SecOps-Architect Practice Test 3 — 25 Questions

Question 1

An architect is reviewing the Cortex XSIAM Analytics dashboard to identify root causes of security incidents. Which data visualization component aggregates related alerts into a single attack storyline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident Storyline. The Incident Storyline in Cortex XSIAM aggregates related alerts into a single attack storyline, providing a unified view of an incident. It correlates alerts from multiple sources to show the sequence of events and root cause. This visualization helps architects understand the attack chain.

Answer

Raw Syslog Viewer

Answer

Indicator Grid

Answer

Dashboard Widget Editor

Question 2

An enterprise is designing a zero-trust architecture where Cortex XDR integrates with Palo Alto Networks Next-Generation Firewalls. Which protocol and component facilitate real-time dynamic blocklisting of compromised endpoints across both the firewall and the endpoint?

Accepted Answer

Cortex XDR incident handler pushing dynamic IP/URL lists to firewalls via PAN-OS API. The Cortex XDR enforcement service pushes dynamic block lists (EDL / IP lists) via XML API or PAN-OS integration to the firewalls.

Answer

Syslog forwarding from firewalls to the local endpoint agent

Answer

SNMP traps sent from endpoints to the firewall management plane

Answer

User-ID agent querying Active Directory via LDAP

Question 3

You need to establish a baseline for normal network traffic and security events across multiple disparate log sources in Cortex XSIAM. What feature should you leverage to aggregate and normalize this data for consistent metric reporting?

Accepted Answer

Cortex XSIAM Parsing Rules and Data Models. Cortex XSIAM uses Parsing Rules (CIM normalization) and Data Models to normalize heterogeneous log data into a consistent schema, enabling accurate cross-source metric reporting.

Answer

WildFire Local Analysis Appliances

Answer

Cortex XSOAR Email Integration Instances

Answer

Prisma SASE Traffic Shapers

Question 4

An architect is defining Key Performance Indicators (KPIs) in Cortex XSIAM to measure the efficiency of Tier-1 analysts. Which built-in metric best evaluates the speed at which analysts initially acknowledge and begin investigating incoming alerts?

Accepted Answer

Mean Time to Acknowledge (MTTA). Mean Time to Acknowledge (MTTA) specifically measures the speed at which analysts transition an alert from new to in-progress, directly evaluating initial triage speed.

Answer

False Positive Rate (FPR)

Answer

Mean Time to Resolution (MTTR)

Answer

Mean Time to Contain (MTTC)

Question 5

An architect is designing an incident response workflow in Cortex XSOAR using the Incident Spooler. Which component is primarily responsible for processing queued events into actionable incidents?

Accepted Answer

Cortex XSOAR Server engine. The War Room is where manual actions and playbooks execute, but the Server engine handles the queue processing and ingestion from the Incident Spooler.

Answer

Demisto REST API

Answer

Threat Intel Management module

Answer

Cortex XSIAM Data Lake collector

Question 6

An architect is designing a secure cloud network architecture using Prisma Access. Which TWO deployment models or components are available in Prisma Access to connect corporate data centers and branch offices? (Choose two)

Accepted Answer

Remote Networks (connecting branch offices via IPsec VPN tunnels to Prisma Access cloud nodes).. Option C is correct because Remote Networks is a Prisma Access deployment component specifically designed to connect branch offices and small sites to the Prisma Access cloud infrastructure using IPsec VPN tunnels terminated on Prisma Access service nodes. Option D is correct because Service Connections is a Prisma Access component that connects corporate headquarters, data centers, or other internal networks to Prisma Access, enabling secure hub-and-spoke routing and access to internal resources through the cloud security platform. Option A is incorrect because Cortex XDR Agent is an endpoint protection agent and cannot be installed on ISP core routers, nor is it a Prisma Access connectivity model. Option B is incorrect because public FTP servers are not a supported or secure mechanism for bridging internal LAN traffic to Prisma Access. Option E is incorrect because physically splicing copper coaxial cables into a Palo Alto Networks office is not a Prisma Access deployment model and is not technically or operationally feasible.

