SecOps-Architect Practice Exam 4 — 20 Questions

Question 1

An architect is configuring a Palo Alto Networks firewall and wants to prevent SYN flood attacks on public-facing web servers. Which security feature should the architect configure?

Accepted Answer

Zone Protection profile configured with SYN flood SYN cookies.. Zone Protection profiles provide protection against flood attacks (SYN flood, UDP flood, ICMP flood), IP spoofing, and reconnaissance.

Answer

Data Filtering profile.

Answer

URL Filtering profile.

Answer

WildFire file analysis profile.

Question 2

An architect is designing a secure architecture using VM-Series on Microsoft Azure. Which TWO Azure-native services or integration components must be configured to achieve high availability with dynamic failover of user traffic across two VM-Series instances? (Choose two)

Accepted Answer

Azure Load Balancer (Standard SKU) to distribute inbound and outbound traffic to the VM-Series data interfaces.. Option C is correct because an Azure Load Balancer (Standard SKU) is the Azure-native mechanism used to distribute inbound and outbound traffic across the data interfaces of two VM-Series firewalls, providing the traffic-fronting component needed for dynamic failover in an active/active or active/passive HA design. Option D is correct because Azure User Defined Routes (UDR) control the effective routing for subnets, and the PAN-OS SDN Connector dynamically rewrites those UDR entries so traffic is redirected to the surviving VM-Series instance during a failover event. Options A and B are incorrect because Azure does not expose physical fiber or copper cross-connects to customer VMs, and HA2 links between VM-Series instances are implemented over the Azure network rather than physical cabling. Option E is incorrect because Microsoft Entra Domain Services is an identity service and plays no role in traffic redirection or firewall high availability failover.

Answer

Physical HA2 fiber optic cables connected between Azure availability zones.

Answer

Azure ExpressRoute direct copper cross-connect cables plugged into the firewall physical NICs.

Answer

Azure Active Directory Domain Services domain controller deployed inside the firewall data plane.

Question 3

When designing an operational dashboard in Cortex XSIAM to monitor SOC analyst workload distribution, which metric is most useful?

Accepted Answer

Number of assigned open incidents per analyst. To monitor SOC analyst workload distribution, the most useful metric is the number of assigned open incidents per analyst. This directly reflects each analyst's current workload and helps balance assignments, identify overload, and manage capacity.

Answer

WildFire malicious verdict percentage

Answer

Cortex XDR agent version distribution

Answer

Total firewall throughput in gigabits per second

Question 4

An architect is designing a large-scale Prisma Access deployment with hundreds of remote networks. To simplify routing management and avoid full-mesh IPsec tunnel complexity between all branch sites, what architectural topology does Prisma Access employ by default?

Accepted Answer

Cloud-backed hub-and-spoke architecture where remote networks connect to Prisma Access cloud nodes, which handle backbone routing.. Prisma Access uses a cloud-backed hub-and-spoke topology: each remote network (branch) establishes an IPsec tunnel to the nearest Prisma Access cloud node, and the Prisma Access backbone handles inter-branch routing. This eliminates the need for full-mesh tunnels between every branch pair, dramatically simplifying routing and scaling. The cloud nodes act as the hub, providing centralized policy enforcement and optimized backbone paths.

Answer

Ring topology relying entirely on legacy Token Ring protocols.

Answer

Full-mesh BGP peering over physical leased dark fiber lines directly connecting every branch office to all other branch offices.

Answer

Peer-to-peer BitTorrent distribution of routing tables.

Question 5

An architect is configuring Panorama to manage a large deployment of firewalls. Which TWO best practices should be implemented regarding Panorama administrative access and security? (Choose two)

Accepted Answer

Configure Role-Based Access Control (RBAC) using custom Admin Roles and Access Domains to restrict administrators to their assigned device groups.. Panorama admin best practices include enforcing Role-Based Access Control (RBAC) via Admin Roles and Access Domains, and enforcing multi-factor authentication (MFA) for all administrators.

Answer

Expose the Panorama management interface directly to the public internet without an IP whitelist or VPN.

