troubleshooting

An architect is planning the deployment of Cortex XDR agents across a heterogeneous enterprise environment. Which TWO deployment methods are officially supported? (Choose two)

An architect is deploying a Palo Alto Networks VM-Series firewall in a Microsoft Azure environment. The firewall must inspect traffic between two subnets in the same virtual network (VNet). The architect wants to ensure that the VM-Series can see and inspect all traffic, including traffic between VMs in different subnets, without modifying the VMs' default gateways. Which Azure networking feature should be used to redirect traffic to the VM-Series?

When designing a threat hunting methodology aligned with the MITRE ATT&CK framework, an architect wants to identify adversary persistence mechanisms. Which tactic category should the analyst focus queries on?

An architect is designing a Prisma Cloud Compute deployment for Kubernetes clusters deployed across multiple cloud providers. The architecture requires real-time runtime defense against container escapes and anomalous process execution. Which Prisma Cloud component must be deployed inside each Kubernetes cluster to achieve this?

An architect is integrating Prisma Access with a cloud-native SOAR platform. The SOAR needs to pull Prisma Access traffic, threat, and URL filtering telemetry on a recurring schedule, and the architect must choose the most reliable, supported collection method that avoids vendor lock-in to a specific SIEM. Which integration approach should the architect select?

An architect is configuring Panorama Template Stacks. Which TWO types of configuration settings are typically defined within Panorama Templates rather than Device Groups? (Choose two)

Which Cortex XSOAR feature should a Security Operations Architect use to automatically calculate, track, and display SLA compliance metrics for incoming security incidents?

An architect is defining Key Performance Indicators (KPIs) in Cortex XSIAM to measure the efficiency of Tier-1 analysts. Which built-in metric best evaluates the speed at which analysts initially acknowledge and begin investigating incoming alerts?

An architect is configuring High Availability (HA) Active/Passive on two PA-5220 firewalls. During a failover event, active TCP sessions are maintained without requiring re-authentication. Which feature makes this possible?

An architect is designing an incident response communications plan for a major data breach affecting regulated customer data. Which TWO stakeholder groups must typically be included in the formal communication escalation matrix during high-severity incidents? (Choose two)

An architect is deploying the Cortex XDR Broker VM to serve as a syslog collector for legacy network devices. The Broker VM loses connectivity to the Cortex XDR cloud. What happens to the collected syslog data during the outage?

An architect is troubleshooting why security metric trends in Cortex XSIAM appear erratic and unreliable. Which THREE factors commonly cause metric distortion in a SOC? (Choose three)

An architect is designing an integration between Prisma Cloud and AWS to perform Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) scanning. Which TWO AWS architectural permissions or resources must be established for complete CSPM and CWPP integration? (Choose two)

A SOC architect at a healthcare provider is mapping detection coverage to the MITRE ATT&CK framework using Cortex XSIAM. The CISO wants a heat map that shows which adversary techniques are covered by existing analytics and which are blind spots, using the native ATT&CK coverage view. Which prerequisite must the architect satisfy for techniques to be correctly attributed in that view?

An architect is configuring a Panorama Device Group and needs to create security rules that apply to all firewalls in the enterprise, regardless of their specific regional location. Where should the architect place these rules within the Panorama rule hierarchy?

An incident response team uses Cortex XSOAR playbooks for automated enrichment. Leadership wants to measure how much time automation saves per incident compared to manual lookup tasks. Which methodology should the architect use to calculate this metric?

When designing a threat hunting architecture, an architect must differentiate between indicator-based searching and hypothesis-driven hunting. Which approach represents a hypothesis-driven threat hunt?

An organization is integrating Cortex XSIAM with third-party security tools for automated remediation. Which THREE mechanisms are supported for triggering external actions from XSIAM/XSOAR? (Choose three)

An architect is designing an integration between Cortex XSOAR and a third-party ticketing system (e.g., ServiceNow). The requirement is to ensure that when an incident severity is updated in XSOAR, the ticket in ServiceNow is automatically updated. Which architectural feature facilitates this synchronization?

An architect is configuring High Availability (HA) on Palo Alto Networks firewalls. Which TWO failure conditions can trigger an automatic HA failover in an Active/Passive deployment? (Choose two)

An architect is designing an integrated security architecture combining Prisma Cloud and Palo Alto Networks NGFWs. Which TWO architectural capabilities does this integration provide? (Choose two)

An architect is configuring High Availability (HA) on a pair of Palo Alto Networks firewalls. Which TWO prerequisites must be met before enabling HA on the firewalls? (Choose two)

An architect is configuring a Palo Alto Networks firewall and wants to inspect unknown files submitted by users over HTTP/FTP/SMTP to determine if they contain zero-day malware. Which service should the architect configure?

An architect is integrating Cortex XSIAM with ServiceNow to automatically create IT service management (ITSM) tickets when incidents are promoted. Where is the field mapping between Cortex XSIAM incident fields and ServiceNow incident fields configured?

An architect is configuring Cortex XDR external integrations. Which TWO native log ingestion or threat intelligence integration options are supported by Cortex XDR? (Choose two)

An architect is configuring a Palo Alto Networks firewall and needs to ensure that DNS requests originating from internal clients to known malicious domains are automatically intercepted or blocked. Which security feature provides this capability?

Which metric category is primarily used to evaluate the financial and operational cost savings delivered by a security orchestration and automation (SOAR) implementation?

An architect is auditing security operations metrics and notices that the False Positive Rate (FPR) for endpoint detection alerts in Cortex XDR has steadily increased over the past two quarters. What is the most appropriate remediation strategy to address this trend?

When designing an incident post-mortem (lessons learned) process following NIST guidelines, which TWO activities should the security architect mandate? (Choose two)

Which metric should a SOC manager review to determine whether alerts are being investigated in a timely manner after they are generated?

A security operations architect is reviewing metrics for a Cortex XSIAM deployment. The SOC manager wants to understand the proportion of alerts that are escalated to incidents versus those that are closed as benign. Which metric should the architect recommend?

An architect is deploying a Palo Alto Networks VM-Series firewall in a Microsoft Azure environment to protect a multi-tier application. The application uses Azure Load Balancer to distribute traffic to web servers, and the firewall must inspect traffic between the load balancer and the web servers. The architect needs to ensure that the firewall can see the original client IP address for logging and policy enforcement. Which Azure feature should the architect configure to preserve the client IP?

A security operations architect is building a Cortex XSIAM dashboard to track the operational health of the automation layer. The SOC wants to know how often playbooks complete without manual intervention versus how often they fail or time out. Which metric should the architect implement to directly quantify the reliability of automated response execution?

A SOC manager wants to standardize how analysts document and share threat intelligence about a newly observed malware family. The architect recommends using the Structured Threat Information Expression (STIX) format. Which statement best describes the primary purpose of STIX in a security operations architecture?

A SecOps architect is establishing the incident response governance model for a new SOC. Leadership wants a framework that defines the full lifecycle from preparation through post-incident activity, with clear phases that map to measurable SOC processes and can be audited. Which framework should the architect adopt as the governing lifecycle?

An architect is troubleshooting a User-ID deployment where users authenticating via captive portal are not getting correctly mapped. Which TWO conditions must be verified to ensure captive portal functions properly? (Choose two)

What is the primary value of tracking 'False Positive Rate' (FPR) as an operational security metric in a SOC?

An architect is designing a metrics program for a Cortex XSIAM deployment. The CISO wants to understand the financial impact of security incidents by measuring the average cost incurred per incident, including analyst time, tool usage, and business disruption. Which approach should the architect take to operationalize this metric?

An architect is deploying Panorama and needs to manage firewalls deployed across different geographic regions with distinct administrative teams. Each team should only be able to view and manage their own local firewalls and policies, but global security rules must apply to all. Which Panorama structural feature should the architect implement?

An architect is designing a Cortex XSOAR playbook that needs to retrieve a list of all endpoints from Cortex XDR and then isolate any endpoint that has a specific tag. Which Cortex XDR integration command should the architect use to fetch the list of endpoints?

A SOC architect is designing a threat response architecture that must align with the MITRE ATT&CK framework and support automated containment. The organization wants to ensure that detection, enrichment, and response actions are consistently mapped to adversary tactics and techniques. Which TWO design practices should the architect implement to achieve this alignment? (Choose two.)

