SecOps-Architect Palo Alto Networks Product Integration And Architecture Practice Test 2 — 15 Questions

Question 1

An architect is designing an enterprise-grade Prisma Access architecture. Which TWO components or services are integral to the Prisma Access architecture for securing both mobile users and branch locations? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Prisma Access Mobile Users utilizing the GlobalProtect app for secure remote worker access.. Prisma Access core components include Remote Networks (for branch offices), Mobile Users (via GlobalProtect app), and Service Connections (for data centers).

Answer

Installing physical PA-7080 hardware chassis inside every employee's living room.

Answer

Physical copper coaxial cables run between remote user homes and Prisma Access cloud nodes.

Question 2

An architect is designing an automated threat remediation workflow using Cortex XSOAR and Palo Alto Networks firewalls. Which TWO actions can be performed by XSOAR when interacting with Palo Alto Networks firewalls during incident response? (Choose two)

Accepted Answer

Retrieving firewall system logs and security rule configurations for forensic investigation.. XSOAR interacts with firewalls to block IPs/domains via External Dynamic Lists or Address Objects, terminate active sessions, and query policy rules.

Answer

Physically replacing burnt-out power supplies in remote firewall hardware chassis.

Answer

Reformatting firewall solid-state internal storage arrays.

Question 3

An architect is designing a multi-tenant Palo Alto Networks firewall deployment using Virtual Systems (vsys). Each vsys requires dedicated administrative access. Which administrative object must be configured to grant a specific administrator access to only one particular vsys?

Accepted Answer

Administrative Role with restricted Access Domain pointing to the specific vsys.. Administrative Roles and Access Domains allow restricting administrators to specific virtual systems (vsys) or device groups.

Answer

GlobalProtect HIP object profiles.

Answer

Global Superuser account sharing.

Question 4

An architect is integrating Palo Alto Networks Cortex XDR with a third-party SOAR platform. The SOAR platform needs to retrieve XDR incidents and update their status. The architect must configure API access. Which authentication method should be used to ensure secure, automated access with least privilege?

Accepted Answer

Generate an API key with a dedicated service account that has only the necessary permissions.. For automated API access to Cortex XDR, the recommended method is to generate an API key associated with a dedicated service account that has only the required permissions. This enables non-interactive authentication and adheres to the principle of least privilege. Other methods like MFA, OAuth, or SAML are either not supported or not suitable for automation.

Answer

Use OAuth 2.0 with client credentials grant and a service principal.

Answer

Configure SAML single sign-on and use the SOAR platform's service account credentials.

Answer

Use a standard user account with a strong password and enable multi-factor authentication.

Question 5

An architect is deploying VM-Series firewalls in Microsoft Azure behind an Azure Load Balancer using a public load balancer with floating IP disabled. The design requires that return traffic from the firewall flows back through the same load balancer to preserve session symmetry. Which configuration must the architect apply to the VM-Series to make this work correctly?

Accepted Answer

Enable floating IP (Direct Server Return) on the Azure Load Balancer and configure the VM-Series to accept traffic destined to the load balancer's front-end IP.. Symmetric return through an Azure Load Balancer requires floating IP so the backend VM sees the original destination and the flow tuple remains intact. The VM-Series must be configured to accept the load balancer's front-end address, otherwise the return packet's tuple will not match and the load balancer will drop the session.

Answer

Enable Source NAT on the VM-Series egress interface so return traffic always leaves via the load balancer.

Answer

Configure the VM-Series with a policy-based forwarding rule that directs return traffic to the load balancer's virtual IP.

Answer

Set the VM-Series interface to use the Azure Load Balancer's health probe port as the default gateway.

Question 6

An architect is deploying a Cortex XSOAR engine inside a segmented OT network where no direct internet access is permitted. The engine must still run playbooks that reach a Cortex XDR tenant and a ServiceNow instance hosted on-premises. Which design correctly satisfies the connectivity requirement?

Accepted Answer

Deploy the engine with outbound connectivity to the Cortex XSOAR server and allowlist the XDR tenant and ServiceNow endpoints, validating reachability before production.. A Cortex XSOAR engine executes integration commands itself, so it must be able to reach both the Cortex XSOAR server and each integration endpoint. In a segmented network, allowlisting the specific XDR tenant and on-premises ServiceNow endpoints preserves isolation while keeping playbooks functional. Validating reachability before go-live prevents silent task failures after deployment.

Answer

Deploy the engine in the IT network and open inbound firewall rules from the OT segment to the engine for all management traffic.

Answer

Deploy the engine with an HTTP proxy configured so all outbound calls to the XDR tenant and ServiceNow traverse the proxy.

Answer

Deploy the engine in the OT segment and rely on the Cortex XSOAR server to proxy every integration command on the engine's behalf.

Question 7

An architect is designing a Cortex XSOAR playbook that automatically creates a ticket in ServiceNow when a high-severity incident is detected. The playbook must avoid creating duplicate tickets if the incident is updated multiple times. Which Cortex XSOAR feature should be used to ensure idempotency?

