SecOps-Architect Practice Exam 3 — 20 Questions

Question 1

An architect is designing a metrics program for a Cortex XSIAM deployment and wants to ensure that reported security metrics drive continuous improvement rather than merely describe past activity. The SOC director requires that each metric be tied to a decision or action. Which TWO characteristics must the architect build into the metric definitions to satisfy this requirement? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Each metric has an explicit target or threshold that triggers a defined response when breached. Metrics drive improvement only when they are connected to decisions. An explicit target or threshold defines when action is needed, and a named owner ensures that action actually occurs. Together they turn a measurement into an operational feedback loop. Precision, dedicated storage, and annual-only review do not create that linkage, so they cannot satisfy the requirement that each metric be tied to a decision or action.

Answer

Each metric is stored in a separate dedicated dataset to simplify long-term retention

Answer

Each metric is reported with the highest possible decimal precision to avoid rounding ambiguity

Answer

Each metric is reviewed only once per year during the annual audit cycle

Question 2

An architect is designing a Prisma SD-WAN deployment integrated with Palo Alto Networks Prisma Access for branch internet and SaaS traffic. Branch sites use Prisma SD-WAN ION devices, and the security team wants all internet-bound traffic from branches to be inspected by Prisma Access while keeping SaaS traffic on a direct optimized path. Which Palo Alto Networks capability should the architect use to steer only the appropriate traffic to Prisma Access?

Accepted Answer

Configure Prisma SD-WAN policy sets with application-based and SaaS-based path selection, directing only non-SaaS internet traffic to the Prisma Access tunnel.. Prisma SD-WAN policy sets evaluate applications and SaaS destinations, allowing granular path decisions at the branch. Directing non-SaaS internet traffic into the Prisma Access tunnel while letting recognized SaaS traffic take a direct optimized path satisfies both inspection and performance goals. The other approaches either tunnel everything, rely on brittle IP lists, or misuse service connections.

Answer

Enable GlobalProtect on all branch endpoints and force full tunnel to Prisma Access, then use split tunneling to exclude SaaS applications by IP address.

Answer

Use Prisma Access service connections with static routes on the ION devices to send all traffic to the closest Prisma Access location.

Answer

Advertise a default route from Prisma Access to the branches and rely on BGP communities to influence SaaS traffic away from the tunnel.

Question 3

When designing a threat hunting architecture using XQL in Cortex XSIAM, which TWO best practices improve query performance and efficiency? (Choose two)

Accepted Answer

Use indexed fields and precise matching operators where possible. Option A is correct because using indexed fields and precise matching operators (e.g., =, in, or exact string comparisons instead of wildcard or regex-heavy filters) lets Cortex XSIAM's XQL engine prune data at the index level, drastically reducing the number of events scanned and improving query speed. Option B is correct because filtering by specific datasets (e.g., xdr_data, panw_ngfw_traffic_raw) and applying narrow time ranges early in the query pipeline limits the volume of data the engine must process before subsequent stages, which is the single most effective way to reduce XQL execution time and resource consumption. Option C is incorrect because unbounded queries across all historical data force full scans of massive datasets, causing slow execution, high resource usage, and potential timeouts. Option D is incorrect because aggregation functions like count, sum, and summarize are essential for efficient threat hunting and are optimized in XQL; avoiding them does not improve performance. Option E is incorrect because selecting all raw unparsed logs and avoiding specific field names increases data volume and prevents the engine from leveraging field-level indexing and parsing optimizations.

Answer

Run unbounded queries across all historical data without time constraints

Answer

Avoid using aggregation functions like count or summarize

Answer

Select all raw unparsed logs and avoid using specific field names

Question 4

An architect is configuring a Palo Alto Networks firewall and wants to inspect unknown files submitted by users over HTTP/FTP/SMTP to determine if they contain zero-day malware. Which service should the architect configure?

Accepted Answer

WildFire cloud-based malware analysis. WildFire is Palo Alto Networks' cloud-based malware analysis service that performs dynamic analysis of unknown files in a sandboxed environment. It supports files submitted over HTTP, FTP, SMTP, SMB, and other protocols, and can identify zero-day malware by observing behavior. The firewall forwards unknown files to WildFire, which returns a verdict (malicious, benign, grayware) and generates signatures that are automatically distributed to the firewall.

