SecOps-Architect Practice Test 11 — 15 Questions

Question 1

A SecOps architect is defining a metric to measure the proportion of security incidents that were resolved within the agreed Service Level Agreement (SLA) time. Which metric should be used?

Accepted Answer

SLA Compliance Rate. SLA Compliance Rate is the only metric that directly measures the proportion of incidents resolved within the agreed SLA time. Other metrics like MTTR or backlog provide related but indirect information, not a direct compliance percentage.

Answer

Backlog of Open Incidents

Answer

Mean Time to Resolve (MTTR)

Answer

First Contact Resolution Rate

Question 2

An architect is designing a Prisma Cloud Compute deployment to secure containerized workloads. Which TWO compliance and vulnerability assessment features are provided by Prisma Cloud Compute Defenders? (Choose two)

Accepted Answer

Evaluating container configurations and host OS settings against CIS (Center for Internet Security) benchmarks.. Option B is correct because Prisma Cloud Compute Defenders perform compliance checks by evaluating container configurations and host OS settings against CIS benchmarks, reporting pass/fail results for hardening requirements. Option D is correct because Defenders scan container images and host operating systems for known CVEs, providing vulnerability assessment across the deployment lifecycle. Option A is incorrect because writing custom assembly code for microservices is an application development task, not a Prisma Cloud Compute Defender capability. Option C is incorrect because analyzing physical power grid load tolerances is a data center facilities concern unrelated to container security. Option E is incorrect because acting as a Layer 7 DNS root server is a network infrastructure role, not a function of Prisma Cloud Compute Defenders.

Answer

Writing custom assembly code for application microservices.

Answer

Analyzing physical power grid load tolerances in data center facilities.

Answer

Acting as a Layer 7 DNS root server for enterprise domains.

Question 3

You are designing executive dashboards in Cortex XSIAM to report security posture trends over the last quarter. Management requires a metric that shows the reduction in successful phishing compromises resulting from user training. Which metric should you implement?

Accepted Answer

Phishing Incident Recurrence and Successful Compromise Rate Trend. Phishing Incident Recurrence and Successful Compromise Rate Trend directly measures whether users are still falling for phishing after training — a declining successful-compromise rate and reduced recurrence indicate training effectiveness. This is the metric that ties user training to measurable security posture improvement.

Answer

Average Analyst Playbook Execution Time

Answer

Cortex XDR Agent Installation Percentage

Answer

Total Phishing Payload Extraction Volume

Question 4

You are deploying Cortex XSIAM and need to ensure that endpoint logs collected from remote agents are normalized into a unified schema before analytics runs. Which feature performs this normalization?

Accepted Answer

XDM (XDR Data Model) mapping and parsing rules. XSIAM utilizes Agent Content and parsing rules to normalize raw logs into the XDM schema during ingestion.

Answer

Cortex XDR Agent Collector Engine

Answer

Magnifier behavioral analytics engine

Answer

Local Analysis Engine (LAE)

Question 5

While establishing baselines for Cortex XDR alert volume to detect operational anomalies, you notice a massive seasonal spike in alerts that threatens to invalidate your baseline threshold. What is the best practice approach to handle this seasonality in security metrics?

Accepted Answer

Segment historical data and apply contextual rolling baselines that account for expected cyclical business variations.. When establishing baselines for security operations, cyclical or seasonal variations must be accounted for using rolling or adjusted seasonal baselines to prevent alert fatigue or masking real anomalies.

Answer

Permanently increase the global alert severity threshold to ignore all alerts during the seasonal window.

Answer

Replace all quantitative alert metrics with qualitative analyst feedback scores.

Answer

Disable automated alert generation in Cortex XDR until the seasonal window concludes.

Question 6

An architect is designing a metrics framework for a Security Operations Center (SOC) using Cortex XSIAM. The SOC wants to measure the effectiveness of its incident triage process by tracking the proportion of incidents that are correctly classified as true positives versus false positives. Which metric should be used to directly assess the accuracy of incident classification?

