SecOps-Architect Practice Exam 3 — 20 Questions

Question 1

An architect is configuring High Availability (HA) on Palo Alto Networks firewalls. Which TWO data or state tables are synchronized across the HA2 link between active and passive peers? (Choose two)

Accepted Answer

ARP table entries to maintain layer 2 reachability after failover.. HA2 synchronizes active session tables, ARP tables, IPsec security associations, and NAT table mappings.

Answer

Local firewall physical power supply voltage metrics.

Answer

Panorama admin account SSH private keys.

Answer

Administrator password history and failed login lockout counters.

Question 2

An architect is designing a high-scale Cortex XDR deployment across 50,000 endpoints. To optimize bandwidth and reduce direct WAN traffic to the cloud backend for agent updates and log collection, which architectural component should be deployed in regional data centers?

Accepted Answer

Cortex XDR Broker VM deployed in regional data centers to act as a local proxy, content cache, and log collector.. Cortex XDR Broker VMs act as regional aggregators and proxies for agent updates, syslog collection, and telemetry forwarding.

Answer

A standalone Panorama virtual machine acting as an endpoint proxy.

Answer

Prisma Access Remote Network nodes running the XDR agent directly on gateway hypervisors.

Answer

A dedicated PA-7080 firewall performing deep packet inspection on all XDR endpoint RAM.

Question 3

An architect is designing a large-scale Prisma Access deployment with hundreds of remote networks. To simplify routing management and avoid full-mesh IPsec tunnel complexity between all branch sites, what architectural topology does Prisma Access employ by default?

Accepted Answer

Cloud-backed hub-and-spoke architecture where remote networks connect to Prisma Access cloud nodes, which handle backbone routing.. Prisma Access utilizes a cloud-native backbone operating on a hub-and-spoke or cloud-routed backbone architecture where remote networks connect to cloud locations, simplifying branch-to-branch and branch-to-DC routing.

Answer

Ring topology relying entirely on legacy Token Ring protocols.

Answer

Full-mesh BGP peering over physical leased dark fiber lines directly connecting every branch office to all other branch offices.

Answer

Peer-to-peer BitTorrent distribution of routing tables.

Question 4

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

Accepted Answer

Verify that the managed firewalls are correctly assigned to a valid Collector Group within Panorama.. Checking log collection status requires verifying connectivity on TCP port 3978 (Panorama SSL/TLS communication), verifying collector group membership, and checking disk space/health on the collectors.

Answer

Reformat the firewall data plane ASICs via the CLI.

Answer

Check if the firewall local management plane CPU is running SNMPv1 polling.

Answer

Disable SSL decryption on all internal zones.

Question 5

An architect is designing an architecture where a Palo Alto Networks firewall receives threat intelligence feeds from external sources in STIX/TAXII format. Which feature on the firewall enables direct ingestion of these customized threat feeds?

Accepted Answer

External Dynamic Lists (EDLs) configured to poll a TAXII server or URL list.. External Dynamic Lists (EDLs) allow firewalls to consume IP addresses, domains, or URLs directly from web servers or STIX/TAXII servers.

Answer

GlobalProtect HIP object database.

Answer

Syslog server forwarding profile.

Answer

Panorama Device Group Static Address Objects.

Question 6

An architect is designing high availability for a Palo Alto Networks firewall deployment and wants to ensure that both firewalls can actively process traffic under normal operating conditions while backing each other up. Which HA mode supports this?

Accepted Answer

High Availability Active/Active mode. Active/Active HA allows both firewalls to process traffic simultaneously, using device-ID and floating IPs to handle session failover.

Answer

Panorama managed standalone mode

Answer

Standalone clustering with no HA links

Answer

High Availability Active/Passive mode

Question 7

An architect is troubleshooting a Cortex XDR deployment where agents on endpoints are failing to communicate with the Cortex XDR cloud tenant. Which outbound network connectivity requirement must be verified on the local corporate firewall?

Accepted Answer

Outbound TCP port 443 (HTTPS) access to the Cortex XDR tenant cloud URL.. Cortex XDR agents communicate with the cloud tenant over outbound HTTPS (TCP port 443).

Answer

Inbound UDP port 69 (TFTP) from endpoints to Panorama.

Answer

Inbound TCP port 3389 (RDP) from the cloud backend to every endpoint.

Answer

Outbound TCP port 3978 to Panorama Collectors.

Question 8

An architect is designing an authentication architecture where Palo Alto Networks firewalls authenticate administrators against an external multi-factor authentication (MFA) provider using SAML 2.0. Which component acts as the Identity Provider (IdP) in this architecture?

Accepted Answer

The external IdP (such as Okta, Azure AD, or Ping Identity).. In a SAML authentication flow, the external system (such as Okta, Azure AD, or Ping Identity) acts as the Identity Provider (IdP), while the firewall acts as the Service Provider (SP).

Answer

The Palo Alto Networks firewall itself.

Answer

The Cortex XSOAR server.

Answer

The local database on the firewall.

Question 9

An architect is configuring a Panorama Device Group and needs to create security rules that apply to all firewalls in the enterprise, regardless of their specific regional location. Where should the architect place these rules within the Panorama rule hierarchy?

Accepted Answer

Panorama Pre-Rules configured at the topmost level before device group specific rules.. Panorama supports Pre-Rules and Post-Rules, with Pre-Rules evaluated before device group local rules and Pre-Rules enforced globally across all device groups when configured at the global level.

Answer

Template stack interface configurations.

Answer

Local firewall CLI configuration files only.

Answer

Post-rules at the bottom of a single remote branch device group.

