Troubleshooting practice questions

An architect is troubleshooting why security metric trends in Cortex XSIAM appear erratic and unreliable. Which THREE factors commonly cause metric distortion in a SOC? (Choose three)

Trap 1: Configuring browser bookmarks for dashboard access

Bookmarks are browser shortcuts that do not affect data metrics.

Trap 2: Using dark mode instead of light mode in the Cortex XSIAM web UI

UI theme settings have zero impact on backend metric data calculation.

A
Configuring browser bookmarks for dashboard access
Why wrong: Bookmarks are browser shortcuts that do not affect data metrics.
B
Intermittent log ingestion pipeline failures or collector outages
Missing log data during pipeline outages creates artificial drops in metric trends.
C
Using dark mode instead of light mode in the Cortex XSIAM web UI
Why wrong: UI theme settings have zero impact on backend metric data calculation.
D
Inconsistent log parsing or changes in log formats from third-party vendors
Broken parsing rules cause events to be misclassified or dropped from metric calculations.
E
Unannounced mass deployment or decommissioning of endpoint agents
Sudden changes in endpoint sensor coverage skew volume-based security metrics.

Question 2mediummulti select

An architect is troubleshooting a User-ID deployment where users authenticating via captive portal are not getting correctly mapped. Which TWO conditions must be verified to ensure captive portal functions properly? (Choose two)

Trap 1: Ensure that the firewall's management plane CPU is disabled to…

Disabling the management plane CPU would crash the firewall.

Trap 2: Ensure that User-ID agents are disabled when captive portal is…

User-ID agents and captive portal can complement each other.

Trap 3: Verify that all users have installed the Prisma Cloud Defender…

Prisma Cloud Defender is for cloud workloads, not user captive portal auth.

A
Verify that an Authentication Profile and Authentication Policy are correctly configured to prompt users.
Captive portal requires an authentication profile to validate credentials against LDAP/RADIUS/SAML.
B
Verify that a security policy rule allows traffic to the captive portal IP address and authentication port.
Firewalls must permit traffic to reach the captive portal service on the device.
C
Ensure that the firewall's management plane CPU is disabled to allow unhindered redirects.
Why wrong: Disabling the management plane CPU would crash the firewall.
D
Ensure that User-ID agents are disabled when captive portal is active.
Why wrong: User-ID agents and captive portal can complement each other.
E
Verify that all users have installed the Prisma Cloud Defender agent.
Why wrong: Prisma Cloud Defender is for cloud workloads, not user captive portal auth.

Question 3mediummulti select

An architect is troubleshooting a Panorama log collection issue where managed firewalls are failing to forward traffic and threat logs to Panorama Collectors. Which TWO troubleshooting steps should the architect perform? (Choose two)

Trap 1: Reformat the firewall data plane ASICs via the CLI.

Reformatting hardware ASICs is destructive and unnecessary for log forwarding issues.

Trap 2: Check if the firewall local management plane CPU is running SNMPv1…

SNMP has no impact on Panorama log forwarding.

Trap 3: Disable SSL decryption on all internal zones.

Decryption settings do not prevent log forwarding to Panorama.

A
Reformat the firewall data plane ASICs via the CLI.
Why wrong: Reformatting hardware ASICs is destructive and unnecessary for log forwarding issues.
B
Verify that the managed firewalls are correctly assigned to a valid Collector Group within Panorama.
Firewalls must belong to a Collector Group to know where to send their logs.
C
Check if the firewall local management plane CPU is running SNMPv1 polling.
Why wrong: SNMP has no impact on Panorama log forwarding.
D
Verify network connectivity and firewall rules between the managed firewalls and Panorama Collectors over TCP port 3978.
Panorama and managed firewalls communicate log data over TCP port 3978.
E
Disable SSL decryption on all internal zones.
Why wrong: Decryption settings do not prevent log forwarding to Panorama.

Question 4mediummultiple choice

An architect is troubleshooting a Cortex XDR deployment where agents on endpoints are failing to communicate with the Cortex XDR cloud tenant. Which outbound network connectivity requirement must be verified on the local corporate firewall?

Trap 1: Inbound UDP port 69 (TFTP) from endpoints to Panorama.