Accepted Answer

Precision. Precision directly measures the accuracy of positive classifications by comparing true positives to all incidents flagged as malicious. It captures both correct and incorrect positive classifications, making it the best metric for assessing triage accuracy. Other metrics like FPR or recall only provide partial views.

Answer

False Positive Rate (FPR)

Answer

Recall

Answer

Mean Time to Resolve (MTTR)

Question 7

You are presenting security metrics to executive management using Cortex XSIAM dashboards. Leadership expresses concern over an apparent increase in malware detection events month-over-month. As a SecOps Architect, how should you contextualize this trend?

Accepted Answer

Contextualize the trend by demonstrating how expanded sensor coverage and improved detection visibility account for the rise in detections, while noting that successful compromises have decreased.. An increase in detected events often reflects improved visibility and broader sensor deployment (e.g., onboarding new log sources or endpoints) rather than a direct increase in actual organizational risk.

Answer

Blame the endpoint users for generating malware and increase disciplinary actions.

Answer

Confirm that the enterprise security posture is actively degrading and recommend cutting off all external internet access.

Answer

Disable the specific Cortex XDR analytics rules generating the malware alerts to lower the reported count.

Question 8

An architect is designing a secure CI/CD pipeline integration using Prisma Cloud to scan container images before they are pushed to a container registry (such as AWS ECR or Docker Hub). Which TWO mechanisms can be utilized for this pre-deployment image scanning? (Choose two)

Accepted Answer

Integrating the Prisma Cloud twistcli scanner utility into the CI/CD pipeline build script (e.g., Jenkins or GitLab CI).. Option A is correct because the twistcli scanner is Prisma Cloud's standalone CLI utility that can be invoked directly within a CI/CD build script (Jenkins, GitLab CI, etc.) to scan container images for vulnerabilities and compliance issues before they are pushed to a registry. Option D is correct because the Prisma Cloud Jenkins plugin integrates natively with Jenkins pipelines to automatically trigger image scans on built images and surface vulnerability and compliance results as part of the build. The other options are incorrect: GlobalProtect is a VPN client unrelated to image scanning (B), BNC cabling to a PA-5250 firewall is a physical network concept with no role in CI/CD image scanning (C), and SNMP traps on the Docker daemon socket are for monitoring/alerting, not pre-deployment vulnerability scanning (E).

Answer

Installing the GlobalProtect desktop VPN client on every container container image layer.

Answer

Physically connecting the build server to a Palo Alto Networks PA-5250 hardware appliance via BNC cables.

Answer

Configuring raw SNMP traps on the Docker daemon socket.

Question 9

An architect is designing an integration between Cortex XSOAR and a third-party ticketing system (e.g., ServiceNow). The requirement is to ensure that when an incident severity is updated in XSOAR, the ticket in ServiceNow is automatically updated. Which architectural feature facilitates this synchronization?

Accepted Answer

Bi-directional incident field mapping and integration commands. Bi-directional incident mapping and mapping rules in XSOAR integration instances allow field values to sync automatically between XSOAR and ticketing systems.

Answer

Syslog forwarding over UDP port 514

Answer

PAN-OS Dynamic Address Group API push

Answer

GlobalProtect client certificate renewal protocol

Question 10

Which role in a well-structured Security Operations Center (SOC) is primarily responsible for performing tier-2 incident triage, deep investigation, and playbook execution?

Accepted Answer

SOC Tier-2 Analyst / Incident Responder. The SOC Tier-2 Analyst / Incident Responder role is specifically responsible for deeper investigation, incident triage beyond initial alert validation, and executing response playbooks. Tier-2 analysts handle escalated incidents that Tier-1 cannot resolve, performing root-cause analysis and coordinating containment. This matches the question's description of tier-2 triage, deep investigation, and playbook execution.

Answer

Compliance Auditor

Answer

Chief Information Security Officer (CISO)

Answer

Helpdesk Support Technician

Question 11

When designing a threat hunting methodology aligned with the MITRE ATT&CK framework, an architect wants to identify adversary persistence mechanisms. Which tactic category should the analyst focus queries on?

