SecOps-Architect Practice Exam 2 — 20 Questions

Question 1

An architect is configuring High Availability (HA) Active/Passive on two PA-5220 firewalls. During a failover event, active TCP sessions are maintained without requiring re-authentication. Which feature makes this possible?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HA2 session synchronization. HA2 session synchronization copies active session table entries from the active peer to the passive peer in real time.

Answer

GlobalProtect cookie persistence

Answer

Dynamic DNS updates

Answer

Panorama configuration push

Question 2

An architect is designing an integration between Prisma Access and a third-party SIEM to ingest all security telemetry, traffic logs, and threat logs. Which TWO methods are officially supported for exporting logs from Prisma Access to external SIEMs? (Choose two)

Accepted Answer

Configure Log Forwarding Profiles within Prisma Access (Panorama managed) to export syslog directly to external SIEM collectors.. Prisma Access supports exporting logs via Syslog from Remote Networks/Mobile Users to an external SIEM, and via Cortex Data Lake (CDLake) log forwarding APIs or forwarders.

Answer

Use SNMP traps polled every 5 seconds by the SIEM against the Prisma Access public IP.

Answer

Configure an SSH tunnel directly into the Prisma Access cloud backend hypervisor to pull raw log files.

Answer

Install a physical syslog agent on the Prisma Access cloud infrastructure gateway nodes.

Question 3

An architect is configuring Panorama to manage software and content updates. Which TWO update types can be scheduled and distributed via Panorama to managed firewalls? (Choose two)

Accepted Answer

Applications and Threats content updates.. Panorama manages dynamic content updates such as Antivirus, WildFire signatures, Applications and Threats, and PAN-OS software images.

Answer

Local client browser operating system updates.

Answer

AWS EC2 instance hypervisor patches.

Answer

Active Directory domain controller schema updates.

Question 4

When reporting on SOC operational efficiency using Cortex XSOAR and XSIAM, which TWO metrics measure analyst productivity and throughput? (Choose two)

Accepted Answer

Number of incidents successfully resolved and closed per analyst. Analyst productivity and throughput are measured by tracking metrics like incidents resolved per analyst and average playbook/task execution speed.

Answer

Firewall hardware power supply redundancy status

Answer

Global WildFire malware detection signature version

Answer

Cortex XDR agent disk space exclusion list

Question 5

An organization utilizing Prisma Cloud calculates Mean Time to Remediate (MTTR) for cloud misconfigurations. The SecOps team notices that the baseline MTTR is heavily skewed by a small number of lingering legacy assets. Which statistical approach should the architect recommend to executive management to provide a more accurate representation of typical remediation performance?

Accepted Answer

Transition reporting from the mean to the median remediation time. Using the median instead of the mean prevents skewed metrics caused by extreme outliers like lingering legacy assets.

Answer

Apply a logarithmic transformation to the incident timestamps before calculating the mean

Answer

Report the arithmetic mean alongside standard deviation

Answer

Exclude all assets older than 90 days from the telemetry database

Question 6

An architect is establishing security operations baseline metrics in Cortex XSIAM. The team wants to measure the percentage of alerts that are determined to be actionable threats versus benign noise. Which metric should be configured?

Accepted Answer

Signal-to-Noise Ratio (or True Positive Rate). True Positive Rate (TPR) or Precision measures the proportion of generated alerts that represent actual security threats.

Answer

Alert Volume Growth Rate

Answer

Analyst Utilization Rate

Answer

Incident Escalation Rate

Question 7

An architect is deploying Prisma Access to secure remote workers. The organization uses explicit proxying for web traffic and requires user-ID mapping for explicit proxy connections. Which Prisma Access component and configuration must be deployed to correctly map users authenticated via an explicit proxy to their respective User-ID groups?

Accepted Answer

Deploy the Explicit Proxy feature in Prisma Access, configure proxy authentication, and integrate with Cloud Identity Engine (CIE) to extract user identity from proxy headers.. Explicit proxy configurations in Prisma Access require configuring Proxy Settings in Panorama and leveraging the Integration with GlobalProtect or the Explicit Proxy feature along with User-ID agents or Cloud Identity Engine (CIE) to map the source IP or proxy headers.