TFTP is not used by Cortex XDR agents.

Trap 2: Inbound TCP port 3389 (RDP) from the cloud backend to every…

Inbound RDP is insecure and not required by XDR.

Trap 3: Outbound TCP port 3978 to Panorama Collectors.

Port 3978 is for Panorama log collection from firewalls, not XDR agents.

A
Outbound TCP port 443 (HTTPS) access to the Cortex XDR tenant cloud URL.
Cortex XDR agents require outbound HTTPS (port 443) access to communicate with the cloud backend.
B
Inbound UDP port 69 (TFTP) from endpoints to Panorama.
Why wrong: TFTP is not used by Cortex XDR agents.
C
Inbound TCP port 3389 (RDP) from the cloud backend to every endpoint.
Why wrong: Inbound RDP is insecure and not required by XDR.
D
Outbound TCP port 3978 to Panorama Collectors.
Why wrong: Port 3978 is for Panorama log collection from firewalls, not XDR agents.

Question 5mediummulti select

An architect is troubleshooting a Palo Alto Networks High Availability (HA) cluster where configuration synchronization between active and passive peers is failing. Which TWO locations or settings should the architect check? (Choose two)

Trap 1: Check the DNS server IP address configured on the management…

DNS configuration does not affect direct peer-to-peer HA sync.

Trap 2: Check the URL Filtering cloud license status.

URL licenses do not prevent HA config sync.

Trap 3: Check the GlobalProtect gateway portal certificate expiration date.

GP certificates do not prevent HA config sync.

A
Verify physical and logical connectivity on the HA1 control link interface.
HA1 handles configuration sync; connectivity failures break config sync.
B
Check the DNS server IP address configured on the management interface.
Why wrong: DNS configuration does not affect direct peer-to-peer HA sync.
C
Check the URL Filtering cloud license status.
Why wrong: URL licenses do not prevent HA config sync.
D
Check the GlobalProtect gateway portal certificate expiration date.
Why wrong: GP certificates do not prevent HA config sync.
E
Verify that both firewalls are running the exact same PAN-OS software version.
Mismatched PAN-OS versions prevent configuration and state synchronization.

Question 6mediummulti select

An architect is troubleshooting a Panorama deployment where managed firewalls show a 'Disconnected' status in the Panorama GUI. Which TWO connectivity requirements should the architect verify? (Choose two)

Trap 1: Check the physical color of the office carpet near the server rack.

Carpet color has no impact on network connectivity.

Trap 2: Verify the HDMI cable connection on the firewall console port.

Console ports are for local serial debugging, not Panorama network connectivity.

Trap 3: Check if the user desktop browser has JavaScript enabled.

Browser settings do not affect firewall-to-Panorama TCP connectivity.

A
Check the physical color of the office carpet near the server rack.
Why wrong: Carpet color has no impact on network connectivity.
B
Verify the HDMI cable connection on the firewall console port.
Why wrong: Console ports are for local serial debugging, not Panorama network connectivity.
C
Verify that TCP port 3978 (Panorama SSL/TLS communication) is open and not blocked by intermediate firewalls or security groups.
Panorama management communication requires TCP port 3978.
D
Check if the user desktop browser has JavaScript enabled.
Why wrong: Browser settings do not affect firewall-to-Panorama TCP connectivity.
E
Verify that the firewall management IP address can successfully reach the Panorama management IP address.
IP reachability between firewall management and Panorama is required for connection.

Read the full network assurance explanation →

Question 7mediummultiple choice

You are configuring log ingestion in Cortex XSIAM from a third-party firewall using a generic syslog collector. The logs are arriving, but the parser is failing to extract destination IP addresses correctly. What is the recommended troubleshooting step?

Trap 1: Increase the Syslog port number from 514 to 6514

Port changes affect transport security or connectivity, not field parsing logic.

Trap 2: Disable Magnifier behavioral analytics

Disabling analytics does not fix log parser regex extractions.

Trap 3: Reinstall the Cortex XDR agent on the third-party firewall

Firewalls do not run Cortex XDR agents.

