SecOps-Architect Practice Test 23 — 15 Questions

Question 1

An architect is designing a Prisma Access deployment for a large enterprise with multiple branch offices. The architect needs to ensure that traffic from branch offices to the internet is inspected by Prisma Access while traffic to internal applications is routed directly over the corporate WAN. Which Prisma Access component should be used to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remote Network with BGP routing and policy-based forwarding. Prisma Access Remote Network is designed to connect branch offices and data centers to Prisma Access. By using BGP, the branch can advertise routes and direct internet-bound traffic to Prisma Access while keeping internal traffic on the WAN. Policy-based forwarding on the branch firewall can further refine traffic selection. This provides the required selective inspection without impacting internal traffic.

Answer

Service Connection with static routes and NAT policies

Answer

Mobile Users with GlobalProtect and split tunneling

Answer

Explicit Proxy with PAC files to redirect traffic to Prisma Access

Question 2

An architect is designing an enterprise incident response workflow in Cortex XSOAR. When a phishing email is reported, the playbook needs to parse the email headers, extract attachments, submit them to WildFire, and notify the security team via Slack. Which component in Cortex XSOAR is responsible for receiving the incoming phishing email and triggering the playbook?

Accepted Answer

Email integration instance (such as Email Server or EWS) with incident classification and mapping.. Incoming email integration instances (such as Email Parsing / EWS / Gmail integrations) ingest emails and trigger associated playbooks based on classifier mapping.

Answer

Prisma Access Remote Network IPsec tunnel.

Answer

GlobalProtect client certificate authority.

Answer

Panorama SNMP trap listener.

Question 3

An architect is designing a Prisma Cloud Compute deployment for Kubernetes clusters. Which TWO architectural components must be considered when planning Defender deployments for security monitoring? (Choose two)

Accepted Answer

Deploying Defender as a Kubernetes DaemonSet to monitor all pods and container runtimes on every worker node.. Option D is correct because Prisma Cloud Compute's Defender is deployed on Kubernetes worker nodes as a DaemonSet, which guarantees one Defender pod runs on every node so it can monitor all pods, container runtimes, and host activity for the cluster. Option E is correct because Defenders must maintain network connectivity to the Prisma Cloud Compute Console (typically over TLS on port 8083, or via a proxy) to receive policies, intelligence updates, and to forward audit events, runtime incidents, and scan results back to the Console. Options A, B, and C are incorrect: GlobalProtect is a Palo Alto Networks VPN client unrelated to Prisma Cloud Compute container monitoring, Defender is a software agent rather than a physical chip soldered to a motherboard, and SNMPv1 agents on loopback interfaces are neither a Prisma Cloud Compute component nor a valid monitoring mechanism for container security.

Answer

Configuring GlobalProtect gateway tunnels inside every container container root filesystem.

Answer

Physically soldering Defender chips onto the motherboard of the Kubernetes master node.

Answer

Installing SNMPv1 agents on all container loopback interfaces.

Question 4

An architect is building a threat-response playbook that must enrich indicators of compromise before containment decisions. The team wants to apply the Structured Threat Information Expression (STIX) 2.1 object model when exchanging indicators with partner SOCs. Which statement correctly describes how STIX 2.1 represents a malicious file hash shared between organizations?

Accepted Answer

It is encoded as an Indicator SDO whose pattern references a File SCO containing the hash value. STIX 2.1 separates cyber observables, modeled as SCOs such as File with hashes, from the analytic assertion of maliciousness, modeled as an Indicator SDO whose pattern references that SCO. This clean separation supports independent sharing and automated matching, whereas wrapping the value in Malware, Observed-Data, or Relationship objects misuses those object types.

Answer

It is encoded as a Relationship SRO that connects two Identity objects using the hash as its ID

Answer

It is encoded as a single Malware SDO with the hash stored in its sample_refs property

Answer

It is encoded as an Observed-Data SDO that wraps the hash and the sighting timestamp

Question 5

A security operations architect is defining metrics to evaluate the effectiveness of the incident response process in Cortex XSIAM. The SOC manager wants to understand how often incidents are reopened after being marked resolved, as this indicates potential gaps in resolution quality. Which metric should the architect track?

Accepted Answer

Incident Reopen Rate. The SOC manager wants to assess resolution quality by tracking how often incidents are reopened. Incident Reopen Rate is the only metric that directly quantifies this behavior. MTTR, False Positive Rate, and Incident Volume per Analyst address speed, alert accuracy, and workload, respectively, and none of them measure the frequency of reopened incidents.

Answer

Mean Time to Resolve (MTTR)

Answer

False Positive Rate

Answer

Incident Volume per Analyst

Question 6

An architect is designing a metrics dashboard in Cortex XSIAM to monitor the health of the SOC's detection and response capabilities. The dashboard should include metrics that indicate the SOC's ability to detect and respond to threats in a timely manner. Which TWO metrics are most appropriate to include? (Choose two.)

