SecOps-Architect Practice Test 12 — 15 Questions

Question 1

Which tool within Cortex XSIAM allows an architect to build customized graphical widgets and dashboards for tracking operational metrics?

Accepted Answer

Cortex XSIAM Dashboards and Widget Builder. Cortex XSIAM includes a native Dashboards and Widget Builder that lets architects create custom graphical widgets (charts, tables, single-value panels) and assemble them into dashboards for operational metrics like MTTD, MTTR, and detection coverage. This is the built-in visualization layer of XSIAM, distinct from other Palo Alto products.

Answer

Prisma Access Cloud Management

Answer

Panorama Policy Optimizer

Answer

WildFire Web Portal

Question 2

An organization is reporting on 'Dwell Time' as a core security posture metric using Cortex XSIAM. If Dwell Time is defined as the duration from initial compromise to containment, which data sources must be successfully correlated to calculate this metric accurately?

Accepted Answer

Initial endpoint intrusion telemetry/alerts and final incident response containment timestamps. Dwell Time is calculated as the delta between the moment of initial compromise and the moment containment is achieved. In Cortex XSIAM, this requires correlating endpoint intrusion telemetry or the earliest alert indicating the initial access vector with the incident response containment timestamp recorded when the incident is closed or the host is isolated. Without both endpoints of that timeline, the metric cannot be derived.

Answer

Firewall active session logs and DNS query volume statistics alone

Answer

WildFire file upload quotas and automated sandbox verdict latency

Answer

Cortex XDR agent heartbeat intervals and operating system patch levels

Question 3

An enterprise is establishing a metrics governance framework for Cortex XSOAR automation. Which THREE criteria should be used to determine if a security workflow is a good candidate for automation? (Choose three)

Accepted Answer

Well-defined, deterministic decision logic and steps. Option C is correct because automation in Cortex XSOAR depends on playbook tasks with clear, deterministic branching logic (conditional tasks, decision trees) that produce the same output for the same input, which is exactly what makes a workflow reliably automatable. Option D is correct because high-volume, repetitive workflows deliver the greatest return on automation investment by reducing analyst toil and MTTR, and XSOAR playbooks, triggers, and incident types are designed to handle recurring incidents at scale. Option E is correct because XSOAR integrations and commands (for example, parsing JSON, XML, or CSV via context and transformers) require structured, machine-parseable inputs; unstructured or ambiguous data cannot be reliably mapped into playbook inputs and outputs. Option A is not a good candidate because subjective, political negotiation between business units requires human judgment and cannot be encoded as deterministic playbook logic. Option B is not a good candidate because a once-per-decade workflow with unpredictable parameters offers negligible automation value and cannot be standardized into a repeatable playbook.

Answer

Requires complex, highly subjective political negotiation between business units

Answer

Executed exactly once every ten years with unpredictable parameters

Question 4

You are configuring Cortex XSOAR integration instances and need to ensure that API keys and passwords are stored securely without appearing in plaintext within playbook logs or incident data. Where should these credentials be stored?

Accepted Answer

As encrypted integration parameters / Vault-managed credentials. Integration credentials in Cortex XSOAR should be stored as encrypted integration parameters (credentials type) managed by the platform vault.

Answer

Inside public incident context data fields

Answer

Hardcoded in custom Python automation scripts

Answer

Plaintext in the playbook YAML file

Question 5

An architect is configuring Panorama Template Stacks. Which TWO types of configuration settings are typically defined within Panorama Templates rather than Device Groups? (Choose two)

Accepted Answer

Network interface IP addresses, virtual routers, and static routes.. Option C is correct because Panorama Templates are designed to hold device-level and network-level configuration that is bound to specific firewalls, including Layer 3 interface IP addresses, virtual routers, and static routes, which are all part of the network configuration pushed to managed devices. Option D is correct because Templates also carry device system settings such as DNS servers, NTP servers, and management plane IP addresses, which are device-specific rather than policy-specific. Options A, B, and E are not correct because Cortex XDR agent packages are managed outside Panorama Templates, while security policy rules, URL filtering profiles, Dynamic Address Groups, and tag registration filters are policy objects and rules that belong in Device Groups, not Templates.

Answer

Cortex XDR agent installation packages.

Answer

Security policy rules and URL filtering security profiles.

Answer

Dynamic Address Groups and tag registration filters.

