SecOps-Architect Practice Exam 2 — 20 Questions

Question 1

An architect is designing an enterprise incident response communication plan. Which THREE components are critical for effective operational coordination during a major security incident? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pre-defined stakeholder and legal notification escalation trees. Option A is correct because pre-defined stakeholder and legal notification escalation trees establish who must be informed, in what order, and within what regulatory timeframes (e.g., GDPR 72-hour breach notification), which is essential for coordinated operational response. Option B is correct because a centralized incident war room with a ticketing audit trail provides a single source of truth, preserves chain-of-custody evidence, and enables real-time task tracking and after-action review. Option C is correct because secure out-of-band communication channels (e.g., encrypted messaging or dedicated conference bridges separate from compromised corporate email) ensure responders can coordinate even if primary infrastructure is breached or unavailable. Option D is not appropriate because publishing unredacted forensic disk images exposes sensitive data, violates privacy and legal obligations, and compromises the investigation. Option E is not appropriate because disabling documentation destroys the audit trail needed for coordination, compliance, and post-incident analysis.

Answer

Publicly posting all unredacted forensic disk images on social media

Answer

Disabling all documentation to maintain total secrecy

Question 2

An architect is configuring Panorama to collect logs from 200 managed firewalls. The log volume exceeds the storage capacity of a single Panorama virtual appliance. Which architectural design should the architect implement to scale log collection?

Accepted Answer

Deploy dedicated Panorama Collector appliances and configure Collector Groups to distribute log ingestion.. Collector Groups in Panorama allow scaling log collection by grouping dedicated Panorama Collector appliances or virtual appliances to ingest logs from assigned firewalls.

Answer

Route all logs through the firewall management interface via FTP.

Answer

Delete traffic logs on all firewalls every 5 minutes.

Answer

Configure GlobalProtect portals to store log databases locally on user laptops.

Question 3

Your organization uses Cortex XSOAR to manage incident response. Management wants to ensure that high-priority incidents do not breach internal SLAs. Where should an architect configure notifications or escalations when an incident approaches its SLA threshold?

Accepted Answer

Within Incident Type SLA settings and associated automation triggers. Cortex XSOAR SLA tracking is configured within Incident Type settings, where you define SLA thresholds and associate automation triggers or playbooks that fire when an incident approaches or breaches the SLA. This is the correct location because SLA timers and escalation logic are tied to incident types and their associated automations.

Answer

Through WildFire cloud-based detonation configuration menus

Answer

Inside the Cortex XDR agent installation package parameters

Answer

Via Panorama firewall administrative access control lists

Question 4

An enterprise security architect is integrating Cortex XSIAM with an external SIEM using the Syslog Export feature. The security team notices that certain sensitive fields need to be redacted before export. Where should the architect configure this transformation?

Accepted Answer

Data Forwarding Rules / Log Forwarding Profiles. Log Forwarding profiles in Cortex XSIAM allow filtering, masking, and transforming logs before they are exported via Syslog or HTTP.

Answer

Magnifier machine learning configuration

Answer

Cortex XDR Agent installation parameters

Answer

XSOAR automation playbook script tasks

Question 5

An architect is configuring Palo Alto Networks firewall logging. By default, when are traffic logs generated for allowed sessions?

Accepted Answer

When the session terminates (closes).. Palo Alto Networks firewalls generate the traffic log entry for an allowed session at session close by default, capturing the full session summary including bytes sent/received, duration, and final application state. This 'session end' behavior is controlled by the Log at Session End setting, which is enabled by default for allow rules. Administrators can additionally enable Log at Session Start to capture the initial connection details.

Answer

Every 1 millisecond regardless of session state.

Answer

Only when an administrator manually clicks 'Export Logs'.

Answer

Only when the session first initiates.

Question 6

An architect is designing an enterprise incident response communication plan. Which THREE components are critical for effective operational coordination during a major security incident? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Panorama Authentication Profile assigned to the GlobalProtect Portal and Gateway configurations.. In Prisma Access / GlobalProtect architectures, the SAML Authentication profile is configured in Panorama under Authentication profiles and assigned to the GlobalProtect Gateway and Portal configurations.

Answer

Panorama Template stack interface MTU settings.

