SecOps-Architect Practice Test 16 — 15 Questions

Question 1

An architect is designing an enterprise deployment of Palo Alto Networks firewalls managed by Panorama. A requirement is that certain firewall configuration changes (such as local interface IP addresses) must remain unique per firewall while security rules remain centrally managed. Which Panorama feature should the architect use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Template Variables defined in Panorama templates with unique values assigned per firewall.. Panorama Template Variables allow you to define variables in a template that can be assigned unique values per managed firewall. This is ideal for settings like interface IP addresses that must differ per firewall, while still allowing central management of the template and other configurations like security rules.

Answer

GlobalProtect HIP object criteria.

Answer

Panorama Pre-Rules with static 'any-any' destinations.

Answer

Global Administrative lockdown mode.

Question 2

An architect is evaluating the effectiveness of alert tuning in Cortex XSIAM. Over three months, the total alert volume decreased by 40%, but the number of confirmed breaches detected remained constant. Which metric combination best validates that this tuning was successful and did not introduce blind spots?

Accepted Answer

Decreased False Positive Rate combined with stable True Positive detection counts and low MTTD. Successful tuning reduces false positives without missing true positives. Validating this requires monitoring the False Positive Rate (dropping) alongside Incident Detection Rate or confirmed breach volume (remaining stable or increasing) and low Mean Time to Detect.

Answer

Increased overall log ingestion volume and higher CPU utilization on endpoints

Answer

Higher analyst turnover rate and increased playbook execution duration

Answer

Greater frequency of firewall rule updates and increased bandwidth consumption

Question 3

An architect is configuring automated containment in Cortex XSOAR where analyst approval is required before isolating an executive's laptop. Which task type in the playbook accomplishes this?

Accepted Answer

Approval Task (Prompt / Questionnaire task). A Data Collection or Manual/Approval task pauses the playbook and sends a notification for user input.

Answer

Syslog Export Task

Answer

Indicator Enrichment Task

Answer

Auto-Remediation Task

Question 4

An architect is establishing security metrics for a multi-tenant Cortex XSIAM environment. Different business units require distinct SLA targets and independent metric baselines. How should the architect configure this separation?

Accepted Answer

Leverage multi-tenancy partitioning, tenant-specific incident types, and scoped dashboard roles to enforce custom SLAs and baselines.. In multi-tenant or segmented Cortex XSIAM architectures, tenant isolation, distinct RBAC, and separate dashboard/incident configuration rules allow customized SLAs and baselines per business unit.

Answer

Disable data segregation so all business units share a single unified metric baseline.

Answer

Export all raw logs to local CSV files and calculate metrics manually in spreadsheets.

Answer

Configure global default SLAs that apply identical thresholds to all business units without modification.

Question 5

You are configuring scheduled metric reports to be emailed weekly to department heads using Cortex XSIAM. Which mechanism should you use to automate the generation and delivery of these reports?

Accepted Answer

Scheduled Reporting and Report Execution settings. Cortex XSIAM and Cortex XSOAR both support scheduled reporting capabilities that compile dashboards and export them via email to specified stakeholders on a recurring basis.

Answer

Panorama Device Group sync commands

Answer

Cortex XDR Agent Auto-Update policies

Answer

WildFire API submission scripts

Question 6

You are preparing a security posture report for the board of directors using Cortex XSIAM. The board wants to understand risk exposure reduction over time. Which metric provides the most executive-level strategic value regarding risk posture?

Accepted Answer

Mean Time to Remediate (MTTR) critical vulnerabilities and associated threat exposure trends. Executive reporting requires metrics that translate technical data into risk reduction. Exposure time, vulnerability dwell time, and quantified risk score trends provide actionable strategic insights.

Answer

Total number of firewall rule modifications performed per week

Answer

Number of Cortex XDR agent heartbeat failures

Answer

Total gigabytes of log data ingested into Cortex Data Lake daily

Question 7

An architect is configuring Cortex XDR external integrations. Which TWO native log ingestion or threat intelligence integration options are supported by Cortex XDR? (Choose two)

Accepted Answer

Integrating external Threat Intelligence feeds using STIX/TAXII server connections.. Option B is correct because Cortex XDR natively supports external threat intelligence integration through STIX/TAXII server connections, allowing it to consume structured indicators of compromise from third-party TI providers. Option E is correct because Cortex XDR uses the Broker VM with its Syslog Collector to ingest third-party network and security logs (for example, from firewalls, proxies, and other appliances) into the platform for correlation and analytics. Option A is incorrect because Cortex XDR does not poll Active Directory via SNMPv1 for group policies; AD data is collected through the Cortex XDR agent and management integrations, not SNMP polling. Option C is incorrect because NetBIOS broadcast password scraping is not a supported integration and describes malicious activity, not a legitimate ingestion method. Option D is incorrect because Cortex XDR does not flash raw firmware onto third-party routers via agent plugins; that is not a supported log ingestion or threat intelligence integration.