Answer

URL Filtering cloud database

Answer

GlobalProtect portal

Answer

DNS Security service

Question 5

An architect is configuring a Palo Alto Networks firewall and wants to block access to known malicious domains and phishing sites. Which security profile should be configured and attached to the security policy?

Accepted Answer

URL Filtering profile. URL Filtering profiles inspect HTTP/HTTPS web traffic and block access to malicious, phishing, or unauthorized web categories.

Answer

WildFire analysis profile

Answer

Antivirus profile

Answer

Data Filtering profile

Question 6

An architect is operationalizing security metrics for a Cortex XSIAM deployment. The SOC manager wants to track the 'Alert Triage Efficiency' metric, defined as the average time from alert creation to analyst assignment. The architect needs to ensure the metric is accurate and actionable. Which two data points must be captured and correlated to calculate this metric correctly? (Choose two.)

Accepted Answer

The timestamp when an analyst is assigned to the alert or incident.. To calculate the average time from alert creation to analyst assignment, the architect must capture both the alert creation timestamp and the assignment timestamp. These two data points define the interval. Cortex XSIAM records both events natively, allowing correlation and aggregation. Other attributes like severity or MITRE tactic are useful for filtering but not for the core calculation.

Answer

The number of automated playbook executions triggered by the alert.

Answer

The MITRE ATT&CK tactic associated with the alert.

Answer

The severity level of the alert as determined by the analytics engine.

Question 7

When setting up automated email parsing in Cortex XSOAR for phishing triage, which integration is specifically required to connect to Microsoft Office 365 using modern authentication (OAuth 2.0)?

Accepted Answer

Microsoft Graph Mail integration. The Microsoft Graph Mail integration is the correct choice because it is the only Cortex XSOAR integration designed to authenticate to Microsoft Office 365 using modern OAuth 2.0 authentication via an Microsoft Entra ID app registration. Microsoft has deprecated Basic Authentication for Exchange Online, so legacy protocols like IMAP and SMTP with basic auth no longer work for automated mailbox access. Graph Mail uses the Microsoft Graph API, which supports application-level permissions (e.g., Mail.Read) and OAuth 2.0 client credentials flow, making it the required integration for phishing triage email parsing.

Answer

SMTP Relay Server integration

Answer

Legacy Exchange IMAP integration

Answer

Active Directory LDAP integration

Question 8

An architect is designing an automated incident response architecture integrating Palo Alto Networks NGFW, Cortex XDR, and Cortex XSOAR. Which TWO architectural principles ensure an effective automated security ecosystem? (Choose two)

Accepted Answer

Centralizing threat intelligence sharing and indicator blocking via External Dynamic Lists and XSOAR playbooks.. Option B is correct because centralizing threat intelligence sharing and indicator blocking through External Dynamic Lists (EDLs) hosted on a web server and consumed by the NGFW, combined with Cortex XSOAR playbooks that push indicators to EDLs or the firewall's dynamic block lists, creates a single authoritative source of IOCs that enforces blocking consistently across the ecosystem. Option D is correct because standardized REST APIs and prebuilt integration packs (e.g., the Palo Alto Networks Panorama, Cortex XDR, and firewall integrations in XSOAR) allow playbooks to query, enrich, and execute response actions across all three products without brittle custom scripting, which is the foundation of reliable orchestration. Option A is wrong because air-gapping security tools with no internet or API access prevents the API-driven orchestration and threat-intel sharing that automated incident response requires. Option C is wrong because disabling automated remediation eliminates the automation benefit and contradicts the goal of an automated security ecosystem. Option E is wrong because manual phone calls and spreadsheets are the opposite of automated orchestration and cannot scale to machine-speed response.

Answer

Isolating all security tools on completely disconnected local networks without internet or API access.

Answer

Disabling all automated remediation to ensure zero visibility.

Answer

Relying entirely on manual phone calls and spreadsheets for every security alert.

Question 9

A multinational corporation uses Cortex XSIAM across three geographically dispersed SOCs. The security leadership wants to measure the consistency of incident triage across regions to identify process drift. Which metric best captures the uniformity of triage decisions, such as severity assignment and escalation, across all SOCs?

