SecOps-Architect Practice Test 2 — 30 Questions

Question 1

An architect is designing an enterprise incident response workflow using Cortex XSOAR. When a malware alert is triggered in Cortex XDR, XSOAR needs to automatically enrich the alert by querying VirusTotal, checking Active Directory for user details, and isolating the host if malicious. What is this orchestration framework called in Cortex XSOAR?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Playbook. Playbooks are the core automation workflows in Cortex XSOAR that chain together integration commands, conditions, and human approval steps.

Answer

GlobalProtect HIP Notification object

Answer

Prisma Access Remote Network profile

Answer

Panorama Device Group Policy Template

Question 2

An architect is designing an automated threat hunting and containment architecture with Cortex XSIAM. Which THREE actions can be triggered automatically upon confirming a high-fidelity behavioral threat detection? (Choose three)

Accepted Answer

Revoking user session tokens and triggering password resets in Active Directory / Azure AD. Option B is correct because Cortex XSIAM playbooks can integrate with identity providers such as Active Directory and Microsoft Entra ID to revoke session tokens and force password resets, immediately cutting off an attacker's authenticated access. Option D is correct because XSIAM can automatically push confirmed malicious indicators (IPs, domains, hashes) to dynamic blocklists on network firewalls, preventing further command-and-control or lateral movement. Option E is correct because the Cortex XDR agent supports automated endpoint isolation, which severs the compromised host's network connectivity while preserving forensic telemetry for investigation. Option A is incorrect because physically disconnecting power cables is a manual, disruptive facility action that no software orchestration platform can perform and would cause unnecessary outage. Option C is incorrect because formatting intranet web server drives is a destructive, manual remediation step that would destroy evidence and is not an automated containment action in XSIAM.

Answer

Physically disconnecting all power cables in the data center

Answer

Formatting the corporate intranet web server hard drives

Question 3

A multinational SOC architect is defining threat response requirements for Cortex XSIAM that must support both automated and analyst-driven investigations across endpoint, network, and identity telemetry. The architect must select the platform capabilities that directly enable correlation of disparate telemetry into a single incident timeline for response actions. (Choose two.)

Accepted Answer

Unified data model that normalizes endpoint, network, and identity events into common schema fields. The two capabilities that directly enable cross-domain correlation are the unified data model, which normalizes events into a common schema, and automated indicator extraction with alert stitching, which groups related events into a single incident. Together they produce the correlated timeline that both automated playbooks and analysts rely on for response actions.

Answer

Endpoint agent heartbeat monitoring for license compliance reporting

Answer

Role-based access control assignment for SOC tier analysts

Answer

Scheduled vulnerability scan integration for asset risk scoring

Question 4

Your SOC leadership team needs to measure the operational efficiency of incident containment. Which metric should you track within Cortex XSOAR to evaluate how quickly analysts isolate compromised endpoints?

Accepted Answer

Mean Time to Contain (MTTC). Mean Time to Contain (MTTC) measures the average time from incident detection to containment — i.e., how quickly analysts isolate compromised endpoints. This directly reflects operational efficiency of containment actions within Cortex XSOAR. MTTC is the metric SOC leadership uses to evaluate containment speed.

Answer

False Alarm Percentage

Answer

Mean Time to Detect (MTTD)

Answer

Alert Escalation Ratio

Question 5

An architect is integrating a Palo Alto Networks next-generation firewall with an external threat intelligence platform that publishes indicators over a REST API. The firewall must block traffic matching new indicators within minutes without manual commits. Which integration approach meets this requirement?

Accepted Answer

Create an External Dynamic List pointing to the platform's REST endpoint and configure a security policy rule to block traffic matching the list.. External Dynamic Lists are the native mechanism for consuming external indicator feeds. The firewall polls the source on a defined interval, and once the list is referenced in security policy, new entries are enforced automatically without a commit. This delivers near-real-time blocking tied directly to the threat intelligence platform's published indicators.

Answer

Register the platform as a dynamic address group source and rely on the firewall to refresh group membership on demand when policy is evaluated.

Answer

Import the indicators into a custom URL category and commit the configuration each time the platform publishes an update.

Answer

Configure the firewall to query the platform's REST API from a custom security policy action that blocks matching sessions inline.

