Certified Security Operations Architect (SecOps-Architect) SecOps-Architect Questions 301–306 | Page 5/5

301

Multi-Selecthard

An architect is integrating Prisma Cloud with a CI/CD pipeline (such as GitHub Actions or Jenkins) to perform Infrastructure as Code (IaC) scanning. Which TWO scanning targets or mechanisms are supported by Prisma Cloud for IaC security? (Choose two)

Select 2 answers

A.Scanning Terraform and AWS CloudFormation templates using the Prisma Cloud IaC CLI or GitHub Actions integration.

B.Scanning Kubernetes YAML manifests and Helm charts in git repositories for misconfigurations.

C.Sniffing active TCP packets traversing a Jenkins build server network switch interface.

D.Querying the Jenkins REST API using raw SNMPv1 strings.

E.Running a Prisma Cloud Defender daemonset inside a developer's local laptop BIOS.

AnswersA, B

Prisma Cloud's IaC scanning natively parses Terraform and AWS CloudFormation templates, detecting misconfigurations before deployment. The IaC CLI and GitHub Actions integration let architects embed this check directly into CI/CD pipelines, satisfying the shift-left requirement in the stem.

Why this answer

Option A is correct because Prisma Cloud's IaC scanning explicitly supports Terraform and AWS CloudFormation templates, and it can be invoked through the Prisma Cloud IaC CLI (twistcli / checkov-based scanning) or via native CI/CD integrations such as the GitHub Actions integration, making it a supported scanning target and mechanism for pipeline use. Option B is correct because Prisma Cloud also scans Kubernetes YAML manifests and Helm charts stored in git repositories to detect misconfigurations, which is a core IaC security capability for container-orchestration configuration. Option C is not correct because Prisma Cloud IaC scanning analyzes declarative infrastructure code, not live TCP packet sniffing on a network switch interface.

Option D is not correct because SNMPv1 is a network-management protocol and has nothing to do with querying the Jenkins REST API for IaC scanning. Option E is not correct because Prisma Cloud Defenders run as containers or hosts in cloud/Kubernetes environments, not inside a laptop BIOS, which is not a supported IaC scanning mechanism.

Full explanation →

302

MCQhard

Your organization has implemented a comprehensive metric reporting framework in Cortex XSIAM. However, analysts are complaining that leadership is weaponizing the 'Mean Time to Resolve' (MTTR) metric to rush investigations, leading to superficial incident closures and recurring security issues. As a SecOps Architect, how should you address this metric dysfunction?

A.Double the MTTR target time across all severity levels to give analysts more breathing room.

B.Abolish all metrics entirely and rely solely on subjective management intuition.

C.Pair MTTR with quality and accuracy metrics such as Incident Reopen Rate and False Negative Discovery Rate to balance speed with thoroughness.

D.Automate all incident closures so analysts no longer have to record resolution times.

AnswerC

Pairing MTTR with Incident Reopen Rate and False Negative Discovery Rate counteracts the rush to close tickets superficially, because those quality metrics expose incidents reopened or missed after closure, forcing balance between speed and thoroughness.

Why this answer

When MTTR is used in isolation, analysts may cut corners to lower their times. Best practice requires pairing speed metrics (MTTR) with quality metrics, such as Reopen Rate or Recurrence Rate, to ensure thoroughness.

Full explanation →

303

Multi-Selecthard

An architect is designing a Prisma Cloud Compute deployment to secure containerized workloads. Which TWO compliance and vulnerability assessment features are provided by Prisma Cloud Compute Defenders? (Choose two)

Select 2 answers

A.Writing custom assembly code for application microservices.

B.Evaluating container configurations and host OS settings against CIS (Center for Internet Security) benchmarks.

C.Analyzing physical power grid load tolerances in data center facilities.

D.Scanning container images and host operating systems for Common Vulnerabilities and Exposures (CVEs).

E.Acting as a Layer 7 DNS root server for enterprise domains.

AnswersB, D

Prisma Cloud Compute Defenders run host and container configuration checks against CIS benchmarks, satisfying the stem's compliance assessment requirement. This differs from image scanning, which targets package vulnerabilities rather than runtime host OS hardening settings. Defenders evaluate the deployed host directly, so CIS benchmark compliance is measured where workloads actually execute.

Why this answer

Option B is correct because Prisma Cloud Compute Defenders perform compliance checks by evaluating container configurations and host OS settings against CIS benchmarks, reporting pass/fail results for hardening requirements. Option D is correct because Defenders scan container images and host operating systems for known CVEs, providing vulnerability assessment across the deployment lifecycle. Option A is incorrect because writing custom assembly code for microservices is an application development task, not a Prisma Cloud Compute Defender capability.

Option C is incorrect because analyzing physical power grid load tolerances is a data center facilities concern unrelated to container security. Option E is incorrect because acting as a Layer 7 DNS root server is a network infrastructure role, not a function of Prisma Cloud Compute Defenders.

