SecOps-Architect Multiple Select — 30 Questions

Question 1

An architect is aligning a new SOC's response workflow with the NIST SP 800-61 incident handling lifecycle. During the containment, eradication, and recovery phase, the team must decide which activities belong there rather than in later lessons-learned work. Which two activities are correctly performed within that phase? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rebuilding an affected host from a known-good image after removing the threat. NIST SP 800-61 places containment, eradication, and recovery actions such as isolating hosts and rebuilding systems in the third phase. Post-mortems, policy revisions, and notifications are either post-incident activities or separate governance obligations. Keeping the phase boundaries clear prevents premature closure and preserves evidence integrity during active handling.

Answer

Publishing a public breach notification to regulators before containment completes

Answer

Conducting a post-mortem meeting to update detection rules and response procedures

Answer

Approving the incident response policy revision in the change advisory board

Question 2

An architect is troubleshooting a User-ID deployment where IP-to-username mappings are missing for users on a specific subnet. Which TWO sources or tools can be checked to verify mapping status on the Palo Alto Networks firewall? (Choose two)

Accepted Answer

Run the CLI command 'show user ip-user-mapping all' on the firewall to view current mappings.. Option C is correct because the CLI command 'show user ip-user-mapping all' directly queries the firewall's User-ID mapping table, displaying the current IP-to-username mappings and their source (e.g., User-ID agent, GlobalProtect, captive portal), which is exactly what is needed to verify whether mappings exist for the affected subnet. Option D is correct because the User-ID agent status and connection state shown under Device > User Identification confirms whether the firewall is successfully connected to the User-ID agent (or Windows-based agent) and receiving mappings; a disconnected or unregistered agent would explain missing mappings for that subnet. Option A is irrelevant since the BIOS boot sequence has nothing to do with User-ID mapping. Option B is irrelevant because GlobalProtect client warranty details are unrelated to IP-to-username mapping status. Option E is irrelevant because HA2 fiber transceivers concern high-availability synchronization links, not User-ID mapping.

Answer

Check the BIOS boot sequence of the firewall management plane.

Answer

Check the GlobalProtect client GUI for hardware warranty details.

Answer

Verify the physical fiber optic cable transceivers on HA2.

Question 3

An architect is designing an automated threat intelligence enrichment pipeline in Cortex XSOAR. Which THREE actions are typically performed during indicator lifecycle management? (Choose three)

Accepted Answer

Correlating and calculating composite reputation scores across multiple sources. Indicator lifecycle management in Cortex XSOAR centers on ingesting, scoring, and retiring indicators as their relevance changes. Option B is correct because the platform correlates indicators from multiple feeds and computes composite reputation scores (e.g., via the reputation commands and DBotScore) so analysts see an aggregated verdict rather than isolated source data. Option C is correct because structured ingestion from STIX/TAXII feeds is a standard, automated way to bring external threat intel into the indicator store for enrichment and matching. Option D is correct because indicators must be aged out or expired based on a TTL so stale IOCs do not generate false positives or clutter the database, which is a core lifecycle stage. Options A and E are incorrect because replacing server motherboards and recompiling the Linux kernel are hardware/OS maintenance tasks unrelated to threat intelligence indicator lifecycle management.

Answer

Physically replacing the server motherboard every 90 days

Answer

Manually recompiling the Linux kernel for every IOC added

Question 4

An architect is designing an enterprise incident response communication plan. Which THREE components are critical for effective operational coordination during a major security incident? (Choose three)

Accepted Answer

Pre-defined stakeholder and legal notification escalation trees. Option A is correct because pre-defined stakeholder and legal notification escalation trees establish who must be informed, in what order, and within what regulatory timeframes (e.g., GDPR 72-hour breach notification), which is essential for coordinated operational response. Option B is correct because a centralized incident war room with a ticketing audit trail provides a single source of truth, preserves chain-of-custody evidence, and enables real-time task tracking and after-action review. Option C is correct because secure out-of-band communication channels (e.g., encrypted messaging or dedicated conference bridges separate from compromised corporate email) ensure responders can coordinate even if primary infrastructure is breached or unavailable. Option D is not appropriate because publishing unredacted forensic disk images exposes sensitive data, violates privacy and legal obligations, and compromises the investigation. Option E is not appropriate because disabling documentation destroys the audit trail needed for coordination, compliance, and post-incident analysis.