Question 6

An organization wants to establish a comprehensive KPI framework to measure maturity across all phases of the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover) using Cortex XSIAM and XSOAR. Which THREE metrics map directly to the 'Respond' function? (Choose three)

Accepted Answer

Mean Time to Contain (MTTC). Option B (Mean Time to Contain, MTTC) is correct because containment is a core Respond-function activity — it measures how quickly an incident is isolated after detection, directly reflecting response effectiveness. Option C (Mean Time to Remediate, MTTR) is correct because remediation/eradication of a confirmed incident is performed within the Respond function, so MTTR quantifies how fast the organization resolves incidents. Option D (percentage of incidents handled via automated playbooks) is correct because XSOAR playbooks execute response actions such as enrichment, containment, and notification, making automation coverage a direct Respond-phase KPI. Option A does not belong because vulnerability scanning cycles measure the Identify function (asset/vulnerability visibility), and Option E does not belong because agent installation coverage is a Protect-function metric for endpoint hardening and control deployment.

Answer

Frequency of vulnerability scanning cycles

Answer

Percentage of endpoints with Cortex XDR agent installed

Question 7

An architect is configuring a Palo Alto Networks firewall to decrypt inbound SSL/TLS traffic destined for an internal web server. Which certificate configuration is required on the firewall to perform Inbound Inspection?

Accepted Answer

The private key and certificate of the internal web server must be installed on the firewall.. For inbound SSL/TLS decryption, the firewall must present the internal web server's own certificate to the client and decrypt the traffic using the server's private key. Therefore, the web server's private key and certificate must be imported onto the firewall (under Device > Certificate Management) so it can impersonate the server during the TLS handshake. This is fundamentally different from outbound/forward-proxy decryption, which uses a forward-trust or self-signed CA to re-sign certificates.

Answer

An expired public certificate from a third-party root CA.

Answer

No certificates are required if SSH is used instead of SSL.

Answer

A self-signed Certificate Authority (CA) certificate generated solely on the firewall without any server keys.

Question 8

When designing a comprehensive security metrics dashboard in Cortex XSIAM for C-level executives, which THREE categories of metrics should be included to provide a balanced view of security posture? (Choose three)

Accepted Answer

Risk and Vulnerability Exposure Trends. Option B (Risk and Vulnerability Exposure Trends) is correct because executive dashboards need trend-level insight into how risk and vulnerability exposure changes over time, which directly reflects the organization's evolving security posture. Option D (Security Coverage and Visibility Metrics such as agent coverage) is correct because coverage metrics show how much of the environment is actually instrumented and monitored, revealing blind spots that undermine any security program. Option E (Incident Response Velocity, MTTD/MTTR) is correct because Mean Time to Detect and Mean Time to Respond quantify how quickly the SOC detects and contains threats, a key operational effectiveness measure for leadership. Option A is not appropriate because individual firewall rule line numbers and syntax formatting are low-level configuration details, not strategic posture metrics. Option C is not appropriate because Cortex XSOAR playbook Python script syntax errors are engineering-level troubleshooting artifacts rather than executive-level security posture indicators.

Answer

Individual firewall rule line numbers and syntax formatting

Answer

Cortex XSOAR playbook Python script syntax errors

Question 9

An architect is designing a Prisma Cloud Compute deployment for Kubernetes clusters deployed across multiple cloud providers. The architecture requires real-time runtime defense against container escapes and anomalous process execution. Which Prisma Cloud component must be deployed inside each Kubernetes cluster to achieve this?

Accepted Answer

Prisma Cloud Defender DaemonSet deployed to every node in the Kubernetes cluster.. Prisma Cloud Compute Defender daemonsets run on each node in the cluster to provide runtime defense, vulnerability scanning, and compliance checks.

Answer

Prisma Access Remote Network connector container pod

Answer

Panorama virtual appliance deployed as a Kubernetes Ingress controller.