A security architect is designing a metrics program for a Cortex XSIAM deployment. The SOC wants to measure the effectiveness of its incident response process by tracking the percentage of incidents that are resolved within the defined Service Level Agreement (SLA) targets. Which metric should the architect implement?

An architect is configuring Palo Alto Networks firewall security policies using WildCard masks and Address Objects. Which TWO best practices should be followed when designing address objects and security rules? (Choose two)

A security operations architect is defining a metrics framework in Cortex XSIAM to evaluate the effectiveness of automated playbook execution. The architect wants to measure both the reliability and the operational impact of automation. Which TWO metrics should be included in the framework to achieve this? (Choose two.)

An architect is designing a high availability deployment for Palo Alto Networks firewalls. What is the primary purpose of the HA1 link?

A security architect needs to create a custom dashboard widget in Cortex XSOAR to track the average duration of phishing incident investigations over the last quarter. Which widget type should the architect select to display this time-series metric trend over a date range?

An architect is designing an enterprise threat hunting program utilizing Cortex XSIAM. They want to create a custom analytics rule that triggers when a specific sequence of three distinct event types occurs within a 10-minute window on the same endpoint. Which feature should be used?

A SOC manager wants to track the team's efficiency in resolving incidents. The manager asks the architect to define a metric that measures the average time from incident creation to incident closure in Cortex XSIAM. Which metric should the architect implement?

An architect is troubleshooting an issue where Palo Alto Networks VM-Series firewalls deployed in AWS are experiencing asymmetric routing issues across multiple network interfaces. Which AWS networking construct must be correctly configured to ensure traffic enters and exits through the correct firewall data interface?

An architect is designing a Prisma SD-WAN deployment integrated with Palo Alto Networks Prisma Access for branch internet and SaaS traffic. Branch sites use Prisma SD-WAN ION devices, and the security team wants all internet-bound traffic from branches to be inspected by Prisma Access while keeping SaaS traffic on a direct optimized path. Which Palo Alto Networks capability should the architect use to steer only the appropriate traffic to Prisma Access?

An architect is designing a security operations architecture where a Palo Alto Networks NGFW must forward all traffic logs and threat logs to an external syslog server at 10.10.20.5 using TCP port 514. The firewall is managed by Panorama. The architect needs to ensure that logs are sent in a structured format that includes all fields. Which configuration should the architect use?

A security operations architect is designing a threat intelligence program that follows the intelligence cycle. The architect must ensure that the program effectively supports decision-making for the SOC team. Which phase of the intelligence cycle involves defining the intelligence requirements and planning the collection of data to meet those requirements?

An architect must present a monthly operational review showing whether the SOC's incident response process is becoming more efficient over time. The team wants a single trend metric that normalizes for changes in incident volume, so that a busy month does not automatically look worse than a quiet one. Which metric best meets this need?

An architect is configuring a Palo Alto Networks firewall to decrypt inbound SSL/TLS traffic destined for an internal web server. Which certificate configuration is required on the firewall to perform Inbound Inspection?

A security operations team is implementing metrics to measure the performance of its Cortex XSOAR automation. The team wants to track the time saved by automation compared to manual execution. Which metric should they use to quantify the efficiency gain from automation?

A SecOps architect is mapping the SOC's detection coverage to the MITRE ATT&CK Enterprise matrix. The CISO wants a defensible way to show which adversary techniques the SOC can currently detect, which it can only partially detect, and which are entirely uncovered, so remediation can be prioritized. Which approach best satisfies this requirement?

A SecOps architect for a managed security service provider (MSSP) needs to report on the efficiency of automated playbooks in Cortex XSOAR. The MSSP wants to know how much manual analyst effort is being saved by automation. Which metric best represents the percentage of tasks within a playbook that were executed automatically without human intervention?

An architect is tasked with reporting the True Positive Rate (TPR) of automated alert rules in Cortex XSIAM to justify tuning efforts. How should TPR be calculated using SOC operational data?

A security architect is mapping the SOC's detection and response capabilities to the MITRE ATT&CK framework. The CISO wants to know which adversary tactic is most directly addressed by correlating endpoint process creation events with network connection events in Cortex XDR. Which ATT&CK tactic does this correlation primarily support?

An architect is designing a threat response workflow that must enrich indicators with multiple external intelligence sources before creating a case. The design uses Cortex XSOAR playbooks. Which approach best ensures the workflow continues even when one intelligence source is temporarily unavailable?

A multinational SOC architect is building a threat response architecture that must correlate adversary behavior across endpoint, network, and cloud telemetry. The CISO wants detections expressed in a vendor-neutral format that can be shared with an external ISAC and mapped to a common adversary taxonomy. Which framework combination should the architect adopt to satisfy both the sharing and mapping requirements?

An architect is configuring a Palo Alto Networks firewall and wants to control application traffic (such as allowing Skype business calls while blocking Skype file transfers). Which security policy match enables this granularity?

An architect is configuring High Availability (HA) on two Palo Alto Networks firewalls. What happens to active sessions on the primary firewall if it experiences a power failure, assuming HA is configured in Active/Passive mode?

When designing a Security Operations Center (SOC) using the NIST cybersecurity framework, which TWO functions are categorized under the 'Detect' core function? (Choose two)

A SecOps architect at a financial services company needs to demonstrate the operational value of their Cortex XSIAM deployment to the executive committee. They want a metric that quantifies the proportion of security incidents that were resolved by automated playbooks without any human analyst intervention. Which Cortex XSIAM metric should they present?

An architect is designing a secure CI/CD pipeline integration using Prisma Cloud to scan container images before they are pushed to a container registry (such as AWS ECR or Docker Hub). Which TWO mechanisms can be utilized for this pre-deployment image scanning? (Choose two)

An architect is designing an executive security operations dashboard using Cortex XSIAM to report on security posture trends. Which TWO metrics are essential to include when demonstrating operational scalability and capacity management to senior leadership? (Choose two)

Which role in a well-structured Security Operations Center (SOC) is primarily responsible for performing tier-2 incident triage, deep investigation, and playbook execution?

Which tool within Cortex XSIAM allows an architect to build customized graphical widgets and dashboards for tracking operational metrics?

An architect is designing an incident response lifecycle based on the NIST SP 800-61 framework for a Security Operations Center (SOC). Which phase immediately follows the Containment, Eradication, and Recovery phase?

A newly formed SOC uses Cortex XSIAM and wants a single headline metric that tells leadership whether the team is keeping pace with incoming incidents, independent of how severe those incidents are. Which metric best fits that purpose?

An architect is deploying Cortex XDR Broker VMs in a DMZ architecture. Which TWO network requirements must be satisfied for successful operation? (Choose two)

An architect is designing an integration between Cortex XDR and an existing third-party SIEM. The requirement is to forward all raw and enriched Cortex XDR incidents and alerts in real time. Which architectural mechanism should be configured within Cortex XDR?

An architect is configuring User-ID mapping on a Palo Alto Networks firewall. Which TWO methods can be used to map IP addresses to usernames in environments where Active Directory is not present? (Choose two)

An architect is configuring Panorama to collect logs from 200 managed firewalls. The log volume exceeds the storage capacity of a single Panorama virtual appliance. Which architectural design should the architect implement to scale log collection?

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for spyware callback communications to command-and-control servers. Which security profile should be configured?

An architect is configuring Indicator Sharing in Cortex XSOAR using the Threat Intel Management module. How are incoming STIX/TAXII indicator feeds prioritized when conflicting reputation scores are received from multiple sources?

You are configuring Cortex XSOAR integration instances and need to ensure that API keys and passwords are stored securely without appearing in plaintext within playbook logs or incident data. Where should these credentials be stored?

An architect is setting up continuous monitoring of SOC performance metrics in Cortex XSIAM. They want to ensure that incident backlog growth is detected before it impacts analyst morale and SLA compliance. Which derived metric should be established?

An enterprise security architect is designing an automated threat response architecture using Cortex XSOAR. The design requires parsing unstructured phishing emails received in a dedicated mailbox. Which XSOAR capability should be leveraged to automatically extract indicators such as URLs, file hashes, and sender domains from the email body?

