SecOps-Architect Palo Alto Networks Product Integration And Architecture Practice Test 3 — 15 Questions

Question 1

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO prerequisites must be met before enabling HA on the firewalls? (Choose two)

Accepted Answer

Both firewalls must be running the exact same PAN-OS software version.. HA peers must have identical hardware/VM models, identical PAN-OS software versions, matching license configurations, and dedicated HA cable connections.

Answer

Management interfaces must be configured on completely different subnet masks with mismatched default gateways.

Answer

Both firewalls must have different models (e.g., PA-3220 paired with PA-5220).

Answer

HA ports must be connected to the internet via public IP addresses.

Question 2

An architect is configuring Cortex XDR external integrations. Which TWO native log ingestion or threat intelligence integration options are supported by Cortex XDR? (Choose two)

Accepted Answer

Integrating external Threat Intelligence feeds using STIX/TAXII server connections.. Cortex XDR supports ingesting third-party alerts and logs via Syslog Collector / Broker VM and integrating Threat Intelligence feeds via STIX/TAXII.

Answer

Polling Windows Active Directory via SNMPv1 for group policies.

Answer

Using NetBIOS broadcast packets to scrape passwords from domain controllers.

Answer

Directly flashing raw firmware onto third-party routers via XDR agent plugins.

Question 3

An architect is configuring Cortex XSOAR incident automation. Which TWO core components are fundamental to building an effective XSOAR playbook? (Choose two)

Accepted Answer

Integration instances that execute specific API commands against third-party and Palo Alto Networks tools.. Cortex XSOAR playbooks consist of tasks, integration commands, conditions, scripts, and inputs/outputs to orchestrate incident response workflows.

Answer

Panorama Dynamic Address Group tags used as storage databases.

Answer

Physical firewall interface cards plugged into the XSOAR server PCI slots.

Answer

Direct kernel-level device drivers installed on the XSOAR server operating system.

Question 4

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for known malware and spyware. Which security profile should the architect attach to the Security Policy rule?

Accepted Answer

Antivirus and Anti-Spyware security profiles. Antivirus and Anti-Spyware security profiles inspect traffic for known malware and command-and-control (C2) signatures.

Answer

File Blocking profile

Answer

Data Filtering profile

Answer

URL Filtering profile

Question 5

An architect is designing a Prisma Access deployment with multiple Remote Networks. Which TWO routing mechanisms are supported for connecting customer premises equipment (CPE) to Prisma Access Node locations? (Choose two)

Accepted Answer

Static routing configured over IPsec VPN tunnels.. Prisma Access supports BGP (Border Gateway Protocol) over IPsec VPN as well as static routing over IPsec VPN to connect customer remote networks.

Answer

OSPF adjacency established directly across the public internet between branch firewalls and Prisma Access.

Answer

Raw Ethernet crossover cables run directly between branch offices and Prisma Access cloud nodes.

Answer

AppleTalk routing protocol over GRE tunnels.

Question 6

An architect is designing an architecture where a Palo Alto Networks firewall receives threat intelligence feeds from external sources in STIX/TAXII format. Which feature on the firewall enables direct ingestion of these customized threat feeds?

Accepted Answer

External Dynamic Lists (EDLs) configured to poll a TAXII server or URL list.. External Dynamic Lists (EDLs) allow firewalls to consume IP addresses, domains, or URLs directly from web servers or STIX/TAXII servers.

Answer

GlobalProtect HIP object database.

Answer

Syslog server forwarding profile.

Answer

Panorama Device Group Static Address Objects.

Question 7

An architect is designing a multi-tenant cloud security architecture using Prisma Cloud. The security team needs to ensure that developers receive security alerts directly inside their collaboration tools (such as Slack or Microsoft Webex) the moment a misconfiguration is detected in infrastructure-as-code or runtime. Which Prisma Cloud feature must the architect configure?

Accepted Answer

Alert Rules combined with notification integrations for Slack and Webhooks.. Prisma Cloud Alert Rules allow configuring integrations with Webhooks, Slack, Microsoft Teams, and SIEMs to push real-time alerts.

Answer

GlobalProtect VPN portal banner announcements.

Answer

Cortex XSOAR email ingestion parsers without alert rules.

Answer

Panorama SNMP trap forwarding to Slack.

Question 8

An architect is designing a high-scale Cortex XDR deployment across 50,000 endpoints. To optimize bandwidth and reduce direct WAN traffic to the cloud backend for agent updates and log collection, which architectural component should be deployed in regional data centers?

Accepted Answer

Cortex XDR Broker VM deployed in regional data centers to act as a local proxy, content cache, and log collector.. Cortex XDR Broker VMs act as regional aggregators and proxies for agent updates, syslog collection, and telemetry forwarding.