Answer

Share a single 'admin' superuser account credential among all members of the network team.

Answer

Disable all logging on Panorama to save disk space.

Question 6

An architect is configuring User-ID to map users via Palo Alto Networks Terminal Services (TS) Agent. Where must the TS Agent be installed in the network architecture?

Accepted Answer

Directly on the Microsoft Terminal Server or Citrix XenApp server.. The Palo Alto Networks Terminal Services (TS) Agent is a lightweight agent that runs directly on the multi-user host — Microsoft Terminal Server or Citrix XenApp — to map individual user sessions to source ports. Because all users on a terminal server share the same IP address, the firewall cannot distinguish them by IP alone; the TS Agent solves this by allocating a unique source port range per user session and reporting the mapping to the firewall via User-ID.

Answer

Inside the Cortex XDR Broker VM appliance.

Answer

On the external DNS root server.

Answer

On the Panorama management virtual appliance.

Question 7

An architect is designing an enterprise security architecture integrating Prisma Access, Cortex XDR, and Cortex XSOAR. Which TWO architectural benefits are realized by this tight integration? (Choose two)

Accepted Answer

Automated incident response orchestration and remediation across network and endpoints using Cortex XSOAR playbooks.. Option D is correct because Cortex XSOAR is the orchestration, automation, and response (SOAR) platform that consumes alerts from Prisma Access and Cortex XDR and executes playbooks to automate incident response and remediation actions across both the network and endpoint layers, which is a core benefit of tight integration. Option E is correct because integrating Prisma Access (cloud-delivered secure network traffic inspection) with Cortex XDR (endpoint telemetry and detection) provides unified threat visibility, correlating network and endpoint events into a single coherent picture for analysts. Option A is wrong because analog telephone lines cannot carry high-speed XDR memory dumps and are unrelated to any modern security architecture. Option B is wrong because integration never eliminates the need for encryption or security policies; those remain essential controls. Option C is wrong because Palo Alto Networks does not replace cloud provider hypervisors with proprietary switches, and such a claim is technically false.

Answer

Using analog telephone lines to transmit high-speed XDR memory dumps.

Answer

Eliminating the need for any encryption or security policies.

Answer

Replacing all cloud provider underlying hypervisors with Palo Alto Networks proprietary switches.

Question 8

An architect is configuring automated metric collection in Cortex XSOAR using incident tags and custom fields to measure playbook automation efficiency. Which metric calculation accurately isolates the value added by automation versus manual analyst intervention?

Accepted Answer

Touchless Resolution Rate (percentage of incidents closed without manual tasks). Touchless Resolution Rate measures the percentage of incidents resolved completely without human intervention, isolating automation efficiency.

Answer

Mean Time to Ingest

Answer

Playbook Step Execution Count

Answer

Total Incident Dwell Time

Question 9

A security architect is defining the incident response lifecycle for a new SOC built on Cortex XSIAM. The CISO asks which phase of the NIST SP 800-61 lifecycle is responsible for validating that containment actions actually removed the adversary's access before returning the environment to normal operations. Which phase should the architect identify?

Accepted Answer

Containment, Eradication, and Recovery. The NIST SP 800-61 lifecycle places containment, eradication, and recovery together, and eradication specifically includes confirming that the adversary's access and artifacts have been removed before recovery begins. Validation of that removal is therefore an activity within this phase, not in detection, preparation, or post-incident review.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Detection and Analysis

Question 10

An architect is configuring Panorama to push configuration updates to managed firewalls using Panorama Templates and Template Stacks. A specific setting needs to be overridden at an individual firewall level without altering the template stack hierarchy. Which Panorama feature enables this capability?

Accepted Answer

Template Variables assigned specific values per managed firewall.. Template Variables in Panorama allow a single template or template stack to contain placeholder variables (e.g., $interface, $ip-address) whose values are defined per managed firewall. When the template stack is pushed, each firewall receives the same configuration structure but substitutes its own assigned variable values, enabling per-device customization without breaking the stack hierarchy or creating device-specific overrides.

Answer

Panorama WildCard objects

Answer

Device-level CLI overrides via administrative lockdown mode.