An organization utilizing Prisma Cloud calculates Mean Time to Remediate (MTTR) for cloud misconfigurations. The SecOps team notices that the baseline MTTR is heavily skewed by a small number of lingering legacy assets. Which statistical approach should the architect recommend to executive management to provide a more accurate representation of typical remediation performance?

An architect is defining a Service Level Objective (SLO) for critical-severity incidents in Cortex XSIAM. Leadership wants a metric that measures how consistently the SOC meets its committed response deadline, expressed as a percentage of incidents handled within the target time. Which metric should the architect select?

A security operations architect is formalizing how the SOC will apply the MITRE ATT&CK framework during live incident response rather than only during retrospective reporting. Which TWO practices correctly embed ATT&CK into the active response workflow? (Choose two.)

An architect is designing a security operations architecture that integrates Palo Alto Networks Cortex XDR with a SIEM. The SIEM will ingest Cortex XDR alerts and telemetry for correlation with other data sources. The architect must ensure that the integration supports bi-directional communication so that SIEM analysts can trigger response actions in Cortex XDR. Which TWO integration methods should the architect use to achieve this? (Choose two.)

An architect is troubleshooting a Panorama deployment where managed firewalls show a 'Disconnected' status in the Panorama GUI. Which TWO connectivity requirements should the architect verify? (Choose two)

An architect is designing a Prisma Access deployment with GlobalProtect for remote users. The security team requires that all traffic from remote users, including traffic destined to the internet, be inspected by Prisma Access security services, and that user identity be consistently applied across all security policies. Which GlobalProtect configuration is required to meet these requirements?

An architect is configuring Panorama to manage software and content updates across an enterprise fleet of firewalls. To prevent untested dynamic updates (such as Antivirus and WildFire signatures) from breaking production traffic, what is the best practice deployment design in Panorama?

An architect is evaluating the effectiveness of alert tuning in Cortex XSIAM. Over three months, the total alert volume decreased by 40%, but the number of confirmed breaches detected remained constant. Which metric combination best validates that this tuning was successful and did not introduce blind spots?

Your organization uses Cortex XSOAR to manage incident response. Management wants to ensure that high-priority incidents do not breach internal SLAs. Where should an architect configure notifications or escalations when an incident approaches its SLA threshold?

You are presenting security metrics to executive management using Cortex XSIAM dashboards. Leadership expresses concern over an apparent increase in malware detection events month-over-month. As a SecOps Architect, how should you contextualize this trend?

An architect is configuring a Palo Alto Networks firewall and wants to inspect compressed or archived files (such as .zip or .tar files) for embedded malware. Which security profile feature enables this inspection?

A security operations architect is tasked with reporting on the overall health of the SOC's detection capabilities in Cortex XSIAM. The CISO wants a metric that shows the proportion of alerts that are determined to be true positives after investigation. Which metric should the architect use?

A security operations architect is designing a metrics framework in Cortex XSIAM to report on the effectiveness of automated playbook execution. The team wants to measure the percentage of playbook runs that completed successfully without manual intervention. Which metric should be used?

An architect is designing a Palo Alto Networks firewall deployment and wants to ensure that security policies are enforced based on applications rather than port numbers. Which core Palo Alto Networks technology achieves this?

Your security leadership requests a monthly report showing the percentage of security alerts that are automatically remediated by Cortex XSOAR playbooks versus those requiring manual intervention. What is this metric commonly called?

An architect is reviewing Cortex XSIAM dashboards designed to monitor threat detection coverage against the MITRE ATT&CK framework. Which THREE components are critical to measure accurately for this coverage analysis? (Choose three)

A SOC architect is designing a metrics program in Cortex XSIAM to demonstrate continuous improvement in detection engineering. Leadership wants evidence that newly deployed detection rules are effective and that tuning reduces wasted analyst effort. Which TWO metrics should the architect include to best support this goal? (Choose two.)

You need to establish a baseline for normal network traffic and security events across multiple disparate log sources in Cortex XSIAM. What feature should you leverage to aggregate and normalize this data for consistent metric reporting?

When planning an incident response table-top exercise for a Security Operations team, which framework provides a standardized taxonomy for describing adversary behaviors and tactics?

A security operations architect must present a monthly report to executive leadership showing whether the SOC is responding to incidents faster than the previous quarter. Which metric most directly communicates improvement in response speed over time?

An architect is defining a 'detection efficacy' metric for Cortex XSIAM that must not be gamed by simply creating more detection rules. The team wants to know whether the rules already deployed are finding real threats. Which definition best resists that gaming?

An architect is establishing security metrics for a multi-tenant Cortex XSIAM environment. Different business units require distinct SLA targets and independent metric baselines. How should the architect configure this separation?

An architect is configuring Panorama to manage software and content updates across managed firewalls. Which TWO update deployment workflows are supported by Panorama? (Choose two)

An architect is defining a set of metrics in Cortex XSIAM to evaluate the performance of the security operations center (SOC) in terms of incident containment and response efficiency. The SOC manager wants to track how quickly incidents are contained after detection and how efficiently analysts handle incidents. Which TWO metrics should be included? (Choose two.)

An architect is configuring a Palo Alto Networks firewall and wants to inspect encrypted TLS traffic passing through the firewall without terminating the SSL session on the firewall itself (e.g., to identify malicious JA3 signatures or SNI without decryption). Which feature should the architect configure?

An architect is designing a Panorama-managed deployment where firewall logs must be forwarded to a Cortex Data Lake tenant for centralized retention and analytics. Which TWO configuration elements are required to make Panorama forward firewall logs to Cortex Data Lake? (Choose two.)

When designing a comprehensive security metrics dashboard in Cortex XSIAM for C-level executives, which THREE categories of metrics should be included to provide a balanced view of security posture? (Choose three)

An architect is defining severity scoring for a SOC that consumes vulnerability data from multiple scanners. Leadership wants scores that reflect exploitability in the wild rather than only theoretical severity. Which framework should the architect adopt as the primary prioritization input for this requirement?

An enterprise security architect is configuring automated threat intelligence sharing between Cortex XSOAR and external ISACs using STIX/TAXII. Which component within Cortex XSOAR is primarily responsible for managing incoming threat indicators, deduplication, and indicator scoring?

An architect is deploying Palo Alto Networks Prisma Access to secure remote users. The organization requires that all traffic from remote users, including internet-bound traffic, be inspected by Prisma Access security services. Which Prisma Access component should the architect configure to meet this requirement?

A security architect is designing a detection and response strategy using Cortex XSIAM. The architect needs to ensure that the platform can automatically correlate alerts from multiple sources and prioritize them based on severity. Which Cortex XSIAM capability should the architect leverage to achieve this?

An architect is designing a Panorama deployment to manage 100 firewalls. To ensure high availability and redundancy for Panorama itself, which deployment architecture should the architect recommend?

An architect is establishing a metrics program in Cortex XSIAM to measure the efficiency of threat hunting. The team wants to quantify how many hunts resulted in the identification of a new threat that was not previously detected by automated systems. Which metric is most appropriate?

During a major security incident, a SOC architect needs to ensure that all evidence collected adheres to chain of custody principles. Which foundational security concept is primarily being enforced?

A SOC architect is designing the containment strategy for ransomware incidents detected by Cortex XSIAM. The requirement is to stop lateral spread immediately while preserving volatile evidence such as running processes and network connections on the encrypted host. Which containment action sequence best meets both goals?

A security architect is defining the containment strategy for ransomware incidents detected by Cortex XDR. The organization operates a hybrid environment with endpoints, on-premises servers, and cloud workloads. Leadership wants assurance that containment actions are applied consistently and can be reversed after eradication. Which design principle should the architect prioritize?

An architect is designing a Zero Trust Network Access (ZTNA) incident response strategy using Prisma Access. When a compromised user device is detected, which action should the automated response workflow trigger to prevent lateral movement?

You are configuring scheduled metric reports to be emailed weekly to department heads using Cortex XSIAM. Which mechanism should you use to automate the generation and delivery of these reports?

