SecOps-Architect Practice Test 17 — 15 Questions

Question 1

An architect is designing a Palo Alto Networks High Availability (HA) deployment. Which TWO statements are correct regarding HA state synchronization and failover behavior? (Choose two)

Accepted Answer

Active TCP and UDP sessions are synchronized across the HA2 link so sessions persist seamlessly during a failover.. Option A is correct because the HA2 link is the dedicated dataplane path used to synchronize session state (including active TCP and UDP sessions, plus ARP/ND and other runtime state) so that established flows continue after a failover without re-establishing sessions. Option C is correct because the HA1 link is the control plane path that synchronizes configuration, and configuration changes made on the active peer are pushed to the passive peer so both devices remain in sync. Option B is incorrect because HA2 is a direct, dedicated link between the two firewalls (or a dedicated Layer 2 path) and does not require a public, internet-routable IP address. Option D is incorrect because HA failover is automatic based on configured failure triggers and priorities, not a manual CLI command on every failover. Option E is incorrect because HA synchronization only mirrors state and configuration between peers; it does not replace Panorama's centralized policy and device management capabilities.

Answer

The HA2 link requires a dedicated public IP address routable over the public internet.

Answer

Failover requires manual intervention via CLI command on the passive unit every time.

Answer

HA synchronization replaces the need for Panorama configuration management entirely.

Question 2

When designing a threat hunting architecture, an architect must differentiate between indicator-based searching and hypothesis-driven hunting. Which approach represents a hypothesis-driven threat hunt?

Accepted Answer

Developing a query to detect potential lateral movement using PowerShell remoting based on recent red team exercises. Hypothesis-driven hunting starts with a theory about potential adversary behavior or TTPs and uses analytics to search for undiscovered activity.

Answer

Blocking known malicious domains using PAN-OS DNS Security

Answer

Automating the ingestion of STIX/TAXII feeds into Cortex XSOAR

Answer

Searching for specific file hashes provided in a recent vendor threat intelligence report

Question 3

An architect is tasked with reporting the True Positive Rate (TPR) of automated alert rules in Cortex XSIAM to justify tuning efforts. How should TPR be calculated using SOC operational data?

Accepted Answer

Verified True Positive Alerts divided by Total Triggered Alerts. True Positive Rate is calculated by dividing the number of verified true positive alerts by the total number of triggered alerts (or true positives plus false negatives, depending on the specific formula variant, but strictly using verified alerts vs total alerts generated).

Answer

Total False Positives divided by Total Closed Incidents

Answer

Total Incidents Remediated divided by Total Hours Worked

Answer

Mean Time to Resolve divided by Mean Time to Detect

Question 4

An incident response architect is defining severity levels for security alerts in Cortex XDR. Which severity classification typically triggers automated containment playbooks without human intervention?

Accepted Answer

Critical. In Cortex XDR, severity levels range from Informational and Low through Medium, High, and Critical. Critical severity is reserved for the most severe, high-confidence threats (e.g., confirmed ransomware behavior, active C2, credential dumping) and is the level typically wired to automated containment playbooks that isolate endpoints or block execution without waiting for an analyst. Lower severities are queued for human triage.

Answer

Debugging

Answer

Low

Answer

Informational

Question 5

An enterprise security architect is reviewing threat detection coverage using the MITRE ATT&CK Navigator. Which THREE strategic objectives can be achieved using this exercise? (Choose three)

Accepted Answer

Identifying detection gaps and blind spots across security monitoring tools. Option A is correct because the ATT&CK Navigator heatmap layers visually expose which techniques have no coverage, directly revealing detection gaps and blind spots across monitoring tools. Option B is correct because Navigator layers can be built from SIEM/XSIAM analytics rule mappings, tying each rule to the specific ATT&CK technique it detects so coverage can be assessed per technique. Option C is correct because gap analysis in Navigator identifies high-priority techniques lacking coverage, which drives decisions on which telemetry sources to onboard and where to invest detection engineering effort. Options D and E are incorrect because overclocking workstation CPUs and assigning static IP addresses to firewall interfaces are hardware/network configuration tasks unrelated to threat detection coverage mapping in ATT&CK Navigator.

