How many Troubleshooting Scenario Questions questions are on this page?

This page has 11 Troubleshooting Scenario Questions scenario questions for the SecOps-Architect exam, each with detailed explanations and wrong-answer analysis.

How should I approach SecOps-Architect scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Security Operations Architect (SecOps-Architect) questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Certified Security Operations Architect (SecOps-Architect) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SecOps-Architect

exam code

Palo Alto Networks

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Full question →

An architect is troubleshooting why security metric trends in Cortex XSIAM appear erratic and unreliable. Which THREE factors commonly cause metric distortion in a SOC? (Choose three)

A
Configuring browser bookmarks for dashboard access
Why wrong: Bookmarks are browser shortcuts that do not affect data metrics.
B
Intermittent log ingestion pipeline failures or collector outages
Missing log data during pipeline outages creates artificial drops in metric trends.
C
Using dark mode instead of light mode in the Cortex XSIAM web UI
Why wrong: UI theme settings have zero impact on backend metric data calculation.
D
Inconsistent log parsing or changes in log formats from third-party vendors
Broken parsing rules cause events to be misclassified or dropped from metric calculations.
E
Unannounced mass deployment or decommissioning of endpoint agents
Sudden changes in endpoint sensor coverage skew volume-based security metrics.

Full breakdown with real-world context →

Question 2mediummulti select

Full question →

An architect is troubleshooting a User-ID deployment where users authenticating via captive portal are not getting correctly mapped. Which TWO conditions must be verified to ensure captive portal functions properly? (Choose two)

A
Verify that an Authentication Profile and Authentication Policy are correctly configured to prompt users.
Captive portal requires an authentication profile to validate credentials against LDAP/RADIUS/SAML.
B
Verify that a security policy rule allows traffic to the captive portal IP address and authentication port.
Firewalls must permit traffic to reach the captive portal service on the device.
C
Ensure that the firewall's management plane CPU is disabled to allow unhindered redirects.
Why wrong: Disabling the management plane CPU would crash the firewall.
D
Ensure that User-ID agents are disabled when captive portal is active.
Why wrong: User-ID agents and captive portal can complement each other.
E
Verify that all users have installed the Prisma Cloud Defender agent.
Why wrong: Prisma Cloud Defender is for cloud workloads, not user captive portal auth.

Full breakdown with real-world context →

Question 3mediummulti select

Full question →

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

A
Reformat the firewall data plane ASICs via the CLI.
Why wrong: Reformatting hardware ASICs is destructive and unnecessary for log forwarding issues.
B
Verify that the managed firewalls are correctly assigned to a valid Collector Group within Panorama.
Firewalls must belong to a Collector Group to know where to send their logs.
C
Check if the firewall local management plane CPU is running SNMPv1 polling.
Why wrong: SNMP has no impact on Panorama log forwarding.
D
Verify network connectivity and firewall rules between the managed firewalls and Panorama Collectors over TCP port 3978.
Panorama and managed firewalls communicate log data over TCP port 3978.
E
Disable SSL decryption on all internal zones.
Why wrong: Decryption settings do not prevent log forwarding to Panorama.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

An architect is troubleshooting a Cortex XDR deployment where agents on endpoints are failing to communicate with the Cortex XDR cloud tenant. Which outbound network connectivity requirement must be verified on the local corporate firewall?

A
Outbound TCP port 443 (HTTPS) access to the Cortex XDR tenant cloud URL.
Cortex XDR agents require outbound HTTPS (port 443) access to communicate with the cloud backend.
B
Inbound UDP port 69 (TFTP) from endpoints to Panorama.
Why wrong: TFTP is not used by Cortex XDR agents.
C
Inbound TCP port 3389 (RDP) from the cloud backend to every endpoint.
Why wrong: Inbound RDP is insecure and not required by XDR.
D
Outbound TCP port 3978 to Panorama Collectors.
Why wrong: Port 3978 is for Panorama log collection from firewalls, not XDR agents.