A SecOps architect must design a 'false positive reduction' report in Cortex XSIAM that leadership will use to justify tuning investment. The report must show whether tuning is genuinely reducing analyst noise rather than just shifting it. Which TWO metric definitions should the architect include? (Choose two.)

An architect is designing an automated containment workflow in Cortex XSOAR. The requirement is to isolate a compromised endpoint running Cortex XDR agent without disrupting critical domain controllers. Which configuration parameter must be validated in the isolation command?

Which TWO metrics are commonly used to measure the impact and ROI of a Cortex XSOAR implementation in a SOC? (Choose two)

An architect is integrating Cortex XDR with a Palo Alto Networks next-generation firewall so that firewall logs are correlated with endpoint telemetry for investigation. The security team wants Cortex XDR to receive firewall traffic, threat, and URL filtering logs with the least administrative overhead. Which integration approach should the architect recommend?

An architect is designing an enterprise incident response communication plan. Which THREE components are critical for effective operational coordination during a major security incident? (Choose three)

An architect is integrating Palo Alto Networks NGFW with AWS VPC environments using the VM-Series auto-scaling template. When a new VM-Series instance spins up dynamically via AWS Auto Scaling, how does the new firewall register and receive its initial configuration without manual administrative intervention?

What is the primary benefit of tracking Mean Time to Detect (MTTD) in a Security Operations Center?

An architect is designing a secure cloud network architecture using Prisma Access. Which TWO deployment models or components are available in Prisma Access to connect corporate data centers and branch offices? (Choose two)

An architect is designing an enterprise deployment of Palo Alto Networks firewalls managed by Panorama. A requirement is that certain firewall configuration changes (such as local interface IP addresses) must remain unique per firewall while security rules remain centrally managed. Which Panorama feature should the architect use?

An enterprise security architect is reviewing threat detection coverage using the MITRE ATT&CK Navigator. Which THREE strategic objectives can be achieved using this exercise? (Choose three)

An architect is designing a Palo Alto Networks High Availability (HA) deployment. Which TWO statements are correct regarding HA state synchronization and failover behavior? (Choose two)

An architect is designing an automated incident response architecture integrating Palo Alto Networks NGFW, Cortex XDR, and Cortex XSOAR. Which TWO architectural principles ensure an effective automated security ecosystem? (Choose two)

An architect is designing log forwarding from a Prisma Access tenant to an on-premises syslog collector that requires mutual TLS and cannot accept the default certificate. The collector's private CA is not trusted by the Prisma Access infrastructure. What is the correct approach?

You are configuring log ingestion in Cortex XSIAM from a third-party firewall using a generic syslog collector. The logs are arriving, but the parser is failing to extract destination IP addresses correctly. What is the recommended troubleshooting step?

An architect is designing an automated threat intelligence enrichment pipeline in Cortex XSOAR. Which THREE actions are typically performed during indicator lifecycle management? (Choose three)

A security architect is designing a threat response architecture using the MITRE ATT&CK framework. The SOC wants to prioritize detection engineering efforts based on the most relevant adversary techniques for their industry. The architect must ensure that the framework is used effectively to map existing detections and identify gaps. Which approach best aligns with the MITRE ATT&CK framework for this purpose?

An enterprise is designing a zero-trust architecture where Cortex XDR integrates with Palo Alto Networks Next-Generation Firewalls. Which protocol and component facilitate real-time dynamic blocklisting of compromised endpoints across both the firewall and the endpoint?

A security architect is designing the threat intelligence ingestion pipeline for a Cortex XSOAR deployment. The organization wants to automatically block IP addresses that appear in high-confidence threat feeds, but the SOC team is concerned about false positives disrupting business-critical applications. Which capability of Cortex XSOAR should the architect configure to safely automate this response while maintaining an audit trail?

An enterprise is establishing a metrics governance framework for Cortex XSOAR automation. Which THREE criteria should be used to determine if a security workflow is a good candidate for automation? (Choose three)

A security operations architect is designing a SOC that follows the NIST Cybersecurity Framework. The architect needs to ensure that the SOC can effectively respond to incidents. According to the NIST Cybersecurity Framework, which function encompasses the activities to take action regarding a detected cybersecurity incident?

An architect is building an executive-facing metrics dashboard in Cortex XSIAM. The CISO wants a single trend line that shows whether the SOC's overall detection and response capability is improving quarter over quarter, without exposing raw incident counts. Which metric design best meets this requirement?

An architect is configuring a Palo Alto Networks firewall and wants to block traffic based on geographic location (e.g., blocking traffic originating from specific countries). Which feature enables this?

Which TWO metrics are essential when evaluating the effectiveness of a Security Operations Center's (SOC) detection engineering process? (Choose two)

When designing an operational dashboard in Cortex XSIAM to monitor SOC analyst workload distribution, which metric is most useful?

A multinational SOC architect is designing a metrics framework for the incident response program. Leadership wants a measure that reflects how long it takes from the moment a security event is detected to the moment the incident is fully contained. Which metric should the architect define?

Your organization is undergoing an external ISO 27001 audit. The auditors request empirical proof of continuous monitoring effectiveness and incident response responsiveness over the past 12 months. Which Cortex XSIAM / XSOAR artifacts should you present to satisfy this requirement?

An enterprise security architect is integrating Cortex XSIAM with an external SIEM using the Syslog Export feature. The security team notices that certain sensitive fields need to be redacted before export. Where should the architect configure this transformation?

An architect is designing an integration between Prisma Access and a third-party SIEM to ingest all security telemetry, traffic logs, and threat logs. Which TWO methods are officially supported for exporting logs from Prisma Access to external SIEMs? (Choose two)

When configuring Cortex XSOAR incident classification and mapping, which TWO elements must be defined for an incoming alert type? (Choose two)

When reporting on SOC operational efficiency using Cortex XSOAR and XSIAM, which TWO metrics measure analyst productivity and throughput? (Choose two)

An architect is designing a Palo Alto Networks SSL Decryption architecture. Which TWO best practices should be implemented to minimize user friction and protect user privacy (e.g., healthcare or financial sites)? (Choose two)

A security architect is establishing an operational metrics dashboard for executive leadership. Which metric best demonstrates the risk reduction impact of automated security orchestration and response (SOAR) playbooks?

An architect is designing a Panorama deployment to manage multiple Palo Alto Networks firewalls. The architect wants to ensure that firewall administrators can only push configurations to firewalls within their assigned region. Which Panorama feature should be used to achieve this role-based access control?

A SOC architect is designing a threat response architecture that uses Cortex XSIAM to automate response actions across endpoint, network, and cloud domains. The CISO requires that automated actions be auditable and reversible where possible. Which TWO design elements are essential to meet these requirements? (Choose two.)

An architect is configuring Cortex XSOAR incident automation. Which TWO core components are fundamental to building an effective XSOAR playbook? (Choose two)

An architect is designing a Palo Alto Networks Prisma Access deployment for a large enterprise with multiple branch offices. The architect must ensure that traffic from branch offices to the internet is inspected by Prisma Access while traffic to private data centers uses a dedicated IPSec tunnel to a VM-Series firewall in the data center. The architect needs to configure the Prisma Access remote network to support this split-tunnel behavior. Which Prisma Access component should the architect configure to achieve this?

An architect is configuring User-ID mapping via GlobalProtect. When remote users connect via GlobalProtect, how does the firewall learn the user-to-IP mapping without querying Active Directory domain controllers directly?

An architect is designing a Prisma Access deployment with multiple Remote Networks. Which TWO routing mechanisms are supported for connecting customer premises equipment (CPE) to Prisma Access Node locations? (Choose two)

An architect is designing a high-availability Cortex XDR deployment. Which TWO architectural elements are critical for ensuring reliable agent telemetry delivery and management? (Choose two)

An architect is integrating Palo Alto Networks Prisma Access with an on-premises data center. The data center hosts critical applications that must be accessed by mobile users through Prisma Access. The architect needs to ensure that traffic from mobile users to the data center is inspected by security policies and that the data center's internal IP addresses are not exposed to the internet. Which Prisma Access component should be used?

An architect is configuring automated metric collection in Cortex XSOAR using incident tags and custom fields to measure playbook automation efficiency. Which metric calculation accurately isolates the value added by automation versus manual analyst intervention?