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect and Mean Time to Respond are the two metrics that directly measure the SOC's timeliness in detecting and responding to threats. They are complementary and provide a clear picture of the SOC's operational speed, making them ideal for a health dashboard.

Answer

Number of Alerts per Day

Answer

Percentage of False Positives

Answer

Analyst Utilization Rate

Question 7

A SecOps architect is building a dashboard in Cortex XSIAM to monitor the health of the incident response process. They want to include metrics that together provide a balanced view of both efficiency and effectiveness. Which two metrics should they include? (Choose two.)

Accepted Answer

Incident Closure Rate. MTTR and Incident Closure Rate together provide a balanced view: MTTR measures efficiency (speed) and Incident Closure Rate measures effectiveness (throughput). Both are directly derived from Cortex XSIAM incident data and are standard metrics for assessing incident response process health. They complement each other to highlight both how fast and how completely incidents are handled.

Answer

Number of open incidents

Answer

Average analyst overtime hours

Answer

Total alerts ingested

Question 8

An architect is designing an automated threat containment architecture using Cortex XSOAR and Prisma Cloud. When Prisma Cloud detects a critical misconfiguration or malware in a running container workload, it triggers a webhook to Cortex XSOAR. What mechanism does XSOAR use to parse the webhook payload and initiate the incident response playbook?

Accepted Answer

Webhook integration instance with incoming mapper and classifier configuration.. Cortex XSOAR uses Webhook integrations with classifier and mapper configurations to ingest incoming JSON payloads from tools like Prisma Cloud and map them to incident fields.

Answer

Panorama SNMP trap listener daemon.

Answer

GlobalProtect HIP notification profile.

Answer

Prisma Access Remote Network IPsec profile.

Question 9

An architect is designing a zero-trust network architecture using Prisma Access and Cortex XDR. Which TWO architectural integrations between Prisma Access and Cortex XDR enhance end-to-end visibility and threat detection? (Choose two)

Accepted Answer

Configuring Cortex XDR analytics to ingest Prisma Access connection logs to detect anomalous remote user behavior.. Option B is correct because Cortex XDR analytics can ingest Prisma Access connection logs, allowing it to baseline and detect anomalous remote-user behavior such as impossible travel, unusual access times, or abnormal data volumes, which is a core zero-trust visibility use case. Option D is correct because Prisma Access forwards traffic, threat, and URL/traffic logs to Cortex Data Lake, where Cortex XDR correlates them with endpoint telemetry to provide end-to-end detection across network and endpoint. The remaining options are not valid integrations: A proposes replacing GlobalProtect with raw FTP daemons, which is neither secure nor a Prisma Access/Cortex XDR integration; C suggests SNMPv1 polling of Prisma Access RAM from browsers, which is not how Prisma Access is monitored and SNMPv1 is insecure and irrelevant here; E describes installing physical firewall ASICs via USB onto laptops, which is not a real Prisma Access or Cortex XDR architectural integration.

Answer

Replacing all GlobalProtect clients with raw FTP daemons.

Answer

Using SNMPv1 polling to read Prisma Access RAM from client web browsers.

Answer

Installing physical firewall ASICs directly onto laptop motherboards via USB.

Question 10

An architect is designing an incident response automation strategy in Cortex XSOAR. Which TWO best practices should be followed when developing custom playbooks? (Choose two)

Accepted Answer

Implement robust error handling and conditional branching for integration failures. Option A is correct because custom Cortex XSOAR playbooks must anticipate integration failures (e.g., API timeouts, authentication errors, rate limits) and use conditional branching, task conditions, and error-handling paths so the playbook can retry, fall back, or escalate rather than aborting mid-incident. Option D is correct because modular sub-playbooks encapsulate repetitive logic (enrichment, containment, notification), making playbooks reusable across incident types, easier to maintain, and simpler to test and version. Option B is not correct: running every integration command synchronously in one monolithic block serializes execution, wastes time, and prevents parallel task execution and granular error isolation. Option C is not correct: hardcoding API credentials in Python script tasks exposes secrets in playbook content and violates credential management; XSOAR provides the Credentials store and integration instances for secure secret handling. Option E is not correct: disabling incident context output removes the data needed for investigation, reporting, and downstream task inputs, and storage savings do not justify losing context.

Answer

Execute all integration commands synchronously in a single monolithic task block

Answer

Hardcode API credentials directly inside Python script tasks for fast execution

Answer

Disable incident context output to save database storage space

Question 11

An architect is planning to onboard a new branch office into an existing Prisma Access deployment. The branch has a single Palo Alto Networks firewall and needs to forward user traffic to Prisma Access for security inspection while also allowing the branch to reach internal data center applications over the corporate WAN. Which component should the architect configure on the branch firewall to establish the secure tunnel to Prisma Access?

