SecOps-Architect Practice Test 2 — 30 Questions

Question 1

An architect is configuring a Palo Alto Networks firewall to decrypt inbound SSL/TLS traffic destined for an internal web server. Which certificate configuration is required on the firewall to perform Inbound Inspection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The private key and certificate of the internal web server must be installed on the firewall.. Inbound Inspection requires importing the server's private key and public certificate onto the firewall so it can decrypt traffic destined for that server.

Answer

An expired public certificate from a third-party root CA.

Answer

No certificates are required if SSH is used instead of SSL.

Answer

A self-signed Certificate Authority (CA) certificate generated solely on the firewall without any server keys.

Question 2

An architect is designing a secure architecture using VM-Series on Microsoft Azure. Which TWO Azure-native services or integration components must be configured to achieve high availability with dynamic failover of user traffic across two VM-Series instances? (Choose two)

Accepted Answer

Azure Load Balancer (Standard SKU) to distribute inbound and outbound traffic to the VM-Series data interfaces.. Azure VM-Series HA typically relies on Azure Load Balancers (ALB) or Azure Route Tables (UDPs/User Defined Routes) with API scripts or SDN connectors running on the firewall to update routing tables upon failover.

Answer

Physical HA2 fiber optic cables connected between Azure availability zones.

Answer

Azure ExpressRoute direct copper cross-connect cables plugged into the firewall physical NICs.

Answer

Azure Active Directory Domain Services domain controller deployed inside the firewall data plane.

Question 3

An architect is troubleshooting a User-ID deployment where users authenticating via captive portal are not getting correctly mapped. Which TWO conditions must be verified to ensure captive portal functions properly? (Choose two)

Accepted Answer

Verify that an Authentication Profile and Authentication Policy are correctly configured to prompt users.. Captive portal requires an appropriate Authentication Profile/Sequence, an explicit security policy allowing HTTP/HTTPS traffic to the captive portal IP/port, and correctly configured redirection settings.

Answer

Ensure that the firewall's management plane CPU is disabled to allow unhindered redirects.

Answer

Ensure that User-ID agents are disabled when captive portal is active.

Answer

Verify that all users have installed the Prisma Cloud Defender agent.

Question 4

An architect is configuring High Availability (HA) on two Palo Alto Networks firewalls. What happens to active sessions on the primary firewall if it experiences a power failure, assuming HA is configured in Active/Passive mode?

Accepted Answer

The passive firewall takes over active traffic and maintains sessions via HA2 synchronization.. In Active/Passive HA, when the active unit fails, the passive unit takes over and active sessions are maintained if HA2 session synchronization is enabled.

Answer

The firewall reboots into maintenance mode and requires manual CLI intervention.

Answer

Traffic is permanently blackholed until an administrator logs into Panorama.

Answer

All active user sessions are immediately dropped and must re-authenticate.

Question 5

An architect is configuring Panorama to push configuration updates to managed firewalls using Panorama Templates and Template Stacks. A specific setting needs to be overridden at an individual firewall level without altering the template stack hierarchy. Which Panorama feature enables this capability?

Accepted Answer

Template Variables assigned specific values per managed firewall.. Panorama Template Variables allow administrators to define variable values per firewall while keeping the underlying template structure uniform.

Answer

Panorama WildCard objects

Answer

Device-level CLI overrides via administrative lockdown mode.

Answer

Global Object Override rules

Question 6

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for known malware and spyware. Which security profile should the architect attach to the Security Policy rule?

Accepted Answer

Antivirus and Anti-Spyware security profiles. Antivirus and Anti-Spyware security profiles inspect traffic for known malware and command-and-control (C2) signatures.

Answer

File Blocking profile

Answer

Data Filtering profile

Answer

URL Filtering profile

Question 7

An architect is configuring a Palo Alto Networks firewall to decrypt inbound SSL/TLS traffic destined for an internal web server. Which certificate configuration is required on the firewall to perform Inbound Inspection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Filtering profile. Data Filtering profiles inspect traffic for patterns matching credit card numbers or social security numbers, as well as predefined or custom regular expressions.