Answer

Installing Cortex XDR Agent directly onto ISP core routers.

Answer

Using public FTP servers to bridge internal LAN traffic to the cloud.

Answer

Direct physical copper coaxial cables spliced from branch offices into the nearest Palo Alto Networks corporate office.

Question 7

An architect is designing an automated threat hunting and containment workflow using Cortex XSOAR. Which TWO external or internal data sources can Cortex XSOAR query or integrate with during an investigation? (Choose two)

Accepted Answer

Active Directory domain controllers for user account status verification.. Option A is correct because Cortex XSOAR can integrate with Active Directory (via the LDAP-based AD integration or the Active Directory Query v2 integration) to query domain controllers and verify user account status, such as whether an account is enabled, disabled, or locked out, which is essential during containment decisions. Option D is correct because Cortex XSOAR natively supports threat intelligence platform integrations, including VirusTotal and Palo Alto Networks WildFire, to enrich indicators (hashes, IPs, URLs, domains) with reputation and verdict data during automated investigations. Options B, C, and E are incorrect because they describe non-standard, unsupported data sources (Bluetooth IoT coffee machine sensors, FM radio tuners, and analog modem dial-up switches) that are not part of Cortex XSOAR's integration ecosystem and have no relevance to enterprise threat hunting or containment workflows.

Answer

Local coffee machine IoT sensors via raw Bluetooth packets.

Answer

FM radio broadcast frequency tuners.

Answer

Raw analog telephone landline switches via modem dial-up.

Question 8

An architect is configuring User-ID mapping using the Palo Alto Networks Windows-based User-ID Agent. To ensure high availability and prevent single points of failure, how should multiple User-ID agents be configured in Panorama or the firewall?

Accepted Answer

Configure multiple User-ID agents in a server list where the firewall queries secondary agents if the primary agent becomes unreachable.. Panorama and firewalls allow configuring multiple User-ID agents in a priority-ordered list or server monitor group so if one agent fails, another takes over.

Answer

Deploy agents on every user workstation without domain controllers.

Answer

Merge all agents into a single physical process via CLI kernel patching.

Answer

Rely solely on static IP address lists.

Question 9

An enterprise security architect is configuring automated threat intelligence sharing between Cortex XSOAR and external ISACs using STIX/TAXII. Which component within Cortex XSOAR is primarily responsible for managing incoming threat indicators, deduplication, and indicator scoring?

Accepted Answer

Threat Intelligence Management (TIM) module. The Threat Intelligence Management (TIM) module within Cortex XSOAR handles indicator lifecycle management, deduplication, scoring, and propagation to enforcement points.

Answer

Cortex XDR Analytics Engine

Answer

Incident Investigation Canvas

Answer

Machine Learning Service Broker

Question 10

When evaluating the maturity of an Incident Response program using the CMMI (Capability Maturity Model Integration) framework, what characterizes a 'Managed' (Level 2) process?

Accepted Answer

Processes are planned, executed, measured, and controlled at the project level. In CMMI, a Managed (Level 2) process is characterized by being planned, performed, measured, and controlled at the project level. Work products and services are managed against a documented plan, and performance is tracked so corrective action can be taken. This is a project-specific discipline, not yet an organization-wide standard.

Answer

Processes are standardized across the entire organization

Answer

Processes are entirely ad-hoc and reactive

Answer

Processes are quantitatively optimized through statistical data

Question 11

An architect is configuring a Palo Alto Networks firewall and wants to prevent SYN flood attacks on public-facing web servers. Which security feature should the architect configure?

Accepted Answer

Zone Protection profile configured with SYN flood SYN cookies.. Zone Protection profiles provide protection against flood attacks (SYN flood, UDP flood, ICMP flood), IP spoofing, and reconnaissance.