A multinational corporation is architecting a Security Operations Center (SOC) using the MITRE ATT&CK framework to prioritize detection engineering efforts. The SOC has limited resources and wants to focus on techniques that are most relevant to its industry and threat landscape. The architect must recommend a systematic approach to map existing detection rules to ATT&CK techniques and identify gaps. Which activity best accomplishes this?

An architect is troubleshooting a User-ID deployment where IP-to-username mappings are missing for users on a specific subnet. Which TWO sources or tools can be checked to verify mapping status on the Palo Alto Networks firewall? (Choose two)

An architect is configuring Palo Alto Networks firewall logging. By default, when are traffic logs generated for allowed sessions?

An architect is designing an enterprise deployment of Prisma Access and needs to ensure that mobile users authenticate against an external SAML 2.0 Identity Provider before establishing a GlobalProtect connection. Where should the SAML Authentication profile be configured in Panorama?

A security architect is designing a threat response playbook in Cortex XSOAR for a large enterprise. To ensure that the playbook can automatically contain threats across the entire environment, the architect needs to integrate with the endpoint protection platform. Which integration should the architect configure to enable automated endpoint isolation and remediation actions?

A SecOps architect is rolling out a new 'automation coverage' KPI in Cortex XSOAR. The KPI must measure the proportion of incidents that were resolved without any manual analyst task, so leadership can track how much repetitive triage work automation has absorbed. Which definition should the architect implement?

Which framework is widely recognized as a comprehensive guideline for establishing a foundational cybersecurity program through five core functions: Identify, Protect, Detect, Respond, and Recover?

When aligning a security operations center (SOC) with the NIST Incident Response lifecycle, which phase immediately follows 'Containment, Eradication, and Recovery'?

An architect is configuring Panorama to push configuration updates to managed firewalls using Panorama Templates and Template Stacks. A specific setting needs to be overridden at an individual firewall level without altering the template stack hierarchy. Which Panorama feature enables this capability?

An architect is configuring User-ID mapping using the Palo Alto Networks Windows-based User-ID Agent. To ensure high availability and prevent single points of failure, how should multiple User-ID agents be configured in Panorama or the firewall?

A SOC architect is designing the escalation architecture for a multinational SOC that operates follow-the-sun. Analysts in one region must hand incidents to the next region without losing context, and leadership wants assurance that high-severity incidents always reach the on-call responder regardless of time zone. Which design element is most critical to meet these requirements?

An architect is designing an integration where Cortex XDR alerts must trigger automated response actions in Cortex XSOAR, and the SOC team requires that a single XSOAR incident be created for multiple related XDR alerts that share the same host and causality chain. Which Cortex XDR feature should the architect leverage to group alerts into one incident?

A security architect is designing a ransomware containment playbook in Cortex XSOAR. The playbook must automatically isolate an infected endpoint, extract its forensic artifacts, and then restore it to the production network only after a senior analyst approves. Which Cortex XSOAR task type best enforces the manual approval step before the restoration task executes?

A security architect is designing a threat response architecture that integrates the Diamond Model of Intrusion Analysis. The SOC wants to use the model to enrich its incident analysis and improve threat intelligence correlation. Which two of the following are core features of the Diamond Model that the architect should incorporate? (Choose two.)

An architect is designing a multi-tenant Prisma Access architecture. Different business units require separate address spaces, security policies, and administrative boundaries. Which Prisma Access feature enables this logical separation?

A SecOps architect is designing an automated containment workflow in Cortex XSOAR that must isolate a compromised endpoint, block the attacker's IP at the perimeter firewall, and open a ticket in the ITSM system. The containment playbook must execute these actions in parallel with a strict 15-minute SLA, and each action must produce an independent audit trail for post-incident review. Which Cortex XSOAR feature should the architect use to meet these requirements?

An architect is configuring User-ID to map users via Palo Alto Networks Terminal Services (TS) Agent. Where must the TS Agent be installed in the network architecture?

When designing an automated metric reporting pipeline from Cortex XSIAM to an external SIEM or data warehouse using APIs, which THREE architectural considerations must be addressed? (Choose three)

A SOC architect is designing the incident response workflow for a Cortex XSOAR deployment and must define how incidents move between tiers. The organization wants to ensure that low-severity phishing alerts are handled consistently without consuming senior analyst time, while high-severity malware detections receive immediate expert attention. Which design element should the architect implement to achieve this?

A multinational SOC architect is mapping detection coverage to the MITRE ATT&CK framework for a Cortex XSIAM deployment. Executive leadership wants to know which adversary techniques currently have no detection logic. Which approach should the architect take to produce this gap analysis?

An architect is designing a Prisma Access deployment for a large enterprise with multiple branch offices. The architect needs to ensure that traffic from branch offices to the internet is inspected by Prisma Access while traffic to internal applications is routed directly over the corporate WAN. Which Prisma Access component should be used to achieve this?

An architect is designing an enterprise incident response workflow in Cortex XSOAR. When a phishing email is reported, the playbook needs to parse the email headers, extract attachments, submit them to WildFire, and notify the security team via Slack. Which component in Cortex XSOAR is responsible for receiving the incoming phishing email and triggering the playbook?

An architect is designing a Prisma Cloud Compute deployment for cloud-native applications. Which TWO security scanning and monitoring capabilities are provided by Prisma Cloud Compute? (Choose two)

An architect is designing a Prisma Cloud Compute deployment for Kubernetes clusters. Which TWO architectural components must be considered when planning Defender deployments for security monitoring? (Choose two)

A security operations architect is designing a threat response architecture that integrates Cortex XSOAR with various security tools. The architect must ensure that the playbooks can automatically gather enriched context from external sources and make informed decisions. Which TWO components are essential for enabling automated enrichment and decision-making in Cortex XSOAR playbooks? (Choose two.)

An architect is building a threat-response playbook that must enrich indicators of compromise before containment decisions. The team wants to apply the Structured Threat Information Expression (STIX) 2.1 object model when exchanging indicators with partner SOCs. Which statement correctly describes how STIX 2.1 represents a malicious file hash shared between organizations?

Which TWO practices ensure that security metric reports generated from Cortex XSIAM remain meaningful and actionable over time? (Choose two)

An enterprise security architect is configuring Cortex XSIAM data ingestion and analytics. Which THREE data sources are essential for comprehensive endpoint and cloud threat detection? (Choose three)

A security architect is designing a threat intelligence ingestion pipeline for a Cortex XSOAR deployment. The SOC receives feeds from multiple providers, but analysts complain about duplicate indicators and conflicting verdicts. The architect needs to ensure that indicators are automatically deduplicated, scored, and enriched before being used in playbooks. Which Cortex XSOAR feature should be implemented to achieve this?

A multinational SOC architect is designing a threat response architecture based on the MITRE ATT&CK framework. The CISO wants assurance that the architecture can detect and respond to adversary techniques across all stages of an intrusion. The architect must select a primary capability that maps detections and response actions to ATT&CK techniques. Which component best fulfills this requirement?

A security operations architect is defining metrics to evaluate the effectiveness of the incident response process in Cortex XSIAM. The SOC manager wants to understand how often incidents are reopened after being marked resolved, as this indicates potential gaps in resolution quality. Which metric should the architect track?

An architect is designing a metrics dashboard in Cortex XSIAM to monitor the health of the SOC's detection and response capabilities. The dashboard should include metrics that indicate the SOC's ability to detect and respond to threats in a timely manner. Which TWO metrics are most appropriate to include? (Choose two.)

A SecOps architect is building a dashboard in Cortex XSIAM to monitor the health of the incident response process. They want to include metrics that together provide a balanced view of both efficiency and effectiveness. Which two metrics should they include? (Choose two.)

An architect is designing an automated threat containment architecture using Cortex XSOAR and Prisma Cloud. When Prisma Cloud detects a critical misconfiguration or malware in a running container workload, it triggers a webhook to Cortex XSOAR. What mechanism does XSOAR use to parse the webhook payload and initiate the incident response playbook?

An organization wants to define a Key Performance Indicator (KPI) in Cortex XSOAR that measures the average time taken by an analyst to acknowledge an incoming high-severity incident. Which metric category best captures this measurement?