Answer

Publicly posting all unredacted forensic disk images on social media

Answer

Disabling all documentation to maintain total secrecy

Question 5

Which TWO metrics are essential when evaluating the effectiveness of a Security Operations Center's (SOC) detection engineering process? (Choose two)

Accepted Answer

False Positive Rate (FPR) of detection rules. The False Positive Rate (FPR) of detection rules (option D) is essential because it quantifies how often benign activity is incorrectly flagged as malicious, directly measuring the noise and analyst workload that detection engineering must minimize. The True Positive Rate (TPR) of detection rules (option E) is equally essential because it measures how reliably the rules catch actual malicious activity, reflecting detection coverage and effectiveness. Together, FPR and TPR form the core trade-off in tuning detection logic, so both are key indicators of a SOC detection engineering process. Option A (Cortex XDR agent license cost per endpoint) is a procurement/budget metric, not a detection quality metric. Option B (total physical weight of server racks) is an irrelevant facilities measurement. Option C (average printer paper consumption) has no bearing on detection engineering performance.

Answer

Cortex XDR agent software license cost per endpoint

Answer

Total physical weight of server racks in the datacenter

Answer

Average printer paper consumption in the SOC office

Question 6

An architect is designing a Palo Alto Networks SSL Decryption architecture. Which TWO best practices should be implemented to minimize user friction and protect user privacy (e.g., healthcare or financial sites)? (Choose two)

Accepted Answer

Install a trusted Enterprise Certificate Authority (CA) root certificate onto all managed client endpoints.. Option B is correct because installing a trusted Enterprise CA root certificate on all managed endpoints allows the firewall to re-sign decrypted sessions with a certificate the client already trusts, preventing browser certificate warnings and minimizing user friction. Option E is correct because configuring Decryption Exclusions for sensitive URL categories such as Financial Services and Healthcare honors privacy regulations (e.g., HIPAA, GLBA) and avoids decrypting traffic users expect to remain private. Option A is wrong because indiscriminately decrypting banking and medical portals violates privacy expectations and may breach compliance requirements. Option C is wrong because self-signed firewall certificates are not trusted by endpoints, producing certificate errors and user friction. Option D is wrong because disabling SSL decryption entirely removes all visibility and threat inspection, defeating the purpose of the architecture.

Answer

Decrypt all traffic indiscriminately, including banking and medical portals, without exception.

Answer

Use self-signed certificates generated on the firewall without distributing them to endpoints.

Answer

Disable SSL decryption entirely across all zones.

Question 7

An architect is designing an automated threat hunting and containment architecture with Cortex XSIAM. Which THREE actions can be triggered automatically upon confirming a high-fidelity behavioral threat detection? (Choose three)

Accepted Answer

Revoking user session tokens and triggering password resets in Active Directory / Azure AD. Option B is correct because Cortex XSIAM playbooks can integrate with identity providers such as Active Directory and Microsoft Entra ID to revoke session tokens and force password resets, immediately cutting off an attacker's authenticated access. Option D is correct because XSIAM can automatically push confirmed malicious indicators (IPs, domains, hashes) to dynamic blocklists on network firewalls, preventing further command-and-control or lateral movement. Option E is correct because the Cortex XDR agent supports automated endpoint isolation, which severs the compromised host's network connectivity while preserving forensic telemetry for investigation. Option A is incorrect because physically disconnecting power cables is a manual, disruptive facility action that no software orchestration platform can perform and would cause unnecessary outage. Option C is incorrect because formatting intranet web server drives is a destructive, manual remediation step that would destroy evidence and is not an automated containment action in XSIAM.

Answer

Physically disconnecting all power cables in the data center

Answer

Formatting the corporate intranet web server hard drives

Question 8

A multinational SOC architect is defining threat response requirements for Cortex XSIAM that must support both automated and analyst-driven investigations across endpoint, network, and identity telemetry. The architect must select the platform capabilities that directly enable correlation of disparate telemetry into a single incident timeline for response actions. (Choose two.)

Accepted Answer

Unified data model that normalizes endpoint, network, and identity events into common schema fields. The two capabilities that directly enable cross-domain correlation are the unified data model, which normalizes events into a common schema, and automated indicator extraction with alert stitching, which groups related events into a single incident. Together they produce the correlated timeline that both automated playbooks and analysts rely on for response actions.

