SecOps-Architect Practice Test 5 — 25 Questions

Question 1

A SecOps architect is defining a metric to measure the proportion of security incidents that were resolved within the agreed Service Level Agreement (SLA) time. Which metric should be used?

Accepted Answer

SLA Compliance Rate. SLA Compliance Rate is the only metric that directly measures the proportion of incidents resolved within the agreed SLA time. Other metrics like MTTR or backlog provide related but indirect information, not a direct compliance percentage.

Answer

Backlog of Open Incidents

Answer

Mean Time to Resolve (MTTR)

Answer

First Contact Resolution Rate

Question 2

An architect is designing a Prisma Cloud Compute deployment to secure containerized workloads. Which TWO compliance and vulnerability assessment features are provided by Prisma Cloud Compute Defenders? (Choose two)

Accepted Answer

Evaluating container configurations and host OS settings against CIS (Center for Internet Security) benchmarks.. Option B is correct because Prisma Cloud Compute Defenders perform compliance checks by evaluating container configurations and host OS settings against CIS benchmarks, reporting pass/fail results for hardening requirements. Option D is correct because Defenders scan container images and host operating systems for known CVEs, providing vulnerability assessment across the deployment lifecycle. Option A is incorrect because writing custom assembly code for microservices is an application development task, not a Prisma Cloud Compute Defender capability. Option C is incorrect because analyzing physical power grid load tolerances is a data center facilities concern unrelated to container security. Option E is incorrect because acting as a Layer 7 DNS root server is a network infrastructure role, not a function of Prisma Cloud Compute Defenders.

Answer

Writing custom assembly code for application microservices.

Answer

Analyzing physical power grid load tolerances in data center facilities.

Answer

Acting as a Layer 7 DNS root server for enterprise domains.

Question 3

You are designing executive dashboards in Cortex XSIAM to report security posture trends over the last quarter. Management requires a metric that shows the reduction in successful phishing compromises resulting from user training. Which metric should you implement?

Accepted Answer

Phishing Incident Recurrence and Successful Compromise Rate Trend. Phishing Incident Recurrence and Successful Compromise Rate Trend directly measures whether users are still falling for phishing after training — a declining successful-compromise rate and reduced recurrence indicate training effectiveness. This is the metric that ties user training to measurable security posture improvement.

Answer

Average Analyst Playbook Execution Time

Answer

Cortex XDR Agent Installation Percentage

Answer

Total Phishing Payload Extraction Volume

Question 4

You are deploying Cortex XSIAM and need to ensure that endpoint logs collected from remote agents are normalized into a unified schema before analytics runs. Which feature performs this normalization?

Accepted Answer

XDM (XDR Data Model) mapping and parsing rules. XSIAM utilizes Agent Content and parsing rules to normalize raw logs into the XDM schema during ingestion.

Answer

Cortex XDR Agent Collector Engine

Answer

Magnifier behavioral analytics engine

Answer

Local Analysis Engine (LAE)

Question 5

While establishing baselines for Cortex XDR alert volume to detect operational anomalies, you notice a massive seasonal spike in alerts that threatens to invalidate your baseline threshold. What is the best practice approach to handle this seasonality in security metrics?

Accepted Answer

Segment historical data and apply contextual rolling baselines that account for expected cyclical business variations.. When establishing baselines for security operations, cyclical or seasonal variations must be accounted for using rolling or adjusted seasonal baselines to prevent alert fatigue or masking real anomalies.

Answer

Permanently increase the global alert severity threshold to ignore all alerts during the seasonal window.

Answer

Replace all quantitative alert metrics with qualitative analyst feedback scores.

Answer

Disable automated alert generation in Cortex XDR until the seasonal window concludes.

Question 6

An architect is designing a metrics framework for a Security Operations Center (SOC) using Cortex XSIAM. The SOC wants to measure the effectiveness of its incident triage process by tracking the proportion of incidents that are correctly classified as true positives versus false positives. Which metric should be used to directly assess the accuracy of incident classification?

Accepted Answer

Precision. Precision directly measures the accuracy of positive classifications by comparing true positives to all incidents flagged as malicious. It captures both correct and incorrect positive classifications, making it the best metric for assessing triage accuracy. Other metrics like FPR or recall only provide partial views.