Answer

Global Object Override rules

Question 11

An architect is establishing security operations baseline metrics in Cortex XSIAM. The team wants to measure the percentage of alerts that are determined to be actionable threats versus benign noise. Which metric should be configured?

Accepted Answer

Signal-to-Noise Ratio (or True Positive Rate). The signal-to-noise ratio, also expressed as the true positive rate, directly measures the proportion of alerts that represent genuine actionable threats versus benign false positives. This is exactly the metric the team needs to quantify how much of the alert stream is meaningful. Configuring it in Cortex XSIAM lets the SOC track detection quality and tuning effectiveness over time.

Answer

Alert Volume Growth Rate

Answer

Analyst Utilization Rate

Answer

Incident Escalation Rate

Question 12

An enterprise security architect is designing an automated containment playbook in Cortex XSOAR for ransomware attacks. Which THREE automated actions should be incorporated into the playbook to effectively contain the threat while preserving forensic evidence? (Choose three)

Accepted Answer

Isolate the affected endpoint via Cortex XDR integration. Option A is correct because isolating the affected endpoint through the Cortex XDR integration cuts off lateral movement and C2 communication while keeping the host powered on, which preserves volatile memory and disk state for later forensics. Option B is correct because triggering an automated memory dump or forensic package collection via Cortex XDR captures volatile evidence (RAM, running processes, network connections) before any remediation or reboot destroys it. Option E is correct because revoking active user sessions and forcing password resets through the identity provider integration neutralizes compromised credentials that ransomware operators commonly use for lateral movement and persistence. Option C is not appropriate because immediately reimaging all domain controllers without investigation destroys forensic evidence and may not address the actual initial access vector. Option D is not appropriate because deleting backup snapshots removes the primary recovery path and is counterproductive to containment and restoration.

Answer

Immediately reimage all domain controllers without investigation

Answer

Delete all backup snapshots across all storage arrays

Question 13

Which TWO actions should an architect take when presenting security metrics to management to ensure credibility and actionable decision-making? (Choose two)

Accepted Answer

Provide contextual trend analysis and comparisons against historical baselines rather than raw isolated numbers. Option A is correct because presenting security metrics with contextual trend analysis and comparisons against historical baselines transforms isolated data points into meaningful patterns that management can interpret, enabling them to see whether risk is increasing or decreasing over time. Option B is correct because aligning technical security metrics with business risk and operational impact ensures that management understands how security posture translates into financial, regulatory, and operational consequences, which is essential for actionable decision-making and prioritization. Option C is incorrect because raw, unparsed log strings lack the summarization and interpretation needed for executive-level decision-making and would obscure rather than clarify the security posture. Option D is incorrect because hiding negative performance metrics undermines credibility and transparency, preventing management from making informed risk decisions. Option E is incorrect because changing baseline definitions weekly to artificially meet targets is a manipulative practice that destroys the credibility and integrity of the metrics program.

Answer

Present raw, unparsed log strings directly without summarization

Answer

Hide all negative performance metrics to avoid difficult conversations

Answer

Change baseline definitions weekly so targets are always artificially met

Question 14

An architect is configuring a Palo Alto Networks firewall and wants to prevent SYN flood attacks on public-facing web servers. Which security feature should the architect configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication Profile configured under Device > Authentication Profile referencing a RADIUS Server Profile.. Panorama or firewall Authentication Profiles allow defining RADIUS, LDAP, Kerberos, or SAML server connections for administrator and user authentication.

Answer

Data Filtering Profile settings.

Answer

Zone Protection Profile settings.

Answer

URL Filtering Profile settings.

Question 15

An architect is designing a multi-cloud network security architecture where Palo Alto Networks VM-Series firewalls are deployed in AWS, Azure, and GCP. Management and policy enforcement must be centralized. Which architectural design provides the most scalable management plane?

Accepted Answer

Centralized Panorama instance managing all multi-cloud VM-Series firewalls using Device Groups and Templates.. Deploying a centralized Panorama instance (either physical or virtual) managing all VM-Series firewalls across AWS, Azure, and GCP via templates and device groups provides the optimal multi-cloud management architecture.