Answer

Endpoint agent heartbeat monitoring for license compliance reporting

Answer

Role-based access control assignment for SOC tier analysts

Answer

Scheduled vulnerability scan integration for asset risk scoring

Question 9

An architect is designing a Prisma Access deployment with multiple Remote Networks. Which TWO routing mechanisms are supported for connecting customer premises equipment (CPE) to Prisma Access Node locations? (Choose two)

Accepted Answer

Static routing configured over IPsec VPN tunnels.. Option B is correct because Prisma Access Remote Networks support static routing over the IPsec VPN tunnels that connect the CPE to the Prisma Access service IPsec termination, allowing the branch to advertise its subnets via configured static routes. Option E is correct because Prisma Access also supports BGP peering over those same IPsec tunnels, which is the recommended dynamic routing mechanism for exchanging routes between the CPE and Prisma Access and enables failover and path selection. Option A is not supported because OSPF adjacencies are not established directly across the public internet to Prisma Access nodes; dynamic routing with Prisma Access is done via BGP over the IPsec tunnel. Option C is invalid because Prisma Access is a cloud-delivered service reached over the internet, so raw Ethernet crossover cables to cloud nodes are not a supported connectivity method. Option D is invalid because AppleTalk is a legacy protocol and GRE tunnels are not the supported transport for Prisma Access Remote Networks routing.

Answer

OSPF adjacency established directly across the public internet between branch firewalls and Prisma Access.

Answer

Raw Ethernet crossover cables run directly between branch offices and Prisma Access cloud nodes.

Answer

AppleTalk routing protocol over GRE tunnels.

Question 10

A SOC architect is designing a threat response architecture that uses Cortex XSIAM to automate response actions across endpoint, network, and cloud domains. The CISO requires that automated actions be auditable and reversible where possible. Which TWO design elements are essential to meet these requirements? (Choose two.)

Accepted Answer

Define rollback or compensating actions for each automated response, such as releasing an endpoint from isolation or restoring a quarantined file.. Auditability demands a centralized, tamper-resistant record of every action's initiator, target, and outcome, while reversibility demands a defined compensating action for each automated response. Together these two elements let the SOC verify and undo automated actions. Excessive privileges, blanket manual approval, and local-only logging either weaken security or fail the stated requirements.

Answer

Store all response action logs only on the local endpoint to reduce central storage costs and latency.

Answer

Disable automated response entirely and require a human analyst to approve every action manually.

Answer

Grant the automation engine domain administrator rights so it can perform any response action without encountering permission errors.

Question 11

An architect is designing a metrics program for a Cortex XSIAM deployment and wants to ensure that reported security metrics drive continuous improvement rather than merely describe past activity. The SOC director requires that each metric be tied to a decision or action. Which TWO characteristics must the architect build into the metric definitions to satisfy this requirement? (Choose two.)

Accepted Answer

Each metric has an explicit target or threshold that triggers a defined response when breached. Metrics drive improvement only when they are connected to decisions. An explicit target or threshold defines when action is needed, and a named owner ensures that action actually occurs. Together they turn a measurement into an operational feedback loop. Precision, dedicated storage, and annual-only review do not create that linkage, so they cannot satisfy the requirement that each metric be tied to a decision or action.

Answer

Each metric is stored in a separate dedicated dataset to simplify long-term retention

Answer

Each metric is reported with the highest possible decimal precision to avoid rounding ambiguity

Answer

Each metric is reviewed only once per year during the annual audit cycle

Question 12

When designing a threat hunting architecture using XQL in Cortex XSIAM, which TWO best practices improve query performance and efficiency? (Choose two)

Accepted Answer

Use indexed fields and precise matching operators where possible. Option A is correct because using indexed fields and precise matching operators (e.g., =, in, or exact string comparisons instead of wildcard or regex-heavy filters) lets Cortex XSIAM's XQL engine prune data at the index level, drastically reducing the number of events scanned and improving query speed. Option B is correct because filtering by specific datasets (e.g., xdr_data, panw_ngfw_traffic_raw) and applying narrow time ranges early in the query pipeline limits the volume of data the engine must process before subsequent stages, which is the single most effective way to reduce XQL execution time and resource consumption. Option C is incorrect because unbounded queries across all historical data force full scans of massive datasets, causing slow execution, high resource usage, and potential timeouts. Option D is incorrect because aggregation functions like count, sum, and summarize are essential for efficient threat hunting and are optimized in XQL; avoiding them does not improve performance. Option E is incorrect because selecting all raw unparsed logs and avoiding specific field names increases data volume and prevents the engine from leveraging field-level indexing and parsing optimizations.

Answer

Run unbounded queries across all historical data without time constraints

Answer

Avoid using aggregation functions like count or summarize

Answer

Select all raw unparsed logs and avoid using specific field names

Question 13

An architect is operationalizing security metrics for a Cortex XSIAM deployment. The SOC manager wants to track the 'Alert Triage Efficiency' metric, defined as the average time from alert creation to analyst assignment. The architect needs to ensure the metric is accurate and actionable. Which two data points must be captured and correlated to calculate this metric correctly? (Choose two.)

