SecOps-Architect Practice Test 4 — 25 Questions

Question 1

An architect is designing log retention and data tiering policies in Cortex XSIAM. To balance regulatory compliance requirements (long-term storage) with high-performance analytics (short-term fast search), how should the data architecture be structured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure active analytical storage for high-frequency queries and cold storage tiers for long-term compliance retention. Cortex XSIAM supports tiered storage architecture where high-performance active storage is used for immediate analytics and threat hunting, while colder storage tiers handle long-term retention.

Answer

Store all telemetry in volatile RAM cache indefinitely

Answer

Forward all raw logs exclusively to an external FTP server in plain text

Answer

Disable all log compression to ensure faster grep searches

Question 2

An architect is designing a Prisma Cloud compliance framework. Which TWO actions or configurations can be implemented in Prisma Cloud to assess and enforce cloud resource security? (Choose two)

Accepted Answer

Writing custom JSON compliance RQL (Resource Query Language) queries to find specific cloud misconfigurations.. Option B is correct because Prisma Cloud's Resource Query Language (RQL) allows security teams to write custom JSON-based queries that search cloud resource configurations and identify specific misconfigurations across providers, which is a core capability for assessing compliance. Option D is correct because Prisma Cloud ships with built-in compliance policies and supports custom policies mapped to recognized standards such as CIS Benchmarks, NIST, and PCI-DSS, enabling continuous assessment and enforcement against those frameworks. Option A is incorrect because SNMPv1 polling of power meters is a hardware/environmental monitoring function unrelated to cloud resource security assessment. Option C is incorrect because reflashing physical motherboards is not a Prisma Cloud capability and has nothing to do with cloud compliance. Option E is incorrect because installing GlobalProtect VPN clients on EC2 disks is an endpoint VPN deployment, not a Prisma Cloud compliance assessment or enforcement action.

Answer

Using SNMPv1 polling to check cloud provider power meters.

Answer

Directly reflashing cloud provider physical hardware motherboards.

Answer

Installing GlobalProtect desktop VPN clients on AWS EC2 virtual machine disks.

Question 3

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for known malware and spyware. Which security profile should the architect attach to the Security Policy rule?

Accepted Answer

Antivirus and Anti-Spyware security profiles. To inspect traffic for known malware and spyware, the firewall must apply Antivirus and Anti-Spyware security profiles. The Antivirus profile scans for viruses, worms, and trojans, while the Anti-Spyware profile detects and blocks spyware, command-and-control traffic, and known malicious domains. Both profiles are attached to the Security Policy rule to enforce content inspection.

Answer

File Blocking profile

Answer

Data Filtering profile

Answer

URL Filtering profile

Question 4

Which metric should a SOC manager review to determine whether alerts are being investigated in a timely manner after they are generated?

Accepted Answer

Mean Time to Acknowledge (MTTA). Mean Time to Acknowledge (MTTA) or Mean Time to Triage measures the speed from alert creation to the start of analyst investigation.

Answer

Total Log Storage Volume in Terabytes

Answer

Firewall Rule Hit Count

Answer

Cortex XDR Agent Deployment Percentage

Question 5

A security operations architect is designing a threat intelligence-driven response architecture using Cortex XSOAR. The architect wants to automatically enrich indicators of compromise (IOCs) from multiple sources and then make a risk-based decision to block or allow them. Which component of Cortex XSOAR should be used to define the logic that correlates and scores the IOCs from different intelligence sources?

Accepted Answer

Reputation Calculation. Reputation Calculation is the Cortex XSOAR feature that enables architects to define custom scoring logic for indicators, aggregating data from multiple sources and applying weights to produce a risk score. This score can then drive automated decisions. The other options are structural or connectivity components that do not provide the required correlation and scoring logic.

