SecOps-Architect Palo Alto Networks Product Integration And Architecture — 10 Questions

Question 1

An architect is integrating Cortex XSOAR with Palo Alto Networks Panorama to automate firewall rule creation. A playbook needs to check if a security policy rule already exists before creating a new one. Which Cortex XSOAR integration command should the architect use to query the existing rules on Panorama?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

pan-os-get-security-rules. The PAN-OS integration in Cortex XSOAR provides specific API wrapper commands. To check rules, the panoramic or PAN-OS integration uses commands like pan-os-get-security-rules.

Answer

xdr-get-firewall-rules

Answer

panorama-list-policies

Answer

fw-query-rules

Question 2

An architect is designing a centralized logging and management architecture using Panorama for 50 distributed Next-Generation Firewalls. Each firewall generates high volumes of traffic logs. To optimize bandwidth consumption and storage, which Panorama feature should the architect configure on the managed firewalls to forward logs directly to an external SIEM while retaining centralized policy management?

Accepted Answer

Configure Log Forwarding Profiles on the firewalls to send syslog directly to the SIEM while keeping Panorama for configuration and management.. Log Forwarding and Export features on Panorama and firewalls allow forwarding directly to external systems without necessarily bloating Panorama storage, while keeping management centralized.

Answer

Disable traffic logging entirely on the firewalls and only enable threat logging to save bandwidth.

Answer

Configure Panorama Collector groups to act as an intermediate proxy for all syslog traffic to the SIEM.

Answer

Configure Panorama to ingest all logs and then use an automated script to rsync logs from Panorama to the SIEM every night.

Question 3

An architect is deploying Prisma Access to secure remote workers. The organization uses explicit proxying for web traffic and requires user-ID mapping for explicit proxy connections. Which Prisma Access component and configuration must be deployed to correctly map users authenticated via an explicit proxy to their respective User-ID groups?

Accepted Answer

Deploy the Explicit Proxy feature in Prisma Access, configure proxy authentication, and integrate with Cloud Identity Engine (CIE) to extract user identity from proxy headers.. Explicit proxy traffic does not traverse GlobalProtect tunnels in the same way as transparent proxy or agent-based traffic, so user identity must be extracted from the proxy authentication exchange. Prisma Access supports the Explicit Proxy feature, and integrating it with Cloud Identity Engine (CIE) allows the firewall to map the authenticated proxy user to the correct User-ID group for policy enforcement. This is the only option that correctly identifies both the component and the identity source.

Answer

Rely solely on GlobalProtect portal cookies for explicit proxy traffic identification.

Answer

Configure standard IP-to-User mapping via User-ID agents on the remote user laptops without a proxy.

Answer

Configure SNMP traps on the proxy server to send ARP tables to Panorama.

Question 4

A security architect is integrating Cortex XDR with an on-premises Palo Alto Networks NGFW via the Syslog Collector. The XDR agent is installed on endpoints, but network-based detections from the firewall are not appearing in the Cortex XDR Incident Viewer. What is the most likely root cause of this integration failure?

Accepted Answer

The firewall Syslog Server profile is missing the correct custom log format or CEF mapping required by Cortex XDR.. Cortex XDR's Syslog Collector expects firewall logs in a specific format — typically CEF (Common Event Format) or a custom log format defined by Palo Alto's Cortex XDR integration guide. If the firewall's Syslog Server profile uses the default PAN-OS log format instead of the required CEF/custom format, the collector cannot parse the events, so no network detections appear in the Incident Viewer. This is the classic misconfiguration when integrating NGFW syslog with Cortex XDR.

Answer

The firewall's WildFire public cloud connection is disabled.

Answer

The firewall management plane CPU is running above 90%, causing it to drop all syslog packets.

Answer

Cortex XDR requires an explicit PAN-OS XML API credential rather than syslog to ingest firewall alerts.

Question 5

An architect is designing a multi-tenant Palo Alto Networks NGFW deployment using Virtual Systems (vsys). Each vsys requires its own isolated set of administrators, security policies, and network interfaces. Which configuration constraint must the architect keep in mind regarding WildFire and Decryption properties in a vsys architecture?

Accepted Answer

Physical interfaces can be allocated exclusively to a vsys or shared, and cryptographic profiles can be shared or defined locally per vsys.. Some features like WildFire, GlobalProtect portal, and certain cryptographic profiles can be shared or configured globally, but vsys have specific rules regarding interface allocation and shared objects. Specifically, physical interfaces must be assigned to specific vsys or shared, and WildFire can be configured globally or per vsys depending on PAN-OS version.

