demonstrate labor savings. Which metric should the architect present as the primary evidence of reduced manual effort?

Accepted Answer

Number of automated actions executed per incident, compared with the manual steps those actions replaced. To prove reduced manual workload, the metric must connect automated activity to the human steps it replaced. Counting executions or tracking MTTR for a subset of analysts does not establish avoided labor. Comparing automated actions with the manual steps they supplanted gives leadership a direct, quantifiable link between playbook use and reduced analyst effort, making it the strongest evidence.

Answer

Percentage of alerts closed as false positives by automation

Answer

Mean time to resolution (MTTR) for incidents handled only by Tier 3 analysts

Answer

Total number of playbook executions per month

Question 6

An enterprise architect is planning a Zero Trust Network Access (ZTNA) migration using Prisma Access. The design must ensure that users are continuously authenticated and authorized before accessing internal applications, regardless of their location. Which component validates user posture and device compliance before granting access?

Accepted Answer

GlobalProtect app performing HIP (Host Information Profile) checks evaluated by Prisma Access.. Prisma Access integrates with GlobalProtect and Posture Assessment (or third-party MDM/EMM integration) to verify device compliance before granting access.

Answer

Panorama SNMP trap listener

Answer

Prisma Cloud Defender host sensor scanning network cables

Answer

The local DHCP server on the user's home network

Question 7

An architect is integrating a Palo Alto Networks next-generation firewall with an external threat intelligence platform using the MineMeld-style output. The platform publishes indicators over HTTPS as a plain-text list, one indicator per line. The architect wants the firewall to consume the list and enforce it in security policy without manual updates. Which configuration should the architect use?

Accepted Answer

Create an External Dynamic List of type IP or Domain, attach it to a security policy rule, and configure the source URL with a refresh interval.. An External Dynamic List sourced from the platform's HTTPS URL, refreshed on a schedule, and referenced in a security policy rule provides automated enforcement of the published indicators. URL-type EDLs are limited to URL filtering, application filters cannot auto-refresh, and DNS category overrides do not ingest arbitrary lists.

Answer

Configure a DNS Security category override that maps the indicator list to a custom sinkhole.

Answer

Create an External Dynamic List of type URL and reference it in a URL Filtering profile.

Answer

Import the indicator list into a custom Application Filter and apply it to a security policy rule.

Question 8

A multinational SOC architect is designing a threat-intelligence ingestion pipeline into Cortex XSOAR. Analysts complain that indicators from a commercial feed suppress internal detections because the feed marks legitimate corporate VPN egress IPs as malicious. The architect must add a pre-ingestion control that prevents these false positives from reaching the indicator database while retaining the feed's other indicators. Which control should be implemented?

Accepted Answer

Create an indicator allow list in Cortex XSOAR and configure the feed integration's reputation calculation to consult it before writing indicators.. The allow list is the only control that operates during feed ingestion and reputation calculation, so it blocks the known-good corporate VPN egress ranges before they reach the indicator database. Post-ingestion playbooks and threshold changes act too late or in the wrong direction, and disabling the feed sacrifices valuable intelligence. The allow list preserves feed coverage while eliminating the suppression of internal detections.

Answer

Disable the feed integration entirely and manually upload only the indicator types the SOC trusts.

Answer

Deploy a Cortex XSOAR playbook that runs on every incident and closes any incident whose indicators match the corporate VPN range.

Answer

Set the feed integration's indicator reputation threshold to 'Bad' and enable the 'Trust any feed' option in server configuration.

Question 9

A security architect is establishing an operational metrics dashboard for executive leadership. Which metric best demonstrates the risk reduction impact of automated security orchestration and response (SOAR) playbooks?

Accepted Answer

Mean Time to Respond (MTTR) / Containment Time. Mean Time to Respond (MTTR) or Containment Time directly shows how automation accelerates remediation and reduces organizational exposure time.

Answer

Total number of raw logs ingested per second (EPS)

Answer

Average CPU utilization of the SIEM collector nodes

Answer

Number of security personnel trained on phishing awareness

Question 10

An architect is configuring Panorama to manage software and content updates. Which TWO update types can be scheduled and distributed via Panorama to managed firewalls? (Choose two)

Accepted Answer

Applications and Threats content updates.. Option A is correct because Panorama can schedule and push dynamic Applications and Threats content updates (the App-ID/Threat signature database) to managed firewalls via Device > Dynamic Updates, letting the appliance pull the latest content package from Palo Alto Networks update servers. Option E is correct because Antivirus and WildFire signature updates are also dynamic content updates that Panorama can schedule and distribute to managed firewalls, keeping the antivirus engine and WildFire signatures current. Panorama's update scheduling specifically covers these dynamic content types (Applications, Threats, Antivirus, WildFire, and related content) rather than third-party OS or infrastructure patches. Option B is not applicable because Panorama does not manage local client browser operating system updates. Option C is not applicable because AWS EC2 hypervisor patches are handled by AWS, not Panorama. Option D is not applicable because Active Directory domain controller schema updates are a Windows Server function unrelated to Panorama content distribution.

Answer

Local client browser operating system updates.

Answer

AWS EC2 instance hypervisor patches.

Answer

Active Directory domain controller schema updates.