SecOps-Architect Practice Questions 1 — 50 Questions

Question 1

An architect is configuring User-ID mapping via GlobalProtect. When remote users connect via GlobalProtect, how does the firewall learn the user-to-IP mapping without querying Active Directory domain controllers directly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GlobalProtect gateway directly registers the authenticated username and assigned tunnel IP with the User-ID subsystem.. GlobalProtect portals and gateways natively send user authentication mapping information to the User-ID subsystem upon successful VPN tunnel establishment.

Answer

GlobalProtect stores user mappings inside Cortex XDR cloud databases.

Answer

GlobalProtect relies on DNS reverse-lookup polling every 24 hours.

Answer

GlobalProtect uses SNMP traps to poll local Wi-Fi routers.

Question 2

An enterprise architect is designing an architecture where Prisma Cloud computes compliance for multi-cloud environments (AWS, Azure, GCP). To provide least-privilege access for Prisma Cloud to discover and assess resource configurations across multiple AWS accounts, which deployment method should the architect recommend?

Accepted Answer

AWS IAM Role with a unique External ID and CloudFormation stack sets deployed across all target accounts linked to a master payer account.. Prisma Cloud requires secure cross-account access in AWS. Enterprise architectures use AWS IAM Roles with External IDs and CloudFormation stack sets for scalable, least-privilege onboarding.

Answer

A single hardcoded AWS IAM Access Key and Secret Access Key embedded in the Prisma Cloud console settings.

Answer

Deploying a Prisma Cloud Defender daemonset on every AWS EC2 instance in the enterprise.

Answer

Configuring AWS Security Hub to push JSON dumps via FTP to Prisma Cloud.

Question 3

An architect is aligning a new SOC's response workflow with the NIST SP 800-61 incident handling lifecycle. During the containment, eradication, and recovery phase, the team must decide which activities belong there rather than in later lessons-learned work. Which two activities are correctly performed within that phase? (Choose two.)

Accepted Answer

Rebuilding an affected host from a known-good image after removing the threat. NIST SP 800-61 places containment, eradication, and recovery actions such as isolating hosts and rebuilding systems in the third phase. Post-mortems, policy revisions, and notifications are either post-incident activities or separate governance obligations. Keeping the phase boundaries clear prevents premature closure and preserves evidence integrity during active handling.

Answer

Publishing a public breach notification to regulators before containment completes

Answer

Conducting a post-mortem meeting to update detection rules and response procedures

Answer

Approving the incident response policy revision in the change advisory board

Question 4

An architect is designing an automated containment workflow in Cortex XSOAR. The requirement is to isolate a compromised endpoint running Cortex XDR agent without disrupting critical domain controllers. Which configuration parameter must be validated in the isolation command?

Accepted Answer

Exclusion lists and targeted device IDs to prevent critical asset isolation. When executing endpoint isolation in Cortex XDR via XSOAR, the architect must ensure exceptions or proper scoping are applied to prevent isolating essential infrastructure like Domain Controllers.

Answer

PAN-OS external dynamic list expiration timers

Answer

Global firewall rule bypass codes

Answer

Syslog forwarding facility levels

Question 5

An architect is configuring User-ID mapping via GlobalProtect. When remote users connect via GlobalProtect, how does the firewall learn the user-to-IP mapping without querying Active Directory domain controllers directly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure multiple LDAP Server profiles in Panorama and map them under User-ID Server Monitor / Agent settings for each domain controller.. When multiple AD forests or domains are present, deploying User-ID agents or configuring Panorama/NGFW User-ID LDAP integrations with appropriate server profiles for each domain ensures complete coverage.

Answer

Use Syslog forwarding from local workstations without a domain controller.

Answer

Configure a single static IP address list for all users.

Answer

Rely solely on GlobalProtect portal logs while disabling Active Directory monitoring.

Question 6

An architect is configuring a Palo Alto Networks firewall and wants to inspect outbound traffic for malware. Which security profile should be attached to the security policy rule allowing outbound internet traffic?