Full explanation →

304

MCQeasy

An architect is designing high availability for a Palo Alto Networks firewall deployment and wants to ensure that both firewalls can actively process traffic under normal operating conditions while backing each other up. Which HA mode supports this?

A.Panorama managed standalone mode

B.Standalone clustering with no HA links

C.High Availability Active/Passive mode

D.High Availability Active/Active mode

AnswerD

Active/Active HA lets both firewalls simultaneously process traffic while synchronising sessions, so each device backs up the other under normal conditions. This satisfies the requirement for concurrent traffic processing, unlike Active/Passive where the secondary stays idle until failover.

Why this answer

High Availability Active/Active mode allows both firewalls in the HA pair to simultaneously process traffic, providing load sharing and mutual backup. Each firewall actively handles sessions, and if one fails, the peer takes over the full load, satisfying the requirement for both to actively process traffic under normal conditions.

Exam trap

The trap is assuming Active/Active means automatic load balancing; candidates may also confuse Active/Passive (one active, one standby) with Active/Active (both active).

How to eliminate wrong answers

Option A is wrong because Panorama managed standalone mode is a management configuration, not an HA mode, and does not provide traffic processing redundancy. Option B is wrong because standalone clustering with no HA links provides no failover or state synchronization. Option C is wrong because Active/Passive mode means only one firewall actively processes traffic while the other remains on standby, which does not meet the requirement that both actively process traffic.

Full explanation →

305

MCQeasy

When designing a Security Operations Center (SOC) tiering model, what is the primary operational responsibility typically assigned to Tier 2 (Incident Responders)?

A.Developing custom machine learning detection models and threat hunting hypotheses

B.High-volume initial alert triage and closing false positives based on strict runbooks

C.In-depth forensic investigation, root cause analysis, and containment execution

D.Managing physical datacenter security and badge access

AnswerC

Tier 2 handles escalated incidents requiring deeper expertise: performing forensic investigation, determining root cause, and executing containment actions such as isolating hosts. This distinguishes it from Tier 1 triage and Tier 3 proactive hunting or engineering work.

Why this answer

Tier 2 (Incident Responders) in a SOC tiering model is responsible for in-depth forensic investigation, root cause analysis, and containment execution. Tier 1 handles initial triage and false positive closure, while Tier 3 focuses on threat hunting and advanced detection engineering. Tier 2 takes escalated incidents from Tier 1 and performs deeper analysis and response actions.

Exam trap

SecOps-Architect often tests the confusion between Tier 1 and Tier 2 responsibilities, tricking candidates into assigning initial triage or threat hunting to Tier 2.

How to eliminate wrong answers

Option A is wrong because developing custom machine learning detection models and threat hunting hypotheses is typically a Tier 3 (Threat Hunter / Detection Engineer) responsibility. Option B is wrong because high-volume initial alert triage and closing false positives based on strict runbooks is the primary responsibility of Tier 1 (Triage Analyst). Option D is wrong because managing physical datacenter security and badge access is a facilities/physical security function, not a SOC tier responsibility.

Full explanation →

306

Multi-Selectmedium

An architect is establishing baselines for Security Operations Center (SOC) performance metrics. Which THREE operational factors must be accounted for to ensure the baseline accurately reflects normal operating conditions? (Choose three)

Select 3 answers

A.Analyst shift schedules and staffing level variations

B.Office interior wall paint colors

C.Changes in enterprise asset inventory and attack surface scope

D.The brand of coffee consumed in the SOC breakroom

E.Seasonal business cycles and holiday operational slowdowns

AnswersA, C, E

Analyst availability directly determines how many alerts can be triaged per hour. Baselines must therefore model shift patterns, handover gaps, weekend coverage and headcount changes, otherwise normal staffing dips are misread as degraded SOC performance.

Why this answer

Option A is correct because SOC baselines must account for analyst shift schedules and staffing level variations, since detection, triage, and response throughput naturally dips during nights, weekends, and handoff periods, and ignoring these would skew metrics such as mean time to detect (MTTD) and mean time to respond (MTTR). Option C is correct because changes in enterprise asset inventory and attack surface scope directly alter alert volume and workload; onboarding new endpoints, cloud workloads, or external-facing services increases telemetry and incidents, so the baseline must be normalized to the monitored estate. Option E is correct because seasonal business cycles and holiday operational slowdowns change both attacker activity and internal user/change activity, producing predictable shifts in alert counts and response times that must be modeled rather than treated as anomalies.

Option B is not relevant because office interior wall paint colors have no measurable effect on SOC telemetry, alert generation, or analyst performance. Option D is not relevant because the brand of coffee in the breakroom is a morale or comfort factor, not an operational variable that influences security monitoring metrics.

Full explanation →

Certified Security Operations Architect (SecOps-Architect) (SecOps-Architect) — Questions 301–306