SecOps-Architect Practice Test 9 — 10 Questions

Question 1

An architect is integrating Cortex XSOAR with threat intelligence platforms. Which THREE attributes are essential when evaluating the quality and operational value of ingested threat indicators? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Accuracy and false positive rate. Option B is correct because accuracy and false positive rate directly determine whether ingested indicators can be trusted for automated enforcement in Cortex XSOAR, since high-FP feeds generate excessive incidents and erode analyst confidence. Option D is correct because context and TTP mapping (e.g., aligning indicators to MITRE ATT&CK techniques and the organization's actual attack surface) let XSOAR playbooks prioritize and enrich only indicators that are operationally relevant. Option E is correct because timeliness—how quickly indicators are delivered relative to adversary campaign velocity—determines whether blocking or hunting actions occur before the infrastructure is rotated or the attack completes. Option A is not a quality or operational-value attribute; storage sizing is a capacity-planning concern, not an indicator-quality metric. Option C is irrelevant, as PDF report typography has no bearing on indicator fidelity, relevance, or detection value.

Answer

Total physical disk space required to store raw indicator text

Answer

Font family used in the vendor's PDF reports

Question 2

A security operations team uses Cortex XSIAM and Cortex XSOAR. The SOC manager wants to measure how well the team is utilizing automation to reduce manual effort. The manager asks the architect to define a metric that quantifies the proportion of incident response actions that were executed automatically versus manually. Which metric should the architect recommend?

Accepted Answer

Automation Coverage Ratio. Automation Coverage Ratio directly quantifies the share of response actions executed automatically, which is the core of the manager's request. MTTD, Alert Volume Trend, and FPR are valuable but focus on detection speed, workload volume, and detection accuracy respectively, not on the balance between manual and automated response. Thus, Automation Coverage Ratio is the only metric that answers how well automation reduces manual effort.

Answer

Mean Time to Detect (MTTD)

Answer

Alert Volume Trend

Answer

False Positive Rate (FPR)

Question 3

An architect is troubleshooting a User-ID agent deployment where group mapping information is not being retrieved from Microsoft Active Directory. Which permission or protocol requirement must be verified on the Active Directory domain controller for group mapping to succeed?

Accepted Answer

Verify LDAP/LDAPS network connectivity and ensure the service account has read permissions to query Active Directory user and group objects.. User-ID agent requires LDAP / LDAPS access and appropriate read permissions on Active Directory to query user and group object attributes.

Answer

Verify that SNMPv1 is enabled on the domain controller.

Answer

Verify that the Domain Controller has the GlobalProtect client installed.

Answer

Verify that the firewall management plane CPU is running at 100%.

Question 4

An architect is designing high availability for a Palo Alto Networks firewall deployment and wants to ensure that both firewalls can actively process traffic under normal operating conditions while backing each other up. Which HA mode supports this?

Accepted Answer

High Availability Active/Active mode. High Availability Active/Active mode allows both firewalls in the HA pair to simultaneously process traffic, providing load sharing and mutual backup. Each firewall actively handles sessions, and if one fails, the peer takes over the full load, satisfying the requirement for both to actively process traffic under normal conditions.

Answer

Panorama managed standalone mode

Answer

Standalone clustering with no HA links

Answer

High Availability Active/Passive mode

Question 5

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

Accepted Answer

Verify that the managed firewalls are correctly assigned to a valid Collector Group within Panorama.. Option B is correct because log forwarding to Panorama Collectors requires each managed firewall to be a member of a valid Collector Group; if a firewall is unassigned or assigned to a nonexistent/invalid Collector Group, its logs will not be forwarded to any Collector. Option D is correct because firewalls send logs to Panorama Collectors over TCP port 3978, so any routing issue, NAT misconfiguration, or security policy blocking that port between the firewall and the Collector will prevent log delivery. Option A is incorrect because reformatting data plane ASICs is a disruptive hardware-level operation unrelated to log forwarding configuration. Option C is incorrect because SNMPv1 polling on the management plane has no bearing on Panorama log collection. Option E is incorrect because disabling SSL decryption on internal zones affects traffic inspection, not the log forwarding path to Panorama Collectors.

Answer

Reformat the firewall data plane ASICs via the CLI.

Answer

Check if the firewall local management plane CPU is running SNMPv1 polling.

Answer

Disable SSL decryption on all internal zones.

Question 6

An architect is designing an authentication architecture where Palo Alto Networks firewalls authenticate administrators against an external multi-factor authentication (MFA) provider using SAML 2.0. Which component acts as the Identity Provider (IdP) in this architecture?

