SecOps-Architect Palo Alto Networks Product Integration And Architecture Practice Test 6 — 15 Questions

Question 1

An architect is designing a secure CI/CD pipeline integration using Prisma Cloud to scan container images before they are pushed to a container registry (such as AWS ECR or Docker Hub). Which TWO mechanisms can be utilized for this pre-deployment image scanning? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Integrating the Prisma Cloud twistcli scanner utility into the CI/CD pipeline build script (e.g., Jenkins or GitLab CI).. Option A is correct because the twistcli scanner is Prisma Cloud's standalone CLI utility that can be invoked directly within a CI/CD build script (Jenkins, GitLab CI, etc.) to scan container images for vulnerabilities and compliance issues before they are pushed to a registry. Option D is correct because the Prisma Cloud Jenkins plugin integrates natively with Jenkins pipelines to automatically trigger image scans on built images and surface vulnerability and compliance results as part of the build. The other options are incorrect: GlobalProtect is a VPN client unrelated to image scanning (B), BNC cabling to a PA-5250 firewall is a physical network concept with no role in CI/CD image scanning (C), and SNMP traps on the Docker daemon socket are for monitoring/alerting, not pre-deployment vulnerability scanning (E).

Answer

Installing the GlobalProtect desktop VPN client on every container container image layer.

Answer

Physically connecting the build server to a Palo Alto Networks PA-5250 hardware appliance via BNC cables.

Answer

Configuring raw SNMP traps on the Docker daemon socket.

Question 2

An architect is designing a Palo Alto Networks High Availability (HA) deployment. Which TWO statements are correct regarding HA state synchronization and failover behavior? (Choose two)

Accepted Answer

Active TCP and UDP sessions are synchronized across the HA2 link so sessions persist seamlessly during a failover.. Option A is correct because the HA2 link is the dedicated dataplane path used to synchronize session state (including active TCP and UDP sessions, plus ARP/ND and other runtime state) so that established flows continue after a failover without re-establishing sessions. Option C is correct because the HA1 link is the control plane path that synchronizes configuration, and configuration changes made on the active peer are pushed to the passive peer so both devices remain in sync. Option B is incorrect because HA2 is a direct, dedicated link between the two firewalls (or a dedicated Layer 2 path) and does not require a public, internet-routable IP address. Option D is incorrect because HA failover is automatic based on configured failure triggers and priorities, not a manual CLI command on every failover. Option E is incorrect because HA synchronization only mirrors state and configuration between peers; it does not replace Panorama's centralized policy and device management capabilities.

Answer

The HA2 link requires a dedicated public IP address routable over the public internet.

Answer

Failover requires manual intervention via CLI command on the passive unit every time.

Answer

HA synchronization replaces the need for Panorama configuration management entirely.

Question 3

An architect is designing an enterprise incident response workflow using Cortex XSOAR. When a malware alert is triggered in Cortex XDR, XSOAR needs to automatically enrich the alert by querying VirusTotal, checking Active Directory for user details, and isolating the host if malicious. What is this orchestration framework called in Cortex XSOAR?

Accepted Answer

Playbook. Playbooks are the core automation workflows in Cortex XSOAR that chain together integration commands, conditions, and human approval steps.

Answer

GlobalProtect HIP Notification object

Answer

Prisma Access Remote Network profile

Answer

Panorama Device Group Policy Template

Question 4

An architect is configuring a Palo Alto Networks firewall and wants to inspect unknown files submitted by users over HTTP/FTP/SMTP to determine if they contain zero-day malware. Which service should the architect configure?

Accepted Answer

WildFire cloud-based malware analysis. WildFire is Palo Alto Networks' cloud-based malware analysis service that performs dynamic analysis of unknown files in a sandboxed environment. It supports files submitted over HTTP, FTP, SMTP, SMB, and other protocols, and can identify zero-day malware by observing behavior. The firewall forwards unknown files to WildFire, which returns a verdict (malicious, benign, grayware) and generates signatures that are automatically distributed to the firewall.

Answer

URL Filtering cloud database

Answer

GlobalProtect portal

Answer

DNS Security service

Question 5

An architect is configuring User-ID mapping via GlobalProtect. When remote users connect via GlobalProtect, how does the firewall learn the user-to-IP mapping without querying Active Directory domain controllers directly?

Accepted Answer

GlobalProtect gateway directly registers the authenticated username and assigned tunnel IP with the User-ID subsystem.. GlobalProtect portals and gateways natively send user authentication mapping information to the User-ID subsystem upon successful VPN tunnel establishment.

Answer

GlobalProtect stores user mappings inside Cortex XDR cloud databases.

Answer

GlobalProtect relies on DNS reverse-lookup polling every 24 hours.

Answer

GlobalProtect uses SNMP traps to poll local Wi-Fi routers.