Answer

Data Filtering profile.

Answer

URL Filtering profile.

Answer

WildFire file analysis profile.

Question 12

An architect is designing a secure architecture using VM-Series on Microsoft Azure. Which TWO Azure-native services or integration components must be configured to achieve high availability with dynamic failover of user traffic across two VM-Series instances? (Choose two)

Accepted Answer

Azure Load Balancer (Standard SKU) to distribute inbound and outbound traffic to the VM-Series data interfaces.. Option C is correct because an Azure Load Balancer (Standard SKU) is the Azure-native mechanism used to distribute inbound and outbound traffic across the data interfaces of two VM-Series firewalls, providing the traffic-fronting component needed for dynamic failover in an active/active or active/passive HA design. Option D is correct because Azure User Defined Routes (UDR) control the effective routing for subnets, and the PAN-OS SDN Connector dynamically rewrites those UDR entries so traffic is redirected to the surviving VM-Series instance during a failover event. Options A and B are incorrect because Azure does not expose physical fiber or copper cross-connects to customer VMs, and HA2 links between VM-Series instances are implemented over the Azure network rather than physical cabling. Option E is incorrect because Microsoft Entra Domain Services is an identity service and plays no role in traffic redirection or firewall high availability failover.

Answer

Physical HA2 fiber optic cables connected between Azure availability zones.

Answer

Azure ExpressRoute direct copper cross-connect cables plugged into the firewall physical NICs.

Answer

Azure Active Directory Domain Services domain controller deployed inside the firewall data plane.

Question 13

When designing an operational dashboard in Cortex XSIAM to monitor SOC analyst workload distribution, which metric is most useful?

Accepted Answer

Number of assigned open incidents per analyst. To monitor SOC analyst workload distribution, the most useful metric is the number of assigned open incidents per analyst. This directly reflects each analyst's current workload and helps balance assignments, identify overload, and manage capacity.

Answer

WildFire malicious verdict percentage

Answer

Cortex XDR agent version distribution

Answer

Total firewall throughput in gigabits per second

Question 14

An architect is designing a large-scale Prisma Access deployment with hundreds of remote networks. To simplify routing management and avoid full-mesh IPsec tunnel complexity between all branch sites, what architectural topology does Prisma Access employ by default?

Accepted Answer

Cloud-backed hub-and-spoke architecture where remote networks connect to Prisma Access cloud nodes, which handle backbone routing.. Prisma Access uses a cloud-backed hub-and-spoke topology: each remote network (branch) establishes an IPsec tunnel to the nearest Prisma Access cloud node, and the Prisma Access backbone handles inter-branch routing. This eliminates the need for full-mesh tunnels between every branch pair, dramatically simplifying routing and scaling. The cloud nodes act as the hub, providing centralized policy enforcement and optimized backbone paths.

Answer

Ring topology relying entirely on legacy Token Ring protocols.

Answer

Full-mesh BGP peering over physical leased dark fiber lines directly connecting every branch office to all other branch offices.

Answer

Peer-to-peer BitTorrent distribution of routing tables.

Question 15

An architect is configuring Panorama to manage a large deployment of firewalls. Which TWO best practices should be implemented regarding Panorama administrative access and security? (Choose two)

Accepted Answer

Configure Role-Based Access Control (RBAC) using custom Admin Roles and Access Domains to restrict administrators to their assigned device groups.. Panorama admin best practices include enforcing Role-Based Access Control (RBAC) via Admin Roles and Access Domains, and enforcing multi-factor authentication (MFA) for all administrators.

Answer

Expose the Panorama management interface directly to the public internet without an IP whitelist or VPN.

Answer

Share a single 'admin' superuser account credential among all members of the network team.

Answer

Disable all logging on Panorama to save disk space.

Question 16

An architect is configuring User-ID to map users via Palo Alto Networks Terminal Services (TS) Agent. Where must the TS Agent be installed in the network architecture?