A
Modify or create a custom XDM parsing rule for the vendor log format
Custom parsing rules correct extraction errors for unsupported log formats.
B
Increase the Syslog port number from 514 to 6514
Why wrong: Port changes affect transport security or connectivity, not field parsing logic.
C
Disable Magnifier behavioral analytics
Why wrong: Disabling analytics does not fix log parser regex extractions.
D
Reinstall the Cortex XDR agent on the third-party firewall
Why wrong: Firewalls do not run Cortex XDR agents.

Review the full routing breakdown →

Question 8mediummultiple choice

An architect is troubleshooting an issue where Palo Alto Networks VM-Series firewalls deployed in AWS are experiencing asymmetric routing issues across multiple network interfaces. Which AWS networking construct must be correctly configured to ensure traffic enters and exits through the correct firewall data interface?

Trap 1: Panorama Template stack backup schedules.

Backups have no effect on cloud routing.

Trap 2: Palo Alto Networks Management interface static default gateway.

Management interface traffic is separate from data plane traffic routing.

Trap 3: AWS Security Groups blocking all inbound ports.

AWS Security Groups block traffic at the AWS layer, but routing is controlled by route tables.

A
Panorama Template stack backup schedules.
Why wrong: Backups have no effect on cloud routing.
B
Palo Alto Networks Management interface static default gateway.
Why wrong: Management interface traffic is separate from data plane traffic routing.
C
AWS Security Groups blocking all inbound ports.
Why wrong: AWS Security Groups block traffic at the AWS layer, but routing is controlled by route tables.
D
AWS Route Tables associated with subnets pointing traffic to specific Elastic Network Interfaces (ENIs).
Proper route table configuration in AWS ensures symmetric routing across VM-Series network interfaces.

Question 9mediummultiple choice

An architect is troubleshooting a User-ID agent deployment where group mapping information is not being retrieved from Microsoft Active Directory. Which permission or protocol requirement must be verified on the Active Directory domain controller for group mapping to succeed?

Trap 1: Verify that SNMPv1 is enabled on the domain controller.

SNMP is not used for AD group mapping.

Trap 2: Verify that the Domain Controller has the GlobalProtect client…

Domain controllers do not run GlobalProtect clients.

Trap 3: Verify that the firewall management plane CPU is running at 100%.

High CPU causes performance degradation, not group mapping retrieval.

A
Verify that SNMPv1 is enabled on the domain controller.
Why wrong: SNMP is not used for AD group mapping.
B
Verify that the Domain Controller has the GlobalProtect client installed.
Why wrong: Domain controllers do not run GlobalProtect clients.
C
Verify LDAP/LDAPS network connectivity and ensure the service account has read permissions to query Active Directory user and group objects.
LDAP connectivity and proper read privileges on AD objects are required for User-ID group mapping.
D
Verify that the firewall management plane CPU is running at 100%.
Why wrong: High CPU causes performance degradation, not group mapping retrieval.

Review the full subnetting walkthrough →

Question 10mediummulti select

An architect is troubleshooting a User-ID deployment where IP-to-username mappings are missing for users on a specific subnet. Which TWO sources or tools can be checked to verify mapping status on the Palo Alto Networks firewall? (Choose two)

Trap 1: Check the BIOS boot sequence of the firewall management plane.

BIOS boot sequence is irrelevant to User-ID mappings.

Trap 2: Check the GlobalProtect client GUI for hardware warranty details.

Warranty details have no relation to User-ID mappings.

Trap 3: Verify the physical fiber optic cable transceivers on HA2.

HA2 transceivers sync HA states, not User-ID mappings.

A
Check the BIOS boot sequence of the firewall management plane.
Why wrong: BIOS boot sequence is irrelevant to User-ID mappings.
B
Check the GlobalProtect client GUI for hardware warranty details.
Why wrong: Warranty details have no relation to User-ID mappings.
C
Run the CLI command 'show user ip-user-mapping all' on the firewall to view current mappings.
The CLI command 'show user ip-user-mapping all' displays active IP-to-user mappings on the firewall.
D
Check the User-ID agent status and connection state on the firewall under Device > User Identification.
Checking User-ID agent status verifies connection health and mapping collection.
E
Verify the physical fiber optic cable transceivers on HA2.
Why wrong: HA2 transceivers sync HA states, not User-ID mappings.