Accepted Answer

Triage Consistency Score. Triage Consistency Score directly measures how uniformly triage decisions are made across different SOCs. By analyzing Cortex XSIAM incident data, such as severity and escalation choices on comparable alerts, this metric highlights process drift. It provides actionable insight for standardizing triage procedures across regions, which is the core requirement.

Answer

Alert Volume per Analyst

Answer

False Positive Rate

Answer

Mean Time to Resolution (MTTR)

Question 10

You are configuring log ingestion in Cortex XSIAM from a third-party firewall using a generic syslog collector. The logs are arriving, but the parser is failing to extract destination IP addresses correctly. What is the recommended troubleshooting step?

Accepted Answer

Modify or create a custom XDM parsing rule for the vendor log format. Cortex XSIAM uses XDM (Extended Data Model) to normalize ingested logs into a common schema. When a generic syslog collector receives logs from a third-party firewall, the default parser may not correctly map vendor-specific fields to XDM attributes like destination IP. Creating or modifying a custom XDM parsing rule allows you to define extraction patterns (e.g., regex, delimiters) that correctly identify and map the destination IP field.

Answer

Increase the Syslog port number from 514 to 6514

Answer

Disable Magnifier behavioral analytics

Answer

Reinstall the Cortex XDR agent on the third-party firewall

Question 11

An architect is reviewing the Cortex XSIAM Analytics dashboard to identify root causes of security incidents. Which data visualization component aggregates related alerts into a single attack storyline?

Accepted Answer

Incident Storyline. The Incident Storyline in Cortex XSIAM aggregates related alerts into a single attack storyline, providing a unified view of an incident. It correlates alerts from multiple sources to show the sequence of events and root cause. This visualization helps architects understand the attack chain.

Answer

Raw Syslog Viewer

Answer

Indicator Grid

Answer

Dashboard Widget Editor

Question 12

An enterprise is designing a zero-trust architecture where Cortex XDR integrates with Palo Alto Networks Next-Generation Firewalls. Which protocol and component facilitate real-time dynamic blocklisting of compromised endpoints across both the firewall and the endpoint?

Accepted Answer

Cortex XDR incident handler pushing dynamic IP/URL lists to firewalls via PAN-OS API. The Cortex XDR enforcement service pushes dynamic block lists (EDL / IP lists) via XML API or PAN-OS integration to the firewalls.

Answer

Syslog forwarding from firewalls to the local endpoint agent

Answer

SNMP traps sent from endpoints to the firewall management plane

Answer

User-ID agent querying Active Directory via LDAP

Question 13

You need to establish a baseline for normal network traffic and security events across multiple disparate log sources in Cortex XSIAM. What feature should you leverage to aggregate and normalize this data for consistent metric reporting?

Accepted Answer

Cortex XSIAM Parsing Rules and Data Models. Cortex XSIAM uses Parsing Rules (CIM normalization) and Data Models to normalize heterogeneous log data into a consistent schema, enabling accurate cross-source metric reporting.

Answer

WildFire Local Analysis Appliances

Answer

Cortex XSOAR Email Integration Instances

Answer

Prisma SASE Traffic Shapers

Question 14

An architect is defining Key Performance Indicators (KPIs) in Cortex XSIAM to measure the efficiency of Tier-1 analysts. Which built-in metric best evaluates the speed at which analysts initially acknowledge and begin investigating incoming alerts?

Accepted Answer

Mean Time to Acknowledge (MTTA). Mean Time to Acknowledge (MTTA) specifically measures the speed at which analysts transition an alert from new to in-progress, directly evaluating initial triage speed.

Answer

False Positive Rate (FPR)

Answer

Mean Time to Resolution (MTTR)

Answer

Mean Time to Contain (MTTC)

Question 15

An architect is designing an incident response workflow in Cortex XSOAR using the Incident Spooler. Which component is primarily responsible for processing queued events into actionable incidents?

Accepted Answer

Cortex XSOAR Server engine. The War Room is where manual actions and playbooks execute, but the Server engine handles the queue processing and ingestion from the Incident Spooler.

