SecOps-Architect Practice Test 2 — 10 Questions

Question 1

An architect is configuring a Palo Alto Networks firewall to prevent unauthorized exfiltration of sensitive data such as credit card numbers and social security numbers. Which security profile should the architect use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Filtering profile. The Data Filtering profile is designed to detect and prevent unauthorized exfiltration of sensitive data such as credit card numbers, social security numbers, and other PII. It uses predefined or custom data patterns to inspect traffic and can block or alert on violations. Attaching this profile to a Security Policy rule enforces data loss prevention.

Answer

WildFire Analysis profile

Answer

URL Filtering profile

Answer

Zone Protection profile

Question 2

An architect is designing a multi-virtual router architecture on a Palo Alto Networks firewall. What is the primary purpose of configuring multiple virtual routers on a single firewall?

Accepted Answer

To maintain separate routing tables and participate in multiple routing protocols across different zones or interfaces.. Multiple virtual routers (VRs) on a Palo Alto Networks firewall allow the device to maintain independent routing tables and run separate routing protocol instances (OSPF, BGP, RIP) per VR. This enables traffic segregation between zones, tenants, or interfaces without requiring separate physical firewalls. Each VR operates as an isolated Layer 3 routing domain, so routes learned in one VR are never leaked into another unless explicitly configured via inter-VR static routes or redistribution.

Answer

To increase the hardware clock speed of the management plane CPU.

Answer

To replace the need for security policy rules.

Answer

To automatically generate Panorama device groups.

Question 3

A security architect is designing a threat response architecture that must coordinate actions across Cortex XSIAM, Cortex XSOAR, and third-party firewalls. During a recent exercise, response actions executed in the wrong order, causing an endpoint to be isolated before its indicators were enriched, which delayed the firewall block. The architect must ensure deterministic ordering of enrichment and containment steps. Which design approach best addresses this?

Accepted Answer

Model the response as a Cortex XSOAR playbook with explicit task dependencies and conditional branches that enforce enrichment before containment.. Deterministic ordering requires an orchestration layer that models task dependencies, and Cortex XSOAR playbooks provide exactly that through sequential tasks and conditional branches. Enrichment can be made a prerequisite for containment, ensuring indicators are available before isolation or firewall blocks execute. Polling changes, parallel execution, and independent listeners either ignore ordering or make it worse.

Answer

Use separate webhook listeners for each system so that each integration receives its commands independently of the others.

Answer

Increase the polling interval on the firewall integration so that block requests are queued and processed in the order they arrive.

Answer

Configure all response actions to run in parallel to reduce mean time to respond and rely on analysts to correct any ordering issues.

Question 4

An architect is designing an automated threat intelligence enrichment pipeline in Cortex XSOAR. Which THREE actions are typically performed during indicator lifecycle management? (Choose three)

Accepted Answer

Correlating and calculating composite reputation scores across multiple sources. Indicator lifecycle management in Cortex XSOAR centers on ingesting, scoring, and retiring indicators as their relevance changes. Option B is correct because the platform correlates indicators from multiple feeds and computes composite reputation scores (e.g., via the reputation commands and DBotScore) so analysts see an aggregated verdict rather than isolated source data. Option C is correct because structured ingestion from STIX/TAXII feeds is a standard, automated way to bring external threat intel into the indicator store for enrichment and matching. Option D is correct because indicators must be aged out or expired based on a TTL so stale IOCs do not generate false positives or clutter the database, which is a core lifecycle stage. Options A and E are incorrect because replacing server motherboards and recompiling the Linux kernel are hardware/OS maintenance tasks unrelated to threat intelligence indicator lifecycle management.

Answer

Physically replacing the server motherboard every 90 days

Answer

Manually recompiling the Linux kernel for every IOC added

Question 5

A Cortex XSIAM customer wants to report the proportion of high-severity incidents that were fully resolved within the agreed service level. The architect must define the metric so that it cannot be inflated by simply closing incidents without completing remediation. Which definition best prevents that distortion?