Accepted Answer

Task-level caching with unique identifiers. The correct approach is to use task-level caching with unique identifiers. Cortex XSOAR allows you to store data in the incident context, such as a ticket ID or a unique key. Before creating a ticket, the playbook can check if that key already exists. If it does, the ticket creation task is skipped. This ensures that even if the incident is updated multiple times, only one ticket is created. This pattern is essential for idempotent integrations.

Answer

Incident merging

Answer

Incident Deduplication

Answer

Playbook loops with break conditions

Question 8

An architect is integrating a Palo Alto Networks VM-Series firewall in Azure with Azure Virtual WAN to inspect traffic between spokes. The architect needs to ensure that traffic from spoke VNets to the internet and to other spokes is inspected by the VM-Series, while maintaining high availability across availability zones. Which Azure routing configuration should the architect implement?

Accepted Answer

Create a user-defined route in each spoke subnet with next hop as the VM-Series virtual appliance private IP, and enable IP forwarding on the VM-Series NIC.. User-defined routes with next hop as the VM-Series private IP ensure that spoke traffic is directed to the firewall for inspection. Enabling IP forwarding on the VM-Series NIC is required for the firewall to forward traffic. This configuration supports high availability by using multiple firewalls behind a load balancer or in active/passive mode, with UDRs pointing to the active instance or load balancer.

Answer

Use Azure Virtual WAN hub with a secured virtual hub and integrate VM-Series as a routing appliance.

Answer

Associate a route table to each spoke subnet with a default route (0.0.0.0/0) pointing to the VM-Series internal load balancer as next hop.

Answer

Configure Azure Route Server and BGP peering with the VM-Series, advertising default route to spokes.

Question 9

An architect is designing a Cortex XSOAR integration to automate enforcement actions on a Palo Alto Networks next-generation firewall. The playbook must dynamically block malicious IP addresses by adding them to an External Dynamic List (EDL) hosted on an internal web server. The firewall is configured to retrieve the EDL every 5 minutes. The architect needs to ensure that newly identified malicious IPs are enforced as quickly as possible without manual intervention. What is the most operationally efficient approach?

Accepted Answer

Configure the XSOAR playbook to update the EDL file on the internal web server whenever a new malicious IP is identified, and reduce the EDL refresh interval to 1 minute on the firewall.. The most efficient method is to have the XSOAR playbook update the EDL file on the internal web server and reduce the firewall's refresh interval. This uses the native EDL pull mechanism, ensuring timely enforcement without additional API calls or complex logic. It maintains a clean separation of duties: XSOAR manages the list content, and the firewall enforces it. Reducing the interval from 5 minutes to 1 minute further minimizes the window of exposure.

Answer

Use the XSOAR Palo Alto Networks PAN-OS integration to push the IP directly to the firewall's block list via the API, bypassing the EDL entirely.

Answer

Create a scheduled XSOAR task that runs every 5 minutes to fetch the EDL from the web server, compare it with the firewall's current block list, and then use the PAN-OS API to add any missing IPs.

Answer

Deploy a dedicated XSOAR integration that listens for syslog messages from the firewall and, upon detecting a new malicious IP in traffic logs, automatically adds it to the EDL file on the web server.

Question 10

An architect is designing a centralized logging solution where Palo Alto Networks next-generation firewalls must forward all traffic, threat, URL, and WildFire logs to a Panorama appliance for long-term retention and correlation. The design requires that log forwarding continue even if the primary Panorama is unavailable. Which Palo Alto Networks feature should the architect configure on the firewalls to ensure logs are sent to Panorama and can be forwarded to a secondary destination if needed?

Accepted Answer

Configure the firewall to forward logs to Panorama and set up a Log Forwarding profile on the firewall that includes a secondary Panorama appliance as a backup destination.. The correct design uses the firewall’s native capability to forward logs to multiple Panorama appliances. By configuring a primary and secondary Panorama in the firewall’s log forwarding settings, logs are sent to the primary and, if it becomes unavailable, the secondary receives them. This ensures centralized logging continuity without relying on external syslog servers or Panorama pulling logs.

Answer

Configure the firewall to forward logs to Panorama, and in the Panorama log forwarding settings, add a secondary syslog server as a backup destination.

Answer

Configure the firewall to forward logs to Panorama and enable Log Forwarding to an external syslog server directly from the firewall as a secondary destination.

Answer

Configure a Log Forwarding profile on the firewall that sends logs to an external syslog server, and configure Panorama to pull logs from that server.

Question 11

An architect is integrating Cortex XDR with a Palo Alto Networks Next-Generation Firewall to enhance endpoint detection and response. The architect wants to ensure that when Cortex XDR detects a malicious process on an endpoint, the firewall can automatically block network traffic from that endpoint. Which TWO configurations are required to achieve this integration? (Choose two.)

Accepted Answer

Enable the Cortex XDR integration on the firewall under Device > Integrations. To integrate Cortex XDR with a Palo Alto Networks firewall, you must enable the Cortex XDR integration on the firewall, which allows it to receive alerts via API. Then, you create a security policy rule that references the dynamic address group populated by Cortex XDR. This ensures that endpoints flagged by Cortex XDR are automatically blocked at the network level. Both steps are essential for automated response.