Accepted Answer

A remote network IPSec tunnel to a Prisma Access remote network onboarding endpoint, with policy-based forwarding for internet-bound traffic.. Remote network onboarding creates an IPSec tunnel from the branch firewall to Prisma Access, enabling traffic inspection for the site. Policy-based forwarding on the branch firewall can direct only internet-bound traffic into the tunnel while the corporate WAN continues to carry data center traffic, satisfying both requirements without over-tunneling.

Answer

A GlobalProtect portal configuration on the branch firewall pointing endpoints to Prisma Access.

Answer

A Prisma Access explicit proxy configuration on the branch firewall with a forward proxy policy for all web traffic.

Answer

An IPSec tunnel to a Prisma Access service connection with a static route for the data center subnet.

Question 12

A multinational SOC architect is designing a threat response architecture based on the MITRE ATT&CK framework. The CISO wants assurance that the architecture can detect and respond to adversary techniques across all stages of an intrusion. The architect must select a primary capability that maps detections and response actions to ATT&CK techniques. Which component best fulfills this requirement?

Accepted Answer

A SIEM with correlation rules that generate alerts tagged with ATT&CK technique IDs, integrated with SOAR playbooks for response.. The correct answer is a SIEM with ATT&CK-tagged correlation rules integrated with SOAR playbooks. This architecture enables detection across multiple stages through correlation rules that map to ATT&CK techniques, while SOAR playbooks provide automated response actions tied to those techniques. It directly meets the CISO's requirement for comprehensive coverage and response, unlike narrower tools that focus on specific domains or only indicators.

Answer

A threat intelligence platform that ingests IOCs and maps them to ATT&CK techniques for automated blocking.

Answer

An endpoint detection and response (EDR) solution that blocks malicious process executions and provides ATT&CK technique coverage for endpoints.

Answer

A vulnerability management system that prioritizes patching based on ATT&CK techniques exploited in the wild.

Question 13

A security operations architect is designing a threat response architecture for a new SOC. The organization wants to adopt the NIST Incident Response Lifecycle to structure their processes. The CISO asks which phase should include activities such as developing an incident response plan, establishing communication protocols, and training staff. Which phase is being described?

Accepted Answer

Preparation. The correct answer is Preparation. In the NIST Incident Response Lifecycle, Preparation is the phase where organizations build their incident response capabilities, including developing plans, establishing communication protocols, and training staff. These activities are proactive and occur before any incident, ensuring that the SOC is ready to respond effectively. The other phases are reactive and focus on handling incidents once they occur.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Containment, Eradication, and Recovery

Question 14

An architect is designing a Cortex XSOAR integration for a SOC where analysts must be able to approve or reject containment actions from a chat platform. The playbook must pause execution until an analyst responds, and the response must be authenticated against Cortex XSOAR users. Which Cortex XSOAR capability should the architect use to implement this human-in-the-loop approval step?

Accepted Answer

A Cortex XSOAR task configured with the 'Ask' or 'Manual' type, which sends a question to a configured channel and waits for an authenticated user response.. Cortex XSOAR's manual/Ask task type is purpose-built for human-in-the-loop steps: it pauses playbook execution, delivers the question to a configured channel, and only resumes with a response from an authenticated Cortex XSOAR user. This provides both the required blocking behavior and an auditable approval record. Polling loops, fire-and-forget webhooks, and generic field-change triggers lack the native authentication and deterministic pause that this approval workflow requires.

Answer

A script task written in Python that opens an outbound webhook to the chat platform and immediately continues the playbook.

Answer

An incident field change trigger that resumes the playbook when a custom field is edited by any user.

Answer

A generic polling task that queries an external ticketing system every 60 seconds for a status change.

Question 15

An architect is integrating Prisma Access with a third-party SIEM. The SIEM must receive Prisma Access logs with low latency and support selective subscription so that only threat and traffic logs are forwarded, while URL logs remain in Cortex Data Lake for later query. Which Prisma Access log-forwarding method should the architect choose?

Accepted Answer

Configure an HTTP log-forwarding profile on the Prisma Access tenant that posts selected log types directly to the SIEM collector.. Prisma Access log-forwarding profiles let architects choose specific log types and deliver them over HTTP/HTTPS to an external collector with low latency. By selecting threat and traffic while omitting URL, the design keeps URL logs in Cortex Data Lake for later query and satisfies the SIEM's real-time needs. Batch exports, polling the query API, and portal-level syslog do not provide the same selective, low-latency streaming behavior.

Answer

Export all logs from Cortex Data Lake to an external storage bucket, then have the SIEM pull only threat and traffic files.

Answer

Use the Cortex Data Lake query API from the SIEM to poll for new threat and traffic logs on a short interval.

Answer

Enable syslog forwarding from the Prisma Access mobile user portals to the SIEM, selecting only threat and traffic facilities.