Answer

Panorama cannot manage firewalls configured with virtual systems.

Answer

Virtual systems cannot have separate security policies; all policies are strictly global.

Answer

Decryption is impossible on virtual systems.

Question 6

An architect is designing a Panorama template stack hierarchy. Which TWO rules govern how templates and template stacks inherit and override settings? (Choose two)

Accepted Answer

Firewalls can only belong to a single template stack at any given time.. Template stacks combine multiple templates in a specific order. Settings defined higher in the stack or in specific child templates override parent templates, and network/device settings follow strict inheritance rules.

Answer

Global templates are immutable and cannot be overridden under any circumstances.

Answer

Template stacks are only used for security rule creation, never for network interfaces.

Question 7

An architect is designing an architecture where a Palo Alto Networks firewall receives threat intelligence feeds from external sources in STIX/TAXII format. Which feature on the firewall enables direct ingestion of these customized threat feeds?

Accepted Answer

External Dynamic Lists (EDLs) configured to poll a TAXII server or URL list.. External Dynamic Lists (EDLs) on Palo Alto Networks firewalls allow the firewall to import IP addresses, URLs, or domains from an external source and refresh them on a schedule. When configured to poll a TAXII server, the firewall can directly ingest STIX/TAXII threat intelligence feeds without manual intervention, making EDLs the correct feature for this requirement.

Answer

GlobalProtect HIP object database.

Answer

Syslog server forwarding profile.

Answer

Panorama Device Group Static Address Objects.

Question 8

An architect is designing an automated threat containment workflow using Cortex XSOAR and Palo Alto Networks NGFWs. Which TWO actions can XSOAR automatically execute on the firewall as part of an incident remediation playbook? (Choose two)

Accepted Answer

Terminate active user sessions on the firewall using PAN-OS API commands.. Option A is correct because Cortex XSOAR's PAN-OS integration can issue API commands (e.g., the `admin` and `op` commands via the PAN-OS XML/REST API) to terminate active user sessions on the firewall, which is a valid automated containment action during remediation. Option D is correct because XSOAR playbooks can dynamically push indicators to a firewall External Dynamic List (EDL) or add IPs/domains to a Custom Address Group via the PAN-OS API, enabling automated blocking of compromised IPs or domains. Option B is incorrect because downgrading PAN-OS to an unpatched legacy release is not a containment action and would increase risk rather than remediate it. Option C is incorrect because reformatting the management plane SSD is a destructive hardware-level operation that XSOAR cannot and should not perform as part of a remediation playbook. Option E is incorrect because physically disconnecting fiber cables via a remote robotic arm is not a capability of Cortex XSOAR or the PAN-OS API.

Answer

Downgrade the firewall PAN-OS software version to an unpatched legacy release.

Answer

Reformat the firewall management plane solid-state drive remotely.

Answer

Physically disconnect the fiber optic patch cables from the firewall data ports via remote robotic arm control.

Question 9

An architect is designing a User-ID architecture using multiple collection methods. Which TWO sources can provide user-to-IP mapping information to a Palo Alto Networks NGFW? (Choose two)

Accepted Answer

DHCP server lease logs monitored via PAN-OS built-in Syslog / User-ID integration.. User-ID sources include Active Directory security event logs, GlobalProtect portals/gateways, Captive Portal, TS Agents, and Exchange/Syslog monitors.

Answer

Raw BGP routing table advertisements.

Answer

Public DNS root hint servers.

Question 10

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO settings or parameters must be identical on both HA peers for the HA cluster to form successfully? (Choose two)

Accepted Answer

Operating mode (Active/Passive or Active/Active) and license configuration.. Option B is correct because the HA peers must be configured with the same operating mode (Active/Passive or Active/Active) and matching license configuration; mismatched modes or licenses prevent the HA control and data links from forming a valid cluster. Option C is correct because both firewalls must run the same PAN-OS software version (and matching content/app versions) so that HA state synchronization, configuration sync, and protocol compatibility work correctly. Option A is incorrect because the physical serial number is unique per chassis and is never required to match; in fact it must differ. Option D is incorrect because the admin account password is a local management credential and does not need to be identical for HA formation. Option E is incorrect because each firewall typically has a unique hostname, and identical hostnames are not a requirement for the HA cluster to form.

Answer

The physical serial number printed on the hardware chassis label.

Answer

The administrative password for the 'admin' user account.

Answer

The hostname assigned to each firewall in the setup menu.