Answer

Configure Cortex XDR to send alerts to the firewall via syslog

Answer

Install the Cortex XDR agent on the firewall

Answer

Configure a bidirectional forwarding detection (BFD) profile between Cortex XDR and the firewall

Question 12

An architect is integrating Cortex XDR with a third-party SOAR platform using the Cortex XDR API. The SOAR platform must retrieve alerts and then isolate endpoints during response. Which two API behaviours must the architect account for? (Choose two.)

Accepted Answer

API keys are scoped by security level and must have sufficient permissions for both alert retrieval and endpoint isolation actions.. Cortex XDR API access depends on both the key's permission scope and correct header-based authentication. A key with adequate security level lets the SOAR platform read alerts and issue isolation actions, while sending both the key value and key ID headers ensures requests authenticate. Ignoring either behaviour causes playbooks to fail or silently do nothing during response.

Answer

Isolation requests are queued and only take effect after the next scheduled policy sync, so playbooks must poll for completion.

Answer

All API calls must originate from an IP address registered in the Cortex XDR allowed list, and unregistered sources are blocked at the network layer.

Answer

Alert retrieval requires a separate streaming subscription because the REST endpoint only returns alerts created in the last five minutes.

Question 13

An architect is integrating Palo Alto Networks Prisma Access with a third-party Security Information and Event Management (SIEM) system. The SIEM must receive all traffic logs, threat logs, and URL filtering logs in real time for correlation and long-term retention. The architect plans to use the Prisma Access log forwarding capability. Which configuration should be implemented to ensure that all relevant logs are forwarded to the SIEM without affecting firewall performance?

Accepted Answer

Use the Prisma Access log forwarding profile to send logs directly to the SIEM's syslog collector, ensuring that the profile is applied to all security policy rules and that the SIEM's ingestion rate is sufficient.. The correct approach is to use Prisma Access log forwarding profiles to send logs directly to the SIEM's syslog collector. This method is designed for real-time forwarding and can be applied to all security rules to ensure comprehensive log coverage. It leverages the scalable infrastructure of Prisma Access, avoiding performance impacts on the firewalls. Ensuring the SIEM can handle the ingestion rate is crucial for success.

Answer

Configure the SIEM as a syslog server in the Prisma Access infrastructure settings, and enable log forwarding for all log types with a filter to exclude low-severity logs.

Answer

Configure Cortex Data Lake to forward logs to the SIEM via an API integration, and set up a scheduled job to pull logs every 15 minutes.

Answer

Deploy a dedicated log forwarder VM-Series firewall in the Prisma Access service connection, and configure it to receive logs from Prisma Access and forward them to the SIEM.

Question 14

An architect is designing a Panorama-managed deployment with multiple firewall templates and template stacks. The architect needs to ensure that device-specific settings are applied correctly and that template stack inheritance follows Panorama best practices. Which TWO statements are correct regarding Panorama template stack inheritance? (Choose two.)

Accepted Answer

Template stack inheritance allows a firewall to receive settings from multiple templates, with the last template in the stack having the highest priority.. In Panorama, template stacks inherit settings from templates in the order they are listed, with the last template having the highest priority. Templates can be reused across multiple stacks, and changes propagate to all stacks unless overridden. These two principles ensure flexible, hierarchical configuration management. Other statements misstate inheritance order or confuse device-specific settings with template inheritance.

Answer

Device-specific settings in a template stack override settings in the templates that are part of the stack.

Answer

Template stacks inherit settings from templates in the order they are listed, with the first template taking precedence.

Answer

Template variables can be used to assign unique values to firewalls within a template stack.

Question 15

An architect is designing a Cortex XDR deployment that integrates with Palo Alto Networks next-generation firewalls to provide unified endpoint and network security. The architect wants to ensure that when Cortex XDR detects a malicious process on an endpoint, the firewall automatically blocks all network traffic from that endpoint until the threat is remediated. Which integration method should be used to achieve this?

Accepted Answer

Enable the Cortex XDR firewall integration in the Cortex XDR management console, which automatically adds the endpoint's IP address to a dynamic address group on the firewall upon detection.. The built-in Cortex XDR firewall integration is the correct method. It allows Cortex XDR to automatically add an endpoint's IP to a dynamic address group on the Palo Alto Networks firewall when a malicious process is detected. This enables immediate network isolation without manual intervention or additional orchestration. The integration uses the PAN-OS API and is designed for this exact use case, ensuring rapid response and simplified management.

Answer

Configure Cortex XDR to send a syslog message to the firewall, which triggers a dynamic address group update via the User-ID agent.

Answer

Create a Cortex XSOAR playbook that receives alerts from Cortex XDR, extracts the endpoint IP, and uses the PAN-OS integration to add the IP to a static block list on the firewall.

Answer

Deploy a GlobalProtect agent on the endpoint that communicates with Cortex XDR and enforces host-based firewall rules to block all network traffic.