Answer

External Dynamic List URL objects.

Answer

Firewall Zone Protection profile settings.

Question 7

An architect is setting up a dashboard in Cortex XSIAM to monitor the overall health of the security operations program. The CISO wants a single metric that reflects the proportion of security incidents that were resolved within the agreed service level agreement (SLA). Which metric should be displayed?

Accepted Answer

SLA Compliance Rate. SLA Compliance Rate is the only metric that directly reports the percentage of incidents resolved within the agreed SLA. It provides a clear, quantitative measure of adherence to service levels, which is exactly what the CISO needs to assess operational health against commitments. Other metrics like MTTR or backlog do not express compliance as a proportion.

Answer

Analyst Utilization

Answer

Mean Time to Resolve (MTTR)

Answer

Incident Backlog

Question 8

Which TWO metrics are essential when evaluating the effectiveness of a Security Operations Center's (SOC) detection engineering process? (Choose two)

Accepted Answer

False Positive Rate (FPR) of detection rules. The False Positive Rate (FPR) of detection rules (option D) is essential because it quantifies how often benign activity is incorrectly flagged as malicious, directly measuring the noise and analyst workload that detection engineering must minimize. The True Positive Rate (TPR) of detection rules (option E) is equally essential because it measures how reliably the rules catch actual malicious activity, reflecting detection coverage and effectiveness. Together, FPR and TPR form the core trade-off in tuning detection logic, so both are key indicators of a SOC detection engineering process. Option A (Cortex XDR agent license cost per endpoint) is a procurement/budget metric, not a detection quality metric. Option B (total physical weight of server racks) is an irrelevant facilities measurement. Option C (average printer paper consumption) has no bearing on detection engineering performance.

Answer

Cortex XDR agent software license cost per endpoint

Answer

Total physical weight of server racks in the datacenter

Answer

Average printer paper consumption in the SOC office

Question 9

An architect is designing a Palo Alto Networks SSL Decryption architecture. Which TWO best practices should be implemented to minimize user friction and protect user privacy (e.g., healthcare or financial sites)? (Choose two)

Accepted Answer

Install a trusted Enterprise Certificate Authority (CA) root certificate onto all managed client endpoints.. Option B is correct because installing a trusted Enterprise CA root certificate on all managed endpoints allows the firewall to re-sign decrypted sessions with a certificate the client already trusts, preventing browser certificate warnings and minimizing user friction. Option E is correct because configuring Decryption Exclusions for sensitive URL categories such as Financial Services and Healthcare honors privacy regulations (e.g., HIPAA, GLBA) and avoids decrypting traffic users expect to remain private. Option A is wrong because indiscriminately decrypting banking and medical portals violates privacy expectations and may breach compliance requirements. Option C is wrong because self-signed firewall certificates are not trusted by endpoints, producing certificate errors and user friction. Option D is wrong because disabling SSL decryption entirely removes all visibility and threat inspection, defeating the purpose of the architecture.

Answer

Decrypt all traffic indiscriminately, including banking and medical portals, without exception.

Answer

Use self-signed certificates generated on the firewall without distributing them to endpoints.

Answer

Disable SSL decryption entirely across all zones.

Question 10

An architect is designing a multi-tenant cloud security architecture using Prisma Cloud. The security team needs to ensure that developers receive security alerts directly inside their collaboration tools (such as Slack or Microsoft Webex) the moment a misconfiguration is detected in infrastructure-as-code or runtime. Which Prisma Cloud feature must the architect configure?

Accepted Answer

Alert Rules combined with notification integrations for Slack and Webhooks.. Prisma Cloud Alert Rules allow configuring integrations with Webhooks, Slack, Microsoft Teams, and SIEMs to push real-time alerts.

Answer

GlobalProtect VPN portal banner announcements.

Answer

Cortex XSOAR email ingestion parsers without alert rules.

Answer

Panorama SNMP trap forwarding to Slack.

Question 11

An architect is designing an enterprise incident response communication plan. Which THREE components are critical for effective operational coordination during a major security incident? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Playbook. Playbooks are the core automation workflows in Cortex XSOAR that chain together integration commands, conditions, and human approval steps.