Accepted Answer

The timestamp when an analyst is assigned to the alert or incident.. To calculate the average time from alert creation to analyst assignment, the architect must capture both the alert creation timestamp and the assignment timestamp. These two data points define the interval. Cortex XSIAM records both events natively, allowing correlation and aggregation. Other attributes like severity or MITRE tactic are useful for filtering but not for the core calculation.

Answer

The number of automated playbook executions triggered by the alert.

Answer

The MITRE ATT&CK tactic associated with the alert.

Answer

The severity level of the alert as determined by the analytics engine.

Question 14

An architect is designing an automated incident response architecture integrating Palo Alto Networks NGFW, Cortex XDR, and Cortex XSOAR. Which TWO architectural principles ensure an effective automated security ecosystem? (Choose two)

Accepted Answer

Centralizing threat intelligence sharing and indicator blocking via External Dynamic Lists and XSOAR playbooks.. Option B is correct because centralizing threat intelligence sharing and indicator blocking through External Dynamic Lists (EDLs) hosted on a web server and consumed by the NGFW, combined with Cortex XSOAR playbooks that push indicators to EDLs or the firewall's dynamic block lists, creates a single authoritative source of IOCs that enforces blocking consistently across the ecosystem. Option D is correct because standardized REST APIs and prebuilt integration packs (e.g., the Palo Alto Networks Panorama, Cortex XDR, and firewall integrations in XSOAR) allow playbooks to query, enrich, and execute response actions across all three products without brittle custom scripting, which is the foundation of reliable orchestration. Option A is wrong because air-gapping security tools with no internet or API access prevents the API-driven orchestration and threat-intel sharing that automated incident response requires. Option C is wrong because disabling automated remediation eliminates the automation benefit and contradicts the goal of an automated security ecosystem. Option E is wrong because manual phone calls and spreadsheets are the opposite of automated orchestration and cannot scale to machine-speed response.

Answer

Isolating all security tools on completely disconnected local networks without internet or API access.

Answer

Disabling all automated remediation to ensure zero visibility.

Answer

Relying entirely on manual phone calls and spreadsheets for every security alert.

Question 15

An architect is designing a secure cloud network architecture using Prisma Access. Which TWO deployment models or components are available in Prisma Access to connect corporate data centers and branch offices? (Choose two)

Accepted Answer

Remote Networks (connecting branch offices via IPsec VPN tunnels to Prisma Access cloud nodes).. Option C is correct because Remote Networks is a Prisma Access deployment component specifically designed to connect branch offices and small sites to the Prisma Access cloud infrastructure using IPsec VPN tunnels terminated on Prisma Access service nodes. Option D is correct because Service Connections is a Prisma Access component that connects corporate headquarters, data centers, or other internal networks to Prisma Access, enabling secure hub-and-spoke routing and access to internal resources through the cloud security platform. Option A is incorrect because Cortex XDR Agent is an endpoint protection agent and cannot be installed on ISP core routers, nor is it a Prisma Access connectivity model. Option B is incorrect because public FTP servers are not a supported or secure mechanism for bridging internal LAN traffic to Prisma Access. Option E is incorrect because physically splicing copper coaxial cables into a Palo Alto Networks office is not a Prisma Access deployment model and is not technically or operationally feasible.

Answer

Installing Cortex XDR Agent directly onto ISP core routers.

Answer

Using public FTP servers to bridge internal LAN traffic to the cloud.

Answer

Direct physical copper coaxial cables spliced from branch offices into the nearest Palo Alto Networks corporate office.

Question 16

An architect is designing an automated threat hunting and containment workflow using Cortex XSOAR. Which TWO external or internal data sources can Cortex XSOAR query or integrate with during an investigation? (Choose two)

Accepted Answer

Active Directory domain controllers for user account status verification.. Option A is correct because Cortex XSOAR can integrate with Active Directory (via the LDAP-based AD integration or the Active Directory Query v2 integration) to query domain controllers and verify user account status, such as whether an account is enabled, disabled, or locked out, which is essential during containment decisions. Option D is correct because Cortex XSOAR natively supports threat intelligence platform integrations, including VirusTotal and Palo Alto Networks WildFire, to enrich indicators (hashes, IPs, URLs, domains) with reputation and verdict data during automated investigations. Options B, C, and E are incorrect because they describe non-standard, unsupported data sources (Bluetooth IoT coffee machine sensors, FM radio tuners, and analog modem dial-up switches) that are not part of Cortex XSOAR's integration ecosystem and have no relevance to enterprise threat hunting or containment workflows.

Answer

Local coffee machine IoT sensors via raw Bluetooth packets.

Answer

FM radio broadcast frequency tuners.

Answer

Raw analog telephone landline switches via modem dial-up.