Answer

Indicator Type

Answer

Playbook

Answer

Integration Instance

Question 6

An architect is integrating Cortex XSOAR with threat intelligence platforms. Which THREE attributes are essential when evaluating the quality and operational value of ingested threat indicators? (Choose three)

Accepted Answer

Accuracy and false positive rate. Option B is correct because accuracy and false positive rate directly determine whether ingested indicators can be trusted for automated enforcement in Cortex XSOAR, since high-FP feeds generate excessive incidents and erode analyst confidence. Option D is correct because context and TTP mapping (e.g., aligning indicators to MITRE ATT&CK techniques and the organization's actual attack surface) let XSOAR playbooks prioritize and enrich only indicators that are operationally relevant. Option E is correct because timeliness—how quickly indicators are delivered relative to adversary campaign velocity—determines whether blocking or hunting actions occur before the infrastructure is rotated or the attack completes. Option A is not a quality or operational-value attribute; storage sizing is a capacity-planning concern, not an indicator-quality metric. Option C is irrelevant, as PDF report typography has no bearing on indicator fidelity, relevance, or detection value.

Answer

Total physical disk space required to store raw indicator text

Answer

Font family used in the vendor's PDF reports

Question 7

A security operations team uses Cortex XSIAM and Cortex XSOAR. The SOC manager wants to measure how well the team is utilizing automation to reduce manual effort. The manager asks the architect to define a metric that quantifies the proportion of incident response actions that were executed automatically versus manually. Which metric should the architect recommend?

Accepted Answer

Automation Coverage Ratio. Automation Coverage Ratio directly quantifies the share of response actions executed automatically, which is the core of the manager's request. MTTD, Alert Volume Trend, and FPR are valuable but focus on detection speed, workload volume, and detection accuracy respectively, not on the balance between manual and automated response. Thus, Automation Coverage Ratio is the only metric that answers how well automation reduces manual effort.

Answer

Mean Time to Detect (MTTD)

Answer

Alert Volume Trend

Answer

False Positive Rate (FPR)

Question 8

An architect is troubleshooting a User-ID agent deployment where group mapping information is not being retrieved from Microsoft Active Directory. Which permission or protocol requirement must be verified on the Active Directory domain controller for group mapping to succeed?

Accepted Answer

Verify LDAP/LDAPS network connectivity and ensure the service account has read permissions to query Active Directory user and group objects.. User-ID agent requires LDAP / LDAPS access and appropriate read permissions on Active Directory to query user and group object attributes.

Answer

Verify that SNMPv1 is enabled on the domain controller.

Answer

Verify that the Domain Controller has the GlobalProtect client installed.

Answer

Verify that the firewall management plane CPU is running at 100%.

Question 9

An architect is designing high availability for a Palo Alto Networks firewall deployment and wants to ensure that both firewalls can actively process traffic under normal operating conditions while backing each other up. Which HA mode supports this?

Accepted Answer

High Availability Active/Active mode. High Availability Active/Active mode allows both firewalls in the HA pair to simultaneously process traffic, providing load sharing and mutual backup. Each firewall actively handles sessions, and if one fails, the peer takes over the full load, satisfying the requirement for both to actively process traffic under normal conditions.

Answer

Panorama managed standalone mode

Answer

Standalone clustering with no HA links

Answer

High Availability Active/Passive mode

Question 10

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

Accepted Answer

Verify that the managed firewalls are correctly assigned to a valid Collector Group within Panorama.. Option B is correct because log forwarding to Panorama Collectors requires each managed firewall to be a member of a valid Collector Group; if a firewall is unassigned or assigned to a nonexistent/invalid Collector Group, its logs will not be forwarded to any Collector. Option D is correct because firewalls send logs to Panorama Collectors over TCP port 3978, so any routing issue, NAT misconfiguration, or security policy blocking that port between the firewall and the Collector will prevent log delivery. Option A is incorrect because reformatting data plane ASICs is a disruptive hardware-level operation unrelated to log forwarding configuration. Option C is incorrect because SNMPv1 polling on the management plane has no bearing on Panorama log collection. Option E is incorrect because disabling SSL decryption on internal zones affects traffic inspection, not the log forwarding path to Panorama Collectors.

Answer

Reformat the firewall data plane ASICs via the CLI.

Answer

Check if the firewall local management plane CPU is running SNMPv1 polling.

Answer

Disable SSL decryption on all internal zones.

Question 11

An architect is designing an authentication architecture where Palo Alto Networks firewalls authenticate administrators against an external multi-factor authentication (MFA) provider using SAML 2.0. Which component acts as the Identity Provider (IdP) in this architecture?

