SecOps-Architect Palo Alto Networks Product Integration And Architecture Practice Test 3 — 15 Questions

Question 1

An architect is integrating Cortex XDR with a third-party threat intelligence platform to automatically block indicators of compromise (IOCs) on Palo Alto Networks firewalls managed by Panorama. The third-party platform provides a REST API that returns a list of malicious IP addresses. The architect needs to ensure that the firewalls dynamically update a block list without manual intervention. Which Palo Alto Networks component should the architect use to achieve this integration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cortex XSOAR playbook that queries the third-party API and uses the Panorama integration to create a Dynamic Address Group (DAG) and register the IPs.. Cortex XSOAR provides native integration with Panorama and can automate the entire workflow: querying the third-party API, parsing the response, and updating a Dynamic Address Group on Panorama. The DAG can then be used in firewall policies to block or allow traffic based on the tags. This eliminates manual intervention and ensures real-time enforcement of threat intelligence.

Answer

Configure a Log Forwarding profile on the firewalls to send logs to the third-party platform, which then pushes IPs back via syslog.

Answer

Use the Palo Alto Networks External Dynamic List (EDL) feature to directly pull the IP list from the third-party API and reference it in security policies.

Answer

Configure a MineMeld instance to aggregate the third-party feed and publish it as an EDL that the firewalls consume.

Question 2

An architect is integrating Palo Alto Networks Cortex XSOAR with a third-party ticketing system to automate incident creation and updates. The architect needs to ensure that XSOAR can receive updates from the ticketing system to synchronize incident status and comments. Which TWO methods can be used to enable this bidirectional synchronization? (Choose two.)

Accepted Answer

Use the XSOAR REST API to periodically poll the ticketing system for updates and update incidents in XSOAR.. The two valid methods are webhooks and REST API polling. Webhooks enable real-time push notifications from the ticketing system to XSOAR, triggering immediate updates. REST API polling allows XSOAR to periodically pull updates, which is useful when the ticketing system cannot send webhooks. Both methods are supported and commonly used in XSOAR integrations. They ensure that incident status and comments remain synchronized between the two systems.

Answer

Set up a syslog forwarder on the ticketing system to send log messages to XSOAR, where a playbook parses the logs to update incidents.

Answer

Enable a direct database connection between XSOAR and the ticketing system's database to read and write incident data.

Answer

Configure the ticketing system to send email notifications to an XSOAR mailbox, and use an email integration to create or update incidents.

Question 3

An architect is designing a security architecture where a Palo Alto Networks VM-Series firewall in a public cloud must inspect east-west traffic between application tiers. The application tiers reside in separate subnets, and the architect wants to avoid asymmetric routing while ensuring all inter-tier traffic traverses the firewall. Which design should the architect choose?

Accepted Answer

Place the VM-Series in a dedicated subnet and use user-defined routes to send inter-tier traffic to the firewall's trusted interface, with the firewall routing to the destination tier.. Inserting the VM-Series in a dedicated subnet and using user-defined routes to steer inter-tier traffic to it creates a symmetric path, because both source and destination tiers send traffic through the same firewall interfaces. The firewall then routes onward to the destination, ensuring policy inspection and avoiding asymmetric routing.

Answer

Deploy the VM-Series in a transit VPC and peer it with each application VPC, relying on VPC peering route tables to force all traffic through the firewall.

Answer

Attach the VM-Series to each application tier subnet and enable floating IP on the load balancer to preserve source IP addresses.

Answer

Use a single-arm deployment with source NAT on the firewall and policy-based routing on the application subnets to redirect traffic.

Question 4

An architect is deploying Panorama and needs to manage firewalls deployed across different geographic regions with distinct administrative teams. Each team should only be able to view and manage their own local firewalls and policies, but global security rules must apply to all. Which Panorama structural feature should the architect implement?

Accepted Answer

Device Groups combined with Administrator Roles and Access Domains.. Panorama uses Device Groups and Administrative Roles/Domains to implement role-based access control (RBAC) and logical grouping for multi-tenancy or regional separation.