Accepted Answer

Antivirus security profile. Antivirus profiles inspect traffic traversing security policies for known malware signatures.

Answer

Decryption profile

Answer

Zone Protection profile

Answer

User-ID agent profile

Question 7

An architect is troubleshooting a User-ID deployment where IP-to-username mappings are missing for users on a specific subnet. Which TWO sources or tools can be checked to verify mapping status on the Palo Alto Networks firewall? (Choose two)

Accepted Answer

Run the CLI command 'show user ip-user-mapping all' on the firewall to view current mappings.. Option C is correct because the CLI command 'show user ip-user-mapping all' directly queries the firewall's User-ID mapping table, displaying the current IP-to-username mappings and their source (e.g., User-ID agent, GlobalProtect, captive portal), which is exactly what is needed to verify whether mappings exist for the affected subnet. Option D is correct because the User-ID agent status and connection state shown under Device > User Identification confirms whether the firewall is successfully connected to the User-ID agent (or Windows-based agent) and receiving mappings; a disconnected or unregistered agent would explain missing mappings for that subnet. Option A is irrelevant since the BIOS boot sequence has nothing to do with User-ID mapping. Option B is irrelevant because GlobalProtect client warranty details are unrelated to IP-to-username mapping status. Option E is irrelevant because HA2 fiber transceivers concern high-availability synchronization links, not User-ID mapping.

Answer

Check the BIOS boot sequence of the firewall management plane.

Answer

Check the GlobalProtect client GUI for hardware warranty details.

Answer

Verify the physical fiber optic cable transceivers on HA2.

Question 8

An architect is designing a zero-trust network segmentation strategy using Palo Alto Networks NGFWs. The security team wants security rules to dynamically adapt when workloads spin up or down in a dynamic environment, without needing static IP addresses in rule definitions. Which feature should the architect implement?

Accepted Answer

Dynamic Address Groups (DAGs) populated via tags registered through VM-Series API or User-ID.. Dynamic Address Groups (DAGs) use tags registered via VM-Series, User-ID, or cloud plugins to automatically add or remove IP addresses from security policies.

Answer

GlobalProtect portal static IP pools.

Answer

Panorama Template Stack variables.

Answer

Static address objects grouped into nested address groups.

Question 9

A SOC architect is standardizing how analysts describe adversary behavior across a multinational team. The CISO mandates adoption of the MITRE ATT&CK framework for all incident documentation. Which structural element of ATT&CK should the architect use to map a specific adversary action such as credential dumping from LSASS memory?

Accepted Answer

A technique identified by its Tactic and Technique IDs (for example, T1003 under Credential Access). Techniques are the correct granularity for documenting a concrete adversary action such as dumping credentials from LSASS memory. Each technique has a stable ID under a tactic, enabling consistent detection mapping, coverage measurement, and intelligence sharing. Groups, software, and mitigations are related objects that enrich context but do not describe the observed behavior itself.

Answer

A software entry describing the specific malware family observed on the endpoint

Answer

A group entry representing the tracked threat actor cluster behind the intrusion

Answer

A mitigation entry that prescribes the defensive control for the observed behavior

Question 10

A security operations team wants to report how quickly its detection content is keeping pace with the evolving threat landscape. The architect proposes tracking the median age of detection rules at the time they first generate a true positive. What does this metric most directly indicate about the detection program?

Accepted Answer

The currency and responsiveness of detection coverage relative to emerging threats. Rule age at first true positive measures how fresh detection content was when it proved effective. A low median indicates the team quickly develops coverage for emerging threats, while a high median signals lagging or stale content. This makes it a direct indicator of detection currency and responsiveness, unlike ROI, analyst workload, or traffic inspection coverage, none of which address detection timeliness.

Answer

The percentage of total network traffic inspected by the detection stack

Answer

The average number of alerts each analyst investigates per shift

Answer

The financial return on investment of the detection engineering team

Question 11

An architect is configuring a Palo Alto Networks firewall to prevent unauthorized exfiltration of sensitive data such as credit card numbers and social security numbers. Which security profile should the architect use?