An architect is designing a zero-trust network architecture using Prisma Access and Cortex XDR. Which TWO architectural integrations between Prisma Access and Cortex XDR enhance end-to-end visibility and threat detection? (Choose two)

An architect is tasked with creating a comprehensive reporting framework in Cortex XSOAR to measure incident response maturity. Which TWO advanced metrics should be incorporated to evaluate the depth and effectiveness of post-incident analysis and containment? (Choose two)

A security operations architect is reviewing the SOC's metrics dashboard in Cortex XSIAM and notices that the 'Automation Coverage' metric shows 92%, yet analysts report that many high-severity incidents still require extensive manual work. The architect suspects the metric is misleading. Which underlying measurement flaw is most likely causing this discrepancy?

A security architect is defining the incident response lifecycle for a new SOC. The organization wants to align with the NIST SP 800-61 framework. The architect must ensure that the SOC follows the correct sequence of phases. Which of the following represents the correct order of the incident response lifecycle phases according to NIST SP 800-61?

An architect is designing an incident response automation strategy in Cortex XSOAR. Which TWO best practices should be followed when developing custom playbooks? (Choose two)

A SecOps architect is asked to prove that the SOC's automated response playbooks are reducing manual workload. The team already tracks the count of playbook executions, but leadership says that number alone does not demonstrate labor savings. Which metric should the architect present as the primary evidence of reduced manual effort?

An architect is designing a multi-tenant environment where each tenant has its own Prisma Access tenant and needs to enforce consistent security policies across all tenants. The architect wants to centrally manage policies and push them to all tenants. Which Palo Alto Networks solution should be used?

An organization is defining metrics to measure the efficacy of its threat hunting program inside Cortex XSIAM. Which metric provides the strongest indicator of a mature and successful proactive hunting capability?

An enterprise architect is planning a Zero Trust Network Access (ZTNA) migration using Prisma Access. The design must ensure that users are continuously authenticated and authorized before accessing internal applications, regardless of their location. Which component validates user posture and device compliance before granting access?

An architect is integrating Cortex XDR with a third-party threat intelligence platform to automatically block indicators of compromise (IOCs) on Palo Alto Networks firewalls. The architect wants to ensure that when a new IOC is added to the threat intelligence platform, it is automatically pushed to the firewalls and enforced. Which integration method should be used?

An architect is integrating a Palo Alto Networks next-generation firewall with an external threat intelligence platform using the MineMeld-style output. The platform publishes indicators over HTTPS as a plain-text list, one indicator per line. The architect wants the firewall to consume the list and enforce it in security policy without manual updates. Which configuration should the architect use?

An architect is designing a multi-tenant cloud security architecture using Prisma Cloud. The security team needs to ensure that developers receive security alerts directly inside their collaboration tools (such as Slack or Microsoft Webex) the moment a misconfiguration is detected in infrastructure-as-code or runtime. Which Prisma Cloud feature must the architect configure?

An architect is designing an enterprise incident response workflow using Cortex XSOAR. When a malware alert is triggered in Cortex XDR, XSOAR needs to automatically enrich the alert by querying VirusTotal, checking Active Directory for user details, and isolating the host if malicious. What is this orchestration framework called in Cortex XSOAR?

A multinational SOC architect is designing a threat-intelligence ingestion pipeline into Cortex XSOAR. Analysts complain that indicators from a commercial feed suppress internal detections because the feed marks legitimate corporate VPN egress IPs as malicious. The architect must add a pre-ingestion control that prevents these false positives from reaching the indicator database while retaining the feed's other indicators. Which control should be implemented?

A SecOps architect is defining a metric to measure the proportion of security incidents that were resolved within the agreed Service Level Agreement (SLA) time. Which metric should be used?

An architect is configuring Panorama to manage software and content updates. Which TWO update types can be scheduled and distributed via Panorama to managed firewalls? (Choose two)

An architect wants Panorama to manage a set of VM-Series firewalls in a public cloud and push device group and template configurations to them. The firewalls can initiate outbound connections but cannot accept inbound management sessions. Which Panorama connectivity model should the architect choose?

You are designing executive dashboards in Cortex XSIAM to report security posture trends over the last quarter. Management requires a metric that shows the reduction in successful phishing compromises resulting from user training. Which metric should you implement?

You are deploying Cortex XSIAM and need to ensure that endpoint logs collected from remote agents are normalized into a unified schema before analytics runs. Which feature performs this normalization?

An architect is designing a Cortex XSOAR integration for a SOC where analysts must be able to approve or reject containment actions from a chat platform. The playbook must pause execution until an analyst responds, and the response must be authenticated against Cortex XSOAR users. Which Cortex XSOAR capability should the architect use to implement this human-in-the-loop approval step?

An architect is designing a metrics framework for a Security Operations Center (SOC) using Cortex XSIAM. The SOC wants to measure the effectiveness of its incident triage process by tracking the proportion of incidents that are correctly classified as true positives versus false positives. Which metric should be used to directly assess the accuracy of incident classification?

An architect is designing an automated incident response workflow in Cortex XSOAR. When a critical phishing incident is reported, the playbook must automatically extract URLs, submit them to WildFire for analysis, and isolate the endpoint if malicious. Which integration instance is responsible for submitting the URL to WildFire within the XSOAR playbook?

An enterprise architect is designing an architecture where Prisma Cloud computes compliance for multi-cloud environments (AWS, Azure, GCP). To provide least-privilege access for Prisma Cloud to discover and assess resource configurations across multiple AWS accounts, which deployment method should the architect recommend?

An architect is aligning a new SOC's response workflow with the NIST SP 800-61 incident handling lifecycle. During the containment, eradication, and recovery phase, the team must decide which activities belong there rather than in later lessons-learned work. Which two activities are correctly performed within that phase? (Choose two.)

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

A SOC architect must design a response architecture where automated playbooks can isolate endpoints, disable user accounts, and block domains without a human approving each action. Legal has mandated that every automated containment action be attributable to a named analyst, that actions be reversible, and that a full audit trail exist. Which architectural control best satisfies these requirements while preserving automation speed?

When establishing a baseline for Security Operations Center (SOC) alert volume in Cortex XSIAM, what is the primary purpose of this baseline?

An architect is configuring User-ID mapping in a multi-forest Active Directory environment. Some users authenticate against domain A, while resources are in domain B. Which User-ID collection method should the architect recommend to ensure seamless mapping across all domains?

A security architect at a financial services firm is designing a threat intelligence sharing program. The firm wants to automatically ingest high-fidelity indicators of compromise (IOCs) from an external partner into Cortex XSOAR to enrich alerts. The architect must select a standard that defines a structured, machine-readable format for representing cyber threat intelligence, including indicators, observed data, and relationships. Which standard should the architect choose?

An architect is designing an authentication architecture where Palo Alto Networks firewalls authenticate administrators against an external multi-factor authentication (MFA) provider using SAML 2.0. Which component acts as the Identity Provider (IdP) in this architecture?

An architect is designing a zero-trust network segmentation strategy using Palo Alto Networks NGFWs. The security team wants security rules to dynamically adapt when workloads spin up or down in a dynamic environment, without needing static IP addresses in rule definitions. Which feature should the architect implement?

A SOC architect is standardizing how analysts describe adversary behavior across a multinational team. The CISO mandates adoption of the MITRE ATT&CK framework for all incident documentation. Which structural element of ATT&CK should the architect use to map a specific adversary action such as credential dumping from LSASS memory?

A security operations team wants to report how quickly its detection content is keeping pace with the evolving threat landscape. The architect proposes tracking the median age of detection rules at the time they first generate a true positive. What does this metric most directly indicate about the detection program?

An organization wants to establish a comprehensive KPI framework to measure maturity across all phases of the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover) using Cortex XSIAM and XSOAR. Which THREE metrics map directly to the 'Respond' function? (Choose three)

An architect is configuring a Palo Alto Networks firewall to prevent unauthorized exfiltration of sensitive data such as credit card numbers and social security numbers. Which security profile should the architect use?

An architect is integrating Prisma Access with a third-party SIEM. The SIEM must receive Prisma Access logs with low latency and support selective subscription so that only threat and traffic logs are forwarded, while URL logs remain in Cortex Data Lake for later query. Which Prisma Access log-forwarding method should the architect choose?

