What does this Select Two (Multi-Select) Questions scenario practice page cover?

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the SecOps-Architect exam, each with detailed explanations and wrong-answer analysis.

How should I approach SecOps-Architect scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

Certified Security Operations Architect (SecOps-Architect)…

Question 1mediummulti select

Full question →

An architect is aligning a new SOC's response workflow with the NIST SP 800-61 incident handling lifecycle. During the containment, eradication, and recovery phase, the team must decide which activities belong there rather than in later lessons-learned work. Which two activities are correctly performed within that phase? (Choose two.)

A
Publishing a public breach notification to regulators before containment completes
Why it fails: Notification obligations may arise from legal requirements, but the framework does not classify them as containment, eradication, or recovery activities. Publishing before containment is complete can also be operationally premature. The phase focuses on technical and tactical response, not regulatory communication timing.
B
Rebuilding an affected host from a known-good image after removing the threat
Rebuilding or restoring systems from trusted images is part of eradication and recovery, which falls squarely in this phase. It removes residual adversary persistence and returns the environment to normal operations. Deferring it to lessons-learned would leave the organization exposed and is not what the framework prescribes.
C
Conducting a post-mortem meeting to update detection rules and response procedures
Why it fails: Post-mortems and process improvement belong to the post-incident activity phase, not containment, eradication, and recovery. The framework deliberately separates learning from active handling so responders are not distracted mid-incident. Confusing the two phases leads to premature closure of active remediation tasks.
D
Approving the incident response policy revision in the change advisory board
Why it fails: Policy revision and governance approvals are ongoing program management activities, not phase-specific handling steps. They may be triggered by lessons learned, but they are not executed during containment or recovery. Treating them as containment work misreads the framework's operational focus.
E
Isolating compromised endpoints from the network to limit lateral movement
Isolation is a canonical containment action executed during the containment, eradication, and recovery phase. It stops ongoing adversary movement and preserves evidence before remediation begins. Placing it in post-incident activity would be too late, since the threat would continue operating while the team merely documented findings.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related SecOps-Architect topic practice pages

Operationalizing Security Metrics practice questions

Secops Frameworks And Threat Response Architecture practice questions

Palo Alto Networks Product Integration And Architecture practice questions

SecOps-Architect fundamentals practice questions

SecOps-Architect scenario practice questions

SecOps-Architect troubleshooting practice questions

Practice scenarios

An architect is troubleshooting a User-ID deployment where IP-to-username mappings are missing for users on a specific subnet. Which TWO sources or tools can be checked to verify mapping status on the Palo Alto Networks firewall? (Choose two)

An architect is designing an automated threat intelligence enrichment pipeline in Cortex XSOAR. Which THREE actions are typically performed during indicator lifecycle management? (Choose three)

An architect is designing an enterprise incident response communication plan. Which THREE components are critical for effective operational coordination during a major security incident? (Choose three)

Which TWO metrics are essential when evaluating the effectiveness of a Security Operations Center's (SOC) detection engineering process? (Choose two)

An architect is designing a Palo Alto Networks SSL Decryption architecture. Which TWO best practices should be implemented to minimize user friction and protect user privacy (e.g., healthcare or financial sites)? (Choose two)

An architect is designing an automated threat hunting and containment architecture with Cortex XSIAM. Which THREE actions can be triggered automatically upon confirming a high-fidelity behavioral threat detection? (Choose three)

An architect is designing a Prisma Access deployment with multiple Remote Networks. Which TWO routing mechanisms are supported for connecting customer premises equipment (CPE) to Prisma Access Node locations? (Choose two)

When designing a threat hunting architecture using XQL in Cortex XSIAM, which TWO best practices improve query performance and efficiency? (Choose two)

An architect is designing an automated incident response architecture integrating Palo Alto Networks NGFW, Cortex XDR, and Cortex XSOAR. Which TWO architectural principles ensure an effective automated security ecosystem? (Choose two)

An architect is designing a secure cloud network architecture using Prisma Access. Which TWO deployment models or components are available in Prisma Access to connect corporate data centers and branch offices? (Choose two)

An architect is designing an automated threat hunting and containment workflow using Cortex XSOAR. Which TWO external or internal data sources can Cortex XSOAR query or integrate with during an investigation? (Choose two)

An architect is designing a secure architecture using VM-Series on Microsoft Azure. Which TWO Azure-native services or integration components must be configured to achieve high availability with dynamic failover of user traffic across two VM-Series instances? (Choose two)

An architect is configuring Panorama to manage a large deployment of firewalls. Which TWO best practices should be implemented regarding Panorama administrative access and security? (Choose two)

An architect is designing an enterprise security architecture integrating Prisma Access, Cortex XDR, and Cortex XSOAR. Which TWO architectural benefits are realized by this tight integration? (Choose two)

An enterprise security architect is designing an automated containment playbook in Cortex XSOAR for ransomware attacks. Which THREE automated actions should be incorporated into the playbook to effectively contain the threat while preserving forensic evidence? (Choose three)