Answer

Rely solely on GlobalProtect portal cookies for explicit proxy traffic identification.

Answer

Configure standard IP-to-User mapping via User-ID agents on the remote user laptops without a proxy.

Answer

Configure SNMP traps on the proxy server to send ARP tables to Panorama.

Question 8

When presenting security posture metrics to executive management, an architect must ensure the reporting framework aligns with business risk rather than purely technical telemetry. Which metric best communicates operational effectiveness to business stakeholders?

Accepted Answer

Risk Reduction Over Time based on closed vulnerabilities and mitigated incidents. Risk Reduction Over Time translates technical telemetry into business context by showing how security investments mitigate exposure.

Answer

Total raw log ingestion volume in gigabytes per day

Answer

Number of firewall rule change requests processed

Answer

Cortex XDR agent version distribution percentages

Question 9

An architect is tasked with creating a comprehensive reporting framework in Cortex XSOAR to measure incident response maturity. Which TWO advanced metrics should be incorporated to evaluate the depth and effectiveness of post-incident analysis and containment? (Choose two)

Accepted Answer

Containment Effectiveness (percentage of incidents without reinfection or recurrence). Containment Effectiveness and Root Cause Identification Time evaluate the qualitative depth and thoroughness of incident response handling beyond basic speed metrics.

Answer

Total disk space consumed by log archives

Answer

Number of software licenses assigned to SOC analysts

Answer

Total number of coffee breaks taken per shift

Question 10

An architect is designing an automated incident response workflow in Cortex XSOAR. When a critical phishing incident is reported, the playbook must automatically extract URLs, submit them to WildFire for analysis, and isolate the endpoint if malicious. Which integration instance is responsible for submitting the URL to WildFire within the XSOAR playbook?

Accepted Answer

WildFire v2 integration integration instance. Cortex XSOAR integrates with WildFire using the WildFire integration pack, which provides commands like wildfire-submit-file or url analysis.

Answer

Active Directory LDAP integration

Answer

Prisma Cloud compliance integration

Answer

Panorama threat-feed integration

Question 11

An architect is configuring a Palo Alto Networks firewall to decrypt inbound SSL/TLS traffic destined for an internal web server. Which certificate configuration is required on the firewall to perform Inbound Inspection?

Accepted Answer

The private key and certificate of the internal web server must be installed on the firewall.. Inbound Inspection requires importing the server's private key and public certificate onto the firewall so it can decrypt traffic destined for that server.

Answer

An expired public certificate from a third-party root CA.

Answer

No certificates are required if SSH is used instead of SSL.

Answer

A self-signed Certificate Authority (CA) certificate generated solely on the firewall without any server keys.

Question 12

An architect is designing a secure architecture using VM-Series on Microsoft Azure. Which TWO Azure-native services or integration components must be configured to achieve high availability with dynamic failover of user traffic across two VM-Series instances? (Choose two)

Accepted Answer

Azure Load Balancer (Standard SKU) to distribute inbound and outbound traffic to the VM-Series data interfaces.. Azure VM-Series HA typically relies on Azure Load Balancers (ALB) or Azure Route Tables (UDPs/User Defined Routes) with API scripts or SDN connectors running on the firewall to update routing tables upon failover.

Answer

Physical HA2 fiber optic cables connected between Azure availability zones.

Answer

Azure ExpressRoute direct copper cross-connect cables plugged into the firewall physical NICs.

Answer

Azure Active Directory Domain Services domain controller deployed inside the firewall data plane.

Question 13

An architect is troubleshooting a User-ID deployment where users authenticating via captive portal are not getting correctly mapped. Which TWO conditions must be verified to ensure captive portal functions properly? (Choose two)

Accepted Answer

Verify that an Authentication Profile and Authentication Policy are correctly configured to prompt users.. Captive portal requires an appropriate Authentication Profile/Sequence, an explicit security policy allowing HTTP/HTTPS traffic to the captive portal IP/port, and correctly configured redirection settings.