Question 10

An architect is configuring High Availability (HA) on Palo Alto Networks firewalls. Which TWO data or state tables are synchronized across the HA2 link between active and passive peers? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Operating mode (Active/Passive or Active/Active) and license configuration.. HA peers require matching device serial numbers/models (or VM models), matching PAN-OS versions, matching license keys, and matching operational modes (Active/Passive).

Answer

The physical serial number printed on the hardware chassis label.

Answer

The administrative password for the 'admin' user account.

Answer

The hostname assigned to each firewall in the setup menu.

Question 11

An architect is configuring a Cortex XDR integration with a third-party SIEM. The SIEM requires log data formatted in Common Event Format (CEF) over Syslog. Where should the architect configure this output format in the Cortex XDR architecture?

Accepted Answer

Cortex XDR Broker VM Syslog Collector profile configured with CEF mapping.. Cortex XDR Log Forwarding profiles or Broker VM Syslog Collector configurations allow formatting logs in CEF or JSON before forwarding to external SIEMs.

Answer

Prisma Cloud compliance check rule definitions.

Answer

Panorama firewall administrative GUI banner settings.

Answer

GlobalProtect gateway portal authentication profile.

Question 12

An architect is configuring Palo Alto Networks firewall logging. By default, when are traffic logs generated for allowed sessions?

Accepted Answer

When the session terminates (closes).. Traffic logs for allowed sessions are generated when the session terminates (closes), logging total bytes, packet counts, and duration.

Answer

Every 1 millisecond regardless of session state.

Answer

Only when an administrator manually clicks 'Export Logs'.

Answer

Only when the session first initiates.

Question 13

An architect is troubleshooting a Palo Alto Networks High Availability (HA) cluster where configuration synchronization between active and passive peers is failing. Which TWO locations or settings should the architect check? (Choose two)

Accepted Answer

Verify physical and logical connectivity on the HA1 control link interface.. HA configuration synchronization failure troubleshooting involves checking HA1 link connectivity, ensuring matching PAN-OS versions, and verifying HA settings in Device > High Availability.

Answer

Check the DNS server IP address configured on the management interface.

Answer

Check the URL Filtering cloud license status.

Answer

Check the GlobalProtect gateway portal certificate expiration date.

Question 14

An architect is designing a high availability deployment for Palo Alto Networks firewalls. What is the primary purpose of the HA1 link?

Accepted Answer

Synchronize control plane configurations and exchange heartbeat keepalive messages between HA peers.. The HA1 link is dedicated to control plane communication, configuration synchronization, and heartbeats between HA peers.

Answer

Transfer high-speed data plane network traffic during normal operation.

Answer

Forward system logs to external SIEM collectors.

Answer

Provide direct internet access to client workstations behind the firewall.

Question 15

An architect is configuring a Palo Alto Networks firewall and wants to control application traffic (such as allowing Skype business calls while blocking Skype file transfers). Which security policy match enables this granularity?

Accepted Answer

App-ID based security policy rules specifying application and sub-features.. App-ID allows granular control of applications and sub-features (App-ID sub-functions) within a single security policy rule.

Answer

Destination IP address matching only.

Answer

TCP port number matching (e.g., port 80/443).

Answer

Source MAC address filtering.

Question 16

An architect is configuring a Palo Alto Networks firewall and wants to inspect unknown files submitted by users over HTTP/FTP/SMTP to determine if they contain zero-day malware. Which service should the architect configure?

Accepted Answer

WildFire cloud-based malware analysis. WildFire is Palo Alto Networks cloud-based threat analysis service that sandboxes unknown files to detect zero-day malware.

Answer

URL Filtering cloud database

Answer

GlobalProtect portal

Answer

DNS Security service

Question 17

An architect is designing a Prisma Cloud Compute deployment for Kubernetes clusters. Which TWO architectural components must be considered when planning Defender deployments for security monitoring? (Choose two)

Accepted Answer

Deploying Defender as a Kubernetes DaemonSet to monitor all pods and container runtimes on every worker node.. Prisma Cloud Compute Defenders can be deployed as DaemonSets on Kubernetes nodes or as serverless/App-Embedded defenders depending on the architecture.

Answer

Configuring GlobalProtect gateway tunnels inside every container container root filesystem.

Answer

Physically soldering Defender chips onto the motherboard of the Kubernetes master node.

Answer

Installing SNMPv1 agents on all container loopback interfaces.

Question 18

An architect is designing a multi-tenant Prisma Access architecture. Different business units require separate address spaces, security policies, and administrative boundaries. Which Prisma Access feature enables this logical separation?

Accepted Answer

Panorama Device Groups and Folders with role-based access control (RBAC).. Prisma Access uses folder structures, device groups, and Panorama multi-tenancy constructs (such as multi-tenant Panorama deployment or distinct Prisma Access folders in Panorama) to logically segment business units.

Answer

Cortex XDR agent exclusion lists.

Answer

Physical stacking cables linking remote branch routers.

Answer

GlobalProtect client-side registry keys.

Question 19

An architect is configuring a Palo Alto Networks firewall and wants to block traffic based on geographic location (e.g., blocking traffic originating from specific countries). Which feature enables this?

Accepted Answer

GeoIP matching in Security Policy rules based on source or destination country tags.. GeoIP in Palo Alto Networks security policies allows matching traffic source or destination countries.

Answer

Static TCP port filtering rules.

Answer

GlobalProtect client version checks.

Answer

DNS root hint server configuration.

Question 20

An architect is configuring a Palo Alto Networks firewall and needs to ensure that DNS requests originating from internal clients to known malicious domains are automatically intercepted or blocked. Which security feature provides this capability?

Accepted Answer

DNS Security service with sinkhole configuration.. DNS Security service uses machine learning and threat intelligence to analyze and block malicious DNS requests in real time.

Answer

Static host file entries on the firewall management interface.

Answer

SNMP trap alert generator.

Answer

DHCP lease reservation tables.