Answer

WildFire Analysis profile

Answer

URL Filtering profile

Answer

Zone Protection profile

Question 8

An architect is integrating Palo Alto Networks NGFW with AWS VPC environments using the VM-Series auto-scaling template. When a new VM-Series instance spins up dynamically via AWS Auto Scaling, how does the new firewall register and receive its initial configuration without manual administrative intervention?

Accepted Answer

Through bootstrapping using an S3 bucket containing an init-cfg.txt file, bootstrap folders, and a valid Panorama registration auth-key.. VM-Series bootstrap allows the firewall to load an init-cfg.txt file, bootstrap package, and contact Panorama upon first boot using API keys and Panorama IP settings.

Answer

By listening for multicast broadcast packets sent by AWS Route 53.

Answer

By executing an interactive SSH wizard triggered via AWS CloudWatch alarms.

Answer

By downloading policies from the AWS Systems Manager Parameter Store via raw SNMP.

Question 9

An architect is configuring User-ID to map users via Palo Alto Networks Terminal Services (TS) Agent. Where must the TS Agent be installed in the network architecture?

Accepted Answer

Directly on the Microsoft Terminal Server or Citrix XenApp server.. The TS Agent must be installed directly on the Microsoft Terminal Server or Citrix XenApp server to track which user is mapped to which TCP port range.

Answer

Inside the Cortex XDR Broker VM appliance.

Answer

On the external DNS root server.

Answer

On the Panorama management virtual appliance.

Question 10

An architect is designing a secure CI/CD pipeline integration using Prisma Cloud to scan container images before they are pushed to a container registry (such as AWS ECR or Docker Hub). Which TWO mechanisms can be utilized for this pre-deployment image scanning? (Choose two)

Accepted Answer

Integrating the Prisma Cloud twistcli scanner utility into the CI/CD pipeline build script (e.g., Jenkins or GitLab CI).. Prisma Cloud supports scanning container images in CI/CD pipelines using plugins for Jenkins, GitLab, GitHub Actions, or using the Prisma Cloud CLI scanner tool.

Answer

Installing the GlobalProtect desktop VPN client on every container container image layer.

Answer

Physically connecting the build server to a Palo Alto Networks PA-5250 hardware appliance via BNC cables.

Answer

Configuring raw SNMP traps on the Docker daemon socket.

Question 11

An architect is configuring High Availability (HA) on Palo Alto Networks firewalls. Which TWO data or state tables are synchronized across the HA2 link between active and passive peers? (Choose two)

Accepted Answer

ARP table entries to maintain layer 2 reachability after failover.. HA2 synchronizes active session tables, ARP tables, IPsec security associations, and NAT table mappings.

Answer

Local firewall physical power supply voltage metrics.

Answer

Panorama admin account SSH private keys.

Answer

Administrator password history and failed login lockout counters.

Question 12

An architect is designing a high-scale Cortex XDR deployment across 50,000 endpoints. To optimize bandwidth and reduce direct WAN traffic to the cloud backend for agent updates and log collection, which architectural component should be deployed in regional data centers?

Accepted Answer

Cortex XDR Broker VM deployed in regional data centers to act as a local proxy, content cache, and log collector.. Cortex XDR Broker VMs act as regional aggregators and proxies for agent updates, syslog collection, and telemetry forwarding.

Answer

A standalone Panorama virtual machine acting as an endpoint proxy.

Answer

Prisma Access Remote Network nodes running the XDR agent directly on gateway hypervisors.

Answer

A dedicated PA-7080 firewall performing deep packet inspection on all XDR endpoint RAM.

Question 13

An architect is designing a large-scale Prisma Access deployment with hundreds of remote networks. To simplify routing management and avoid full-mesh IPsec tunnel complexity between all branch sites, what architectural topology does Prisma Access employ by default?

Accepted Answer

Cloud-backed hub-and-spoke architecture where remote networks connect to Prisma Access cloud nodes, which handle backbone routing.. Prisma Access utilizes a cloud-native backbone operating on a hub-and-spoke or cloud-routed backbone architecture where remote networks connect to cloud locations, simplifying branch-to-branch and branch-to-DC routing.

Answer

Ring topology relying entirely on legacy Token Ring protocols.