Answer

Managing each cloud firewall independently via its local web GUI with no central management.

Answer

Using Cortex XSOAR as a replacement for Panorama configuration management.

Answer

Relying entirely on AWS CloudWatch to push security rules to Azure firewalls.

Question 16

An architect is designing log retention and data tiering policies in Cortex XSIAM. To balance regulatory compliance requirements (long-term storage) with high-performance analytics (short-term fast search), how should the data architecture be structured?

Accepted Answer

Configure active analytical storage for high-frequency queries and cold storage tiers for long-term compliance retention. Cortex XSIAM supports tiered storage architecture where high-performance active storage is used for immediate analytics and threat hunting, while colder storage tiers handle long-term retention.

Answer

Store all telemetry in volatile RAM cache indefinitely

Answer

Forward all raw logs exclusively to an external FTP server in plain text

Answer

Disable all log compression to ensure faster grep searches

Question 17

An architect is designing a Prisma Cloud compliance framework. Which TWO actions or configurations can be implemented in Prisma Cloud to assess and enforce cloud resource security? (Choose two)

Accepted Answer

Writing custom JSON compliance RQL (Resource Query Language) queries to find specific cloud misconfigurations.. Option B is correct because Prisma Cloud's Resource Query Language (RQL) allows security teams to write custom JSON-based queries that search cloud resource configurations and identify specific misconfigurations across providers, which is a core capability for assessing compliance. Option D is correct because Prisma Cloud ships with built-in compliance policies and supports custom policies mapped to recognized standards such as CIS Benchmarks, NIST, and PCI-DSS, enabling continuous assessment and enforcement against those frameworks. Option A is incorrect because SNMPv1 polling of power meters is a hardware/environmental monitoring function unrelated to cloud resource security assessment. Option C is incorrect because reflashing physical motherboards is not a Prisma Cloud capability and has nothing to do with cloud compliance. Option E is incorrect because installing GlobalProtect VPN clients on EC2 disks is an endpoint VPN deployment, not a Prisma Cloud compliance assessment or enforcement action.

Answer

Using SNMPv1 polling to check cloud provider power meters.

Answer

Directly reflashing cloud provider physical hardware motherboards.

Answer

Installing GlobalProtect desktop VPN clients on AWS EC2 virtual machine disks.

Question 18

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for known malware and spyware. Which security profile should the architect attach to the Security Policy rule?

Accepted Answer

Antivirus and Anti-Spyware security profiles. To inspect traffic for known malware and spyware, the firewall must apply Antivirus and Anti-Spyware security profiles. The Antivirus profile scans for viruses, worms, and trojans, while the Anti-Spyware profile detects and blocks spyware, command-and-control traffic, and known malicious domains. Both profiles are attached to the Security Policy rule to enforce content inspection.

Answer

File Blocking profile

Answer

Data Filtering profile

Answer

URL Filtering profile

Question 19

Which metric should a SOC manager review to determine whether alerts are being investigated in a timely manner after they are generated?

Accepted Answer

Mean Time to Acknowledge (MTTA). Mean Time to Acknowledge (MTTA) or Mean Time to Triage measures the speed from alert creation to the start of analyst investigation.

Answer

Total Log Storage Volume in Terabytes

Answer

Firewall Rule Hit Count

Answer

Cortex XDR Agent Deployment Percentage

Question 20

A security operations architect is designing a threat intelligence-driven response architecture using Cortex XSOAR. The architect wants to automatically enrich indicators of compromise (IOCs) from multiple sources and then make a risk-based decision to block or allow them. Which component of Cortex XSOAR should be used to define the logic that correlates and scores the IOCs from different intelligence sources?

Accepted Answer

Reputation Calculation. Reputation Calculation is the Cortex XSOAR feature that enables architects to define custom scoring logic for indicators, aggregating data from multiple sources and applying weights to produce a risk score. This score can then drive automated decisions. The other options are structural or connectivity components that do not provide the required correlation and scoring logic.

Answer

Indicator Type

Answer

Playbook

Answer

Integration Instance