SecOps-Architect Practice Exam 4 — 20 Questions

Question 1

An architect is configuring Palo Alto Networks firewall interfaces. Which TWO interface types are supported in PAN-OS for routing traffic between security zones? (Choose two)

Accepted Answer

Layer 3 interface assigned an IP address and virtual router.. PAN-OS supports Layer 3 interfaces, Layer 2 interfaces, Virtual Wire (vwire), Tap, and Loopback/Tunnel interfaces.

Answer

Bluetooth Low Energy (BLE) antenna interface.

Answer

Universal Serial Bus (USB) printer interface.

Answer

HDMI multimedia display interface.

Question 2

An architect is configuring a Palo Alto Networks firewall and wants to inspect encrypted TLS traffic passing through the firewall without terminating the SSL session on the firewall itself (e.g., to identify malicious JA3 signatures or SNI without decryption). Which feature should the architect configure?

Accepted Answer

App-ID inspection of SSL/TLS Server Name Indication (SNI) and certificate attributes during handshake.. SSH Proxy or SSL Decryption without decryption (using SSL Forward Proxy visibility or inspecting SNI/certificate metadata) allows visibility into encrypted traffic metadata. Specifically, App-ID uses SNI and certificate inspection in TLS handshakes without full decryption.

Answer

Installing GlobalProtect portal certificates.

Answer

Formatting logs into raw Syslog CEF.

Answer

Disabling all security profiles.

Question 3

An architect is designing an enterprise deployment of Palo Alto Networks firewalls managed by Panorama. A requirement is that certain firewall configuration changes (such as local interface IP addresses) must remain unique per firewall while security rules remain centrally managed. Which Panorama feature should the architect use?

Accepted Answer

Template Variables defined in Panorama templates with unique values assigned per firewall.. Template Variables allow defining unique values per firewall while using centralized templates.

Answer

GlobalProtect HIP object criteria.

Answer

Panorama Pre-Rules with static 'any-any' destinations.

Answer

Global Administrative lockdown mode.

Question 4

An architect is designing a multi-tenant Palo Alto Networks firewall deployment using Virtual Systems (vsys). Each vsys requires dedicated administrative access. Which administrative object must be configured to grant a specific administrator access to only one particular vsys?

Accepted Answer

Administrative Role with restricted Access Domain pointing to the specific vsys.. Administrative Roles and Access Domains allow restricting administrators to specific virtual systems (vsys) or device groups.

Answer

GlobalProtect HIP object profiles.

Answer

Global Superuser account sharing.

Question 5

An architect is designing a Prisma Cloud Compute deployment for cloud-native applications. Which TWO security scanning and monitoring capabilities are provided by Prisma Cloud Compute? (Choose two)

Accepted Answer

Vulnerability scanning for container images, serverless functions, and virtual machine hosts.. Prisma Cloud Compute provides vulnerability scanning for container images, serverless functions, and host VMs, plus runtime defense and compliance checks.

Answer

Physically rewiring enterprise data center power distribution units.

Answer

Hosting public website domains on Prisma Cloud Defender node storage.

Answer

Printing physical compliance paper certificates on office laser printers.

Question 6

An incident response architect is defining severity levels for security alerts in Cortex XDR. Which severity classification typically triggers automated containment playbooks without human intervention?

Accepted Answer

Critical. High or Critical severity alerts are commonly mapped to automated containment responses in modern SOAR architectures.

Answer

Debugging

Answer

Low

Answer

Informational

Question 7

An architect is configuring a Palo Alto Networks firewall and wants to inspect compressed or archived files (such as .zip or .tar files) for embedded malware. Which security profile feature enables this inspection?

Accepted Answer

Antivirus and File Blocking profiles configured with archive unpacking enabled.. File Blocking and Antivirus profiles support archive unpacking (decompression) to inspect nested files within archives.

Answer

Zone Protection profile with SYN cookies.

Answer

URL Filtering profile with SSL decryption disabled.

Answer

DNS Security service sinkhole.

Question 8

When setting up automated email parsing in Cortex XSOAR for phishing triage, which integration is specifically required to connect to Microsoft Office 365 using modern authentication (OAuth 2.0)?

Accepted Answer

Microsoft Graph Mail integration. The Microsoft Office 365 Mail integration (or MS Graph Mail) uses OAuth 2.0 to ingest emails securely.

Answer

SMTP Relay Server integration

Answer

Legacy Exchange IMAP integration

Answer

Active Directory LDAP integration

Question 9

An architect is designing an enterprise threat hunting program utilizing Cortex XSIAM. They want to create a custom analytics rule that triggers when a specific sequence of three distinct event types occurs within a 10-minute window on the same endpoint. Which feature should be used?

Accepted Answer

XQL Correlation Rules (Sequence matching). Data Stitching and XQL correlation rules allow multi-event sequence detection across datasets and time windows.

Answer

Static IP Blocklist configuration

Answer

XSOAR Email Parsing Rules

Answer

Cortex XDR Agent Local Analysis settings

Question 10

An architect is designing an enterprise incident response communication plan. Which THREE components are critical for effective operational coordination during a major security incident? (Choose three)

Accepted Answer

Pre-defined stakeholder and legal notification escalation trees. Effective operational coordination requires secure communication channels, stakeholder notification trees, and centralized logging.