Answer

Multiple virtual routers inside a single device group.

Answer

Separate Panorama virtual appliances for each region configured in an HA mesh cluster.

Answer

Dynamic Address Groups with tag-based RBAC.

Question 5

An architect is configuring User-ID to identify users behind a Microsoft Active Directory domain. Which protocol does the Palo Alto Networks User-ID agent use to query Active Directory security event logs for user login and logoff events?

Accepted Answer

WMI or Windows RPC/SMB to read Security Event Logs. The User-ID agent monitors Active Directory domain controllers using Windows security event logs via WMI or Windows RPC/SMB protocols.

Answer

NetFlow v9 templates

Answer

SNMPv3 polling of Active Directory database tables

Answer

HTTP POST requests sent by the Active Directory DNS service

Question 6

An enterprise architect is designing an architecture where Prisma Cloud computes compliance for multi-cloud environments (AWS, Azure, GCP). To provide least-privilege access for Prisma Cloud to discover and assess resource configurations across multiple AWS accounts, which deployment method should the architect recommend?

Accepted Answer

AWS IAM Role with a unique External ID and CloudFormation stack sets deployed across all target accounts linked to a master payer account.. Prisma Cloud requires secure cross-account access in AWS. Enterprise architectures use AWS IAM Roles with External IDs and CloudFormation stack sets for scalable, least-privilege onboarding.

Answer

A single hardcoded AWS IAM Access Key and Secret Access Key embedded in the Prisma Cloud console settings.

Answer

Deploying a Prisma Cloud Defender daemonset on every AWS EC2 instance in the enterprise.

Answer

Configuring AWS Security Hub to push JSON dumps via FTP to Prisma Cloud.

Question 7

When designing a high-availability (HA) architecture for a pair of Palo Alto Networks NGFWs, which interface type must be dedicated and directly connected between the two peers for session and state synchronization?

Accepted Answer

HA2 interface. HA1 backup and HA1 primary interfaces are used for control plane state synchronization, while HA2 is used for data plane session synchronization.

Answer

External zone data interface

Answer

Management interface

Answer

Panorama registration interface

Question 8

An architect is designing an integration between Cortex XDR and an existing third-party SIEM. The requirement is to forward all raw and enriched Cortex XDR incidents and alerts in real time. Which architectural mechanism should be configured within Cortex XDR?

Accepted Answer

Configure a Syslog Server profile or Cortex XDR Streaming API connector to export log data in CEF or JSON format.. Cortex XDR supports forwarding alerts and incidents to third-party SIEMs using Syslog or HTTP/HTTPS via a configured Cortex XDR Streaming API or Syslog Collector profile.

Answer

Configure an explicit proxy on Panorama to intercept XDR database traffic and mirror it to the SIEM.

Answer

Install a dedicated firewall between the XDR agent and the cloud backend to sniff telemetry.

Answer

Deploy an SNMP trap receiver on the SIEM and enable SNMPv1 polling on the XDR agent.

Question 9

An architect is configuring High Availability (HA) Active/Passive on two PA-5220 firewalls. During a failover event, active TCP sessions are maintained without requiring re-authentication. Which feature makes this possible?

Accepted Answer

HA2 session synchronization. HA2 is the dedicated HA link between Palo Alto firewalls used for synchronizing session state (and other stateful information) so that the passive peer already has the active TCP session table. When failover occurs, the passive firewall takes over with the session state intact, so established TCP sessions continue without re-authentication or re-handshake.

Answer

GlobalProtect cookie persistence

Answer

Dynamic DNS updates

Answer

Panorama configuration push

Question 10

An architect is configuring a Palo Alto Networks firewall to decrypt inbound SSL/TLS traffic destined for an internal web server. Which certificate configuration is required on the firewall to perform Inbound Inspection?

Accepted Answer

The private key and certificate of the internal web server must be installed on the firewall.. For inbound SSL/TLS decryption, the firewall must present the internal web server's own certificate to the client and decrypt the traffic using the server's private key. Therefore, the web server's private key and certificate must be imported onto the firewall (under Device > Certificate Management) so it can impersonate the server during the TLS handshake. This is fundamentally different from outbound/forward-proxy decryption, which uses a forward-trust or self-signed CA to re-sign certificates.

