2.2 Design Tenant Structure, Multitenancy Hierarchies, and Component Placement for Various Deployment Scenarios SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a deployment where a customer has multiple remote branch offices that generate logs but have limited bandwidth, what is the most appropriate placement for Broker VMs?

   • AIn each branch office to collect and forward logs locally
   • BOn the same network segment as the Cortex Data Lake
   • CCentrally in the corporate headquarters to simplify management
   • DIn the cloud provider's region closest to the branch offices
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In a deployment where data is collected from multiple regions and needs to be processed centrally for correlation, where should engines be placed?

   • AIn the Cortex Data Lake
   • BIn a central location where all data can be aggregated
   • COn the same network as the data sources
   • DIn each region to process data locally
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   A security operations team is designing a multitenant Palo Alto Networks deployment. They plan to use Broker VMs to forward traffic from multiple tenants to a central engine, XDR Collectors to ingest endpoint telemetry from each tenant, and a shared engine to perform analysis. Which statement correctly describes how these components integrate in a cohesive multitenant architecture?

   • AEach tenant must have its own dedicated engine, and Broker VMs and XDR Collectors from all tenants forward directly to that tenant's engine.
   • BXDR Collectors are used only for cloud workload telemetry, while Broker VMs are used for on-premises network traffic; the engine receives data only from Broker VMs.
   • CBroker VMs and XDR Collectors are interchangeable components, and either can be used to forward both network traffic and endpoint telemetry to the engine.
   • DBroker VMs forward traffic to the engine, and XDR Collectors forward endpoint telemetry to the same engine, with tenant separation enforced through logical constructs such as labels or partitions.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When designing data collection for a network with a mix of on-premises and cloud workloads, what is the recommended placement strategy for XDR Collectors?

   • APlace collectors only in the cloud to handle all data
   • BPlace collectors only on-premises to handle all data
   • CPlace collectors in a single location that has the best connectivity to all sources
   • DPlace collectors both on-premises and in the cloud to cover all data sources
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary role of an engine in the Palo Alto Networks security operations platform?

   • ATo process and analyze data to detect threats and generate alerts
   • BTo provide a user interface for security analysts
   • CTo store historical data for long-term retention
   • DTo collect raw logs from network devices
   Reveal Solution Discussion Select an answer first