Accepted Answer

The external IdP (such as Okta, Azure AD, or Ping Identity).. In a SAML 2.0 authentication flow, the Identity Provider (IdP) is the external system that authenticates the user and issues SAML assertions. When Palo Alto Networks firewalls authenticate administrators against an external MFA provider using SAML, that external provider (e.g., Okta, Microsoft Entra ID, Ping Identity) acts as the IdP.

Answer

The Palo Alto Networks firewall itself.

Answer

The Cortex XSOAR server.

Answer

The local database on the firewall.

Question 12

An architect is integrating Prisma Cloud with a CI/CD pipeline (such as GitHub Actions or Jenkins) to perform Infrastructure as Code (IaC) scanning. Which TWO scanning targets or mechanisms are supported by Prisma Cloud for IaC security? (Choose two)

Accepted Answer

Scanning Terraform and AWS CloudFormation templates using the Prisma Cloud IaC CLI or GitHub Actions integration.. Option A is correct because Prisma Cloud's IaC scanning explicitly supports Terraform and AWS CloudFormation templates, and it can be invoked through the Prisma Cloud IaC CLI (twistcli / checkov-based scanning) or via native CI/CD integrations such as the GitHub Actions integration, making it a supported scanning target and mechanism for pipeline use. Option B is correct because Prisma Cloud also scans Kubernetes YAML manifests and Helm charts stored in git repositories to detect misconfigurations, which is a core IaC security capability for container-orchestration configuration. Option C is not correct because Prisma Cloud IaC scanning analyzes declarative infrastructure code, not live TCP packet sniffing on a network switch interface. Option D is not correct because SNMPv1 is a network-management protocol and has nothing to do with querying the Jenkins REST API for IaC scanning. Option E is not correct because Prisma Cloud Defenders run as containers or hosts in cloud/Kubernetes environments, not inside a laptop BIOS, which is not a supported IaC scanning mechanism.

Answer

Sniffing active TCP packets traversing a Jenkins build server network switch interface.

Answer

Querying the Jenkins REST API using raw SNMPv1 strings.

Answer

Running a Prisma Cloud Defender daemonset inside a developer's local laptop BIOS.

Question 13

When establishing a baseline for Security Operations Center (SOC) alert volume in Cortex XSIAM, what is the primary purpose of this baseline?

Accepted Answer

To identify operational anomalies and deviations that require investigation or tuning. Establishing a baseline allows the SOC to identify abnormal deviations, such as sudden spikes in alerts that may indicate an active attack or a misconfigured log source.

Answer

To determine the exact licensing cost for future Cortex XDR expansion

Answer

To configure firewall security policies automatically

Answer

To replace manual analyst triage with fully automated playbook closures

Question 14

Your organization has implemented a comprehensive metric reporting framework in Cortex XSIAM. However, analysts are complaining that leadership is weaponizing the 'Mean Time to Resolve' (MTTR) metric to rush investigations, leading to superficial incident closures and recurring security issues. As a SecOps Architect, how should you address this metric dysfunction?

Accepted Answer

Pair MTTR with quality and accuracy metrics such as Incident Reopen Rate and False Negative Discovery Rate to balance speed with thoroughness.. When MTTR is used in isolation, analysts may cut corners to lower their times. Best practice requires pairing speed metrics (MTTR) with quality metrics, such as Reopen Rate or Recurrence Rate, to ensure thoroughness.

Answer

Double the MTTR target time across all severity levels to give analysts more breathing room.

Answer

Abolish all metrics entirely and rely solely on subjective management intuition.

Answer

Automate all incident closures so analysts no longer have to record resolution times.

Question 15

An architect is troubleshooting a Cortex XDR deployment where agents on endpoints are failing to communicate with the Cortex XDR cloud tenant. Which outbound network connectivity requirement must be verified on the local corporate firewall?

Accepted Answer

Outbound TCP port 443 (HTTPS) access to the Cortex XDR tenant cloud URL.. Cortex XDR agents communicate with the Cortex XDR cloud tenant over outbound TCP 443 (HTTPS). The local corporate firewall must allow outbound HTTPS traffic to the tenant's cloud URL (e.g., *.xdr.us.paloaltonetworks.com) for agents to register, send telemetry, and receive policy updates.