Answer

An expired public certificate from a third-party root CA.

Answer

No certificates are required if SSH is used instead of SSL.

Answer

A self-signed Certificate Authority (CA) certificate generated solely on the firewall without any server keys.

Question 11

An enterprise architect is planning a Zero Trust Network Access (ZTNA) migration using Prisma Access. The design must ensure that users are continuously authenticated and authorized before accessing internal applications, regardless of their location. Which component validates user posture and device compliance before granting access?

Accepted Answer

GlobalProtect app performing HIP (Host Information Profile) checks evaluated by Prisma Access.. Prisma Access integrates with GlobalProtect and Posture Assessment (or third-party MDM/EMM integration) to verify device compliance before granting access.

Answer

Panorama SNMP trap listener

Answer

Prisma Cloud Defender host sensor scanning network cables

Answer

The local DHCP server on the user's home network

Question 12

An architect is configuring Panorama to push configuration updates to managed firewalls using Panorama Templates and Template Stacks. A specific setting needs to be overridden at an individual firewall level without altering the template stack hierarchy. Which Panorama feature enables this capability?

Accepted Answer

Template Variables assigned specific values per managed firewall.. Template Variables in Panorama allow a single template or template stack to contain placeholder variables (e.g., $interface, $ip-address) whose values are defined per managed firewall. When the template stack is pushed, each firewall receives the same configuration structure but substitutes its own assigned variable values, enabling per-device customization without breaking the stack hierarchy or creating device-specific overrides.

Answer

Panorama WildCard objects

Answer

Device-level CLI overrides via administrative lockdown mode.

Answer

Global Object Override rules

Question 13

An architect is designing a Prisma Cloud Compute deployment for Kubernetes clusters deployed across multiple cloud providers. The architecture requires real-time runtime defense against container escapes and anomalous process execution. Which Prisma Cloud component must be deployed inside each Kubernetes cluster to achieve this?

Accepted Answer

Prisma Cloud Defender DaemonSet deployed to every node in the Kubernetes cluster.. Prisma Cloud Compute Defender daemonsets run on each node in the cluster to provide runtime defense, vulnerability scanning, and compliance checks.

Answer

Prisma Access Remote Network connector container pod

Answer

Panorama virtual appliance deployed as a Kubernetes Ingress controller.

Answer

GlobalProtect containerized app

Question 14

An architect is designing an automated incident response workflow in Cortex XSOAR. When a critical phishing incident is reported, the playbook must automatically extract URLs, submit them to WildFire for analysis, and isolate the endpoint if malicious. Which integration instance is responsible for submitting the URL to WildFire within the XSOAR playbook?

Accepted Answer

WildFire v2 integration integration instance. The WildFire v2 integration instance in Cortex XSOAR is specifically designed to submit files and URLs to the WildFire cloud service for analysis. When the playbook needs to submit a URL for WildFire analysis, it calls the WildFire v2 integration's commands (e.g., wildfire-submit-url). This integration handles authentication, submission, and retrieval of the verdict.

Answer

Active Directory LDAP integration

Answer

Prisma Cloud compliance integration

Answer

Panorama threat-feed integration

Question 15

An architect is configuring User-ID mapping in a multi-forest Active Directory environment. Some users authenticate against domain A, while resources are in domain B. Which User-ID collection method should the architect recommend to ensure seamless mapping across all domains?

Accepted Answer

Configure multiple LDAP Server profiles in Panorama and map them under User-ID Server Monitor / Agent settings for each domain controller.. When multiple AD forests or domains are present, deploying User-ID agents or configuring Panorama/NGFW User-ID LDAP integrations with appropriate server profiles for each domain ensures complete coverage.

Answer

Use Syslog forwarding from local workstations without a domain controller.

Answer

Configure a single static IP address list for all users.

Answer

Rely solely on GlobalProtect portal logs while disabling Active Directory monitoring.