Answer

False Positive Rate (FPR)

Answer

Recall

Answer

Mean Time to Resolve (MTTR)

Question 7

You are presenting security metrics to executive management using Cortex XSIAM dashboards. Leadership expresses concern over an apparent increase in malware detection events month-over-month. As a SecOps Architect, how should you contextualize this trend?

Accepted Answer

Contextualize the trend by demonstrating how expanded sensor coverage and improved detection visibility account for the rise in detections, while noting that successful compromises have decreased.. An increase in detected events often reflects improved visibility and broader sensor deployment (e.g., onboarding new log sources or endpoints) rather than a direct increase in actual organizational risk.

Answer

Blame the endpoint users for generating malware and increase disciplinary actions.

Answer

Confirm that the enterprise security posture is actively degrading and recommend cutting off all external internet access.

Answer

Disable the specific Cortex XDR analytics rules generating the malware alerts to lower the reported count.

Question 8

An architect is designing a secure CI/CD pipeline integration using Prisma Cloud to scan container images before they are pushed to a container registry (such as AWS ECR or Docker Hub). Which TWO mechanisms can be utilized for this pre-deployment image scanning? (Choose two)

Accepted Answer

Integrating the Prisma Cloud twistcli scanner utility into the CI/CD pipeline build script (e.g., Jenkins or GitLab CI).. Option A is correct because the twistcli scanner is Prisma Cloud's standalone CLI utility that can be invoked directly within a CI/CD build script (Jenkins, GitLab CI, etc.) to scan container images for vulnerabilities and compliance issues before they are pushed to a registry. Option D is correct because the Prisma Cloud Jenkins plugin integrates natively with Jenkins pipelines to automatically trigger image scans on built images and surface vulnerability and compliance results as part of the build. The other options are incorrect: GlobalProtect is a VPN client unrelated to image scanning (B), BNC cabling to a PA-5250 firewall is a physical network concept with no role in CI/CD image scanning (C), and SNMP traps on the Docker daemon socket are for monitoring/alerting, not pre-deployment vulnerability scanning (E).

Answer

Installing the GlobalProtect desktop VPN client on every container container image layer.

Answer

Physically connecting the build server to a Palo Alto Networks PA-5250 hardware appliance via BNC cables.

Answer

Configuring raw SNMP traps on the Docker daemon socket.

Question 9

An architect is designing an integration between Cortex XSOAR and a third-party ticketing system (e.g., ServiceNow). The requirement is to ensure that when an incident severity is updated in XSOAR, the ticket in ServiceNow is automatically updated. Which architectural feature facilitates this synchronization?

Accepted Answer

Bi-directional incident field mapping and integration commands. Bi-directional incident mapping and mapping rules in XSOAR integration instances allow field values to sync automatically between XSOAR and ticketing systems.

Answer

Syslog forwarding over UDP port 514

Answer

PAN-OS Dynamic Address Group API push

Answer

GlobalProtect client certificate renewal protocol

Question 10

Which role in a well-structured Security Operations Center (SOC) is primarily responsible for performing tier-2 incident triage, deep investigation, and playbook execution?

Accepted Answer

SOC Tier-2 Analyst / Incident Responder. The SOC Tier-2 Analyst / Incident Responder role is specifically responsible for deeper investigation, incident triage beyond initial alert validation, and executing response playbooks. Tier-2 analysts handle escalated incidents that Tier-1 cannot resolve, performing root-cause analysis and coordinating containment. This matches the question's description of tier-2 triage, deep investigation, and playbook execution.

Answer

Compliance Auditor

Answer

Chief Information Security Officer (CISO)

Answer

Helpdesk Support Technician

Question 11

When designing a threat hunting methodology aligned with the MITRE ATT&CK framework, an architect wants to identify adversary persistence mechanisms. Which tactic category should the analyst focus queries on?