Question 6

An architect is designing a Prisma Access deployment with multiple Remote Networks. Which TWO routing mechanisms are supported for connecting customer premises equipment (CPE) to Prisma Access Node locations? (Choose two)

Accepted Answer

Static routing configured over IPsec VPN tunnels.. Option B is correct because Prisma Access Remote Networks support static routing over the IPsec VPN tunnels that connect the CPE to the Prisma Access service IPsec termination, allowing the branch to advertise its subnets via configured static routes. Option E is correct because Prisma Access also supports BGP peering over those same IPsec tunnels, which is the recommended dynamic routing mechanism for exchanging routes between the CPE and Prisma Access and enables failover and path selection. Option A is not supported because OSPF adjacencies are not established directly across the public internet to Prisma Access nodes; dynamic routing with Prisma Access is done via BGP over the IPsec tunnel. Option C is invalid because Prisma Access is a cloud-delivered service reached over the internet, so raw Ethernet crossover cables to cloud nodes are not a supported connectivity method. Option D is invalid because AppleTalk is a legacy protocol and GRE tunnels are not the supported transport for Prisma Access Remote Networks routing.

Answer

OSPF adjacency established directly across the public internet between branch firewalls and Prisma Access.

Answer

Raw Ethernet crossover cables run directly between branch offices and Prisma Access cloud nodes.

Answer

AppleTalk routing protocol over GRE tunnels.

Question 7

A SOC architect is designing a threat response architecture that uses Cortex XSIAM to automate response actions across endpoint, network, and cloud domains. The CISO requires that automated actions be auditable and reversible where possible. Which TWO design elements are essential to meet these requirements? (Choose two.)

Accepted Answer

Define rollback or compensating actions for each automated response, such as releasing an endpoint from isolation or restoring a quarantined file.. Auditability demands a centralized, tamper-resistant record of every action's initiator, target, and outcome, while reversibility demands a defined compensating action for each automated response. Together these two elements let the SOC verify and undo automated actions. Excessive privileges, blanket manual approval, and local-only logging either weaken security or fail the stated requirements.

Answer

Store all response action logs only on the local endpoint to reduce central storage costs and latency.

Answer

Disable automated response entirely and require a human analyst to approve every action manually.

Answer

Grant the automation engine domain administrator rights so it can perform any response action without encountering permission errors.

Question 8

An architect is designing a high availability deployment for Palo Alto Networks firewalls. What is the primary purpose of the HA1 link?

Accepted Answer

Synchronize control plane configurations and exchange heartbeat keepalive messages between HA peers.. The HA1 link is the dedicated control-plane and heartbeat path between Palo Alto HA peers. It carries configuration synchronization (so the passive/active peer stays in sync), hello/heartbeat keepalives for peer liveness detection, and state information needed for failover decisions. It is not used for user data traffic.

Answer

Transfer high-speed data plane network traffic during normal operation.

Answer

Forward system logs to external SIEM collectors.

Answer

Provide direct internet access to client workstations behind the firewall.

Question 9

An architect is configuring User-ID to identify users behind a Microsoft Active Directory domain. Which protocol does the Palo Alto Networks User-ID agent use to query Active Directory security event logs for user login and logoff events?

Accepted Answer

WMI or Windows RPC/SMB to read Security Event Logs. The User-ID agent monitors Active Directory domain controllers using Windows security event logs via WMI or Windows RPC/SMB protocols.

Answer

NetFlow v9 templates

Answer

SNMPv3 polling of Active Directory database tables

Answer

HTTP POST requests sent by the Active Directory DNS service

Question 10

An architect is defining a Service Level Objective (SLO) for the SOC using Cortex XSIAM. The SLO states that 95% of high-severity incidents must be resolved within 4 hours of creation. The architect needs to create a metric that measures compliance with this SLO over a rolling 30-day window. Which Cortex XSIAM feature should the architect use to automatically calculate and alert on SLO compliance?

Accepted Answer

Create a scheduled XQL query that runs daily, calculates the percentage of high-severity incidents resolved within 4 hours over the past 30 days, and triggers a webhook if below 95%.. A scheduled XQL query is the most flexible and accurate way to compute rolling SLO compliance in Cortex XSIAM. It can aggregate incident data, apply the 95% threshold, and trigger notifications via webhook. This approach leverages native query capabilities and automation, ensuring the metric is consistently updated and actionable without relying on non-existent built-in widgets.

Answer

Configure a correlation rule that evaluates incident resolution times in real time and generates an alert when an incident exceeds 4 hours.

Answer

Use the built-in 'SLO Compliance' dashboard widget that automatically tracks all SLOs defined in the system.

Answer

Leverage the 'Incident SLA' field that is automatically populated by Cortex XSIAM based on severity and resolution time.

Question 11

An architect is designing a metrics program for a Cortex XSIAM deployment and wants to ensure that reported security metrics drive continuous improvement rather than merely describe past activity. The SOC director requires that each metric be tied to a decision or action. Which TWO characteristics must the architect build into the metric definitions to satisfy this requirement? (Choose two.)

