SecOps-Architect Practice Test 3 — 10 Questions

Question 1

An architect is configuring High Availability (HA) Active/Passive on two PA-5220 firewalls. During a failover event, active TCP sessions are maintained without requiring re-authentication. Which feature makes this possible?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HA2 session synchronization. HA2 session synchronization copies active session table entries from the active peer to the passive peer in real time.

Answer

GlobalProtect cookie persistence

Answer

Dynamic DNS updates

Answer

Panorama configuration push

Question 2

An architect is designing an integration between Prisma Access and a third-party SIEM to ingest all security telemetry, traffic logs, and threat logs. Which TWO methods are officially supported for exporting logs from Prisma Access to external SIEMs? (Choose two)

Accepted Answer

Configure Log Forwarding Profiles within Prisma Access (Panorama managed) to export syslog directly to external SIEM collectors.. Prisma Access supports exporting logs via Syslog from Remote Networks/Mobile Users to an external SIEM, and via Cortex Data Lake (CDLake) log forwarding APIs or forwarders.

Answer

Use SNMP traps polled every 5 seconds by the SIEM against the Prisma Access public IP.

Answer

Configure an SSH tunnel directly into the Prisma Access cloud backend hypervisor to pull raw log files.

Answer

Install a physical syslog agent on the Prisma Access cloud infrastructure gateway nodes.

Question 3

An architect is configuring Panorama to manage software and content updates. Which TWO update types can be scheduled and distributed via Panorama to managed firewalls? (Choose two)

Accepted Answer

Applications and Threats content updates.. Panorama manages dynamic content updates such as Antivirus, WildFire signatures, Applications and Threats, and PAN-OS software images.

Answer

Local client browser operating system updates.

Answer

AWS EC2 instance hypervisor patches.

Answer

Active Directory domain controller schema updates.

Question 4

When reporting on SOC operational efficiency using Cortex XSOAR and XSIAM, which TWO metrics measure analyst productivity and throughput? (Choose two)

Accepted Answer

Number of incidents successfully resolved and closed per analyst. Analyst productivity and throughput are measured by tracking metrics like incidents resolved per analyst and average playbook/task execution speed.

Answer

Firewall hardware power supply redundancy status

Answer

Global WildFire malware detection signature version

Answer

Cortex XDR agent disk space exclusion list

Question 5

An organization utilizing Prisma Cloud calculates Mean Time to Remediate (MTTR) for cloud misconfigurations. The SecOps team notices that the baseline MTTR is heavily skewed by a small number of lingering legacy assets. Which statistical approach should the architect recommend to executive management to provide a more accurate representation of typical remediation performance?

Accepted Answer

Transition reporting from the mean to the median remediation time. Using the median instead of the mean prevents skewed metrics caused by extreme outliers like lingering legacy assets.

Answer

Apply a logarithmic transformation to the incident timestamps before calculating the mean

Answer

Report the arithmetic mean alongside standard deviation

Answer

Exclude all assets older than 90 days from the telemetry database

Question 6

An architect is establishing security operations baseline metrics in Cortex XSIAM. The team wants to measure the percentage of alerts that are determined to be actionable threats versus benign noise. Which metric should be configured?

Accepted Answer

Signal-to-Noise Ratio (or True Positive Rate). True Positive Rate (TPR) or Precision measures the proportion of generated alerts that represent actual security threats.

Answer

Alert Volume Growth Rate

Answer

Analyst Utilization Rate

Answer

Incident Escalation Rate

Question 7

An architect is deploying Prisma Access to secure remote workers. The organization uses explicit proxying for web traffic and requires user-ID mapping for explicit proxy connections. Which Prisma Access component and configuration must be deployed to correctly map users authenticated via an explicit proxy to their respective User-ID groups?

Accepted Answer

Deploy the Explicit Proxy feature in Prisma Access, configure proxy authentication, and integrate with Cloud Identity Engine (CIE) to extract user identity from proxy headers.. Explicit proxy configurations in Prisma Access require configuring Proxy Settings in Panorama and leveraging the Integration with GlobalProtect or the Explicit Proxy feature along with User-ID agents or Cloud Identity Engine (CIE) to map the source IP or proxy headers.

Answer

Rely solely on GlobalProtect portal cookies for explicit proxy traffic identification.

Answer

Configure standard IP-to-User mapping via User-ID agents on the remote user laptops without a proxy.

Answer

Configure SNMP traps on the proxy server to send ARP tables to Panorama.

Question 8

When presenting security posture metrics to executive management, an architect must ensure the reporting framework aligns with business risk rather than purely technical telemetry. Which metric best communicates operational effectiveness to business stakeholders?

Accepted Answer

Risk Reduction Over Time based on closed vulnerabilities and mitigated incidents. Risk Reduction Over Time translates technical telemetry into business context by showing how security investments mitigate exposure.

Answer

Total raw log ingestion volume in gigabytes per day

Answer

Number of firewall rule change requests processed

Answer

Cortex XDR agent version distribution percentages

Question 9

An architect is tasked with creating a comprehensive reporting framework in Cortex XSOAR to measure incident response maturity. Which TWO advanced metrics should be incorporated to evaluate the depth and effectiveness of post-incident analysis and containment? (Choose two)

Accepted Answer

Containment Effectiveness (percentage of incidents without reinfection or recurrence). Containment Effectiveness and Root Cause Identification Time evaluate the qualitative depth and thoroughness of incident response handling beyond basic speed metrics.

Answer

Total disk space consumed by log archives

Answer

Number of software licenses assigned to SOC analysts

Answer

Total number of coffee breaks taken per shift

Question 10

An architect is designing an automated incident response workflow in Cortex XSOAR. When a critical phishing incident is reported, the playbook must automatically extract URLs, submit them to WildFire for analysis, and isolate the endpoint if malicious. Which integration instance is responsible for submitting the URL to WildFire within the XSOAR playbook?

Accepted Answer

WildFire v2 integration integration instance. Cortex XSOAR integrates with WildFire using the WildFire integration pack, which provides commands like wildfire-submit-file or url analysis.

Answer

Active Directory LDAP integration

Answer

Prisma Cloud compliance integration

Answer

Panorama threat-feed integration