Answer

GlobalProtect HIP Notification object

Answer

Prisma Access Remote Network profile

Answer

Panorama Device Group Policy Template

Question 12

An architect is designing an automated threat hunting and containment architecture with Cortex XSIAM. Which THREE actions can be triggered automatically upon confirming a high-fidelity behavioral threat detection? (Choose three)

Accepted Answer

Revoking user session tokens and triggering password resets in Active Directory / Azure AD. Option B is correct because Cortex XSIAM playbooks can integrate with identity providers such as Active Directory and Microsoft Entra ID to revoke session tokens and force password resets, immediately cutting off an attacker's authenticated access. Option D is correct because XSIAM can automatically push confirmed malicious indicators (IPs, domains, hashes) to dynamic blocklists on network firewalls, preventing further command-and-control or lateral movement. Option E is correct because the Cortex XDR agent supports automated endpoint isolation, which severs the compromised host's network connectivity while preserving forensic telemetry for investigation. Option A is incorrect because physically disconnecting power cables is a manual, disruptive facility action that no software orchestration platform can perform and would cause unnecessary outage. Option C is incorrect because formatting intranet web server drives is a destructive, manual remediation step that would destroy evidence and is not an automated containment action in XSIAM.

Answer

Physically disconnecting all power cables in the data center

Answer

Formatting the corporate intranet web server hard drives

Question 13

A multinational SOC architect is defining threat response requirements for Cortex XSIAM that must support both automated and analyst-driven investigations across endpoint, network, and identity telemetry. The architect must select the platform capabilities that directly enable correlation of disparate telemetry into a single incident timeline for response actions. (Choose two.)

Accepted Answer

Unified data model that normalizes endpoint, network, and identity events into common schema fields. The two capabilities that directly enable cross-domain correlation are the unified data model, which normalizes events into a common schema, and automated indicator extraction with alert stitching, which groups related events into a single incident. Together they produce the correlated timeline that both automated playbooks and analysts rely on for response actions.

Answer

Endpoint agent heartbeat monitoring for license compliance reporting

Answer

Role-based access control assignment for SOC tier analysts

Answer

Scheduled vulnerability scan integration for asset risk scoring

Question 14

Your SOC leadership team needs to measure the operational efficiency of incident containment. Which metric should you track within Cortex XSOAR to evaluate how quickly analysts isolate compromised endpoints?

Accepted Answer

Mean Time to Contain (MTTC). Mean Time to Contain (MTTC) measures the average time from incident detection to containment — i.e., how quickly analysts isolate compromised endpoints. This directly reflects operational efficiency of containment actions within Cortex XSOAR. MTTC is the metric SOC leadership uses to evaluate containment speed.

Answer

False Alarm Percentage

Answer

Mean Time to Detect (MTTD)

Answer

Alert Escalation Ratio

Question 15

An architect is integrating a Palo Alto Networks next-generation firewall with an external threat intelligence platform that publishes indicators over a REST API. The firewall must block traffic matching new indicators within minutes without manual commits. Which integration approach meets this requirement?

Accepted Answer

Create an External Dynamic List pointing to the platform's REST endpoint and configure a security policy rule to block traffic matching the list.. External Dynamic Lists are the native mechanism for consuming external indicator feeds. The firewall polls the source on a defined interval, and once the list is referenced in security policy, new entries are enforced automatically without a commit. This delivers near-real-time blocking tied directly to the threat intelligence platform's published indicators.

Answer

Register the platform as a dynamic address group source and rely on the firewall to refresh group membership on demand when policy is evaluated.

Answer

Import the indicators into a custom URL category and commit the configuration each time the platform publishes an update.

Answer

Configure the firewall to query the platform's REST API from a custom security policy action that blocks matching sessions inline.

