SecOps-Architect Palo Alto Networks Product Integration And Architecture Practice Test 1 — 15 Questions

Question 1

An architect is integrating Cortex XSOAR with Palo Alto Networks Panorama to automate firewall rule creation. A playbook needs to check if a security policy rule already exists before creating a new one. Which Cortex XSOAR integration command should the architect use to query the existing rules on Panorama?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

pan-os-get-security-rules. The PAN-OS integration in Cortex XSOAR provides specific API wrapper commands. To check rules, the panoramic or PAN-OS integration uses commands like pan-os-get-security-rules.

Answer

xdr-get-firewall-rules

Answer

panorama-list-policies

Answer

fw-query-rules

Question 2

An architect is designing a centralized logging and management architecture using Panorama for 50 distributed Next-Generation Firewalls. Each firewall generates high volumes of traffic logs. To optimize bandwidth consumption and storage, which Panorama feature should the architect configure on the managed firewalls to forward logs directly to an external SIEM while retaining centralized policy management?

Accepted Answer

Configure Log Forwarding Profiles on the firewalls to send syslog directly to the SIEM while keeping Panorama for configuration and management.. Log Forwarding and Export features on Panorama and firewalls allow forwarding directly to external systems without necessarily bloating Panorama storage, while keeping management centralized.

Answer

Disable traffic logging entirely on the firewalls and only enable threat logging to save bandwidth.

Answer

Configure Panorama Collector groups to act as an intermediate proxy for all syslog traffic to the SIEM.

Answer

Configure Panorama to ingest all logs and then use an automated script to rsync logs from Panorama to the SIEM every night.

Question 3

An architect is deploying Prisma Access to secure remote workers. The organization uses explicit proxying for web traffic and requires user-ID mapping for explicit proxy connections. Which Prisma Access component and configuration must be deployed to correctly map users authenticated via an explicit proxy to their respective User-ID groups?

Accepted Answer

Deploy the Explicit Proxy feature in Prisma Access, configure proxy authentication, and integrate with Cloud Identity Engine (CIE) to extract user identity from proxy headers.. Explicit proxy traffic does not traverse GlobalProtect tunnels in the same way as transparent proxy or agent-based traffic, so user identity must be extracted from the proxy authentication exchange. Prisma Access supports the Explicit Proxy feature, and integrating it with Cloud Identity Engine (CIE) allows the firewall to map the authenticated proxy user to the correct User-ID group for policy enforcement. This is the only option that correctly identifies both the component and the identity source.

Answer

Rely solely on GlobalProtect portal cookies for explicit proxy traffic identification.

Answer

Configure standard IP-to-User mapping via User-ID agents on the remote user laptops without a proxy.

Answer

Configure SNMP traps on the proxy server to send ARP tables to Panorama.

Question 4

A security architect is integrating Cortex XDR with an on-premises Palo Alto Networks NGFW via the Syslog Collector. The XDR agent is installed on endpoints, but network-based detections from the firewall are not appearing in the Cortex XDR Incident Viewer. What is the most likely root cause of this integration failure?

Accepted Answer

The firewall Syslog Server profile is missing the correct custom log format or CEF mapping required by Cortex XDR.. Cortex XDR's Syslog Collector expects firewall logs in a specific format — typically CEF (Common Event Format) or a custom log format defined by Palo Alto's Cortex XDR integration guide. If the firewall's Syslog Server profile uses the default PAN-OS log format instead of the required CEF/custom format, the collector cannot parse the events, so no network detections appear in the Incident Viewer. This is the classic misconfiguration when integrating NGFW syslog with Cortex XDR.

Answer

The firewall's WildFire public cloud connection is disabled.

Answer

The firewall management plane CPU is running above 90%, causing it to drop all syslog packets.

Answer

Cortex XDR requires an explicit PAN-OS XML API credential rather than syslog to ingest firewall alerts.

Question 5

An architect is designing a multi-tenant Palo Alto Networks NGFW deployment using Virtual Systems (vsys). Each vsys requires its own isolated set of administrators, security policies, and network interfaces. Which configuration constraint must the architect keep in mind regarding WildFire and Decryption properties in a vsys architecture?

Accepted Answer

Physical interfaces can be allocated exclusively to a vsys or shared, and cryptographic profiles can be shared or defined locally per vsys.. Some features like WildFire, GlobalProtect portal, and certain cryptographic profiles can be shared or configured globally, but vsys have specific rules regarding interface allocation and shared objects. Specifically, physical interfaces must be assigned to specific vsys or shared, and WildFire can be configured globally or per vsys depending on PAN-OS version.