Question 17

An architect is designing a secure architecture using VM-Series on Microsoft Azure. Which TWO Azure-native services or integration components must be configured to achieve high availability with dynamic failover of user traffic across two VM-Series instances? (Choose two)

Accepted Answer

Azure Load Balancer (Standard SKU) to distribute inbound and outbound traffic to the VM-Series data interfaces.. Option C is correct because an Azure Load Balancer (Standard SKU) is the Azure-native mechanism used to distribute inbound and outbound traffic across the data interfaces of two VM-Series firewalls, providing the traffic-fronting component needed for dynamic failover in an active/active or active/passive HA design. Option D is correct because Azure User Defined Routes (UDR) control the effective routing for subnets, and the PAN-OS SDN Connector dynamically rewrites those UDR entries so traffic is redirected to the surviving VM-Series instance during a failover event. Options A and B are incorrect because Azure does not expose physical fiber or copper cross-connects to customer VMs, and HA2 links between VM-Series instances are implemented over the Azure network rather than physical cabling. Option E is incorrect because Microsoft Entra Domain Services is an identity service and plays no role in traffic redirection or firewall high availability failover.

Answer

Physical HA2 fiber optic cables connected between Azure availability zones.

Answer

Azure ExpressRoute direct copper cross-connect cables plugged into the firewall physical NICs.

Answer

Azure Active Directory Domain Services domain controller deployed inside the firewall data plane.

Question 18

An architect is configuring Panorama to manage a large deployment of firewalls. Which TWO best practices should be implemented regarding Panorama administrative access and security? (Choose two)

Accepted Answer

Configure Role-Based Access Control (RBAC) using custom Admin Roles and Access Domains to restrict administrators to their assigned device groups.. Panorama admin best practices include enforcing Role-Based Access Control (RBAC) via Admin Roles and Access Domains, and enforcing multi-factor authentication (MFA) for all administrators.

Answer

Expose the Panorama management interface directly to the public internet without an IP whitelist or VPN.

Answer

Share a single 'admin' superuser account credential among all members of the network team.

Answer

Disable all logging on Panorama to save disk space.

Question 19

An architect is designing an enterprise security architecture integrating Prisma Access, Cortex XDR, and Cortex XSOAR. Which TWO architectural benefits are realized by this tight integration? (Choose two)

Accepted Answer

Automated incident response orchestration and remediation across network and endpoints using Cortex XSOAR playbooks.. Option D is correct because Cortex XSOAR is the orchestration, automation, and response (SOAR) platform that consumes alerts from Prisma Access and Cortex XDR and executes playbooks to automate incident response and remediation actions across both the network and endpoint layers, which is a core benefit of tight integration. Option E is correct because integrating Prisma Access (cloud-delivered secure network traffic inspection) with Cortex XDR (endpoint telemetry and detection) provides unified threat visibility, correlating network and endpoint events into a single coherent picture for analysts. Option A is wrong because analog telephone lines cannot carry high-speed XDR memory dumps and are unrelated to any modern security architecture. Option B is wrong because integration never eliminates the need for encryption or security policies; those remain essential controls. Option C is wrong because Palo Alto Networks does not replace cloud provider hypervisors with proprietary switches, and such a claim is technically false.

Answer

Using analog telephone lines to transmit high-speed XDR memory dumps.

Answer

Eliminating the need for any encryption or security policies.

Answer

Replacing all cloud provider underlying hypervisors with Palo Alto Networks proprietary switches.

Question 20

An enterprise security architect is designing an automated containment playbook in Cortex XSOAR for ransomware attacks. Which THREE automated actions should be incorporated into the playbook to effectively contain the threat while preserving forensic evidence? (Choose three)

Accepted Answer

Isolate the affected endpoint via Cortex XDR integration. Option A is correct because isolating the affected endpoint through the Cortex XDR integration cuts off lateral movement and C2 communication while keeping the host powered on, which preserves volatile memory and disk state for later forensics. Option B is correct because triggering an automated memory dump or forensic package collection via Cortex XDR captures volatile evidence (RAM, running processes, network connections) before any remediation or reboot destroys it. Option E is correct because revoking active user sessions and forcing password resets through the identity provider integration neutralizes compromised credentials that ransomware operators commonly use for lateral movement and persistence. Option C is not appropriate because immediately reimaging all domain controllers without investigation destroys forensic evidence and may not address the actual initial access vector. Option D is not appropriate because deleting backup snapshots removes the primary recovery path and is counterproductive to containment and restoration.

Answer

Immediately reimage all domain controllers without investigation

Answer

Delete all backup snapshots across all storage arrays