Answer

Automatically overclocking enterprise workstation CPUs

Answer

Configuring static IP addresses on firewall interfaces

Question 6

An enterprise security architect is configuring Cortex XSIAM data ingestion and analytics. Which THREE data sources are essential for comprehensive endpoint and cloud threat detection? (Choose three)

Accepted Answer

Endpoint EDR telemetry (process execution, file modifications, network connections). Option A is correct because endpoint EDR telemetry supplies the process-execution, file-modification, and network-connection events that Cortex XSIAM's analytics engine needs to detect host-based threats such as malicious process trees, ransomware file encryption, and command-and-control connections. Option C is correct because cloud provider audit logs like AWS CloudTrail and Azure Activity Logs record control-plane API activity (e.g., IAM changes, resource creation, privilege escalation), which is essential for detecting cloud account compromise and misconfiguration abuse. Option E is correct because network traffic flow logs and firewall security logs provide the north-south and east-west visibility needed to identify lateral movement, exfiltration, and policy violations that endpoint and cloud logs alone may miss. Options B and D are incorrect because local calculator cache files and printer driver configuration backups are low-value, host-local artifacts with no security telemetry relevance to endpoint or cloud threat detection.

Answer

Local calculator application cache files

Answer

Local printer driver configuration backups

Question 7

Which TWO practices ensure that security metric reports generated from Cortex XSIAM remain meaningful and actionable over time? (Choose two)

Accepted Answer

Assigning clear accountability and ownership for actioning insights generated by the reports. Option A is correct because meaningful security metrics require clear ownership: without assigned accountability for actioning the insights, reports become informational artifacts rather than drivers of remediation, and no one is responsible for closing the loop on detected issues. Option C is correct because thresholds and metrics must be periodically reviewed and tuned; as the organization grows and the threat landscape evolves, static thresholds produce false positives or miss real risks, eroding the report's actionability. The remaining options are incorrect: Option B destroys the historical trend data needed for baselining and detecting anomalies, Option D restricts access to external auditors who lack operational context and cannot act on findings, and Option E makes reports unreadable and unsearchable, eliminating any practical value.

Answer

Eliminating all historical trend data every 24 hours

Answer

Restricting dashboard access solely to external auditors

Answer

Archiving all metric reports into unreadable binary formats with no search capability

Question 8

Which TWO metrics are commonly used to measure the impact and ROI of a Cortex XSOAR implementation in a SOC? (Choose two)

Accepted Answer

Reduction in Mean Time to Resolve (MTTR) for standard incident types. Option D is correct because reducing Mean Time to Resolve (MTTR) for standard incident types is a primary SOC efficiency metric that directly demonstrates Cortex XSOAR's impact through faster playbook-driven triage, investigation, and remediation. Option E is correct because total analyst hours saved through automated playbook execution quantifies the labor and cost savings XSOAR delivers, which is a standard way to calculate ROI by translating reclaimed analyst time into monetary value. The remaining options do not belong: A measures raw log storage volume, which reflects data retention rather than XSOAR's operational impact; B describes a WildFire detonation backlog, an infrastructure/throughput indicator unrelated to XSOAR ROI; and C counts physical badge swipes, which is a facility-access statistic with no bearing on SOC incident response performance or automation value.