Accepted Answer

Data Filtering profile. The Data Filtering profile is designed to detect and prevent unauthorized exfiltration of sensitive data such as credit card numbers, social security numbers, and other PII. It uses predefined or custom data patterns to inspect traffic and can block or alert on violations. Attaching this profile to a Security Policy rule enforces data loss prevention.

Answer

WildFire Analysis profile

Answer

URL Filtering profile

Answer

Zone Protection profile

Question 12

An architect is designing a multi-virtual router architecture on a Palo Alto Networks firewall. What is the primary purpose of configuring multiple virtual routers on a single firewall?

Accepted Answer

To maintain separate routing tables and participate in multiple routing protocols across different zones or interfaces.. Multiple virtual routers (VRs) on a Palo Alto Networks firewall allow the device to maintain independent routing tables and run separate routing protocol instances (OSPF, BGP, RIP) per VR. This enables traffic segregation between zones, tenants, or interfaces without requiring separate physical firewalls. Each VR operates as an isolated Layer 3 routing domain, so routes learned in one VR are never leaked into another unless explicitly configured via inter-VR static routes or redistribution.

Answer

To increase the hardware clock speed of the management plane CPU.

Answer

To replace the need for security policy rules.

Answer

To automatically generate Panorama device groups.

Question 13

A security architect is designing a threat response architecture that must coordinate actions across Cortex XSIAM, Cortex XSOAR, and third-party firewalls. During a recent exercise, response actions executed in the wrong order, causing an endpoint to be isolated before its indicators were enriched, which delayed the firewall block. The architect must ensure deterministic ordering of enrichment and containment steps. Which design approach best addresses this?

Accepted Answer

Model the response as a Cortex XSOAR playbook with explicit task dependencies and conditional branches that enforce enrichment before containment.. Deterministic ordering requires an orchestration layer that models task dependencies, and Cortex XSOAR playbooks provide exactly that through sequential tasks and conditional branches. Enrichment can be made a prerequisite for containment, ensuring indicators are available before isolation or firewall blocks execute. Polling changes, parallel execution, and independent listeners either ignore ordering or make it worse.

Answer

Use separate webhook listeners for each system so that each integration receives its commands independently of the others.

Answer

Increase the polling interval on the firewall integration so that block requests are queued and processed in the order they arrive.

Answer

Configure all response actions to run in parallel to reduce mean time to respond and rely on analysts to correct any ordering issues.

Question 14

An architect is designing an automated threat intelligence enrichment pipeline in Cortex XSOAR. Which THREE actions are typically performed during indicator lifecycle management? (Choose three)

Accepted Answer

Correlating and calculating composite reputation scores across multiple sources. Indicator lifecycle management in Cortex XSOAR centers on ingesting, scoring, and retiring indicators as their relevance changes. Option B is correct because the platform correlates indicators from multiple feeds and computes composite reputation scores (e.g., via the reputation commands and DBotScore) so analysts see an aggregated verdict rather than isolated source data. Option C is correct because structured ingestion from STIX/TAXII feeds is a standard, automated way to bring external threat intel into the indicator store for enrichment and matching. Option D is correct because indicators must be aged out or expired based on a TTL so stale IOCs do not generate false positives or clutter the database, which is a core lifecycle stage. Options A and E are incorrect because replacing server motherboards and recompiling the Linux kernel are hardware/OS maintenance tasks unrelated to threat intelligence indicator lifecycle management.

Answer

Physically replacing the server motherboard every 90 days

Answer

Manually recompiling the Linux kernel for every IOC added

Question 15

A Cortex XSIAM customer wants to report the proportion of high-severity incidents that were fully resolved within the agreed service level. The architect must define the metric so that it cannot be inflated by simply closing incidents without completing remediation. Which definition best prevents that distortion?

Accepted Answer

Percentage of high-severity incidents where all required remediation tasks were completed and verified within the SLA window. To prevent inflation, the SLA metric must require evidence of completed and verified remediation, not merely a closed status. Counting all closures regardless of reason allows premature or benign closure to pad the number. Workload and opening counts describe different aspects of operations and cannot confirm resolution quality. The definition tied to verified remediation tasks within the SLA window is the only one that reliably reflects true service attainment.