Question 6

An architect is designing a zero-trust network architecture using Prisma Access and Cortex XDR. Which TWO architectural integrations between Prisma Access and Cortex XDR enhance end-to-end visibility and threat detection? (Choose two)

Accepted Answer

Configuring Cortex XDR analytics to ingest Prisma Access connection logs to detect anomalous remote user behavior.. Option B is correct because Cortex XDR analytics can ingest Prisma Access connection logs, allowing it to baseline and detect anomalous remote-user behavior such as impossible travel, unusual access times, or abnormal data volumes, which is a core zero-trust visibility use case. Option D is correct because Prisma Access forwards traffic, threat, and URL/traffic logs to Cortex Data Lake, where Cortex XDR correlates them with endpoint telemetry to provide end-to-end detection across network and endpoint. The remaining options are not valid integrations: A proposes replacing GlobalProtect with raw FTP daemons, which is neither secure nor a Prisma Access/Cortex XDR integration; C suggests SNMPv1 polling of Prisma Access RAM from browsers, which is not how Prisma Access is monitored and SNMPv1 is insecure and irrelevant here; E describes installing physical firewall ASICs via USB onto laptops, which is not a real Prisma Access or Cortex XDR architectural integration.

Answer

Replacing all GlobalProtect clients with raw FTP daemons.

Answer

Using SNMPv1 polling to read Prisma Access RAM from client web browsers.

Answer

Installing physical firewall ASICs directly onto laptop motherboards via USB.

Question 7

An architect is designing an automated threat hunting and containment workflow using Cortex XSOAR. Which TWO external or internal data sources can Cortex XSOAR query or integrate with during an investigation? (Choose two)

Accepted Answer

Active Directory domain controllers for user account status verification.. Option A is correct because Cortex XSOAR can integrate with Active Directory (via the LDAP-based AD integration or the Active Directory Query v2 integration) to query domain controllers and verify user account status, such as whether an account is enabled, disabled, or locked out, which is essential during containment decisions. Option D is correct because Cortex XSOAR natively supports threat intelligence platform integrations, including VirusTotal and Palo Alto Networks WildFire, to enrich indicators (hashes, IPs, URLs, domains) with reputation and verdict data during automated investigations. Options B, C, and E are incorrect because they describe non-standard, unsupported data sources (Bluetooth IoT coffee machine sensors, FM radio tuners, and analog modem dial-up switches) that are not part of Cortex XSOAR's integration ecosystem and have no relevance to enterprise threat hunting or containment workflows.

Answer

Local coffee machine IoT sensors via raw Bluetooth packets.

Answer

FM radio broadcast frequency tuners.

Answer

Raw analog telephone landline switches via modem dial-up.

Question 8

An architect is configuring User-ID mapping on a Palo Alto Networks firewall. Which TWO methods can be used to map IP addresses to usernames in environments where Active Directory is not present? (Choose two)

Accepted Answer

GlobalProtect client connections which report username and IP upon login.. Option D is correct because GlobalProtect, when configured with User-ID, reports the authenticated username and the assigned source IP address to the firewall upon login, creating a valid IP-to-username mapping without requiring Active Directory. Option E is correct because Captive Portal intercepts HTTP/HTTPS sessions and prompts users for credentials, then maps the authenticated username to the client's source IP for User-ID purposes. These two methods are native Palo Alto Networks User-ID mechanisms that function independently of Active Directory. Option A is irrelevant because the BIOS clock has nothing to do with identity mapping. Option B is not a supported User-ID method and unauthenticated SNMP polling of ARP tables does not provide username mappings. Option C is illegitimate and unrelated to any supported User-ID mapping technique.

Answer

Manually editing the firewall BIOS clock.

Answer

SNMP polling of unmanaged switch ARP tables without authentication.

Answer

Direct NetBIOS password hash cracking on remote workstations.

Question 9

An architect is configuring Panorama to manage a large deployment of firewalls. Which TWO best practices should be implemented regarding Panorama administrative access and security? (Choose two)

Accepted Answer

Configure Role-Based Access Control (RBAC) using custom Admin Roles and Access Domains to restrict administrators to their assigned device groups.. Panorama admin best practices include enforcing Role-Based Access Control (RBAC) via Admin Roles and Access Domains, and enforcing multi-factor authentication (MFA) for all administrators.

Answer

Expose the Panorama management interface directly to the public internet without an IP whitelist or VPN.

Answer

Share a single 'admin' superuser account credential among all members of the network team.

Answer

Disable all logging on Panorama to save disk space.

Question 10

An architect is designing a high availability deployment for Palo Alto Networks firewalls. What is the primary purpose of the HA1 link?