Full breakdown with real-world context →

Question 5mediummulti select

Full question →

An architect is troubleshooting a Palo Alto Networks High Availability (HA) cluster where configuration synchronization between active and passive peers is failing. Which TWO locations or settings should the architect check? (Choose two)

A
Verify physical and logical connectivity on the HA1 control link interface.
HA1 handles configuration sync; connectivity failures break config sync.
B
Check the DNS server IP address configured on the management interface.
Why wrong: DNS configuration does not affect direct peer-to-peer HA sync.
C
Check the URL Filtering cloud license status.
Why wrong: URL licenses do not prevent HA config sync.
D
Check the GlobalProtect gateway portal certificate expiration date.
Why wrong: GP certificates do not prevent HA config sync.
E
Verify that both firewalls are running the exact same PAN-OS software version.
Mismatched PAN-OS versions prevent configuration and state synchronization.

Full breakdown with real-world context →

Question 6mediummulti select

Full question →

An architect is troubleshooting a Panorama deployment where managed firewalls show a 'Disconnected' status in the Panorama GUI. Which TWO connectivity requirements should the architect verify? (Choose two)

A
Check the physical color of the office carpet near the server rack.
Why wrong: Carpet color has no impact on network connectivity.
B
Verify the HDMI cable connection on the firewall console port.
Why wrong: Console ports are for local serial debugging, not Panorama network connectivity.
C
Verify that TCP port 3978 (Panorama SSL/TLS communication) is open and not blocked by intermediate firewalls or security groups.
Panorama management communication requires TCP port 3978.
D
Check if the user desktop browser has JavaScript enabled.
Why wrong: Browser settings do not affect firewall-to-Panorama TCP connectivity.
E
Verify that the firewall management IP address can successfully reach the Panorama management IP address.
IP reachability between firewall management and Panorama is required for connection.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full network assurance explanation →

You are configuring log ingestion in Cortex XSIAM from a third-party firewall using a generic syslog collector. The logs are arriving, but the parser is failing to extract destination IP addresses correctly. What is the recommended troubleshooting step?

A
Modify or create a custom XDM parsing rule for the vendor log format
Custom parsing rules correct extraction errors for unsupported log formats.
B
Increase the Syslog port number from 514 to 6514
Why wrong: Port changes affect transport security or connectivity, not field parsing logic.
C
Disable Magnifier behavioral analytics
Why wrong: Disabling analytics does not fix log parser regex extractions.
D
Reinstall the Cortex XDR agent on the third-party firewall
Why wrong: Firewalls do not run Cortex XDR agents.

Full breakdown with real-world context →

Question 8easymultiple choice

Full question →

Which metric should a SOC manager review to determine whether alerts are being investigated in a timely manner after they are generated?

A
Total Log Storage Volume in Terabytes
Why wrong: Storage volume measures data retention capacity, not investigation speed.
B
Firewall Rule Hit Count
Why wrong: Rule hit count measures firewall rule usage.
C
Mean Time to Acknowledge (MTTA)
MTTA specifically measures how quickly alerts are picked up and acknowledged by analysts.
D
Cortex XDR Agent Deployment Percentage
Why wrong: Deployment percentage measures endpoint coverage.

Full breakdown with real-world context →

Question 9mediummultiple choice

Review the full routing breakdown →

An architect is troubleshooting an issue where Palo Alto Networks VM-Series firewalls deployed in AWS are experiencing asymmetric routing issues across multiple network interfaces. Which AWS networking construct must be correctly configured to ensure traffic enters and exits through the correct firewall data interface?

A
Panorama Template stack backup schedules.
Why wrong: Backups have no effect on cloud routing.
B
Palo Alto Networks Management interface static default gateway.
Why wrong: Management interface traffic is separate from data plane traffic routing.
C
AWS Security Groups blocking all inbound ports.
Why wrong: AWS Security Groups block traffic at the AWS layer, but routing is controlled by route tables.
D
AWS Route Tables associated with subnets pointing traffic to specific Elastic Network Interfaces (ENIs).
Proper route table configuration in AWS ensures symmetric routing across VM-Series network interfaces.

