SecOps-Architect Practice Test 15 — 15 Questions

Question 1

A security architect is designing a threat intelligence program for a SOC. The organization wants to leverage the Cyber Kill Chain framework to structure its detection and response strategies. The architect needs to ensure that the SOC can map its existing controls to the stages of the Cyber Kill Chain. Which of the following correctly lists the stages of the Cyber Kill Chain in order?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives. The Cyber Kill Chain stages are Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. This order reflects the adversary's progression from planning to execution. Understanding this sequence allows security architects to place controls at each stage to detect and disrupt attacks. Any deviation from this order would misalign the mapping of defenses and reduce the effectiveness of the threat intelligence program.

Answer

Reconnaissance, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives, Weaponization

Answer

Reconnaissance, Weaponization, Exploitation, Delivery, Installation, Command and Control, Actions on Objectives

Answer

Reconnaissance, Weaponization, Delivery, Installation, Exploitation, Command and Control, Actions on Objectives

Question 2

An architect is designing a Prisma Access deployment with GlobalProtect for remote users. The security team requires that all traffic from remote users, including traffic destined to the internet, be inspected by Prisma Access security services, and that user identity be consistently applied across all security policies. Which GlobalProtect configuration is required to meet these requirements?

Accepted Answer

Enable no split tunneling (full tunnel) and configure User-ID in GlobalProtect.. To inspect all remote user traffic, including internet-bound, the GlobalProtect configuration must use no split tunneling, forcing all traffic through Prisma Access. User-ID in GlobalProtect ensures that user identity is consistently applied across all security policies. The other options either allow traffic to bypass inspection or do not address identity consistently.

Answer

Configure split tunneling with access route including /0 and exclude internal subnets.

Answer

Use GlobalProtect with IPsec and enable X-Auth to capture user credentials.

Answer

Configure split tunneling with access route including all internal subnets and exclude public internet.

Question 3

An architect is integrating Cortex XDR with a third-party threat intelligence platform to automatically block indicators of compromise (IOCs) on Palo Alto Networks firewalls. The architect wants to ensure that when a new IOC is added to the threat intelligence platform, it is automatically pushed to the firewalls and enforced. Which integration method should be used?

Accepted Answer

Cortex XSOAR playbook that triggers on new IOCs and uses the Palo Alto Networks firewall integration to update policy. Cortex XSOAR is the central orchestration platform for automating security workflows. Its Palo Alto Networks firewall integration allows playbooks to programmatically add IOCs to EDLs or create security rules, ensuring immediate enforcement. By triggering on new IOCs from the threat intelligence platform, the playbook automates the entire process, reducing response time and human error. This is the most scalable and maintainable solution.

Answer

Panorama log forwarding to the threat intelligence platform and automatic policy updates via the platform's API

Answer

GlobalProtect with HIP profiles to block IOCs based on endpoint posture

Answer

Cortex XDR API with custom scripts to poll the threat intelligence platform and update firewall policies

Question 4

An architect is integrating Cortex XDR with a third-party endpoint management platform so that when Cortex XDR isolates an endpoint, the management platform should not attempt to push software updates to it. The architect needs the most reliable, event-driven way to notify the external platform of the isolation state change. Which approach should the architect use?

Accepted Answer

Configure a Cortex XDR alert notification webhook that calls the external platform's API when an isolation event fires.. Cortex XDR's outbound webhook notification delivers an event-driven push when an endpoint is isolated, letting the external platform block update pushes in near real time. Polling and scheduled exports are batch and latency-prone, and an inbound listener is neither supported nor secure, so the webhook is the correct integration mechanism.

Answer

Create a Cortex XSOAR playbook that listens on an inbound port for Cortex XDR to connect to.

Answer

Poll the Cortex XDR management API every 60 seconds for endpoint isolation status changes.

Answer

Export Cortex XDR endpoint status to a CSV on a schedule and have the platform import the file.

Question 5

A security architect is defining the containment strategy for ransomware incidents detected by Cortex XDR. The organization operates a hybrid environment with endpoints, on-premises servers, and cloud workloads. Leadership wants assurance that containment actions are applied consistently and can be reversed after eradication. Which design principle should the architect prioritize?

Accepted Answer

Isolate affected endpoints using Cortex XDR network isolation while documenting each action for later reversal. Network isolation through Cortex XDR confines the threat while keeping the management channel open for investigation, and it can be lifted once eradication is verified. Documenting each containment action provides the reversibility and auditability leadership requires. Deleting files, disabling accounts broadly, or powering off systems either destroys evidence, disrupts operations excessively, or cannot be cleanly reversed.

Answer

Disable user accounts for all employees in the affected business unit until the incident is closed

Answer

Immediately delete all files with ransomware-associated extensions from affected systems

Answer

Shut down all affected endpoints and servers at the power source to halt encryption

Question 6

A SOC architect is designing the incident response workflow for a Cortex XSOAR deployment and must define how incidents move between tiers. The organization wants to ensure that low-severity phishing alerts are handled consistently without consuming senior analyst time, while high-severity malware detections receive immediate expert attention. Which design element should the architect implement to achieve this?