Answer

Full-mesh BGP peering over physical leased dark fiber lines directly connecting every branch office to all other branch offices.

Answer

Peer-to-peer BitTorrent distribution of routing tables.

Question 14

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

Accepted Answer

Verify that the managed firewalls are correctly assigned to a valid Collector Group within Panorama.. Checking log collection status requires verifying connectivity on TCP port 3978 (Panorama SSL/TLS communication), verifying collector group membership, and checking disk space/health on the collectors.

Answer

Reformat the firewall data plane ASICs via the CLI.

Answer

Check if the firewall local management plane CPU is running SNMPv1 polling.

Answer

Disable SSL decryption on all internal zones.

Question 15

An architect is designing an architecture where a Palo Alto Networks firewall receives threat intelligence feeds from external sources in STIX/TAXII format. Which feature on the firewall enables direct ingestion of these customized threat feeds?

Accepted Answer

External Dynamic Lists (EDLs) configured to poll a TAXII server or URL list.. External Dynamic Lists (EDLs) allow firewalls to consume IP addresses, domains, or URLs directly from web servers or STIX/TAXII servers.

Answer

GlobalProtect HIP object database.

Answer

Syslog server forwarding profile.

Answer

Panorama Device Group Static Address Objects.

Question 16

An architect is designing high availability for a Palo Alto Networks firewall deployment and wants to ensure that both firewalls can actively process traffic under normal operating conditions while backing each other up. Which HA mode supports this?

Accepted Answer

High Availability Active/Active mode. Active/Active HA allows both firewalls to process traffic simultaneously, using device-ID and floating IPs to handle session failover.

Answer

Panorama managed standalone mode

Answer

Standalone clustering with no HA links

Answer

High Availability Active/Passive mode

Question 17

An architect is troubleshooting a Cortex XDR deployment where agents on endpoints are failing to communicate with the Cortex XDR cloud tenant. Which outbound network connectivity requirement must be verified on the local corporate firewall?

Accepted Answer

Outbound TCP port 443 (HTTPS) access to the Cortex XDR tenant cloud URL.. Cortex XDR agents communicate with the cloud tenant over outbound HTTPS (TCP port 443).

Answer

Inbound UDP port 69 (TFTP) from endpoints to Panorama.

Answer

Inbound TCP port 3389 (RDP) from the cloud backend to every endpoint.

Answer

Outbound TCP port 3978 to Panorama Collectors.

Question 18

An architect is designing an authentication architecture where Palo Alto Networks firewalls authenticate administrators against an external multi-factor authentication (MFA) provider using SAML 2.0. Which component acts as the Identity Provider (IdP) in this architecture?

Accepted Answer

The external IdP (such as Okta, Azure AD, or Ping Identity).. In a SAML authentication flow, the external system (such as Okta, Azure AD, or Ping Identity) acts as the Identity Provider (IdP), while the firewall acts as the Service Provider (SP).

Answer

The Palo Alto Networks firewall itself.

Answer

The Cortex XSOAR server.

Answer

The local database on the firewall.

Question 19

An architect is configuring a Panorama Device Group and needs to create security rules that apply to all firewalls in the enterprise, regardless of their specific regional location. Where should the architect place these rules within the Panorama rule hierarchy?

Accepted Answer

Panorama Pre-Rules configured at the topmost level before device group specific rules.. Panorama supports Pre-Rules and Post-Rules, with Pre-Rules evaluated before device group local rules and Pre-Rules enforced globally across all device groups when configured at the global level.

Answer

Template stack interface configurations.

Answer

Local firewall CLI configuration files only.

Answer

Post-rules at the bottom of a single remote branch device group.

Question 20

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO settings or parameters must be identical on both HA peers for the HA cluster to form successfully? (Choose two)

Accepted Answer

Operating mode (Active/Passive or Active/Active) and license configuration.. HA peers require matching device serial numbers/models (or VM models), matching PAN-OS versions, matching license keys, and matching operational modes (Active/Passive).

Answer

The physical serial number printed on the hardware chassis label.

Answer

The administrative password for the 'admin' user account.

Answer

The hostname assigned to each firewall in the setup menu.