Answer

Panorama cannot manage firewalls configured with virtual systems.

Answer

Virtual systems cannot have separate security policies; all policies are strictly global.

Answer

Decryption is impossible on virtual systems.

Question 6

An architect is designing a Panorama template stack hierarchy. Which TWO rules govern how templates and template stacks inherit and override settings? (Choose two)

Accepted Answer

Firewalls can only belong to a single template stack at any given time.. Template stacks combine multiple templates in a specific order. Settings defined higher in the stack or in specific child templates override parent templates, and network/device settings follow strict inheritance rules.

Answer

Global templates are immutable and cannot be overridden under any circumstances.

Answer

Template stacks are only used for security rule creation, never for network interfaces.

Question 7

An architect is designing an architecture where a Palo Alto Networks firewall receives threat intelligence feeds from external sources in STIX/TAXII format. Which feature on the firewall enables direct ingestion of these customized threat feeds?

Accepted Answer

External Dynamic Lists (EDLs) configured to poll a TAXII server or URL list.. External Dynamic Lists (EDLs) on Palo Alto Networks firewalls allow the firewall to import IP addresses, URLs, or domains from an external source and refresh them on a schedule. When configured to poll a TAXII server, the firewall can directly ingest STIX/TAXII threat intelligence feeds without manual intervention, making EDLs the correct feature for this requirement.

Answer

GlobalProtect HIP object database.

Answer

Syslog server forwarding profile.

Answer

Panorama Device Group Static Address Objects.

Question 8

An architect is designing an automated threat containment workflow using Cortex XSOAR and Palo Alto Networks NGFWs. Which TWO actions can XSOAR automatically execute on the firewall as part of an incident remediation playbook? (Choose two)

Accepted Answer

Terminate active user sessions on the firewall using PAN-OS API commands.. Option A is correct because Cortex XSOAR's PAN-OS integration can issue API commands (e.g., the `admin` and `op` commands via the PAN-OS XML/REST API) to terminate active user sessions on the firewall, which is a valid automated containment action during remediation. Option D is correct because XSOAR playbooks can dynamically push indicators to a firewall External Dynamic List (EDL) or add IPs/domains to a Custom Address Group via the PAN-OS API, enabling automated blocking of compromised IPs or domains. Option B is incorrect because downgrading PAN-OS to an unpatched legacy release is not a containment action and would increase risk rather than remediate it. Option C is incorrect because reformatting the management plane SSD is a destructive hardware-level operation that XSOAR cannot and should not perform as part of a remediation playbook. Option E is incorrect because physically disconnecting fiber cables via a remote robotic arm is not a capability of Cortex XSOAR or the PAN-OS API.

Answer

Downgrade the firewall PAN-OS software version to an unpatched legacy release.

Answer

Reformat the firewall management plane solid-state drive remotely.

Answer

Physically disconnect the fiber optic patch cables from the firewall data ports via remote robotic arm control.

Question 9

An architect is designing a User-ID architecture using multiple collection methods. Which TWO sources can provide user-to-IP mapping information to a Palo Alto Networks NGFW? (Choose two)

Accepted Answer

DHCP server lease logs monitored via PAN-OS built-in Syslog / User-ID integration.. User-ID sources include Active Directory security event logs, GlobalProtect portals/gateways, Captive Portal, TS Agents, and Exchange/Syslog monitors.

Answer

Raw BGP routing table advertisements.

Answer

Public DNS root hint servers.

Question 10

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO settings or parameters must be identical on both HA peers for the HA cluster to form successfully? (Choose two)

Accepted Answer

Operating mode (Active/Passive or Active/Active) and license configuration.. Option B is correct because the HA peers must be configured with the same operating mode (Active/Passive or Active/Active) and matching license configuration; mismatched modes or licenses prevent the HA control and data links from forming a valid cluster. Option C is correct because both firewalls must run the same PAN-OS software version (and matching content/app versions) so that HA state synchronization, configuration sync, and protocol compatibility work correctly. Option A is incorrect because the physical serial number is unique per chassis and is never required to match; in fact it must differ. Option D is incorrect because the admin account password is a local management credential and does not need to be identical for HA formation. Option E is incorrect because each firewall typically has a unique hostname, and identical hostnames are not a requirement for the HA cluster to form.