Answer

Demisto REST API

Answer

Threat Intel Management module

Answer

Cortex XSIAM Data Lake collector

Question 16

An architect is designing a secure cloud network architecture using Prisma Access. Which TWO deployment models or components are available in Prisma Access to connect corporate data centers and branch offices? (Choose two)

Accepted Answer

Remote Networks (connecting branch offices via IPsec VPN tunnels to Prisma Access cloud nodes).. Option C is correct because Remote Networks is a Prisma Access deployment component specifically designed to connect branch offices and small sites to the Prisma Access cloud infrastructure using IPsec VPN tunnels terminated on Prisma Access service nodes. Option D is correct because Service Connections is a Prisma Access component that connects corporate headquarters, data centers, or other internal networks to Prisma Access, enabling secure hub-and-spoke routing and access to internal resources through the cloud security platform. Option A is incorrect because Cortex XDR Agent is an endpoint protection agent and cannot be installed on ISP core routers, nor is it a Prisma Access connectivity model. Option B is incorrect because public FTP servers are not a supported or secure mechanism for bridging internal LAN traffic to Prisma Access. Option E is incorrect because physically splicing copper coaxial cables into a Palo Alto Networks office is not a Prisma Access deployment model and is not technically or operationally feasible.

Answer

Installing Cortex XDR Agent directly onto ISP core routers.

Answer

Using public FTP servers to bridge internal LAN traffic to the cloud.

Answer

Direct physical copper coaxial cables spliced from branch offices into the nearest Palo Alto Networks corporate office.

Question 17

An architect is designing an automated threat hunting and containment workflow using Cortex XSOAR. Which TWO external or internal data sources can Cortex XSOAR query or integrate with during an investigation? (Choose two)

Accepted Answer

Active Directory domain controllers for user account status verification.. Option A is correct because Cortex XSOAR can integrate with Active Directory (via the LDAP-based AD integration or the Active Directory Query v2 integration) to query domain controllers and verify user account status, such as whether an account is enabled, disabled, or locked out, which is essential during containment decisions. Option D is correct because Cortex XSOAR natively supports threat intelligence platform integrations, including VirusTotal and Palo Alto Networks WildFire, to enrich indicators (hashes, IPs, URLs, domains) with reputation and verdict data during automated investigations. Options B, C, and E are incorrect because they describe non-standard, unsupported data sources (Bluetooth IoT coffee machine sensors, FM radio tuners, and analog modem dial-up switches) that are not part of Cortex XSOAR's integration ecosystem and have no relevance to enterprise threat hunting or containment workflows.

Answer

Local coffee machine IoT sensors via raw Bluetooth packets.

Answer

FM radio broadcast frequency tuners.

Answer

Raw analog telephone landline switches via modem dial-up.

Question 18

An architect is configuring User-ID mapping using the Palo Alto Networks Windows-based User-ID Agent. To ensure high availability and prevent single points of failure, how should multiple User-ID agents be configured in Panorama or the firewall?

Accepted Answer

Configure multiple User-ID agents in a server list where the firewall queries secondary agents if the primary agent becomes unreachable.. Panorama and firewalls allow configuring multiple User-ID agents in a priority-ordered list or server monitor group so if one agent fails, another takes over.

Answer

Deploy agents on every user workstation without domain controllers.

Answer

Merge all agents into a single physical process via CLI kernel patching.

Answer

Rely solely on static IP address lists.

Question 19

An enterprise security architect is configuring automated threat intelligence sharing between Cortex XSOAR and external ISACs using STIX/TAXII. Which component within Cortex XSOAR is primarily responsible for managing incoming threat indicators, deduplication, and indicator scoring?

Accepted Answer

Threat Intelligence Management (TIM) module. The Threat Intelligence Management (TIM) module within Cortex XSOAR handles indicator lifecycle management, deduplication, scoring, and propagation to enforcement points.

Answer

Cortex XDR Analytics Engine

Answer

Incident Investigation Canvas

Answer

Machine Learning Service Broker

Question 20

When evaluating the maturity of an Incident Response program using the CMMI (Capability Maturity Model Integration) framework, what characterizes a 'Managed' (Level 2) process?

Accepted Answer

Processes are planned, executed, measured, and controlled at the project level. In CMMI, a Managed (Level 2) process is characterized by being planned, performed, measured, and controlled at the project level. Work products and services are managed against a documented plan, and performance is tracked so corrective action can be taken. This is a project-specific discipline, not yet an organization-wide standard.

Answer

Processes are standardized across the entire organization

Answer

Processes are entirely ad-hoc and reactive

Answer

Processes are quantitatively optimized through statistical data