Answer

Polling Windows Active Directory via SNMPv1 for group policies.

Answer

Using NetBIOS broadcast packets to scrape passwords from domain controllers.

Answer

Directly flashing raw firmware onto third-party routers via XDR agent plugins.

Question 8

When configuring Cortex XSOAR incident classification and mapping, which TWO elements must be defined for an incoming alert type? (Choose two)

Accepted Answer

Field mapping schema between incoming alerts and XSOAR incident fields. In Cortex XSOAR, incident classification and mapping requires defining how incoming alert data is translated into XSOAR incident fields, which is exactly what option A (field mapping schema between incoming alerts and XSOAR incident fields) provides — without a mapping schema, the raw alert fields cannot populate the incident fields correctly. Option C (associated default playbook) is also required because classification and mapping ties an alert type to a default playbook that automatically runs when that incident type is created, enabling automated response. Options B, D, and E are unrelated to XSOAR classification and mapping: CPU core allocation, BIOS vendor name, and printer queue ID are infrastructure/hardware details that play no role in defining how alerts are classified, mapped, or automated in Cortex XSOAR.

Answer

Physical server CPU core allocation

Answer

Endpoint BIOS vendor name

Answer

Local printer queue ID

Question 9

What is the primary objective of establishing a baseline for Mean Time to Resolution (MTTR) in security operations?

Accepted Answer

To measure improvements in incident response speed and evaluate the impact of optimizations over time. Establishing an MTTR baseline provides a measurable reference point to track improvements in incident response speed over time. It allows security operations teams to quantify the impact of process changes, automation, and tooling investments. Without a baseline, you cannot objectively demonstrate whether response times are improving or degrading.

Answer

To provision cloud storage capacity in Cortex Data Lake

Answer

To determine firewall rule redundancy across Panorama devices

Answer

To automatically lock out user accounts that take too long to respond

Question 10

An architect is configuring a Panorama Device Group and needs to create security rules that apply to all firewalls in the enterprise, regardless of their specific regional location. Where should the architect place these rules within the Panorama rule hierarchy?

Accepted Answer

Panorama Pre-Rules configured at the topmost level before device group specific rules.. Panorama Pre-Rules are evaluated before Device Group rules and are inherited by all managed firewalls, making them the correct location for enterprise-wide policy that must apply regardless of region. Placing shared rules at the topmost Pre-Rules level ensures consistent enforcement across every device group without duplicating the rule in each group.

Answer

Template stack interface configurations.

Answer

Local firewall CLI configuration files only.

Answer

Post-rules at the bottom of a single remote branch device group.

Question 11

An architect is designing a high-scale Cortex XDR deployment across 50,000 endpoints. To optimize bandwidth and reduce direct WAN traffic to the cloud backend for agent updates and log collection, which architectural component should be deployed in regional data centers?

Accepted Answer

Cortex XDR Broker VM deployed in regional data centers to act as a local proxy, content cache, and log collector.. The Cortex XDR Broker VM is purpose-built to sit in regional data centers and act as a local proxy, content cache, and log collector for XDR agents. It reduces WAN traffic by caching agent updates and content locally and by aggregating endpoint logs before forwarding them to the Cortex XDR cloud backend. This is the documented architectural component for scaling Cortex XDR across large, distributed endpoint populations.

Answer

A standalone Panorama virtual machine acting as an endpoint proxy.

Answer

Prisma Access Remote Network nodes running the XDR agent directly on gateway hypervisors.

Answer

A dedicated PA-7080 firewall performing deep packet inspection on all XDR endpoint RAM.