When designing a high-availability (HA) architecture for a pair of Palo Alto Networks NGFWs, which interface type must be dedicated and directly connected between the two peers for session and state synchronization?

An organization is integrating Prisma Cloud with Cortex XSOAR to automate cloud incident response. When configuring the Prisma Cloud integration instance in XSOAR, which authentication mechanism is recommended to securely fetch alerts without using static user credentials?

An incident response architect is defining severity levels for security alerts in Cortex XDR. Which severity classification typically triggers automated containment playbooks without human intervention?

An architect is designing a multi-virtual router architecture on a Palo Alto Networks firewall. What is the primary purpose of configuring multiple virtual routers on a single firewall?

A security architect is designing a threat response architecture that must coordinate actions across Cortex XSIAM, Cortex XSOAR, and third-party firewalls. During a recent exercise, response actions executed in the wrong order, causing an endpoint to be isolated before its indicators were enriched, which delayed the firewall block. The architect must ensure deterministic ordering of enrichment and containment steps. Which design approach best addresses this?

A Cortex XSIAM customer wants to report the proportion of high-severity incidents that were fully resolved within the agreed service level. The architect must define the metric so that it cannot be inflated by simply closing incidents without completing remediation. Which definition best prevents that distortion?

An architect is troubleshooting a Cortex XDR deployment where agents on endpoints are failing to communicate with the Cortex XDR cloud tenant. Which outbound network connectivity requirement must be verified on the local corporate firewall?

You are preparing a security posture report for the board of directors using Cortex XSIAM. The board wants to understand risk exposure reduction over time. Which metric provides the most executive-level strategic value regarding risk posture?

An architect is integrating Cortex XDR with a third-party endpoint management platform so that when Cortex XDR isolates an endpoint, the management platform should not attempt to push software updates to it. The architect needs the most reliable, event-driven way to notify the external platform of the isolation state change. Which approach should the architect use?

When reporting security posture metrics to non-technical stakeholders, why is it recommended to use risk-based metrics alongside operational performance metrics?

When presenting security posture metrics to executive management, an architect must ensure the reporting framework aligns with business risk rather than purely technical telemetry. Which metric best communicates operational effectiveness to business stakeholders?

An organization is adopting the Cyber Kill Chain framework to evaluate their intrusion detection capabilities across the network and endpoint layers. During which phase should security architects implement egress filtering and DNS sinkholing to disrupt adversary operations?

An enterprise deploying Cortex XSIAM notices that a specific custom BIQL (Behavioral Incident Query Language) dashboard reporting on metric trends is timing out during peak hours. What is the most appropriate architectural remediation?

A security operations architect is designing a metrics program in Cortex XSIAM and wants to ensure that the SOC's detection tuning efforts are measurable. The team has been adding exclusions and threshold adjustments to reduce noise. Which metric best quantifies whether these tuning actions are improving the signal-to-noise ratio over time?

A financial services SOC is architecting a threat response workflow in Cortex XSOAR that must query an internal threat intelligence platform, enrich indicators, and automatically create a blocklist entry only when the indicator's confidence score exceeds a defined threshold. The architect needs the playbook to evaluate the score and conditionally branch without writing custom Python. Which mechanism should be used?

An architect is planning to onboard a new branch office into an existing Prisma Access deployment. The branch has a single Palo Alto Networks firewall and needs to forward user traffic to Prisma Access for security inspection while also allowing the branch to reach internal data center applications over the corporate WAN. Which component should the architect configure on the branch firewall to establish the secure tunnel to Prisma Access?

A security operations team is using Cortex XSIAM to track the 'Mean Time to Detect' (MTTD) metric for endpoint alerts. The team defines MTTD as the time between the initial malicious activity on an endpoint and the creation of an alert in Cortex XSIAM. The architect needs to ensure that the metric is calculated consistently across all endpoint alerts. Which Cortex XSIAM data source should the architect use to obtain the timestamp of the initial malicious activity?

An architect is configuring automated containment in Cortex XSOAR where analyst approval is required before isolating an executive's laptop. Which task type in the playbook accomplishes this?

A security architect is designing a threat intelligence program for a SOC. The organization wants to leverage the Cyber Kill Chain framework to structure its detection and response strategies. The architect needs to ensure that the SOC can map its existing controls to the stages of the Cyber Kill Chain. Which of the following correctly lists the stages of the Cyber Kill Chain in order?

An architect is designing an incident response workflow in Cortex XSOAR using the Incident Spooler. Which component is primarily responsible for processing queued events into actionable incidents?

An architect is setting up a dashboard in Cortex XSIAM to monitor the overall health of the security operations program. The CISO wants a single metric that reflects the proportion of security incidents that were resolved within the agreed service level agreement (SLA). Which metric should be displayed?

While establishing baselines for Cortex XDR alert volume to detect operational anomalies, you notice a massive seasonal spike in alerts that threatens to invalidate your baseline threshold. What is the best practice approach to handle this seasonality in security metrics?

An architect is designing an automated threat hunting and containment workflow using Cortex XSOAR. Which TWO external or internal data sources can Cortex XSOAR query or integrate with during an investigation? (Choose two)

An architect is designing a threat hunting architecture that leverages Cortex XSIAM XQL (XDR Query Language). To identify potential living-off-the-land binaries (LotLB) execution, which query structure correctly filters process execution events for anomalous parent-child relationships?

A multinational SOC architect is defining threat response requirements for Cortex XSIAM that must support both automated and analyst-driven investigations across endpoint, network, and identity telemetry. The architect must select the platform capabilities that directly enable correlation of disparate telemetry into a single incident timeline for response actions. (Choose two.)

Your SOC leadership team needs to measure the operational efficiency of incident containment. Which metric should you track within Cortex XSOAR to evaluate how quickly analysts isolate compromised endpoints?

An architect is integrating a Palo Alto Networks next-generation firewall with an external threat intelligence platform that publishes indicators over a REST API. The firewall must block traffic matching new indicators within minutes without manual commits. Which integration approach meets this requirement?

An architect is configuring User-ID to identify users behind a Microsoft Active Directory domain. Which protocol does the Palo Alto Networks User-ID agent use to query Active Directory security event logs for user login and logoff events?

An architect is defining a Service Level Objective (SLO) for the SOC using Cortex XSIAM. The SLO states that 95% of high-severity incidents must be resolved within 4 hours of creation. The architect needs to create a metric that measures compliance with this SLO over a rolling 30-day window. Which Cortex XSIAM feature should the architect use to automatically calculate and alert on SLO compliance?

An architect is designing a metrics program for a Cortex XSIAM deployment and wants to ensure that reported security metrics drive continuous improvement rather than merely describe past activity. The SOC director requires that each metric be tied to a decision or action. Which TWO characteristics must the architect build into the metric definitions to satisfy this requirement? (Choose two.)

A security operations architect is designing a threat response architecture for a new SOC. The organization wants to adopt the NIST Incident Response Lifecycle to structure their processes. The CISO asks which phase should include activities such as developing an incident response plan, establishing communication protocols, and training staff. Which phase is being described?

An architect is troubleshooting a Palo Alto Networks High Availability (HA) cluster where configuration synchronization between active and passive peers is failing. Which TWO locations or settings should the architect check? (Choose two)

What is the primary objective of establishing a baseline for Mean Time to Resolution (MTTR) in security operations?

An architect is designing an automated threat hunting and containment architecture with Cortex XSIAM. Which THREE actions can be triggered automatically upon confirming a high-fidelity behavioral threat detection? (Choose three)

An architect is designing a high-scale Cortex XDR deployment across 50,000 endpoints. To optimize bandwidth and reduce direct WAN traffic to the cloud backend for agent updates and log collection, which architectural component should be deployed in regional data centers?

When designing a threat hunting architecture using XQL in Cortex XSIAM, which TWO best practices improve query performance and efficiency? (Choose two)

An architect is configuring a Palo Alto Networks firewall and wants to block access to known malicious domains and phishing sites. Which security profile should be configured and attached to the security policy?