Answer

Ensure that the firewall's management plane CPU is disabled to allow unhindered redirects.

Answer

Ensure that User-ID agents are disabled when captive portal is active.

Answer

Verify that all users have installed the Prisma Cloud Defender agent.

Question 14

An architect is configuring High Availability (HA) Active/Passive on two PA-5220 firewalls. During a failover event, active TCP sessions are maintained without requiring re-authentication. Which feature makes this possible?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The passive firewall takes over active traffic and maintains sessions via HA2 synchronization.. In Active/Passive HA, when the active unit fails, the passive unit takes over and active sessions are maintained if HA2 session synchronization is enabled.

Answer

The firewall reboots into maintenance mode and requires manual CLI intervention.

Answer

Traffic is permanently blackholed until an administrator logs into Panorama.

Answer

All active user sessions are immediately dropped and must re-authenticate.

Question 15

An architect is configuring Panorama to push configuration updates to managed firewalls using Panorama Templates and Template Stacks. A specific setting needs to be overridden at an individual firewall level without altering the template stack hierarchy. Which Panorama feature enables this capability?

Accepted Answer

Template Variables assigned specific values per managed firewall.. Panorama Template Variables allow administrators to define variable values per firewall while keeping the underlying template structure uniform.

Answer

Panorama WildCard objects

Answer

Device-level CLI overrides via administrative lockdown mode.

Answer

Global Object Override rules

Question 16

An architect is designing a Panorama template stack hierarchy. Which TWO rules govern how templates and template stacks inherit and override settings? (Choose two)

Accepted Answer

Firewalls can only belong to a single template stack at any given time.. Template stacks combine multiple templates in a specific order. Settings defined higher in the stack or in specific child templates override parent templates, and network/device settings follow strict inheritance rules.

Answer

Global templates are immutable and cannot be overridden under any circumstances.

Answer

Template stacks are only used for security rule creation, never for network interfaces.

Question 17

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for known malware and spyware. Which security profile should the architect attach to the Security Policy rule?

Accepted Answer

Antivirus and Anti-Spyware security profiles. Antivirus and Anti-Spyware security profiles inspect traffic for known malware and command-and-control (C2) signatures.

Answer

File Blocking profile

Answer

Data Filtering profile

Answer

URL Filtering profile

Question 18

An architect is configuring a Palo Alto Networks firewall to prevent unauthorized exfiltration of sensitive data such as credit card numbers and social security numbers. Which security profile should the architect use?

Accepted Answer

Data Filtering profile. Data Filtering profiles inspect traffic for patterns matching credit card numbers or social security numbers, as well as predefined or custom regular expressions.

Answer

WildFire Analysis profile

Answer

URL Filtering profile

Answer

Zone Protection profile

Question 19

An architect is integrating Palo Alto Networks NGFW with AWS VPC environments using the VM-Series auto-scaling template. When a new VM-Series instance spins up dynamically via AWS Auto Scaling, how does the new firewall register and receive its initial configuration without manual administrative intervention?

Accepted Answer

Through bootstrapping using an S3 bucket containing an init-cfg.txt file, bootstrap folders, and a valid Panorama registration auth-key.. VM-Series bootstrap allows the firewall to load an init-cfg.txt file, bootstrap package, and contact Panorama upon first boot using API keys and Panorama IP settings.

Answer

By listening for multicast broadcast packets sent by AWS Route 53.

Answer

By executing an interactive SSH wizard triggered via AWS CloudWatch alarms.

Answer

By downloading policies from the AWS Systems Manager Parameter Store via raw SNMP.

Question 20

An architect is configuring User-ID to map users via Palo Alto Networks Terminal Services (TS) Agent. Where must the TS Agent be installed in the network architecture?

Accepted Answer

Directly on the Microsoft Terminal Server or Citrix XenApp server.. The TS Agent must be installed directly on the Microsoft Terminal Server or Citrix XenApp server to track which user is mapped to which TCP port range.

Answer

Inside the Cortex XDR Broker VM appliance.

Answer

On the external DNS root server.

Answer

On the Panorama management virtual appliance.