Question 12

An architect is troubleshooting a User-ID deployment where users authenticating via captive portal are not getting correctly mapped. Which TWO conditions must be verified to ensure captive portal functions properly? (Choose two)

Accepted Answer

Verify that an Authentication Profile and Authentication Policy are correctly configured to prompt users.. Option A is correct because captive portal authentication depends on a properly configured Authentication Profile (which defines the portal, authentication method, and redirect behavior) bound to an Authentication Policy that actually prompts users to authenticate; without these, users are never challenged and thus never mapped. Option B is correct because clients must be able to reach the captive portal's IP address and authentication port, which requires a security policy rule permitting that traffic; if the rule blocks it, the redirect or login page fails and User-ID mapping cannot complete. Option C is wrong because the management plane CPU is not a feature that can be 'disabled' to improve redirects, and captive portal processing is not gated on such a setting. Option D is wrong because User-ID agents and captive portal are complementary, not mutually exclusive; disabling agents would not fix captive portal mapping and could remove other mapping sources. Option E is wrong because Prisma Cloud Defender is an agent for cloud workload protection, not a requirement for on-firewall captive portal authentication.

Answer

Ensure that the firewall's management plane CPU is disabled to allow unhindered redirects.

Answer

Ensure that User-ID agents are disabled when captive portal is active.

Answer

Verify that all users have installed the Prisma Cloud Defender agent.

Question 13

An architect is troubleshooting a Panorama deployment where managed firewalls show a 'Disconnected' status in the Panorama GUI. Which TWO connectivity requirements should the architect verify? (Choose two)

Accepted Answer

Verify that TCP port 3978 (Panorama SSL/TLS communication) is open and not blocked by intermediate firewalls or security groups.. Option C is correct because Panorama management-plane communication with managed firewalls uses TCP port 3978 for SSL/TLS, so any intermediate firewall, security group, or ACL blocking that port will cause the firewall to show as Disconnected. Option E is correct because the managed firewall must have IP reachability from its management IP to the Panorama management IP; without this underlying network path, the management connection cannot be established regardless of port settings. Option A is incorrect because carpet color is irrelevant to network connectivity. Option B is incorrect because the console port is a local serial/RJ-45 management interface, not an HDMI connection, and it is not used for Panorama management connectivity. Option D is incorrect because JavaScript in a user's desktop browser affects GUI rendering only, not the firewall-to-Panorama management tunnel.

Answer

Check the physical color of the office carpet near the server rack.

Answer

Verify the HDMI cable connection on the firewall console port.

Answer

Check if the user desktop browser has JavaScript enabled.

Question 14

An architect is configuring a Palo Alto Networks firewall and needs to ensure that DNS requests originating from internal clients to known malicious domains are automatically intercepted or blocked. Which security feature provides this capability?

Accepted Answer

DNS Security service with sinkhole configuration.. Palo Alto's DNS Security service inspects DNS queries and responses against threat intelligence and can sinkhole malicious domains, redirecting clients to a firewall-hosted sinkhole IP that blocks or logs the connection. Configuring a DNS sinkhole action in the DNS Security profile automatically intercepts requests to known malicious domains. This is the purpose-built feature for this requirement.

Answer

Static host file entries on the firewall management interface.

Answer

SNMP trap alert generator.

Answer

DHCP lease reservation tables.

Question 15

An architect is configuring Palo Alto Networks firewall security policies using WildCard masks and Address Objects. Which TWO best practices should be followed when designing address objects and security rules? (Choose two)

Accepted Answer

Use descriptive naming conventions for Address Objects and Address Groups to clearly indicate their purpose and zone.. Option A is correct because descriptive naming conventions for Address Objects and Address Groups make policies self-documenting, so administrators can immediately identify an object's purpose and associated zone, which reduces misconfiguration risk during audits and rule changes. Option B is correct because grouping related IP addresses and subnets into Address Groups lets a single security rule reference the group, so adding or removing members only requires editing the group rather than every rule, greatly simplifying rule management and reducing policy bloat. Option C is not appropriate because predefined PAN-OS application objects are required for App-ID based policy enforcement and should not be deleted. Option D is wrong because a single any/any/any rule defeats the purpose of least-privilege segmentation and App-ID control. Option E is wrong because hardcoding IPs into rules eliminates the reusability and maintainability benefits of Address Objects.

Answer

Delete all predefined PAN-OS application objects from the firewall.

Answer

Use a single security rule with source 'any', destination 'any', and application 'any' for all enterprise traffic.

Answer

Hardcode individual IP addresses directly into every security rule without using address objects.