Answer

GlobalProtect containerized app

Question 10

An architect is configuring User-ID mapping on a Palo Alto Networks firewall. Which TWO methods can be used to map IP addresses to usernames in environments where Active Directory is not present? (Choose two)

Accepted Answer

GlobalProtect client connections which report username and IP upon login.. Option D is correct because GlobalProtect, when configured with User-ID, reports the authenticated username and the assigned source IP address to the firewall upon login, creating a valid IP-to-username mapping without requiring Active Directory. Option E is correct because Captive Portal intercepts HTTP/HTTPS sessions and prompts users for credentials, then maps the authenticated username to the client's source IP for User-ID purposes. These two methods are native Palo Alto Networks User-ID mechanisms that function independently of Active Directory. Option A is irrelevant because the BIOS clock has nothing to do with identity mapping. Option B is not a supported User-ID method and unauthenticated SNMP polling of ARP tables does not provide username mappings. Option C is illegitimate and unrelated to any supported User-ID mapping technique.

Answer

Manually editing the firewall BIOS clock.

Answer

SNMP polling of unmanaged switch ARP tables without authentication.

Answer

Direct NetBIOS password hash cracking on remote workstations.

Question 11

Which Cortex XSOAR feature should a Security Operations Architect use to automatically calculate, track, and display SLA compliance metrics for incoming security incidents?

Accepted Answer

Incident SLAs and SLA dashboards. Cortex XSOAR includes native Incident SLA functionality that lets architects define SLA timers per incident type, severity, or custom field, and then track breach/at-risk status in real time. The built-in SLA dashboards and widgets visualize compliance percentages, average response times, and breaches across teams, which is exactly what the question asks for. This is a core XSOAR feature used by SOC managers to enforce response commitments.

Answer

Cortex XDR Analytics Engine

Answer

WildFire submission quotas

Answer

Threat Intelligence Management feeds

Question 12

An organization is defining metrics to measure the efficacy of its threat hunting program inside Cortex XSIAM. Which metric provides the strongest indicator of a mature and successful proactive hunting capability?

Accepted Answer

Number of high-fidelity threats discovered through proactive hunting that convert into new detection rules. A mature threat hunting program is measured by the number of unique, previously undetected threats uncovered through hypothesis-driven hunting that subsequently result in new automated detection rules.

Answer

Total number of log queries executed by hunters per day

Answer

Total storage consumed by threat hunting analytical models

Answer

Percentage of routine Tier 1 alert triage handled by scripts

Question 13

An architect is designing an incident response lifecycle based on the NIST SP 800-61 framework for a Security Operations Center (SOC). Which phase immediately follows the Containment, Eradication, and Recovery phase?

Accepted Answer

Post-Incident Activity. According to NIST SP 800-61, the lifecycle phases are Preparation, Detection and Analysis, Containment, Eradication, and Recovery, and finally Post-Incident Activity (Lessons Learned).

Answer

Detection and Analysis

Answer

Threat Intelligence Enrichment

Answer

Risk Assessment

Question 14

An architect is troubleshooting why security metric trends in Cortex XSIAM appear erratic and unreliable. Which THREE factors commonly cause metric distortion in a SOC? (Choose three)

Accepted Answer

Intermittent log ingestion pipeline failures or collector outages. Option B is correct because intermittent failures in log ingestion pipelines or collector outages create gaps and spikes in the data feeding Cortex XSIAM metrics, so trends become erratic when telemetry is missing or delayed. Option D is correct because inconsistent parsing or vendor log-format changes can cause events to be misclassified, dropped, or mapped to the wrong fields, directly distorting the underlying counts and trends that metrics are built on. Option E is correct because an unannounced mass deployment or decommissioning of endpoint agents abruptly changes the population of reporting endpoints, producing artificial jumps or drops in metric values that do not reflect real security posture changes. Option A does not belong because browser bookmarks only affect a user's navigation convenience and have no effect on data collection or metric computation. Option C does not belong because dark mode versus light mode is purely a UI display preference and does not alter the ingested data or the calculated metrics.

Answer

Configuring browser bookmarks for dashboard access

Answer

Using dark mode instead of light mode in the Cortex XSIAM web UI

Question 15

An enterprise security architect is designing an automated threat response architecture using Cortex XSOAR. The design requires parsing unstructured phishing emails received in a dedicated mailbox. Which XSOAR capability should be leveraged to automatically extract indicators such as URLs, file hashes, and sender domains from the email body?

Accepted Answer

Phishing parser and indicator extraction engines. Cortex XSOAR utilizes built-in email parsing parsers and regex-based extraction mechanisms, often enhanced by parsers within the Phishing integration pack, to extract indicators.

Answer

Cortex XDR file quarantine policy engine

Answer

Minemeld RSS feed collector

Answer

PAN-OS WildFire sandbox detonation queue