Answer

Total count of high-severity incidents opened during the SLA window

Answer

Percentage of high-severity incidents closed within the SLA window, regardless of closure reason

Answer

Average number of high-severity incidents assigned to each analyst within the SLA window

Question 16

An organization is integrating Prisma Cloud with Cortex XSOAR to automate cloud incident response. When configuring the Prisma Cloud integration instance in XSOAR, which authentication mechanism is recommended to securely fetch alerts without using static user credentials?

Accepted Answer

OAuth 2.0 Client Credentials grant via a dedicated Service Account. The Prisma Cloud integration in Cortex XSOAR supports OAuth 2.0 Client Credentials grant using a dedicated Service Account, which issues short-lived access tokens without embedding static user credentials. This is the recommended secure authentication method for fetching alerts programmatically. It aligns with least-privilege and credential-rotation best practices.

Answer

LDAP bind credentials through a Cortex XDR Broker VM

Answer

HTTP Basic Authentication with administrative credentials

Answer

SAML 2.0 Federation token exchange

Question 17

When reporting security posture metrics to non-technical stakeholders, why is it recommended to use risk-based metrics alongside operational performance metrics?

Accepted Answer

Risk metrics translate technical SOC activity into business impact and potential financial exposure that executives understand.. Risk-based metrics translate technical concepts (like alerts and playbooks) into business impact (like financial exposure and compliance posture), which resonates better with executive leadership.

Answer

Risk metrics are required by Cortex XSOAR to execute automated remediation playbooks.

Answer

Risk metrics replace the need for any technical logging or endpoint monitoring in Cortex XDR.

Answer

Risk metrics automatically patch vulnerabilities on endpoints without requiring administrative approval.

Question 18

When presenting security posture metrics to executive management, an architect must ensure the reporting framework aligns with business risk rather than purely technical telemetry. Which metric best communicates operational effectiveness to business stakeholders?

Accepted Answer

Risk Reduction Over Time based on closed vulnerabilities and mitigated incidents. Risk reduction over time, measured by closed vulnerabilities and mitigated incidents, translates technical security activity into business-relevant outcomes by showing how the organization's exposure is decreasing. Executives care about whether security investments are lowering risk, not about raw telemetry volumes. This metric directly connects operational effectiveness to business risk posture.

Answer

Total raw log ingestion volume in gigabytes per day

Answer

Number of firewall rule change requests processed

Answer

Cortex XDR agent version distribution percentages

Question 19

An organization is adopting the Cyber Kill Chain framework to evaluate their intrusion detection capabilities across the network and endpoint layers. During which phase should security architects implement egress filtering and DNS sinkholing to disrupt adversary operations?

Accepted Answer

Command and Control (C2). Egress filtering and DNS sinkholing are defensive measures that disrupt the Command and Control (C2) phase of the Cyber Kill Chain, where compromised hosts attempt to communicate with adversary-controlled infrastructure. By blocking outbound traffic to known malicious IPs/domains and sinkholing DNS requests, defenders prevent the adversary from issuing commands or exfiltrating data. This directly targets the C2 channel rather than earlier phases like Reconnaissance or Exploitation.

Answer

Reconnaissance

Answer

Exploitation

Answer

Installation

Question 20

Your organization is undergoing an external ISO 27001 audit. The auditors request empirical proof of continuous monitoring effectiveness and incident response responsiveness over the past 12 months. Which Cortex XSIAM / XSOAR artifacts should you present to satisfy this requirement?

Accepted Answer

Aggregated historical SLA compliance reports, MTTD/MTTR trend dashboards, and immutable incident audit logs.. Auditors require historical audit trails, SLA compliance reports, trend graphs of MTTD/MTTR, and immutable incident response logs proving continuous operations and adherence to internal policies.

Answer

A signed letter from the SOC manager stating that the team works very hard.

Answer

Raw backup files of the firewall configuration database without incident metrics.

Answer

A list of employee login passwords stored in plaintext.