Accepted Answer

The external IdP (such as Okta, Azure AD, or Ping Identity).. In a SAML 2.0 authentication flow, the Identity Provider (IdP) is the external system that authenticates the user and issues SAML assertions. When Palo Alto Networks firewalls authenticate administrators against an external MFA provider using SAML, that external provider (e.g., Okta, Microsoft Entra ID, Ping Identity) acts as the IdP.

Answer

The Palo Alto Networks firewall itself.

Answer

The Cortex XSOAR server.

Answer

The local database on the firewall.

Question 7

An architect is integrating Prisma Cloud with a CI/CD pipeline (such as GitHub Actions or Jenkins) to perform Infrastructure as Code (IaC) scanning. Which TWO scanning targets or mechanisms are supported by Prisma Cloud for IaC security? (Choose two)

Accepted Answer

Scanning Terraform and AWS CloudFormation templates using the Prisma Cloud IaC CLI or GitHub Actions integration.. Option A is correct because Prisma Cloud's IaC scanning explicitly supports Terraform and AWS CloudFormation templates, and it can be invoked through the Prisma Cloud IaC CLI (twistcli / checkov-based scanning) or via native CI/CD integrations such as the GitHub Actions integration, making it a supported scanning target and mechanism for pipeline use. Option B is correct because Prisma Cloud also scans Kubernetes YAML manifests and Helm charts stored in git repositories to detect misconfigurations, which is a core IaC security capability for container-orchestration configuration. Option C is not correct because Prisma Cloud IaC scanning analyzes declarative infrastructure code, not live TCP packet sniffing on a network switch interface. Option D is not correct because SNMPv1 is a network-management protocol and has nothing to do with querying the Jenkins REST API for IaC scanning. Option E is not correct because Prisma Cloud Defenders run as containers or hosts in cloud/Kubernetes environments, not inside a laptop BIOS, which is not a supported IaC scanning mechanism.

Answer

Sniffing active TCP packets traversing a Jenkins build server network switch interface.

Answer

Querying the Jenkins REST API using raw SNMPv1 strings.

Answer

Running a Prisma Cloud Defender daemonset inside a developer's local laptop BIOS.

Question 8

When establishing a baseline for Security Operations Center (SOC) alert volume in Cortex XSIAM, what is the primary purpose of this baseline?

Accepted Answer

To identify operational anomalies and deviations that require investigation or tuning. Establishing a baseline allows the SOC to identify abnormal deviations, such as sudden spikes in alerts that may indicate an active attack or a misconfigured log source.

Answer

To determine the exact licensing cost for future Cortex XDR expansion

Answer

To configure firewall security policies automatically

Answer

To replace manual analyst triage with fully automated playbook closures

Question 9

Your organization has implemented a comprehensive metric reporting framework in Cortex XSIAM. However, analysts are complaining that leadership is weaponizing the 'Mean Time to Resolve' (MTTR) metric to rush investigations, leading to superficial incident closures and recurring security issues. As a SecOps Architect, how should you address this metric dysfunction?

Accepted Answer

Pair MTTR with quality and accuracy metrics such as Incident Reopen Rate and False Negative Discovery Rate to balance speed with thoroughness.. When MTTR is used in isolation, analysts may cut corners to lower their times. Best practice requires pairing speed metrics (MTTR) with quality metrics, such as Reopen Rate or Recurrence Rate, to ensure thoroughness.

Answer

Double the MTTR target time across all severity levels to give analysts more breathing room.

Answer

Abolish all metrics entirely and rely solely on subjective management intuition.

Answer

Automate all incident closures so analysts no longer have to record resolution times.

Question 10

An architect is troubleshooting a Cortex XDR deployment where agents on endpoints are failing to communicate with the Cortex XDR cloud tenant. Which outbound network connectivity requirement must be verified on the local corporate firewall?

Accepted Answer

Outbound TCP port 443 (HTTPS) access to the Cortex XDR tenant cloud URL.. Cortex XDR agents communicate with the Cortex XDR cloud tenant over outbound TCP 443 (HTTPS). The local corporate firewall must allow outbound HTTPS traffic to the tenant's cloud URL (e.g., *.xdr.us.paloaltonetworks.com) for agents to register, send telemetry, and receive policy updates.

Answer

Inbound UDP port 69 (TFTP) from endpoints to Panorama.

Answer

Inbound TCP port 3389 (RDP) from the cloud backend to every endpoint.

Answer

Outbound TCP port 3978 to Panorama Collectors.