Accepted Answer

Persistence. In MITRE ATT&CK, Persistence is the tactic category (TA0003) that covers techniques adversaries use to maintain footholds across restarts, credential changes, or other interruptions — such as registry Run keys, scheduled tasks, services, and web shells. An analyst hunting for persistence mechanisms should query for these specific techniques (T1547, T1053, T1543, T1505) rather than tactics focused on gaining initial entry or collecting data.

Answer

Initial Access

Answer

Collection

Answer

Execution

Question 12

An architect is deploying the Cortex XDR Broker VM to serve as a syslog collector for legacy network devices. The Broker VM loses connectivity to the Cortex XDR cloud. What happens to the collected syslog data during the outage?

Accepted Answer

The data is buffered locally on the Broker VM and forwarded once reconnected. The Cortex XDR Broker VM is designed with local buffering capability to handle temporary loss of connectivity to the Cortex XDR cloud. When the cloud is unreachable, collected syslog data is stored locally on the Broker VM's disk and forwarded once connectivity is restored, ensuring no data loss during transient outages. This store-and-forward behavior is a core resilience feature of the Broker VM.

Answer

The Broker VM automatically switches to backup SMTP forwarding

Answer

The syslog sender devices resend the packets automatically via TCP retry

Answer

The data is permanently dropped until connectivity returns

Question 13

An architect is configuring High Availability (HA) on two Palo Alto Networks firewalls. What happens to active sessions on the primary firewall if it experiences a power failure, assuming HA is configured in Active/Passive mode?

Accepted Answer

The passive firewall takes over active traffic and maintains sessions via HA2 synchronization.. In an Active/Passive HA configuration, when the primary firewall fails (e.g., power failure), the passive firewall takes over as active and maintains existing sessions because session state is synchronized via the HA2 link. HA2 synchronization ensures that session tables, including TCP state and NAT translations, are mirrored to the passive device, allowing it to continue traffic without dropping sessions. This provides seamless failover with minimal disruption.

Answer

The firewall reboots into maintenance mode and requires manual CLI intervention.

Answer

Traffic is permanently blackholed until an administrator logs into Panorama.

Answer

All active user sessions are immediately dropped and must re-authenticate.

Question 14

An architect is configuring a Palo Alto Networks firewall and wants to inspect encrypted TLS traffic passing through the firewall without terminating the SSL session on the firewall itself (e.g., to identify malicious JA3 signatures or SNI without decryption). Which feature should the architect configure?

Accepted Answer

App-ID inspection of SSL/TLS Server Name Indication (SNI) and certificate attributes during handshake.. Palo Alto Networks App-ID can inspect the TLS handshake without decryption to extract the Server Name Indication (SNI) and certificate attributes, which can be used to identify applications and threats like malicious JA3 signatures. This allows visibility into encrypted traffic without terminating SSL.

Answer

Installing GlobalProtect portal certificates.

Answer

Formatting logs into raw Syslog CEF.

Answer

Disabling all security profiles.

Question 15

An architect is deploying Cortex XDR Broker VMs in a DMZ architecture. Which TWO network requirements must be satisfied for successful operation? (Choose two)

Accepted Answer

Inbound syslog or SNMP trap connectivity from local log sources. Option D is correct because the Cortex XDR Broker VM must establish outbound HTTPS (TCP 443) connections to the Cortex XDR cloud tenant to register, receive policy/configuration updates, and forward collected data, so this egress path is mandatory. Option A is correct because the Broker VM's log-collection role requires inbound syslog (UDP/TCP 514) or SNMP trap (UDP 162) connectivity from local log sources so those devices can deliver their logs to the broker for forwarding to the cloud. Option B is wrong because inbound RDP from public internet addresses is never a Cortex XDR Broker VM requirement and would be a serious security exposure. Option C is wrong because the Broker VM does not perform direct PostgreSQL database replication on port 5432 to external client workstations. Option E is wrong because unencrypted FTP is not used for Broker VM configuration uploads; management and data transfer occur over secure channels to the Cortex XDR tenant.

Answer

Inbound RDP access from public internet IP addresses

Answer

Direct database replication port 5432 to external client workstations

Answer

Unencrypted FTP access for configuration file uploads

Question 16

Which tool within Cortex XSIAM allows an architect to build customized graphical widgets and dashboards for tracking operational metrics?