Answer

Total gigabytes of firewall log traffic archived per month

Answer

WildFire file detonation queue length

Answer

Number of physical security badge swipes at the SOC entrance

Question 9

An architect is designing an executive security operations dashboard using Cortex XSIAM to report on security posture trends. Which TWO metrics are essential to include when demonstrating operational scalability and capacity management to senior leadership? (Choose two)

Accepted Answer

Alert Volume vs. Incident Conversion Rate. Option B, Alert Volume vs. Incident Conversion Rate, is essential because it demonstrates how effectively the XSIAM platform scales to ingest and triage high volumes of raw alerts while converting only the meaningful ones into actionable incidents, directly evidencing operational scalability and detection efficiency for leadership. Option E, Analyst Workload Capacity and Utilization Trends, is essential because it quantifies whether the SOC team can absorb growing incident volumes, showing utilization, throughput, and capacity headroom that justify staffing and platform scaling decisions. Option A, Active directory domain controller CPU temperatures, is a low-level infrastructure health metric unrelated to security operations scalability or capacity management. Option C, Local firewall packet drop counts, is a network-device performance detail that does not reflect SOC operational capacity or XSIAM scalability. Option D, Cortex XDR agent installation deployment scripts, is an implementation artifact, not a posture or capacity metric suitable for an executive dashboard.

Answer

Active directory domain controller CPU temperatures

Answer

Local firewall packet drop counts

Answer

Cortex XDR agent installation deployment scripts

Question 10

An architect is tasked with creating a comprehensive reporting framework in Cortex XSOAR to measure incident response maturity. Which TWO advanced metrics should be incorporated to evaluate the depth and effectiveness of post-incident analysis and containment? (Choose two)

Accepted Answer

Containment Effectiveness (percentage of incidents without reinfection or recurrence). Option A, Containment Effectiveness (percentage of incidents without reinfection or recurrence), is correct because it directly measures the quality and durability of containment actions by tracking whether threats are fully eradicated rather than merely suppressed, which is a key indicator of response maturity. Option C, Root Cause Identification Time (Mean Time to Identify origin), is correct because it quantifies the depth of post-incident analysis by measuring how quickly analysts determine the true origin of an incident, a core component of effective lessons-learned and prevention processes. Option B, total disk space consumed by log archives, is a storage-capacity metric that says nothing about analytical depth or containment quality. Option D, number of software licenses assigned to SOC analysts, is a procurement/asset statistic unrelated to incident response effectiveness. Option E, total coffee breaks per shift, is a facetious workplace metric with no bearing on security operations maturity.

Answer

Total disk space consumed by log archives

Answer

Number of software licenses assigned to SOC analysts

Answer

Total number of coffee breaks taken per shift

Question 11

An architect is designing a Prisma Cloud Compute deployment for cloud-native applications. Which TWO security scanning and monitoring capabilities are provided by Prisma Cloud Compute? (Choose two)

Accepted Answer

Vulnerability scanning for container images, serverless functions, and virtual machine hosts.. Option B is correct because Prisma Cloud Compute (formerly Twistlock) includes a vulnerability scanner that inspects container images, serverless functions, and VM hosts against CVE databases, covering the full cloud-native workload lifecycle. Option C is correct because Prisma Cloud Compute's runtime defense uses Defenders to monitor container processes, network connections, and file system activity, applying behavioral models and rules to detect anomalies and threats in real time. The other options are incorrect: A and E describe physical/manual activities outside the scope of a software security platform, and D misuses Defender node storage, which is not a web-hosting service but a lightweight agent for enforcement and telemetry.

Answer

Physically rewiring enterprise data center power distribution units.

Answer

Hosting public website domains on Prisma Cloud Defender node storage.

Answer

Printing physical compliance paper certificates on office laser printers.

Question 12

When designing an incident post-mortem (lessons learned) process following NIST guidelines, which TWO activities should the security architect mandate? (Choose two)

Accepted Answer

Conducting a root cause analysis review meeting with key stakeholders. Option A is correct because NIST SP 800-61 (Computer Security Incident Handling Guide) explicitly calls for holding a lessons-learned meeting with all key stakeholders after an incident to review what happened, identify the root cause, and determine what could have been done differently. Option D is correct because the post-mortem must feed back into the organization's defensive posture; NIST guidance directs teams to update detection signatures, correlation rules, and automated response playbooks (e.g., SOAR workflows) to close the operational gaps that allowed the incident or slowed response. Options B, C, and E are wrong: destroying firewall and SIEM log archives (B) violates evidence retention and audit requirements, reverting systems to factory defaults without review (C) would erase forensic artifacts and disrupt production, and publicly disclosing employee disciplinary actions (E) breaches privacy and HR policy and has no place in a technical lessons-learned process.

