SecOps-Architect Practice Questions 2 — 50 Questions

Question 1

An architect is configuring a Cortex XDR integration with a third-party SIEM. The SIEM requires log data formatted in Common Event Format (CEF) over Syslog. Where should the architect configure this output format in the Cortex XDR architecture?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cortex XDR Broker VM Syslog Collector profile configured with CEF mapping.. Cortex XDR Log Forwarding profiles or Broker VM Syslog Collector configurations allow formatting logs in CEF or JSON before forwarding to external SIEMs.

Answer

Prisma Cloud compliance check rule definitions.

Answer

Panorama firewall administrative GUI banner settings.

Answer

GlobalProtect gateway portal authentication profile.

Question 2

An architect is configuring Palo Alto Networks firewall logging. By default, when are traffic logs generated for allowed sessions?

Accepted Answer

When the session terminates (closes).. Traffic logs for allowed sessions are generated when the session terminates (closes), logging total bytes, packet counts, and duration.

Answer

Every 1 millisecond regardless of session state.

Answer

Only when an administrator manually clicks 'Export Logs'.

Answer

Only when the session first initiates.

Question 3

An architect is troubleshooting a Palo Alto Networks High Availability (HA) cluster where configuration synchronization between active and passive peers is failing. Which TWO locations or settings should the architect check? (Choose two)

Accepted Answer

Verify physical and logical connectivity on the HA1 control link interface.. HA configuration synchronization failure troubleshooting involves checking HA1 link connectivity, ensuring matching PAN-OS versions, and verifying HA settings in Device > High Availability.

Answer

Check the DNS server IP address configured on the management interface.

Answer

Check the URL Filtering cloud license status.

Answer

Check the GlobalProtect gateway portal certificate expiration date.

Question 4

An architect is designing a high availability deployment for Palo Alto Networks firewalls. What is the primary purpose of the HA1 link?

Accepted Answer

Synchronize control plane configurations and exchange heartbeat keepalive messages between HA peers.. The HA1 link is dedicated to control plane communication, configuration synchronization, and heartbeats between HA peers.

Answer

Transfer high-speed data plane network traffic during normal operation.

Answer

Forward system logs to external SIEM collectors.

Answer

Provide direct internet access to client workstations behind the firewall.

Question 5

An architect is configuring a Palo Alto Networks firewall and wants to control application traffic (such as allowing Skype business calls while blocking Skype file transfers). Which security policy match enables this granularity?

Accepted Answer

App-ID based security policy rules specifying application and sub-features.. App-ID allows granular control of applications and sub-features (App-ID sub-functions) within a single security policy rule.

Answer

Destination IP address matching only.

Answer

TCP port number matching (e.g., port 80/443).

Answer

Source MAC address filtering.

Question 6

An architect is configuring a Palo Alto Networks firewall and wants to inspect unknown files submitted by users over HTTP/FTP/SMTP to determine if they contain zero-day malware. Which service should the architect configure?

Accepted Answer

WildFire cloud-based malware analysis. WildFire is Palo Alto Networks cloud-based threat analysis service that sandboxes unknown files to detect zero-day malware.

Answer

URL Filtering cloud database

Answer

GlobalProtect portal

Answer

DNS Security service

Question 7

An architect is designing a Prisma Cloud Compute deployment for Kubernetes clusters. Which TWO architectural components must be considered when planning Defender deployments for security monitoring? (Choose two)

Accepted Answer

Deploying Defender as a Kubernetes DaemonSet to monitor all pods and container runtimes on every worker node.. Prisma Cloud Compute Defenders can be deployed as DaemonSets on Kubernetes nodes or as serverless/App-Embedded defenders depending on the architecture.

Answer

Configuring GlobalProtect gateway tunnels inside every container container root filesystem.

Answer

Physically soldering Defender chips onto the motherboard of the Kubernetes master node.

Answer

Installing SNMPv1 agents on all container loopback interfaces.

Question 8

An architect is designing a multi-tenant Prisma Access architecture. Different business units require separate address spaces, security policies, and administrative boundaries. Which Prisma Access feature enables this logical separation?

Accepted Answer

Panorama Device Groups and Folders with role-based access control (RBAC).. Prisma Access uses folder structures, device groups, and Panorama multi-tenancy constructs (such as multi-tenant Panorama deployment or distinct Prisma Access folders in Panorama) to logically segment business units.

Answer

Cortex XDR agent exclusion lists.

Answer

Physical stacking cables linking remote branch routers.

Answer

GlobalProtect client-side registry keys.

Question 9

An architect is configuring a Palo Alto Networks firewall and wants to block traffic based on geographic location (e.g., blocking traffic originating from specific countries). Which feature enables this?

Accepted Answer

GeoIP matching in Security Policy rules based on source or destination country tags.. GeoIP in Palo Alto Networks security policies allows matching traffic source or destination countries.

Answer

Static TCP port filtering rules.

Answer

GlobalProtect client version checks.

Answer

DNS root hint server configuration.

Question 10

An architect is configuring a Palo Alto Networks firewall and needs to ensure that DNS requests originating from internal clients to known malicious domains are automatically intercepted or blocked. Which security feature provides this capability?

Accepted Answer

DNS Security service with sinkhole configuration.. DNS Security service uses machine learning and threat intelligence to analyze and block malicious DNS requests in real time.

Answer

Static host file entries on the firewall management interface.

Answer

SNMP trap alert generator.