Accepted Answer

Cortex XSIAM Dashboards and Widget Builder. Cortex XSIAM includes a native Dashboards and Widget Builder that lets architects create custom graphical widgets (charts, tables, single-value panels) and assemble them into dashboards for operational metrics like MTTD, MTTR, and detection coverage. This is the built-in visualization layer of XSIAM, distinct from other Palo Alto products.

Answer

Prisma Access Cloud Management

Answer

Panorama Policy Optimizer

Answer

WildFire Web Portal

Question 17

An organization is reporting on 'Dwell Time' as a core security posture metric using Cortex XSIAM. If Dwell Time is defined as the duration from initial compromise to containment, which data sources must be successfully correlated to calculate this metric accurately?

Accepted Answer

Initial endpoint intrusion telemetry/alerts and final incident response containment timestamps. Dwell Time is calculated as the delta between the moment of initial compromise and the moment containment is achieved. In Cortex XSIAM, this requires correlating endpoint intrusion telemetry or the earliest alert indicating the initial access vector with the incident response containment timestamp recorded when the incident is closed or the host is isolated. Without both endpoints of that timeline, the metric cannot be derived.

Answer

Firewall active session logs and DNS query volume statistics alone

Answer

WildFire file upload quotas and automated sandbox verdict latency

Answer

Cortex XDR agent heartbeat intervals and operating system patch levels

Question 18

An enterprise is establishing a metrics governance framework for Cortex XSOAR automation. Which THREE criteria should be used to determine if a security workflow is a good candidate for automation? (Choose three)

Accepted Answer

Well-defined, deterministic decision logic and steps. Option C is correct because automation in Cortex XSOAR depends on playbook tasks with clear, deterministic branching logic (conditional tasks, decision trees) that produce the same output for the same input, which is exactly what makes a workflow reliably automatable. Option D is correct because high-volume, repetitive workflows deliver the greatest return on automation investment by reducing analyst toil and MTTR, and XSOAR playbooks, triggers, and incident types are designed to handle recurring incidents at scale. Option E is correct because XSOAR integrations and commands (for example, parsing JSON, XML, or CSV via context and transformers) require structured, machine-parseable inputs; unstructured or ambiguous data cannot be reliably mapped into playbook inputs and outputs. Option A is not a good candidate because subjective, political negotiation between business units requires human judgment and cannot be encoded as deterministic playbook logic. Option B is not a good candidate because a once-per-decade workflow with unpredictable parameters offers negligible automation value and cannot be standardized into a repeatable playbook.

Answer

Requires complex, highly subjective political negotiation between business units

Answer

Executed exactly once every ten years with unpredictable parameters

Question 19

You are configuring Cortex XSOAR integration instances and need to ensure that API keys and passwords are stored securely without appearing in plaintext within playbook logs or incident data. Where should these credentials be stored?

Accepted Answer

As encrypted integration parameters / Vault-managed credentials. Integration credentials in Cortex XSOAR should be stored as encrypted integration parameters (credentials type) managed by the platform vault.

Answer

Inside public incident context data fields

Answer

Hardcoded in custom Python automation scripts

Answer

Plaintext in the playbook YAML file

Question 20

An architect is configuring Panorama Template Stacks. Which TWO types of configuration settings are typically defined within Panorama Templates rather than Device Groups? (Choose two)

Accepted Answer

Network interface IP addresses, virtual routers, and static routes.. Option C is correct because Panorama Templates are designed to hold device-level and network-level configuration that is bound to specific firewalls, including Layer 3 interface IP addresses, virtual routers, and static routes, which are all part of the network configuration pushed to managed devices. Option D is correct because Templates also carry device system settings such as DNS servers, NTP servers, and management plane IP addresses, which are device-specific rather than policy-specific. Options A, B, and E are not correct because Cortex XDR agent packages are managed outside Panorama Templates, while security policy rules, URL filtering profiles, Dynamic Address Groups, and tag registration filters are policy objects and rules that belong in Device Groups, not Templates.

Answer

Cortex XDR agent installation packages.

Answer

Security policy rules and URL filtering security profiles.

Answer

Dynamic Address Groups and tag registration filters.