Question 16

An architect is designing a Prisma Access deployment with multiple Remote Networks. Which TWO routing mechanisms are supported for connecting customer premises equipment (CPE) to Prisma Access Node locations? (Choose two)

Accepted Answer

Static routing configured over IPsec VPN tunnels.. Option B is correct because Prisma Access Remote Networks support static routing over the IPsec VPN tunnels that connect the CPE to the Prisma Access service IPsec termination, allowing the branch to advertise its subnets via configured static routes. Option E is correct because Prisma Access also supports BGP peering over those same IPsec tunnels, which is the recommended dynamic routing mechanism for exchanging routes between the CPE and Prisma Access and enables failover and path selection. Option A is not supported because OSPF adjacencies are not established directly across the public internet to Prisma Access nodes; dynamic routing with Prisma Access is done via BGP over the IPsec tunnel. Option C is invalid because Prisma Access is a cloud-delivered service reached over the internet, so raw Ethernet crossover cables to cloud nodes are not a supported connectivity method. Option D is invalid because AppleTalk is a legacy protocol and GRE tunnels are not the supported transport for Prisma Access Remote Networks routing.

Answer

OSPF adjacency established directly across the public internet between branch firewalls and Prisma Access.

Answer

Raw Ethernet crossover cables run directly between branch offices and Prisma Access cloud nodes.

Answer

AppleTalk routing protocol over GRE tunnels.

Question 17

A SOC architect is designing a threat response architecture that uses Cortex XSIAM to automate response actions across endpoint, network, and cloud domains. The CISO requires that automated actions be auditable and reversible where possible. Which TWO design elements are essential to meet these requirements? (Choose two.)

Accepted Answer

Define rollback or compensating actions for each automated response, such as releasing an endpoint from isolation or restoring a quarantined file.. Auditability demands a centralized, tamper-resistant record of every action's initiator, target, and outcome, while reversibility demands a defined compensating action for each automated response. Together these two elements let the SOC verify and undo automated actions. Excessive privileges, blanket manual approval, and local-only logging either weaken security or fail the stated requirements.

Answer

Store all response action logs only on the local endpoint to reduce central storage costs and latency.

Answer

Disable automated response entirely and require a human analyst to approve every action manually.

Answer

Grant the automation engine domain administrator rights so it can perform any response action without encountering permission errors.

Question 18

An architect is designing a high availability deployment for Palo Alto Networks firewalls. What is the primary purpose of the HA1 link?

Accepted Answer

Synchronize control plane configurations and exchange heartbeat keepalive messages between HA peers.. The HA1 link is the dedicated control-plane and heartbeat path between Palo Alto HA peers. It carries configuration synchronization (so the passive/active peer stays in sync), hello/heartbeat keepalives for peer liveness detection, and state information needed for failover decisions. It is not used for user data traffic.

Answer

Transfer high-speed data plane network traffic during normal operation.

Answer

Forward system logs to external SIEM collectors.

Answer

Provide direct internet access to client workstations behind the firewall.

Question 19

An architect is configuring User-ID to identify users behind a Microsoft Active Directory domain. Which protocol does the Palo Alto Networks User-ID agent use to query Active Directory security event logs for user login and logoff events?

Accepted Answer

WMI or Windows RPC/SMB to read Security Event Logs. The User-ID agent monitors Active Directory domain controllers using Windows security event logs via WMI or Windows RPC/SMB protocols.

Answer

NetFlow v9 templates

Answer

SNMPv3 polling of Active Directory database tables

Answer

HTTP POST requests sent by the Active Directory DNS service

Question 20

An architect is defining a Service Level Objective (SLO) for the SOC using Cortex XSIAM. The SLO states that 95% of high-severity incidents must be resolved within 4 hours of creation. The architect needs to create a metric that measures compliance with this SLO over a rolling 30-day window. Which Cortex XSIAM feature should the architect use to automatically calculate and alert on SLO compliance?

Accepted Answer

Create a scheduled XQL query that runs daily, calculates the percentage of high-severity incidents resolved within 4 hours over the past 30 days, and triggers a webhook if below 95%.. A scheduled XQL query is the most flexible and accurate way to compute rolling SLO compliance in Cortex XSIAM. It can aggregate incident data, apply the 95% threshold, and trigger notifications via webhook. This approach leverages native query capabilities and automation, ensuring the metric is consistently updated and actionable without relying on non-existent built-in widgets.

Answer

Configure a correlation rule that evaluates incident resolution times in real time and generates an alert when an incident exceeds 4 hours.

Answer

Use the built-in 'SLO Compliance' dashboard widget that automatically tracks all SLOs defined in the system.

Answer

Leverage the 'Incident SLA' field that is automatically populated by Cortex XSIAM based on severity and resolution time.