Answer

DHCP lease reservation tables.

Question 11

An architect is configuring Palo Alto Networks firewall interfaces. Which TWO interface types are supported in PAN-OS for routing traffic between security zones? (Choose two)

Accepted Answer

Layer 3 interface assigned an IP address and virtual router.. PAN-OS supports Layer 3 interfaces, Layer 2 interfaces, Virtual Wire (vwire), Tap, and Loopback/Tunnel interfaces.

Answer

Bluetooth Low Energy (BLE) antenna interface.

Answer

Universal Serial Bus (USB) printer interface.

Answer

HDMI multimedia display interface.

Question 12

An architect is configuring a Palo Alto Networks firewall and wants to inspect encrypted TLS traffic passing through the firewall without terminating the SSL session on the firewall itself (e.g., to identify malicious JA3 signatures or SNI without decryption). Which feature should the architect configure?

Accepted Answer

App-ID inspection of SSL/TLS Server Name Indication (SNI) and certificate attributes during handshake.. SSH Proxy or SSL Decryption without decryption (using SSL Forward Proxy visibility or inspecting SNI/certificate metadata) allows visibility into encrypted traffic metadata. Specifically, App-ID uses SNI and certificate inspection in TLS handshakes without full decryption.

Answer

Installing GlobalProtect portal certificates.

Answer

Formatting logs into raw Syslog CEF.

Answer

Disabling all security profiles.

Question 13

An architect is designing an enterprise deployment of Palo Alto Networks firewalls managed by Panorama. A requirement is that certain firewall configuration changes (such as local interface IP addresses) must remain unique per firewall while security rules remain centrally managed. Which Panorama feature should the architect use?

Accepted Answer

Template Variables defined in Panorama templates with unique values assigned per firewall.. Template Variables allow defining unique values per firewall while using centralized templates.

Answer

GlobalProtect HIP object criteria.

Answer

Panorama Pre-Rules with static 'any-any' destinations.

Answer

Global Administrative lockdown mode.

Question 14

An architect is designing a multi-tenant Palo Alto Networks firewall deployment using Virtual Systems (vsys). Each vsys requires dedicated administrative access. Which administrative object must be configured to grant a specific administrator access to only one particular vsys?

Accepted Answer

Administrative Role with restricted Access Domain pointing to the specific vsys.. Administrative Roles and Access Domains allow restricting administrators to specific virtual systems (vsys) or device groups.

Answer

GlobalProtect HIP object profiles.

Answer

Global Superuser account sharing.

Question 15

An architect is designing a Prisma Cloud Compute deployment for cloud-native applications. Which TWO security scanning and monitoring capabilities are provided by Prisma Cloud Compute? (Choose two)

Accepted Answer

Vulnerability scanning for container images, serverless functions, and virtual machine hosts.. Prisma Cloud Compute provides vulnerability scanning for container images, serverless functions, and host VMs, plus runtime defense and compliance checks.

Answer

Physically rewiring enterprise data center power distribution units.

Answer

Hosting public website domains on Prisma Cloud Defender node storage.

Answer

Printing physical compliance paper certificates on office laser printers.

Question 16

An incident response architect is defining severity levels for security alerts in Cortex XDR. Which severity classification typically triggers automated containment playbooks without human intervention?

Accepted Answer

Critical. High or Critical severity alerts are commonly mapped to automated containment responses in modern SOAR architectures.

Answer

Debugging

Answer

Low

Answer

Informational

Question 17

An architect is configuring a Palo Alto Networks firewall and wants to inspect compressed or archived files (such as .zip or .tar files) for embedded malware. Which security profile feature enables this inspection?

Accepted Answer

Antivirus and File Blocking profiles configured with archive unpacking enabled.. File Blocking and Antivirus profiles support archive unpacking (decompression) to inspect nested files within archives.

Answer

Zone Protection profile with SYN cookies.

Answer

URL Filtering profile with SSL decryption disabled.

Answer

DNS Security service sinkhole.

Question 18

When setting up automated email parsing in Cortex XSOAR for phishing triage, which integration is specifically required to connect to Microsoft Office 365 using modern authentication (OAuth 2.0)?

Accepted Answer

Microsoft Graph Mail integration. The Microsoft Office 365 Mail integration (or MS Graph Mail) uses OAuth 2.0 to ingest emails securely.

Answer

SMTP Relay Server integration

Answer

Legacy Exchange IMAP integration

Answer

Active Directory LDAP integration

Question 19

An architect is designing an enterprise threat hunting program utilizing Cortex XSIAM. They want to create a custom analytics rule that triggers when a specific sequence of three distinct event types occurs within a 10-minute window on the same endpoint. Which feature should be used?

Accepted Answer

XQL Correlation Rules (Sequence matching). Data Stitching and XQL correlation rules allow multi-event sequence detection across datasets and time windows.

Answer

Static IP Blocklist configuration

Answer

XSOAR Email Parsing Rules

Answer

Cortex XDR Agent Local Analysis settings

Question 20

An architect is designing an enterprise incident response communication plan. Which THREE components are critical for effective operational coordination during a major security incident? (Choose three)

Accepted Answer

Pre-defined stakeholder and legal notification escalation trees. Effective operational coordination requires secure communication channels, stakeholder notification trees, and centralized logging.

Answer

Publicly posting all unredacted forensic disk images on social media

Answer

Disabling all documentation to maintain total secrecy