Accepted Answer

Each metric has an explicit target or threshold that triggers a defined response when breached. Metrics drive improvement only when they are connected to decisions. An explicit target or threshold defines when action is needed, and a named owner ensures that action actually occurs. Together they turn a measurement into an operational feedback loop. Precision, dedicated storage, and annual-only review do not create that linkage, so they cannot satisfy the requirement that each metric be tied to a decision or action.

Answer

Each metric is stored in a separate dedicated dataset to simplify long-term retention

Answer

Each metric is reported with the highest possible decimal precision to avoid rounding ambiguity

Answer

Each metric is reviewed only once per year during the annual audit cycle

Question 12

An architect is designing a Prisma SD-WAN deployment integrated with Palo Alto Networks Prisma Access for branch internet and SaaS traffic. Branch sites use Prisma SD-WAN ION devices, and the security team wants all internet-bound traffic from branches to be inspected by Prisma Access while keeping SaaS traffic on a direct optimized path. Which Palo Alto Networks capability should the architect use to steer only the appropriate traffic to Prisma Access?

Accepted Answer

Configure Prisma SD-WAN policy sets with application-based and SaaS-based path selection, directing only non-SaaS internet traffic to the Prisma Access tunnel.. Prisma SD-WAN policy sets evaluate applications and SaaS destinations, allowing granular path decisions at the branch. Directing non-SaaS internet traffic into the Prisma Access tunnel while letting recognized SaaS traffic take a direct optimized path satisfies both inspection and performance goals. The other approaches either tunnel everything, rely on brittle IP lists, or misuse service connections.

Answer

Enable GlobalProtect on all branch endpoints and force full tunnel to Prisma Access, then use split tunneling to exclude SaaS applications by IP address.

Answer

Use Prisma Access service connections with static routes on the ION devices to send all traffic to the closest Prisma Access location.

Answer

Advertise a default route from Prisma Access to the branches and rely on BGP communities to influence SaaS traffic away from the tunnel.

Question 13

When designing a threat hunting architecture using XQL in Cortex XSIAM, which TWO best practices improve query performance and efficiency? (Choose two)

Accepted Answer

Use indexed fields and precise matching operators where possible. Option A is correct because using indexed fields and precise matching operators (e.g., =, in, or exact string comparisons instead of wildcard or regex-heavy filters) lets Cortex XSIAM's XQL engine prune data at the index level, drastically reducing the number of events scanned and improving query speed. Option B is correct because filtering by specific datasets (e.g., xdr_data, panw_ngfw_traffic_raw) and applying narrow time ranges early in the query pipeline limits the volume of data the engine must process before subsequent stages, which is the single most effective way to reduce XQL execution time and resource consumption. Option C is incorrect because unbounded queries across all historical data force full scans of massive datasets, causing slow execution, high resource usage, and potential timeouts. Option D is incorrect because aggregation functions like count, sum, and summarize are essential for efficient threat hunting and are optimized in XQL; avoiding them does not improve performance. Option E is incorrect because selecting all raw unparsed logs and avoiding specific field names increases data volume and prevents the engine from leveraging field-level indexing and parsing optimizations.

Answer

Run unbounded queries across all historical data without time constraints

Answer

Avoid using aggregation functions like count or summarize

Answer

Select all raw unparsed logs and avoid using specific field names

Question 14

An architect is configuring a Palo Alto Networks firewall and wants to inspect unknown files submitted by users over HTTP/FTP/SMTP to determine if they contain zero-day malware. Which service should the architect configure?

Accepted Answer

WildFire cloud-based malware analysis. WildFire is Palo Alto Networks' cloud-based malware analysis service that performs dynamic analysis of unknown files in a sandboxed environment. It supports files submitted over HTTP, FTP, SMTP, SMB, and other protocols, and can identify zero-day malware by observing behavior. The firewall forwards unknown files to WildFire, which returns a verdict (malicious, benign, grayware) and generates signatures that are automatically distributed to the firewall.

Answer

URL Filtering cloud database

Answer

GlobalProtect portal

Answer

DNS Security service

Question 15

An architect is configuring a Palo Alto Networks firewall and wants to block access to known malicious domains and phishing sites. Which security profile should be configured and attached to the security policy?

Accepted Answer

URL Filtering profile. URL Filtering profiles inspect HTTP/HTTPS web traffic and block access to malicious, phishing, or unauthorized web categories.

Answer

WildFire analysis profile

Answer

Antivirus profile

Answer

Data Filtering profile

Question 16

An architect is operationalizing security metrics for a Cortex XSIAM deployment. The SOC manager wants to track the 'Alert Triage Efficiency' metric, defined as the average time from alert creation to analyst assignment. The architect needs to ensure the metric is accurate and actionable. Which two data points must be captured and correlated to calculate this metric correctly? (Choose two.)