Answer

Deleting all firewall and SIEM log archives immediately

Answer

Reverting all system configurations to factory defaults without review

Answer

Publicly disclosing employee disciplinary actions on social media

Question 13

An architect is planning the deployment of Cortex XDR agents across a heterogeneous enterprise environment. Which TWO deployment methods are officially supported? (Choose two)

Accepted Answer

Active Directory Group Policy Object (GPO) deployment. Option B is correct because Cortex XDR supports deploying the agent via Active Directory Group Policy Object (GPO), which lets administrators push the installer to domain-joined Windows endpoints through a computer startup script or software installation policy. Option D is correct because Cortex XDR officially supports distribution through centralized endpoint management platforms such as Microsoft Intune, Microsoft SCCM, and Jamf, which are the standard mechanisms for large-scale, heterogeneous fleets. Option A is not a supported deployment method, as emailing installers as spam attachments is insecure and unreliable and is not an official Cortex XDR deployment channel. Option C is not supported because floppy disks are obsolete media and Cortex XDR does not provide floppy-based installation. Option E is not supported because mailing unencrypted USB drives is insecure and is not an official deployment method for Cortex XDR agents.

Answer

Embedding the agent installer inside public spam email attachments

Answer

Manual floppy disk installation on every workstation

Answer

Mailing unencrypted USB flash drives to employees' home addresses

Question 14

When designing a Security Operations Center (SOC) using the NIST cybersecurity framework, which TWO functions are categorized under the 'Detect' core function? (Choose two)

Accepted Answer

Security Continuous Monitoring (SCM). Security Continuous Monitoring (SCM) (C) is correct because the NIST Cybersecurity Framework's Detect function includes the category 'Security Continuous Monitoring' (DE.CM), which covers monitoring the network, systems, and assets to identify cybersecurity events and verify the effectiveness of protective measures. Detection Processes and Procedures (E) is also correct because the Detect function includes the category 'Detection Processes' (DE.DP), which ensures that detection activities, roles, responsibilities, and reporting are properly defined, tested, and communicated. The other options belong to different functions: Disaster Recovery plan execution (A) and Incident Recovery Planning (B) fall under the Recover function, while Access Control policy enforcement (D) is part of the Protect function (specifically PR.AC), not Detect.

Answer

Disaster Recovery plan execution

Answer

Incident Recovery Planning

Answer

Access Control policy enforcement

Question 15

An architect is troubleshooting a Palo Alto Networks High Availability (HA) cluster where configuration synchronization between active and passive peers is failing. Which TWO locations or settings should the architect check? (Choose two)

Accepted Answer

Verify physical and logical connectivity on the HA1 control link interface.. Option A is correct because configuration synchronization in a Palo Alto Networks HA cluster is carried over the HA1 control link, so any physical or logical failure on the HA1 interface (cabling, port state, IP addressing, or HA1 configuration) will directly break config sync between peers. Option E is correct because PAN-OS requires both HA peers to run the exact same PAN-OS software version for HA to function properly, including configuration synchronization; a version mismatch prevents the peers from forming a healthy HA pair and syncing configuration. Option B is not relevant because DNS server settings on the management interface affect management-plane name resolution, not HA config synchronization. Option C is not relevant because the URL Filtering cloud license status affects content inspection and cloud lookups, not HA configuration sync. Option D is not relevant because the GlobalProtect portal certificate expiration affects VPN portal authentication, not HA configuration synchronization.

Answer

Check the DNS server IP address configured on the management interface.

Answer

Check the URL Filtering cloud license status.

Answer

Check the GlobalProtect gateway portal certificate expiration date.