Answer

A standalone Panorama virtual machine acting as an endpoint proxy.

Answer

Prisma Access Remote Network nodes running the XDR agent directly on gateway hypervisors.

Answer

A dedicated PA-7080 firewall performing deep packet inspection on all XDR endpoint RAM.

Question 9

An architect is configuring User-ID to map users via Palo Alto Networks Terminal Services (TS) Agent. Where must the TS Agent be installed in the network architecture?

Accepted Answer

Directly on the Microsoft Terminal Server or Citrix XenApp server.. The TS Agent must be installed directly on the Microsoft Terminal Server or Citrix XenApp server to track which user is mapped to which TCP port range.

Answer

Inside the Cortex XDR Broker VM appliance.

Answer

On the external DNS root server.

Answer

On the Panorama management virtual appliance.

Question 10

An architect is designing a zero-trust network segmentation strategy using Palo Alto Networks NGFWs. The security team wants security rules to dynamically adapt when workloads spin up or down in a dynamic environment, without needing static IP addresses in rule definitions. Which feature should the architect implement?

Accepted Answer

Dynamic Address Groups (DAGs) populated via tags registered through VM-Series API or User-ID.. Dynamic Address Groups (DAGs) use tags registered via VM-Series, User-ID, or cloud plugins to automatically add or remove IP addresses from security policies.

Answer

GlobalProtect portal static IP pools.

Answer

Panorama Template Stack variables.

Answer

Static address objects grouped into nested address groups.

Question 11

An architect is troubleshooting an issue where Palo Alto Networks VM-Series firewalls deployed in AWS are experiencing asymmetric routing issues across multiple network interfaces. Which AWS networking construct must be correctly configured to ensure traffic enters and exits through the correct firewall data interface?

Accepted Answer

AWS Route Tables associated with subnets pointing traffic to specific Elastic Network Interfaces (ENIs).. AWS Route Tables (specifically custom Route Tables associated with subnets and Elastic Network Interfaces) dictate traffic flow to and from VM-Series interfaces.

Answer

Panorama Template stack backup schedules.

Answer

Palo Alto Networks Management interface static default gateway.

Answer

AWS Security Groups blocking all inbound ports.

Question 12

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO prerequisites must be met before enabling HA on the firewalls? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The passive firewall takes over active traffic and maintains sessions via HA2 synchronization.. In Active/Passive HA, when the active unit fails, the passive unit takes over and active sessions are maintained if HA2 session synchronization is enabled.

Answer

The firewall reboots into maintenance mode and requires manual CLI intervention.

Answer

Traffic is permanently blackholed until an administrator logs into Panorama.

Answer

All active user sessions are immediately dropped and must re-authenticate.

Question 13

An architect is designing a secure cloud network architecture using Prisma Access. Which TWO deployment models or components are available in Prisma Access to connect corporate data centers and branch offices? (Choose two)

Accepted Answer

Remote Networks (connecting branch offices via IPsec VPN tunnels to Prisma Access cloud nodes).. Prisma Access connects corporate locations via Remote Networks (IPsec VPN from branch routers/firewalls) and Service Connections (connecting data centers or HQ to Prisma Access via IPsec/BGP).

Answer

Installing Cortex XDR Agent directly onto ISP core routers.

Answer

Using public FTP servers to bridge internal LAN traffic to the cloud.

Answer

Direct physical copper coaxial cables spliced from branch offices into the nearest Palo Alto Networks corporate office.

Question 14

An architect is designing an automated threat containment workflow using Cortex XSOAR and Palo Alto Networks NGFWs. Which TWO actions can XSOAR automatically execute on the firewall as part of an incident remediation playbook? (Choose two)

Accepted Answer

Terminate active user sessions on the firewall using PAN-OS API commands.. Cortex XSOAR integrations with PAN-OS / Panorama can block IP addresses/domains by adding them to external dynamic lists or custom address objects, and terminate active user sessions.

Answer

Downgrade the firewall PAN-OS software version to an unpatched legacy release.

Answer

Reformat the firewall management plane solid-state drive remotely.

Answer

Physically disconnect the fiber optic patch cables from the firewall data ports via remote robotic arm control.

Question 15

An architect is designing a Prisma Cloud Compute deployment to secure containerized workloads. Which TWO compliance and vulnerability assessment features are provided by Prisma Cloud Compute Defenders? (Choose two)

Accepted Answer

Evaluating container configurations and host OS settings against CIS (Center for Internet Security) benchmarks.. Prisma Cloud Compute Defenders perform vulnerability scanning of container images, host OS packages, and compliance checks against CIS benchmarks.

Answer

Writing custom assembly code for application microservices.

Answer

Analyzing physical power grid load tolerances in data center facilities.

Answer

Acting as a Layer 7 DNS root server for enterprise domains.