Answer

The physical serial number printed on the hardware chassis label.

Answer

The administrative password for the 'admin' user account.

Answer

The hostname assigned to each firewall in the setup menu.

Question 11

An architect is designing a Palo Alto Networks VM-Series deployment in Google Cloud Platform (GCP). To enable high availability with automated failover of traffic across multiple VM-Series instances, which GCP networking feature is typically integrated with PAN-OS High Availability?

Accepted Answer

GCP Load Balancers and custom forwarding rules integrated with PAN-OS SDN API calls for route manipulation.. GCP internal and external HTTP(S) / TCP/UDP load balancers combined with GCP Forwarding Rules and PAN-OS SDN API integration handle traffic distribution and failover.

Answer

GCP Cloud Storage S3 buckets acting as static routers.

Answer

Panorama SNMPv1 traps polling GCP virtual disks.

Answer

Physical serial port cross-connects between GCP server racks.

Question 12

An architect is designing an integration between Cortex XSOAR and Palo Alto Networks Panorama. Which TWO actions can be performed via the PAN-OS / Panorama integration pack in XSOAR? (Choose two)

Accepted Answer

Committing configuration changes made by playbooks on Panorama to managed firewalls.. The PAN-OS integration in XSOAR allows committing changes, retrieving security rules, blocking indicators, and updating address objects on Panorama or firewalls.

Answer

Directly updating the physical BIOS firmware of Panorama hardware appliances.

Answer

Reformatting the Panorama PostgreSQL log database storage partitions.

Question 13

An architect is configuring High Availability (HA) on Palo Alto Networks firewalls. Which TWO data or state tables are synchronized across the HA2 link between active and passive peers? (Choose two)

Accepted Answer

ARP table entries to maintain layer 2 reachability after failover.. Option C is correct because the ARP table is part of the layer 2 forwarding state that Palo Alto Networks synchronizes over the HA2 link, so the passive peer already knows MAC-to-IP bindings and can forward traffic immediately after a failover without waiting to relearn them. Option D is correct because the session table (including TCP and UDP session state and related flow information) is synchronized over HA2, which allows established sessions to continue uninterrupted when the passive firewall takes over as active. The HA2 link is dedicated to synchronizing this runtime data/state, while HA1 handles control-plane and HA1 backup traffic. Option A is not synchronized because physical power supply voltage is local hardware telemetry, not HA state. Option B is not synchronized because Panorama admin SSH private keys are management credentials and are not part of HA2 state synchronization. Option E is not synchronized because administrator password history and failed-login lockout counters are local management-plane authentication data, not session or forwarding state.

Answer

Local firewall physical power supply voltage metrics.

Answer

Panorama admin account SSH private keys.

Answer

Administrator password history and failed login lockout counters.

Question 14

An architect is configuring a Cortex XDR integration with a third-party SIEM. The SIEM requires log data formatted in Common Event Format (CEF) over Syslog. Where should the architect configure this output format in the Cortex XDR architecture?

Accepted Answer

Cortex XDR Broker VM Syslog Collector profile configured with CEF mapping.. The Cortex XDR Broker VM includes a Syslog Collector that can be configured to forward logs in Common Event Format (CEF) over Syslog to third-party SIEMs. This is the correct architectural component for formatting and forwarding logs to external systems.

Answer

Prisma Cloud compliance check rule definitions.

Answer

Panorama firewall administrative GUI banner settings.

Answer

GlobalProtect gateway portal authentication profile.

Question 15

An architect is configuring Palo Alto Networks firewall interfaces. Which TWO interface types are supported in PAN-OS for routing traffic between security zones? (Choose two)

Accepted Answer

Layer 3 interface assigned an IP address and virtual router.. Option C is correct because a Layer 3 interface in PAN-OS is assigned an IP address and bound to a virtual router, which lets the firewall perform routing decisions and forward traffic between security zones. Option D is correct because a Virtual Wire (vwire) interface binds two physical ports into a transparent inline pair, passing traffic between zones without IP addressing or routing, which is a supported PAN-OS deployment mode for inter-zone traffic. Options A, B, and E are incorrect because BLE antennas, USB printer interfaces, and HDMI display interfaces are not PAN-OS interface types used for routing or forwarding traffic between security zones.

Answer

Bluetooth Low Energy (BLE) antenna interface.

Answer

Universal Serial Bus (USB) printer interface.

Answer

HDMI multimedia display interface.