Full breakdown with real-world context →

Question 10mediummultiple choice

Full question →

An architect is troubleshooting a User-ID agent deployment where group mapping information is not being retrieved from Microsoft Active Directory. Which permission or protocol requirement must be verified on the Active Directory domain controller for group mapping to succeed?

A
Verify that SNMPv1 is enabled on the domain controller.
Why wrong: SNMP is not used for AD group mapping.
B
Verify that the Domain Controller has the GlobalProtect client installed.
Why wrong: Domain controllers do not run GlobalProtect clients.
C
Verify LDAP/LDAPS network connectivity and ensure the service account has read permissions to query Active Directory user and group objects.
LDAP connectivity and proper read privileges on AD objects are required for User-ID group mapping.
D
Verify that the firewall management plane CPU is running at 100%.
Why wrong: High CPU causes performance degradation, not group mapping retrieval.

Full breakdown with real-world context →

Question 11mediummulti select

Review the full subnetting walkthrough →

An architect is troubleshooting a User-ID deployment where IP-to-username mappings are missing for users on a specific subnet. Which TWO sources or tools can be checked to verify mapping status on the Palo Alto Networks firewall? (Choose two)

A
Check the BIOS boot sequence of the firewall management plane.
Why wrong: BIOS boot sequence is irrelevant to User-ID mappings.
B
Check the GlobalProtect client GUI for hardware warranty details.
Why wrong: Warranty details have no relation to User-ID mappings.
C
Run the CLI command 'show user ip-user-mapping all' on the firewall to view current mappings.
The CLI command 'show user ip-user-mapping all' displays active IP-to-user mappings on the firewall.
D
Check the User-ID agent status and connection state on the firewall under Device > User Identification.
Checking User-ID agent status verifies connection health and mapping collection.
E
Verify the physical fiber optic cable transceivers on HA2.
Why wrong: HA2 transceivers sync HA states, not User-ID mappings.

Full breakdown with real-world context →

These SecOps-Architect practice questions are part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style SecOps-Architect questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related SecOps-Architect topic practice pages

Operationalizing Security Metrics practice questions

Secops Frameworks And Threat Response Architecture practice questions

Palo Alto Networks Product Integration And Architecture practice questions

SecOps-Architect fundamentals practice questions

SecOps-Architect scenario practice questions

SecOps-Architect troubleshooting practice questions

Practice scenarios

An architect is troubleshooting why security metric trends in Cortex XSIAM appear erratic and unreliable. Which THREE factors commonly cause metric distortion in a SOC? (Choose three)

An architect is troubleshooting a User-ID deployment where users authenticating via captive portal are not getting correctly mapped. Which TWO conditions must be verified to ensure captive portal functions properly? (Choose two)

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

An architect is troubleshooting a Cortex XDR deployment where agents on endpoints are failing to communicate with the Cortex XDR cloud tenant. Which outbound network connectivity requirement must be verified on the local corporate firewall?

An architect is troubleshooting a Palo Alto Networks High Availability (HA) cluster where configuration synchronization between active and passive peers is failing. Which TWO locations or settings should the architect check? (Choose two)

An architect is troubleshooting a Panorama deployment where managed firewalls show a 'Disconnected' status in the Panorama GUI. Which TWO connectivity requirements should the architect verify? (Choose two)

You are configuring log ingestion in Cortex XSIAM from a third-party firewall using a generic syslog collector. The logs are arriving, but the parser is failing to extract destination IP addresses correctly. What is the recommended troubleshooting step?

Which metric should a SOC manager review to determine whether alerts are being investigated in a timely manner after they are generated?

An architect is troubleshooting a User-ID agent deployment where group mapping information is not being retrieved from Microsoft Active Directory. Which permission or protocol requirement must be verified on the Active Directory domain controller for group mapping to succeed?

An architect is troubleshooting a User-ID deployment where IP-to-username mappings are missing for users on a specific subnet. Which TWO sources or tools can be checked to verify mapping status on the Palo Alto Networks firewall? (Choose two)