Answer

Publicly posting all unredacted forensic disk images on social media

Answer

Disabling all documentation to maintain total secrecy

Question 11

When designing an incident post-mortem (lessons learned) process following NIST guidelines, which TWO activities should the security architect mandate? (Choose two)

Accepted Answer

Conducting a root cause analysis review meeting with key stakeholders. Post-incident activities include conducting a root cause analysis meeting, documenting lessons learned, updating playbooks, and improving detection rules.

Answer

Deleting all firewall and SIEM log archives immediately

Answer

Reverting all system configurations to factory defaults without review

Answer

Publicly disclosing employee disciplinary actions on social media

Question 12

An architect is designing a multi-virtual router architecture on a Palo Alto Networks firewall. What is the primary purpose of configuring multiple virtual routers on a single firewall?

Accepted Answer

To maintain separate routing tables and participate in multiple routing protocols across different zones or interfaces.. Multiple virtual routers allow the firewall to participate in different routing tables and routing protocols (OSPF, BGP, static) across different security zones or interfaces.

Answer

To increase the hardware clock speed of the management plane CPU.

Answer

To replace the need for security policy rules.

Answer

To automatically generate Panorama device groups.

Question 13

An architect is troubleshooting a Panorama deployment where managed firewalls show a 'Disconnected' status in the Panorama GUI. Which TWO connectivity requirements should the architect verify? (Choose two)

Accepted Answer

Verify that TCP port 3978 (Panorama SSL/TLS communication) is open and not blocked by intermediate firewalls or security groups.. Firewalls and Panorama communicate management traffic over TCP port 3978 (SSL/TLS). Verifying network routing, firewall rules, and management interface reachability is crucial.

Answer

Check the physical color of the office carpet near the server rack.

Answer

Verify the HDMI cable connection on the firewall console port.

Answer

Check if the user desktop browser has JavaScript enabled.

Question 14

When designing a threat hunting methodology aligned with the MITRE ATT&CK framework, an architect wants to identify adversary persistence mechanisms. Which tactic category should the analyst focus queries on?

Accepted Answer

Persistence. Persistence tactics include techniques such as Registry Run Keys, Startup Folder, and Scheduled Tasks.

Answer

Initial Access

Answer

Collection

Answer

Execution

Question 15

When planning an incident response table-top exercise for a Security Operations team, which framework provides a standardized taxonomy for describing adversary behaviors and tactics?

Accepted Answer

MITRE ATT&CK Framework. MITRE ATT&CK provides a comprehensive matrix of adversary tactics and techniques.

Answer

PCI-DSS v4.0

Answer

ITIL v4 Service Management

Answer

ISO/IEC 27001

Question 16

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for spyware callback communications to command-and-control servers. Which security profile should be configured?

Accepted Answer

Anti-Spyware security profile. Anti-Spyware profiles inspect traffic for known spyware signatures and command-and-control (C2) communication patterns.

Answer

URL Filtering profile

Answer

Data Filtering profile

Answer

WildFire analysis profile

Question 17

In a multi-tenant Cortex XSOAR deployment, an architect needs to restrict access to specific playbooks so that Tenant A analysts cannot view or execute playbooks owned by Tenant B. Where is this access control configured?

Accepted Answer

Role-Based Access Control (RBAC) settings under Settings > Common > Roles. Role-Based Access Control (RBAC) in Cortex XSOAR allows restricting playbook and incident type visibility based on assigned roles.

Answer

Global Server Configuration settings

Answer

Playbook JSON source code permissions

Answer

Integration instance parameters

Question 18

An organization is integrating Prisma Cloud with Cortex XSOAR to automate cloud incident response. When configuring the Prisma Cloud integration instance in XSOAR, which authentication mechanism is recommended to securely fetch alerts without using static user credentials?

Accepted Answer

OAuth 2.0 Client Credentials grant via a dedicated Service Account. Prisma Cloud integration instances in XSOAR use Access Key ID and Secret Key generated via Service Accounts for secure API access.

Answer

LDAP bind credentials through a Cortex XDR Broker VM

Answer

HTTP Basic Authentication with administrative credentials

Answer

SAML 2.0 Federation token exchange

Question 19

Which role in a well-structured Security Operations Center (SOC) is primarily responsible for performing tier-2 incident triage, deep investigation, and playbook execution?

Accepted Answer

SOC Tier-2 Analyst / Incident Responder. Tier-2 analysts handle escalated alerts requiring deeper investigation and active remediation.

Answer

Compliance Auditor

Answer

Chief Information Security Officer (CISO)

Answer

Helpdesk Support Technician

Question 20

An architect is configuring Indicator Sharing in Cortex XSOAR using the Threat Intel Management module. How are incoming STIX/TAXII indicator feeds prioritized when conflicting reputation scores are received from multiple sources?

Accepted Answer

By configuring source reliability and vendor weight settings. Threat Intel Management in XSOAR uses indicator scoring rules and source reliability weights to determine the final composite score.

Answer

Alphabetical sorting of feed names

Answer

Manual override for every single indicator

Answer

First-in, first-out ingestion timestamp priority