Accepted Answer

Percentage of high-severity incidents where all required remediation tasks were completed and verified within the SLA window. To prevent inflation, the SLA metric must require evidence of completed and verified remediation, not merely a closed status. Counting all closures regardless of reason allows premature or benign closure to pad the number. Workload and opening counts describe different aspects of operations and cannot confirm resolution quality. The definition tied to verified remediation tasks within the SLA window is the only one that reliably reflects true service attainment.

Answer

Total count of high-severity incidents opened during the SLA window

Answer

Percentage of high-severity incidents closed within the SLA window, regardless of closure reason

Answer

Average number of high-severity incidents assigned to each analyst within the SLA window

Question 6

An organization is integrating Prisma Cloud with Cortex XSOAR to automate cloud incident response. When configuring the Prisma Cloud integration instance in XSOAR, which authentication mechanism is recommended to securely fetch alerts without using static user credentials?

Accepted Answer

OAuth 2.0 Client Credentials grant via a dedicated Service Account. The Prisma Cloud integration in Cortex XSOAR supports OAuth 2.0 Client Credentials grant using a dedicated Service Account, which issues short-lived access tokens without embedding static user credentials. This is the recommended secure authentication method for fetching alerts programmatically. It aligns with least-privilege and credential-rotation best practices.

Answer

LDAP bind credentials through a Cortex XDR Broker VM

Answer

HTTP Basic Authentication with administrative credentials

Answer

SAML 2.0 Federation token exchange

Question 7

When reporting security posture metrics to non-technical stakeholders, why is it recommended to use risk-based metrics alongside operational performance metrics?

Accepted Answer

Risk metrics translate technical SOC activity into business impact and potential financial exposure that executives understand.. Risk-based metrics translate technical concepts (like alerts and playbooks) into business impact (like financial exposure and compliance posture), which resonates better with executive leadership.

Answer

Risk metrics are required by Cortex XSOAR to execute automated remediation playbooks.

Answer

Risk metrics replace the need for any technical logging or endpoint monitoring in Cortex XDR.

Answer

Risk metrics automatically patch vulnerabilities on endpoints without requiring administrative approval.

Question 8

When presenting security posture metrics to executive management, an architect must ensure the reporting framework aligns with business risk rather than purely technical telemetry. Which metric best communicates operational effectiveness to business stakeholders?

Accepted Answer

Risk Reduction Over Time based on closed vulnerabilities and mitigated incidents. Risk reduction over time, measured by closed vulnerabilities and mitigated incidents, translates technical security activity into business-relevant outcomes by showing how the organization's exposure is decreasing. Executives care about whether security investments are lowering risk, not about raw telemetry volumes. This metric directly connects operational effectiveness to business risk posture.

Answer

Total raw log ingestion volume in gigabytes per day

Answer

Number of firewall rule change requests processed

Answer

Cortex XDR agent version distribution percentages

Question 9

An organization is adopting the Cyber Kill Chain framework to evaluate their intrusion detection capabilities across the network and endpoint layers. During which phase should security architects implement egress filtering and DNS sinkholing to disrupt adversary operations?

Accepted Answer

Command and Control (C2). Egress filtering and DNS sinkholing are defensive measures that disrupt the Command and Control (C2) phase of the Cyber Kill Chain, where compromised hosts attempt to communicate with adversary-controlled infrastructure. By blocking outbound traffic to known malicious IPs/domains and sinkholing DNS requests, defenders prevent the adversary from issuing commands or exfiltrating data. This directly targets the C2 channel rather than earlier phases like Reconnaissance or Exploitation.

Answer

Reconnaissance

Answer

Exploitation

Answer

Installation

Question 10

Your organization is undergoing an external ISO 27001 audit. The auditors request empirical proof of continuous monitoring effectiveness and incident response responsiveness over the past 12 months. Which Cortex XSIAM / XSOAR artifacts should you present to satisfy this requirement?

Accepted Answer

Aggregated historical SLA compliance reports, MTTD/MTTR trend dashboards, and immutable incident audit logs.. Auditors require historical audit trails, SLA compliance reports, trend graphs of MTTD/MTTR, and immutable incident response logs proving continuous operations and adherence to internal policies.

Answer

A signed letter from the SOC manager stating that the team works very hard.

Answer

Raw backup files of the firewall configuration database without incident metrics.

Answer

A list of employee login passwords stored in plaintext.