Accepted Answer

The timestamp when an analyst is assigned to the alert or incident.. To calculate the average time from alert creation to analyst assignment, the architect must capture both the alert creation timestamp and the assignment timestamp. These two data points define the interval. Cortex XSIAM records both events natively, allowing correlation and aggregation. Other attributes like severity or MITRE tactic are useful for filtering but not for the core calculation.

Answer

The number of automated playbook executions triggered by the alert.

Answer

The MITRE ATT&CK tactic associated with the alert.

Answer

The severity level of the alert as determined by the analytics engine.

Question 17

When setting up automated email parsing in Cortex XSOAR for phishing triage, which integration is specifically required to connect to Microsoft Office 365 using modern authentication (OAuth 2.0)?

Accepted Answer

Microsoft Graph Mail integration. The Microsoft Graph Mail integration is the correct choice because it is the only Cortex XSOAR integration designed to authenticate to Microsoft Office 365 using modern OAuth 2.0 authentication via an Microsoft Entra ID app registration. Microsoft has deprecated Basic Authentication for Exchange Online, so legacy protocols like IMAP and SMTP with basic auth no longer work for automated mailbox access. Graph Mail uses the Microsoft Graph API, which supports application-level permissions (e.g., Mail.Read) and OAuth 2.0 client credentials flow, making it the required integration for phishing triage email parsing.

Answer

SMTP Relay Server integration

Answer

Legacy Exchange IMAP integration

Answer

Active Directory LDAP integration

Question 18

An architect is designing an automated incident response architecture integrating Palo Alto Networks NGFW, Cortex XDR, and Cortex XSOAR. Which TWO architectural principles ensure an effective automated security ecosystem? (Choose two)

Accepted Answer

Centralizing threat intelligence sharing and indicator blocking via External Dynamic Lists and XSOAR playbooks.. Option B is correct because centralizing threat intelligence sharing and indicator blocking through External Dynamic Lists (EDLs) hosted on a web server and consumed by the NGFW, combined with Cortex XSOAR playbooks that push indicators to EDLs or the firewall's dynamic block lists, creates a single authoritative source of IOCs that enforces blocking consistently across the ecosystem. Option D is correct because standardized REST APIs and prebuilt integration packs (e.g., the Palo Alto Networks Panorama, Cortex XDR, and firewall integrations in XSOAR) allow playbooks to query, enrich, and execute response actions across all three products without brittle custom scripting, which is the foundation of reliable orchestration. Option A is wrong because air-gapping security tools with no internet or API access prevents the API-driven orchestration and threat-intel sharing that automated incident response requires. Option C is wrong because disabling automated remediation eliminates the automation benefit and contradicts the goal of an automated security ecosystem. Option E is wrong because manual phone calls and spreadsheets are the opposite of automated orchestration and cannot scale to machine-speed response.

Answer

Isolating all security tools on completely disconnected local networks without internet or API access.

Answer

Disabling all automated remediation to ensure zero visibility.

Answer

Relying entirely on manual phone calls and spreadsheets for every security alert.

Question 19

A multinational corporation uses Cortex XSIAM across three geographically dispersed SOCs. The security leadership wants to measure the consistency of incident triage across regions to identify process drift. Which metric best captures the uniformity of triage decisions, such as severity assignment and escalation, across all SOCs?

Accepted Answer

Triage Consistency Score. Triage Consistency Score directly measures how uniformly triage decisions are made across different SOCs. By analyzing Cortex XSIAM incident data, such as severity and escalation choices on comparable alerts, this metric highlights process drift. It provides actionable insight for standardizing triage procedures across regions, which is the core requirement.

Answer

Alert Volume per Analyst

Answer

False Positive Rate

Answer

Mean Time to Resolution (MTTR)

Question 20

You are configuring log ingestion in Cortex XSIAM from a third-party firewall using a generic syslog collector. The logs are arriving, but the parser is failing to extract destination IP addresses correctly. What is the recommended troubleshooting step?

Accepted Answer

Modify or create a custom XDM parsing rule for the vendor log format. Cortex XSIAM uses XDM (Extended Data Model) to normalize ingested logs into a common schema. When a generic syslog collector receives logs from a third-party firewall, the default parser may not correctly map vendor-specific fields to XDM attributes like destination IP. Creating or modifying a custom XDM parsing rule allows you to define extraction patterns (e.g., regex, delimiters) that correctly identify and map the destination IP field.

Answer

Increase the Syslog port number from 514 to 6514

Answer

Disable Magnifier behavioral analytics

Answer

Reinstall the Cortex XDR agent on the third-party firewall