Accepted Answer

Severity-based playbook routing that assigns incidents to tier-appropriate queues automatically. Routing incidents by severity through dedicated playbooks and tier-appropriate queues ensures that low-severity phishing alerts are handled consistently by Tier 1 while high-severity malware detections reach senior analysts immediately. Automated routing removes manual delay and supervisor dependency, and it scales with incident volume, satisfying both consistency and expertise-preservation requirements.

Answer

Manual incident assignment by a shift supervisor at the start of every shift

Answer

Round-robin distribution of all incidents across every analyst regardless of tier

Answer

A single shared queue where all analysts pick incidents in the order they arrive

Question 7

An architect is integrating Palo Alto Networks NGFW with AWS VPC environments using the VM-Series auto-scaling template. When a new VM-Series instance spins up dynamically via AWS Auto Scaling, how does the new firewall register and receive its initial configuration without manual administrative intervention?

Accepted Answer

Through bootstrapping using an S3 bucket containing an init-cfg.txt file, bootstrap folders, and a valid Panorama registration auth-key.. VM-Series firewalls in AWS auto-scaling use bootstrapping to automatically receive initial configuration. The bootstrap process reads an init-cfg.txt file from an S3 bucket, which contains parameters such as the Panorama IP address, auth key, and template stack name. The firewall then registers with Panorama and pulls its configuration, enabling zero-touch provisioning.

Answer

By listening for multicast broadcast packets sent by AWS Route 53.

Answer

By executing an interactive SSH wizard triggered via AWS CloudWatch alarms.

Answer

By downloading policies from the AWS Systems Manager Parameter Store via raw SNMP.

Question 8

A security architect is designing a threat intelligence program for a SOC. The organization wants to leverage the Cyber Kill Chain framework to structure its detection and response strategies. The architect needs to ensure that the SOC can map its existing controls to the stages of the Cyber Kill Chain. Which of the following correctly lists the stages of the Cyber Kill Chain in order?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adversary, Capability, Infrastructure, and Victim as the four vertices. The Diamond Model of Intrusion Analysis is built on four vertices—Adversary, Capability, Infrastructure, and Victim—and two axes—sociological and technological—that connect them. These features allow analysts to pivot between elements, generate hypotheses, and correlate incidents. The model is not linear, does not include vulnerability scoring, and does not require mapping to MITRE ATT&CK. Incorporating the vertices and axes is essential for effective threat intelligence correlation.

Answer

A linear sequence of phases from reconnaissance to exfiltration

Answer

A requirement to map all activity to the MITRE ATT&CK framework

Answer

A scoring system for prioritizing vulnerabilities

Question 9

An architect is designing a Cortex XSOAR playbook that needs to retrieve a list of all endpoints from Cortex XDR and then isolate any endpoint that has a specific tag. Which Cortex XDR integration command should the architect use to fetch the list of endpoints?

Accepted Answer

xdr-get-endpoints. The xdr-get-endpoints command is specifically designed to retrieve a list of endpoints from Cortex XDR, including their tags and other metadata. This allows the playbook to filter endpoints by tag and then isolate them using xdr-isolate-endpoint. Other commands retrieve incidents, alerts, or policies, which do not directly provide the required endpoint list.

Answer

xdr-get-policy

Answer

xdr-get-incidents

Answer

xdr-get-alerts

Question 10

A SOC architect is designing the escalation path for a global follow-the-sun operation. Analysts in one region close cases at end of shift, and the next region frequently reopens them because critical context was lost during handoff. Leadership wants a design that guarantees continuity of investigative state across regions without duplicating analyst effort. Which architectural approach best addresses the root cause?

Accepted Answer

Standardize a structured case handoff record capturing hypotheses, evidence collected, actions taken, and open questions, with a mandatory verbal briefing at shift transition. The reopens stem from investigative state not surviving the shift boundary, so the fix is a standardized handoff artifact that captures hypotheses, evidence, completed actions, and unresolved questions, reinforced by a live briefing. Mandating same-shift closure, adding headcount, or centralizing all work either worsens quality, absorbs rework, or sacrifices around-the-clock coverage without preserving context.

Answer

Route all cases to a single centralized region so no handoff ever occurs between time zones

Answer

Mandate that each region complete its investigations before shift end so no case crosses a regional boundary

Answer

Increase the number of analysts per shift so each region has spare capacity to re-investigate reopened cases

Question 11

An architect wants Panorama to manage a set of VM-Series firewalls in a public cloud and push device group and template configurations to them. The firewalls can initiate outbound connections but cannot accept inbound management sessions. Which Panorama connectivity model should the architect choose?

Accepted Answer

Configure the firewalls to connect to Panorama using the firewall-initiated connection model, where each firewall registers with Panorama over an outbound connection.. When managed firewalls can only initiate outbound connections, Panorama must use the firewall-initiated connection model. Each firewall registers with Panorama over an outbound channel, and Panorama then delivers device group and template configuration through that established session. This model suits cloud deployments behind NAT or restrictive security groups where inbound management access is unavailable.

