SecOps-Architect Palo Alto Networks Product Integration And Architecture Practice Test 9 — 15 Questions

Question 1

An architect is designing a Prisma Cloud Compute deployment for cloud-native applications. Which TWO security scanning and monitoring capabilities are provided by Prisma Cloud Compute? (Choose two)

Accepted Answer

Vulnerability scanning for container images, serverless functions, and virtual machine hosts.. Option B is correct because Prisma Cloud Compute (formerly Twistlock) includes a vulnerability scanner that inspects container images, serverless functions, and VM hosts against CVE databases, covering the full cloud-native workload lifecycle. Option C is correct because Prisma Cloud Compute's runtime defense uses Defenders to monitor container processes, network connections, and file system activity, applying behavioral models and rules to detect anomalies and threats in real time. The other options are incorrect: A and E describe physical/manual activities outside the scope of a software security platform, and D misuses Defender node storage, which is not a web-hosting service but a lightweight agent for enforcement and telemetry.

Answer

Physically rewiring enterprise data center power distribution units.

Answer

Hosting public website domains on Prisma Cloud Defender node storage.

Answer

Printing physical compliance paper certificates on office laser printers.

Question 2

An architect is designing a security operations architecture where a Palo Alto Networks NGFW must forward all traffic logs and threat logs to an external syslog server at 10.10.20.5 using TCP port 514. The firewall is managed by Panorama. The architect needs to ensure that logs are sent in a structured format that includes all fields. Which configuration should the architect use?

Accepted Answer

Configure a Syslog server profile with the server address, transport TCP, port 514, and format IETF.. The requirement is to send logs to an external syslog server using TCP port 514 in a structured format that includes all fields. Palo Alto Networks firewalls support syslog formats: BSD, IETF, and CEF. IETF format is structured and includes all fields, while BSD is unstructured and CEF includes only a subset. Therefore, configuring a syslog server profile with IETF format over TCP port 514 meets the requirement.

Answer

Configure a Syslog server profile with the server address, transport SSL, port 6514, and format IETF.

Answer

Configure a Syslog server profile with the server address, transport TCP, port 514, and format CEF.

Answer

Configure a Syslog server profile with the server address, transport TCP, port 514, and format BSD.

Question 3

An architect is integrating Prisma Access with a cloud-native SOAR platform. The SOAR needs to pull Prisma Access traffic, threat, and URL filtering telemetry on a recurring schedule, and the architect must choose the most reliable, supported collection method that avoids vendor lock-in to a specific SIEM. Which integration approach should the architect select?

Accepted Answer

Use the Prisma Access Cortex Data Lake Query API to retrieve logs programmatically on a schedule.. The Cortex Data Lake Query API is the supported programmatic interface for retrieving Prisma Access telemetry, giving the SOAR a scheduled, paginated pull that avoids SIEM lock-in and delivers normalized records. Push-based syslog, direct collector disk access, and email parsing either lack reliability, lack support, or cannot scale to the required log volume.

Answer

Deploy a dedicated Log Collector VM in the VPC and query its local disk for historical telemetry.

Answer

Configure a syslog forwarding profile on Prisma Access to send logs to the SOAR's syslog receiver.

Answer

Enable email notifications from Prisma Access for each log type and parse the resulting mailbox.

Question 4

An architect is deploying Cortex XDR to protect endpoints across a hybrid environment. The security team wants to ensure that if an endpoint loses connectivity to the Cortex XDR management console, it continues to enforce security policies and can later upload forensic data. Which Cortex XDR component provides this capability?

Accepted Answer

Cortex XDR agent with local policy caching. The Cortex XDR agent is designed to operate autonomously when disconnected from the management console. It caches policies locally, so security enforcement continues uninterrupted. Additionally, it stores endpoint telemetry and forensic data locally, then uploads it once connectivity is restored. This ensures both protection and data integrity during network outages, which is critical for remote or hybrid endpoints.

Answer

Cortex XDR agent with cloud-based policy enforcement

Answer

Cortex XDR Broker VM

Answer

Cortex XDR management console with high availability

Question 5

An architect is designing an integration where Cortex XDR alerts must trigger automated response actions in Cortex XSOAR, and the SOC team requires that a single XSOAR incident be created for multiple related XDR alerts that share the same host and causality chain. Which Cortex XDR feature should the architect leverage to group alerts into one incident?

Accepted Answer

Cortex XDR alert grouping based on causality chain and host. Cortex XDR automatically groups related alerts into a single alert group based on shared causality chain and host. When integrated with Cortex XSOAR, this grouped alert can trigger one incident, reducing noise and aligning with the SOC requirement. Other methods either require manual intervention or occur after incident creation, failing to meet the single-incident goal at the source.