Accepted Answer

Directly on the Microsoft Terminal Server or Citrix XenApp server.. The Palo Alto Networks Terminal Services (TS) Agent is a lightweight agent that runs directly on the multi-user host — Microsoft Terminal Server or Citrix XenApp — to map individual user sessions to source ports. Because all users on a terminal server share the same IP address, the firewall cannot distinguish them by IP alone; the TS Agent solves this by allocating a unique source port range per user session and reporting the mapping to the firewall via User-ID.

Answer

Inside the Cortex XDR Broker VM appliance.

Answer

On the external DNS root server.

Answer

On the Panorama management virtual appliance.

Question 17

An architect is designing an enterprise security architecture integrating Prisma Access, Cortex XDR, and Cortex XSOAR. Which TWO architectural benefits are realized by this tight integration? (Choose two)

Accepted Answer

Automated incident response orchestration and remediation across network and endpoints using Cortex XSOAR playbooks.. Option D is correct because Cortex XSOAR is the orchestration, automation, and response (SOAR) platform that consumes alerts from Prisma Access and Cortex XDR and executes playbooks to automate incident response and remediation actions across both the network and endpoint layers, which is a core benefit of tight integration. Option E is correct because integrating Prisma Access (cloud-delivered secure network traffic inspection) with Cortex XDR (endpoint telemetry and detection) provides unified threat visibility, correlating network and endpoint events into a single coherent picture for analysts. Option A is wrong because analog telephone lines cannot carry high-speed XDR memory dumps and are unrelated to any modern security architecture. Option B is wrong because integration never eliminates the need for encryption or security policies; those remain essential controls. Option C is wrong because Palo Alto Networks does not replace cloud provider hypervisors with proprietary switches, and such a claim is technically false.

Answer

Using analog telephone lines to transmit high-speed XDR memory dumps.

Answer

Eliminating the need for any encryption or security policies.

Answer

Replacing all cloud provider underlying hypervisors with Palo Alto Networks proprietary switches.

Question 18

An architect is configuring automated metric collection in Cortex XSOAR using incident tags and custom fields to measure playbook automation efficiency. Which metric calculation accurately isolates the value added by automation versus manual analyst intervention?

Accepted Answer

Touchless Resolution Rate (percentage of incidents closed without manual tasks). Touchless Resolution Rate measures the percentage of incidents resolved completely without human intervention, isolating automation efficiency.

Answer

Mean Time to Ingest

Answer

Playbook Step Execution Count

Answer

Total Incident Dwell Time

Question 19

A security architect is defining the incident response lifecycle for a new SOC built on Cortex XSIAM. The CISO asks which phase of the NIST SP 800-61 lifecycle is responsible for validating that containment actions actually removed the adversary's access before returning the environment to normal operations. Which phase should the architect identify?

Accepted Answer

Containment, Eradication, and Recovery. The NIST SP 800-61 lifecycle places containment, eradication, and recovery together, and eradication specifically includes confirming that the adversary's access and artifacts have been removed before recovery begins. Validation of that removal is therefore an activity within this phase, not in detection, preparation, or post-incident review.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Detection and Analysis

Question 20

An architect is configuring Panorama to push configuration updates to managed firewalls using Panorama Templates and Template Stacks. A specific setting needs to be overridden at an individual firewall level without altering the template stack hierarchy. Which Panorama feature enables this capability?

Accepted Answer

Template Variables assigned specific values per managed firewall.. Template Variables in Panorama allow a single template or template stack to contain placeholder variables (e.g., $interface, $ip-address) whose values are defined per managed firewall. When the template stack is pushed, each firewall receives the same configuration structure but substitutes its own assigned variable values, enabling per-device customization without breaking the stack hierarchy or creating device-specific overrides.

Answer

Panorama WildCard objects

Answer

Device-level CLI overrides via administrative lockdown mode.

Answer

Global Object Override rules