Answer

Configure the firewalls to connect to Panorama using the Panorama-interfaces management model, where Panorama initiates all configuration pushes.

Answer

Deploy a Panorama appliance in the same cloud VPC as the firewalls and use its management interface to push configuration over the private network.

Answer

Use the Panorama high availability passive peer to push configuration to the firewalls while the active peer handles logging only.

Question 12

An architect is designing a Panorama deployment to manage multiple Palo Alto Networks firewalls. The architect wants to ensure that firewall administrators can only push configurations to firewalls within their assigned region. Which Panorama feature should be used to achieve this role-based access control?

Accepted Answer

Panorama role-based access control (RBAC) with custom admin roles and device group filters. Panorama RBAC allows you to define custom roles with specific permissions, including which device groups an administrator can access. By assigning administrators to device groups that match their region, you can enforce that they only push configurations to firewalls in their region. This is the correct and standard approach for regional access control.

Answer

Panorama high availability (HA) with active-passive configuration

Answer

Panorama log forwarding profiles with region-based filters

Answer

Panorama templates with variable overrides

Question 13

An architect is deploying a Palo Alto Networks VM-Series firewall in a Microsoft Azure environment. The firewall must inspect traffic between two subnets in the same virtual network (VNet). The architect wants to ensure that the VM-Series can see and inspect all traffic, including traffic between VMs in different subnets, without modifying the VMs' default gateways. Which Azure networking feature should be used to redirect traffic to the VM-Series?

Accepted Answer

Azure User-Defined Routes (UDRs) with the VM-Series as the next hop for the subnets.. User-Defined Routes (UDRs) are the correct Azure feature. They allow you to define custom routes that override Azure's default system routes, directing traffic to a virtual appliance such as the VM-Series. By associating UDRs with the subnets, all traffic leaving those subnets (including inter-subnet traffic) is sent to the VM-Series for inspection. This does not require changing the VMs' default gateways because the UDRs are applied at the subnet level, making it transparent to the VMs.

Answer

Azure Firewall Manager with security partner provider integration to inject the VM-Series into the traffic path.

Answer

Azure Network Watcher with IP flow verify to redirect traffic to the VM-Series.

Answer

Azure Load Balancer with a backend pool containing the VM-Series, and configure the VMs to use the load balancer as their gateway.

Question 14

An architect is designing a security operations architecture that integrates Palo Alto Networks Cortex XDR with a SIEM. The SIEM will ingest Cortex XDR alerts and telemetry for correlation with other data sources. The architect must ensure that the integration supports bi-directional communication so that SIEM analysts can trigger response actions in Cortex XDR. Which TWO integration methods should the architect use to achieve this? (Choose two.)

Accepted Answer

Deploy a Cortex XSOAR instance and configure the SIEM to send events to XSOAR via its REST API, then use XSOAR playbooks to call Cortex XDR actions.. Bi-directional integration between a SIEM and Cortex XDR requires a method for the SIEM to both receive alerts and send commands. The Cortex XDR REST API allows direct querying and action execution, while Cortex XSOAR can act as an intermediary, receiving events from the SIEM and orchestrating responses in Cortex XDR. Both are supported and commonly used in SecOps architectures.

Answer

Use the Cortex XDR Broker VM to establish a direct connection between the SIEM and Cortex XDR for command execution.

Answer

Configure Cortex XDR to send webhooks to the SIEM for each alert, and the SIEM can respond by sending HTTP POST requests to a Cortex XDR webhook receiver.

Answer

Configure Cortex XDR to forward alerts to the SIEM using syslog in Common Event Format (CEF).

Question 15

An architect is designing a Palo Alto Networks Prisma Access deployment for a large enterprise with multiple branch offices. The architect must ensure that traffic from branch offices to the internet is inspected by Prisma Access while traffic to private data centers uses a dedicated IPSec tunnel to a VM-Series firewall in the data center. The architect needs to configure the Prisma Access remote network to support this split-tunnel behavior. Which Prisma Access component should the architect configure to achieve this?

Accepted Answer

Configure a Remote Network in Prisma Access and use policy-based routing on the branch firewall to send data center traffic directly over the IPSec tunnel.. The correct approach is to configure a Remote Network in Prisma Access for branch internet traffic and use policy-based routing on the branch firewall to steer data center traffic over a separate IPSec tunnel to the VM-Series. This ensures that only internet-bound traffic is inspected by Prisma Access, while private traffic takes a direct path, meeting the split-tunnel requirement.

Answer

Configure Prisma Access to use a GlobalProtect portal with split-tunnel settings that exclude data center subnets from the VPN tunnel.

Answer

Deploy Prisma Access in a hub-and-spoke topology and configure the branch firewalls to use Prisma Access as the default route for all traffic, including data center traffic.

Answer

Configure a Service Connection in Prisma Access and advertise specific routes to the branch offices to direct traffic to the data center.