Answer

Cortex XSOAR incident type with deduplication and merging rules

Answer

Cortex XDR incident grouping via the incident management console

Answer

Cortex XSOAR playbook that queries XDR for all alerts and manually merges them

Question 6

An architect is integrating Palo Alto Networks Prisma Access with an on-premises data center. The data center hosts critical applications that must be accessed by mobile users through Prisma Access. The architect needs to ensure that traffic from mobile users to the data center is inspected by security policies and that the data center's internal IP addresses are not exposed to the internet. Which Prisma Access component should be used?

Accepted Answer

Prisma Access Service Connection. The correct component is Prisma Access Service Connection. It establishes an IPsec tunnel between Prisma Access and the on-premises data center, enabling mobile users to securely access internal applications. Traffic is inspected by Prisma Access security policies, and the data center's private IP addresses are not exposed to the internet. This is the recommended architecture for integrating Prisma Access with a data center.

Answer

Prisma Access Remote Network

Answer

Prisma Access Mobile User

Answer

Prisma Access Explicit Proxy

Question 7

An architect is deploying Palo Alto Networks Prisma Access to secure remote users. The organization requires that all traffic from remote users, including internet-bound traffic, be inspected by Prisma Access security services. Which Prisma Access component should the architect configure to meet this requirement?

Accepted Answer

Mobile users. Prisma Access provides secure remote access through the Mobile Users component. When configured with GlobalProtect, all traffic from remote users can be routed through Prisma Access for inspection by security services. Other components like Remote Network and Service Connection serve different purposes, such as connecting sites or data centers.

Answer

Remote network

Answer

Service connection

Answer

Explicit proxy

Question 8

An architect is designing a multi-tenant environment where each tenant has its own Prisma Access tenant and needs to enforce consistent security policies across all tenants. The architect wants to centrally manage policies and push them to all tenants. Which Palo Alto Networks solution should be used?

Accepted Answer

Prisma Access Multitenancy with a parent tenant and child tenants. Prisma Access Multitenancy is specifically designed for managed security service providers and large enterprises that need to manage multiple tenants from a single pane of glass. A parent tenant can create policies that are inherited by child tenants, ensuring consistent security posture while maintaining tenant isolation. This native capability eliminates the need for manual policy duplication and reduces operational overhead.

Answer

Panorama with multiple device groups and template stacks

Answer

GlobalProtect with multiple portals and gateways

Answer

Cortex XSOAR with custom playbooks to push policies to each tenant

Question 9

An architect is designing a Prisma Access deployment with GlobalProtect for remote users. The security team requires that all traffic from remote users, including traffic destined to the internet, be inspected by Prisma Access security services, and that user identity be consistently applied across all security policies. Which GlobalProtect configuration is required to meet these requirements?

Accepted Answer

Enable no split tunneling (full tunnel) and configure User-ID in GlobalProtect.. To inspect all remote user traffic, including internet-bound, the GlobalProtect configuration must use no split tunneling, forcing all traffic through Prisma Access. User-ID in GlobalProtect ensures that user identity is consistently applied across all security policies. The other options either allow traffic to bypass inspection or do not address identity consistently.

Answer

Configure split tunneling with access route including /0 and exclude internal subnets.

Answer

Use GlobalProtect with IPsec and enable X-Auth to capture user credentials.

Answer

Configure split tunneling with access route including all internal subnets and exclude public internet.

Question 10

An architect is integrating Cortex XDR with a third-party endpoint management platform so that when Cortex XDR isolates an endpoint, the management platform should not attempt to push software updates to it. The architect needs the most reliable, event-driven way to notify the external platform of the isolation state change. Which approach should the architect use?

Accepted Answer

Configure a Cortex XDR alert notification webhook that calls the external platform's API when an isolation event fires.. Cortex XDR's outbound webhook notification delivers an event-driven push when an endpoint is isolated, letting the external platform block update pushes in near real time. Polling and scheduled exports are batch and latency-prone, and an inbound listener is neither supported nor secure, so the webhook is the correct integration mechanism.

Answer

Create a Cortex XSOAR playbook that listens on an inbound port for Cortex XDR to connect to.

Answer

Poll the Cortex XDR management API every 60 seconds for endpoint isolation status changes.

Answer

Export Cortex XDR endpoint status to a CSV on a schedule and have the platform import the file.

Question 11

An architect is integrating Cortex XDR with a third-party threat intelligence platform to automatically block indicators of compromise (IOCs) on Palo Alto Networks firewalls. The architect wants to ensure that when a new IOC is added to the threat intelligence platform, it is automatically pushed to the firewalls and enforced. Which integration method should be used?