Accepted Answer

Synchronize control plane configurations and exchange heartbeat keepalive messages between HA peers.. The HA1 link is the dedicated control-plane and heartbeat path between Palo Alto HA peers. It carries configuration synchronization (so the passive/active peer stays in sync), hello/heartbeat keepalives for peer liveness detection, and state information needed for failover decisions. It is not used for user data traffic.

Answer

Transfer high-speed data plane network traffic during normal operation.

Answer

Forward system logs to external SIEM collectors.

Answer

Provide direct internet access to client workstations behind the firewall.

Question 11

An architect is configuring a Palo Alto Networks firewall and needs to ensure that DNS requests originating from internal clients to known malicious domains are automatically intercepted or blocked. Which security feature provides this capability?

Accepted Answer

DNS Security service with sinkhole configuration.. Palo Alto's DNS Security service inspects DNS queries and responses against threat intelligence and can sinkhole malicious domains, redirecting clients to a firewall-hosted sinkhole IP that blocks or logs the connection. Configuring a DNS sinkhole action in the DNS Security profile automatically intercepts requests to known malicious domains. This is the purpose-built feature for this requirement.

Answer

Static host file entries on the firewall management interface.

Answer

SNMP trap alert generator.

Answer

DHCP lease reservation tables.

Question 12

An architect is designing an enterprise deployment of Prisma Access and needs to ensure that mobile users authenticate against an external SAML 2.0 Identity Provider before establishing a GlobalProtect connection. Where should the SAML Authentication profile be configured in Panorama?

Accepted Answer

Panorama Authentication Profile assigned to the GlobalProtect Portal and Gateway configurations.. In Prisma Access / GlobalProtect architectures, the SAML Authentication profile is configured in Panorama under Authentication profiles and assigned to the GlobalProtect Gateway and Portal configurations.

Answer

Panorama Template stack interface MTU settings.

Answer

External Dynamic List URL objects.

Answer

Firewall Zone Protection profile settings.

Question 13

An architect is troubleshooting a Cortex XDR deployment where agents on endpoints are failing to communicate with the Cortex XDR cloud tenant. Which outbound network connectivity requirement must be verified on the local corporate firewall?

Accepted Answer

Outbound TCP port 443 (HTTPS) access to the Cortex XDR tenant cloud URL.. Cortex XDR agents communicate with the Cortex XDR cloud tenant over outbound TCP 443 (HTTPS). The local corporate firewall must allow outbound HTTPS traffic to the tenant's cloud URL (e.g., *.xdr.us.paloaltonetworks.com) for agents to register, send telemetry, and receive policy updates.

Answer

Inbound UDP port 69 (TFTP) from endpoints to Panorama.

Answer

Inbound TCP port 3389 (RDP) from the cloud backend to every endpoint.

Answer

Outbound TCP port 3978 to Panorama Collectors.

Question 14

An architect is configuring a Palo Alto Networks firewall and wants to control application traffic (such as allowing Skype business calls while blocking Skype file transfers). Which security policy match enables this granularity?

Accepted Answer

App-ID based security policy rules specifying application and sub-features.. App-ID is Palo Alto Networks' patented traffic classification technology that identifies applications regardless of port, protocol, encryption, or evasion tactics. Security policy rules can match on a specific application and then use the application's sub-features (e.g., Skype business calls vs. Skype file transfers) to allow or deny granular functions within the same application. This is the only mechanism in the listed options that provides application-layer and function-level control.

Answer

Destination IP address matching only.

Answer

TCP port number matching (e.g., port 80/443).

Answer

Source MAC address filtering.

Question 15

An architect is configuring Palo Alto Networks firewall security policies using WildCard masks and Address Objects. Which TWO best practices should be followed when designing address objects and security rules? (Choose two)

Accepted Answer

Use descriptive naming conventions for Address Objects and Address Groups to clearly indicate their purpose and zone.. Option A is correct because descriptive naming conventions for Address Objects and Address Groups make policies self-documenting, so administrators can immediately identify an object's purpose and associated zone, which reduces misconfiguration risk during audits and rule changes. Option B is correct because grouping related IP addresses and subnets into Address Groups lets a single security rule reference the group, so adding or removing members only requires editing the group rather than every rule, greatly simplifying rule management and reducing policy bloat. Option C is not appropriate because predefined PAN-OS application objects are required for App-ID based policy enforcement and should not be deleted. Option D is wrong because a single any/any/any rule defeats the purpose of least-privilege segmentation and App-ID control. Option E is wrong because hardcoding IPs into rules eliminates the reusability and maintainability benefits of Address Objects.

Answer

Delete all predefined PAN-OS application objects from the firewall.

Answer

Use a single security rule with source 'any', destination 'any', and application 'any' for all enterprise traffic.

Answer

Hardcode individual IP addresses directly into every security rule without using address objects.