Answer

Inbound UDP port 69 (TFTP) from endpoints to Panorama.

Answer

Inbound TCP port 3389 (RDP) from the cloud backend to every endpoint.

Answer

Outbound TCP port 3978 to Panorama Collectors.

Question 16

When designing a high-availability (HA) architecture for a pair of Palo Alto Networks NGFWs, which interface type must be dedicated and directly connected between the two peers for session and state synchronization?

Accepted Answer

HA2 interface. HA1 backup and HA1 primary interfaces are used for control plane state synchronization, while HA2 is used for data plane session synchronization.

Answer

External zone data interface

Answer

Management interface

Answer

Panorama registration interface

Question 17

An incident response team uses Cortex XSOAR playbooks for automated enrichment. Leadership wants to measure how much time automation saves per incident compared to manual lookup tasks. Which methodology should the architect use to calculate this metric?

Accepted Answer

Multiply total successful automated task executions by the estimated manual execution time per task.. To calculate time saved by automation, multiply the number of automated task executions by the estimated time it would take an analyst to perform those same tasks manually.

Answer

Subtract the total number of closed incidents from the number of open incidents.

Answer

Measure the average CPU load of the Cortex XSOAR server during playbook execution.

Answer

Divide total firewall logs by the number of active Cortex XSOAR integrations.

Question 18

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO prerequisites must be met before enabling HA on the firewalls? (Choose two)

Accepted Answer

Both firewalls must be running the exact same PAN-OS software version.. Option B is correct because Palo Alto Networks requires both HA peers to run the exact same PAN-OS software version so that configuration synchronization, HA state negotiation, and failover behave consistently between the two devices. Option D is correct because both firewalls must have identical licenses and support subscriptions (e.g., Threat Prevention, URL Filtering, WildFire, DNS Security) so that security profiles and features remain functional on the passive peer after a failover. Option A is incorrect because HA peers should have management interfaces on the same subnet with matching default gateways to allow proper HA communication and management access. Option C is incorrect because HA pairs must be the same hardware model, not different models, to ensure compatible interfaces and performance. Option E is incorrect because HA ports are dedicated Layer 2/Layer 3 links between the two firewalls (HA1, HA2, HA3) and do not need public IP addresses or internet connectivity.

Answer

Management interfaces must be configured on completely different subnet masks with mismatched default gateways.

Answer

Both firewalls must have different models (e.g., PA-3220 paired with PA-5220).

Answer

HA ports must be connected to the internet via public IP addresses.

Question 19

When designing a Security Operations Center (SOC) tiering model, what is the primary operational responsibility typically assigned to Tier 2 (Incident Responders)?

Accepted Answer

In-depth forensic investigation, root cause analysis, and containment execution. Tier 2 (Incident Responders) in a SOC tiering model is responsible for in-depth forensic investigation, root cause analysis, and containment execution. Tier 1 handles initial triage and false positive closure, while Tier 3 focuses on threat hunting and advanced detection engineering. Tier 2 takes escalated incidents from Tier 1 and performs deeper analysis and response actions.

Answer

Developing custom machine learning detection models and threat hunting hypotheses

Answer

High-volume initial alert triage and closing false positives based on strict runbooks

Answer

Managing physical datacenter security and badge access

Question 20

A SecOps architect is asked to prove that the SOC's automated response playbooks are reducing manual workload. The team already tracks the count of playbook executions, but leadership says that number alone does not demonstrate labor savings. Which metric should the architect present as the primary evidence of reduced manual effort?

Accepted Answer

Number of automated actions executed per incident, compared with the manual steps those actions replaced. To prove reduced manual workload, the metric must connect automated activity to the human steps it replaced. Counting executions or tracking MTTR for a subset of analysts does not establish avoided labor. Comparing automated actions with the manual steps they supplanted gives leadership a direct, quantifiable link between playbook use and reduced analyst effort, making it the strongest evidence.

Answer

Percentage of alerts closed as false positives by automation

Answer

Mean time to resolution (MTTR) for incidents handled only by Tier 3 analysts

Answer

Total number of playbook executions per month