A SOC architect is designing the escalation path for a global follow-the-sun operation. Analysts in one region close cases at end of shift, and the next region frequently reopens them because critical context was lost during handoff. Leadership wants a design that guarantees continuity of investigative state across regions without duplicating analyst effort. Which architectural approach best addresses the root cause?

An architect is operationalizing security metrics for a Cortex XSIAM deployment. The SOC manager wants to track the 'Alert Triage Efficiency' metric, defined as the average time from alert creation to analyst assignment. The architect needs to ensure the metric is accurate and actionable. Which two data points must be captured and correlated to calculate this metric correctly? (Choose two.)

An architect is reviewing the Cortex XSIAM Analytics dashboard to identify root causes of security incidents. Which data visualization component aggregates related alerts into a single attack storyline?

When setting up automated email parsing in Cortex XSOAR for phishing triage, which integration is specifically required to connect to Microsoft Office 365 using modern authentication (OAuth 2.0)?

A multinational corporation uses Cortex XSIAM across three geographically dispersed SOCs. The security leadership wants to measure the consistency of incident triage across regions to identify process drift. Which metric best captures the uniformity of triage decisions, such as severity assignment and escalation, across all SOCs?

An architect is configuring a Palo Alto Networks firewall and wants to inspect outbound traffic for malware. Which security profile should be attached to the security policy rule allowing outbound internet traffic?

When evaluating the maturity of an Incident Response program using the CMMI (Capability Maturity Model Integration) framework, what characterizes a 'Managed' (Level 2) process?

An architect is configuring a Palo Alto Networks firewall and wants to prevent SYN flood attacks on public-facing web servers. Which security feature should the architect configure?

An architect is designing a secure architecture using VM-Series on Microsoft Azure. Which TWO Azure-native services or integration components must be configured to achieve high availability with dynamic failover of user traffic across two VM-Series instances? (Choose two)

An architect is designing a large-scale Prisma Access deployment with hundreds of remote networks. To simplify routing management and avoid full-mesh IPsec tunnel complexity between all branch sites, what architectural topology does Prisma Access employ by default?

An architect is configuring Panorama to manage a large deployment of firewalls. Which TWO best practices should be implemented regarding Panorama administrative access and security? (Choose two)

An organization is reporting on 'Dwell Time' as a core security posture metric using Cortex XSIAM. If Dwell Time is defined as the duration from initial compromise to containment, which data sources must be successfully correlated to calculate this metric accurately?

A SOC architect is designing automated response playbooks in Cortex XSOAR for phishing incidents reported by users. The architecture must safely automate enrichment and containment while limiting the blast radius of a faulty or overly aggressive playbook. Which TWO design practices best achieve this? (Choose two.)

An architect is designing an enterprise security architecture integrating Prisma Access, Cortex XDR, and Cortex XSOAR. Which TWO architectural benefits are realized by this tight integration? (Choose two)

A security operations architect is building a metrics dashboard in Cortex XSIAM to track the SOC's incident response performance. The dashboard must show, for each severity level, the percentage of incidents that met their defined response SLA. Which Cortex XSIAM capability should the architect use to calculate and display SLA compliance by severity?

A security architect is defining the incident response lifecycle for a new SOC built on Cortex XSIAM. The CISO asks which phase of the NIST SP 800-61 lifecycle is responsible for validating that containment actions actually removed the adversary's access before returning the environment to normal operations. Which phase should the architect identify?

An architect is deploying Cortex XDR to protect endpoints across a hybrid environment. The security team wants to ensure that if an endpoint loses connectivity to the Cortex XDR management console, it continues to enforce security policies and can later upload forensic data. Which Cortex XDR component provides this capability?

An enterprise security architect is designing an automated containment playbook in Cortex XSOAR for ransomware attacks. Which THREE automated actions should be incorporated into the playbook to effectively contain the threat while preserving forensic evidence? (Choose three)

Which TWO actions should an architect take when presenting security metrics to management to ensure credibility and actionable decision-making? (Choose two)

An architect is configuring a Palo Alto Networks firewall and wants to ensure that administrative logins are authenticated against an external RADIUS server with multi-factor authentication. Where should the architect configure the RADIUS server profile?

An architect is designing a multi-cloud network security architecture where Palo Alto Networks VM-Series firewalls are deployed in AWS, Azure, and GCP. Management and policy enforcement must be centralized. Which architectural design provides the most scalable management plane?

An architect is designing log retention and data tiering policies in Cortex XSIAM. To balance regulatory compliance requirements (long-term storage) with high-performance analytics (short-term fast search), how should the data architecture be structured?

An architect is establishing security operations baseline metrics in Cortex XSIAM. The team wants to measure the percentage of alerts that are determined to be actionable threats versus benign noise. Which metric should be configured?

An architect is designing a Prisma Cloud compliance framework. Which TWO actions or configurations can be implemented in Prisma Cloud to assess and enforce cloud resource security? (Choose two)

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for known malware and spyware. Which security profile should the architect attach to the Security Policy rule?

A security operations architect is designing a threat intelligence-driven response architecture using Cortex XSOAR. The architect wants to automatically enrich indicators of compromise (IOCs) from multiple sources and then make a risk-based decision to block or allow them. Which component of Cortex XSOAR should be used to define the logic that correlates and scores the IOCs from different intelligence sources?

A security operations architect is establishing a metrics framework in Cortex XSIAM to measure the efficiency of the incident triage process. The SOC manager wants to know the average time it takes for an analyst to acknowledge an incident after it is created. Which metric should the architect implement?

An architect is integrating Cortex XSOAR with threat intelligence platforms. Which THREE attributes are essential when evaluating the quality and operational value of ingested threat indicators? (Choose three)

A SOC architect is defining the containment step in the incident response lifecycle for ransomware affecting a single endpoint. The endpoint is managed by Cortex XDR and is still communicating with its command-and-control server. Which action best satisfies immediate containment while preserving forensic evidence?

A security operations team uses Cortex XSIAM and Cortex XSOAR. The SOC manager wants to measure how well the team is utilizing automation to reduce manual effort. The manager asks the architect to define a metric that quantifies the proportion of incident response actions that were executed automatically versus manually. Which metric should the architect recommend?

An architect is troubleshooting a User-ID agent deployment where group mapping information is not being retrieved from Microsoft Active Directory. Which permission or protocol requirement must be verified on the Active Directory domain controller for group mapping to succeed?

An architect is designing a metric to measure the 'Automation Coverage' of incident response in Cortex XSOAR. The metric is defined as the percentage of incidents that were fully resolved by automated playbooks without human intervention. The architect notices that some incidents are closed by playbooks but still require manual approval steps. The organization wants the metric to exclude incidents that required any human approval, even if the playbook completed the remediation. Which Cortex XSOAR feature should the architect use to accurately identify incidents that were fully automated?

A security operations team tracks mean time to detect (MTTD) in Cortex XSIAM. Leadership notices MTTD improved sharply after the team enabled additional low-severity correlation rules, even though no detection engineering work changed. The architect must explain why the metric moved and how to keep it trustworthy. What is the most accurate explanation?

An architect is integrating Prisma Cloud with a CI/CD pipeline (such as GitHub Actions or Jenkins) to perform Infrastructure as Code (IaC) scanning. Which TWO scanning targets or mechanisms are supported by Prisma Cloud for IaC security? (Choose two)

Your organization has implemented a comprehensive metric reporting framework in Cortex XSIAM. However, analysts are complaining that leadership is weaponizing the 'Mean Time to Resolve' (MTTR) metric to rush investigations, leading to superficial incident closures and recurring security issues. As a SecOps Architect, how should you address this metric dysfunction?

An architect is designing a Prisma Cloud Compute deployment to secure containerized workloads. Which TWO compliance and vulnerability assessment features are provided by Prisma Cloud Compute Defenders? (Choose two)

An architect is designing high availability for a Palo Alto Networks firewall deployment and wants to ensure that both firewalls can actively process traffic under normal operating conditions while backing each other up. Which HA mode supports this?

When designing a Security Operations Center (SOC) tiering model, what is the primary operational responsibility typically assigned to Tier 2 (Incident Responders)?

An architect is establishing baselines for Security Operations Center (SOC) performance metrics. Which THREE operational factors must be accounted for to ensure the baseline accurately reflects normal operating conditions? (Choose three)