Accepted Answer

Cortex XSOAR playbook that triggers on new IOCs and uses the Palo Alto Networks firewall integration to update policy. Cortex XSOAR is the central orchestration platform for automating security workflows. Its Palo Alto Networks firewall integration allows playbooks to programmatically add IOCs to EDLs or create security rules, ensuring immediate enforcement. By triggering on new IOCs from the threat intelligence platform, the playbook automates the entire process, reducing response time and human error. This is the most scalable and maintainable solution.

Answer

Panorama log forwarding to the threat intelligence platform and automatic policy updates via the platform's API

Answer

GlobalProtect with HIP profiles to block IOCs based on endpoint posture

Answer

Cortex XDR API with custom scripts to poll the threat intelligence platform and update firewall policies

Question 12

An architect is designing a Panorama-managed deployment where firewall logs must be forwarded to a Cortex Data Lake tenant for centralized retention and analytics. Which TWO configuration elements are required to make Panorama forward firewall logs to Cortex Data Lake? (Choose two.)

Accepted Answer

Configure a Log Forwarding profile with a Cortex Data Lake destination and attach it to the relevant security policy rules.. Forwarding firewall logs to Cortex Data Lake requires two things: authenticating and registering Panorama and its managed firewalls to the tenant, and attaching a Log Forwarding profile with a Cortex Data Lake destination to the security rules that generate logs. Log Collector VMs, syslog, and custom formats do not enable the cloud destination.

Answer

Enable syslog forwarding on every managed firewall and set the Cortex Data Lake tenant as the syslog server.

Answer

Install a dedicated Log Collector VM in each region and point Panorama at its management interface.

Answer

Create a custom log format template that matches the Cortex Data Lake schema and apply it to all firewall interfaces.

Question 13

An architect is designing a Prisma Access deployment for a large enterprise with multiple branch offices. The architect needs to ensure that traffic from branch offices to the internet is inspected by Prisma Access while traffic to internal applications is routed directly over the corporate WAN. Which Prisma Access component should be used to achieve this?

Accepted Answer

Remote Network with BGP routing and policy-based forwarding. Prisma Access Remote Network is designed to connect branch offices and data centers to Prisma Access. By using BGP, the branch can advertise routes and direct internet-bound traffic to Prisma Access while keeping internal traffic on the WAN. Policy-based forwarding on the branch firewall can further refine traffic selection. This provides the required selective inspection without impacting internal traffic.

Answer

Service Connection with static routes and NAT policies

Answer

Mobile Users with GlobalProtect and split tunneling

Answer

Explicit Proxy with PAC files to redirect traffic to Prisma Access

Question 14

An architect is designing log forwarding from a Prisma Access tenant to an on-premises syslog collector that requires mutual TLS and cannot accept the default certificate. The collector's private CA is not trusted by the Prisma Access infrastructure. What is the correct approach?

Accepted Answer

Import the collector's CA certificate and client certificate into the Prisma Access configuration, then configure the syslog profile to use them for the outbound connection.. Mutual TLS requires trust in both directions: the sender must validate the receiver and present a client certificate the receiver trusts. Since the collector's private CA is not in the default trust store, it must be imported into Prisma Access alongside the client certificate and referenced by the syslog profile. Without those imports, the handshake cannot complete regardless of other network changes.

Answer

Generate a self-signed certificate on the collector and add the Prisma Access public certificate to the collector's trust store only.

Answer

Disable certificate validation on the syslog profile so the collector accepts the connection without presenting a trusted client certificate.

Answer

Route syslog through a Cortex Data Lake forwarder that terminates TLS and re-encrypts traffic to the collector with a public certificate.

Question 15

An architect is integrating a Palo Alto Networks next-generation firewall with an external threat intelligence platform using the MineMeld-style output. The platform publishes indicators over HTTPS as a plain-text list, one indicator per line. The architect wants the firewall to consume the list and enforce it in security policy without manual updates. Which configuration should the architect use?

Accepted Answer

Create an External Dynamic List of type IP or Domain, attach it to a security policy rule, and configure the source URL with a refresh interval.. An External Dynamic List sourced from the platform's HTTPS URL, refreshed on a schedule, and referenced in a security policy rule provides automated enforcement of the published indicators. URL-type EDLs are limited to URL filtering, application filters cannot auto-refresh, and DNS category overrides do not ingest arbitrary lists.

Answer

Configure a DNS Security category override that maps the indicator list to a custom sinkhole.

Answer

Create an External Dynamic List of type URL and reference it in a URL Filtering profile.

Answer

Import the indicator list into a custom Application Filter and apply it to a security policy rule.