Accepted Answer

Persistence. In MITRE ATT&CK, Persistence is the tactic category (TA0003) that covers techniques adversaries use to maintain footholds across restarts, credential changes, or other interruptions — such as registry Run keys, scheduled tasks, services, and web shells. An analyst hunting for persistence mechanisms should query for these specific techniques (T1547, T1053, T1543, T1505) rather than tactics focused on gaining initial entry or collecting data.

Answer

Initial Access

Answer

Collection

Answer

Execution

Question 12

An architect is deploying the Cortex XDR Broker VM to serve as a syslog collector for legacy network devices. The Broker VM loses connectivity to the Cortex XDR cloud. What happens to the collected syslog data during the outage?

Accepted Answer

The data is buffered locally on the Broker VM and forwarded once reconnected. The Cortex XDR Broker VM is designed with local buffering capability to handle temporary loss of connectivity to the Cortex XDR cloud. When the cloud is unreachable, collected syslog data is stored locally on the Broker VM's disk and forwarded once connectivity is restored, ensuring no data loss during transient outages. This store-and-forward behavior is a core resilience feature of the Broker VM.

Answer

The Broker VM automatically switches to backup SMTP forwarding

Answer

The syslog sender devices resend the packets automatically via TCP retry

Answer

The data is permanently dropped until connectivity returns

Question 13

An architect is configuring High Availability (HA) on two Palo Alto Networks firewalls. What happens to active sessions on the primary firewall if it experiences a power failure, assuming HA is configured in Active/Passive mode?

Accepted Answer

The passive firewall takes over active traffic and maintains sessions via HA2 synchronization.. In an Active/Passive HA configuration, when the primary firewall fails (e.g., power failure), the passive firewall takes over as active and maintains existing sessions because session state is synchronized via the HA2 link. HA2 synchronization ensures that session tables, including TCP state and NAT translations, are mirrored to the passive device, allowing it to continue traffic without dropping sessions. This provides seamless failover with minimal disruption.

Answer

The firewall reboots into maintenance mode and requires manual CLI intervention.

Answer

Traffic is permanently blackholed until an administrator logs into Panorama.

Answer

All active user sessions are immediately dropped and must re-authenticate.

Question 14

An architect is configuring a Palo Alto Networks firewall and wants to inspect encrypted TLS traffic passing through the firewall without terminating the SSL session on the firewall itself (e.g., to identify malicious JA3 signatures or SNI without decryption). Which feature should the architect configure?

Accepted Answer

App-ID inspection of SSL/TLS Server Name Indication (SNI) and certificate attributes during handshake.. Palo Alto Networks App-ID can inspect the TLS handshake without decryption to extract the Server Name Indication (SNI) and certificate attributes, which can be used to identify applications and threats like malicious JA3 signatures. This allows visibility into encrypted traffic without terminating SSL.

Answer

Installing GlobalProtect portal certificates.

Answer

Formatting logs into raw Syslog CEF.

Answer

Disabling all security profiles.

Question 15

An architect is deploying Cortex XDR Broker VMs in a DMZ architecture. Which TWO network requirements must be satisfied for successful operation? (Choose two)

Accepted Answer

Inbound syslog or SNMP trap connectivity from local log sources. Option D is correct because the Cortex XDR Broker VM must establish outbound HTTPS (TCP 443) connections to the Cortex XDR cloud tenant to register, receive policy/configuration updates, and forward collected data, so this egress path is mandatory. Option A is correct because the Broker VM's log-collection role requires inbound syslog (UDP/TCP 514) or SNMP trap (UDP 162) connectivity from local log sources so those devices can deliver their logs to the broker for forwarding to the cloud. Option B is wrong because inbound RDP from public internet addresses is never a Cortex XDR Broker VM requirement and would be a serious security exposure. Option C is wrong because the Broker VM does not perform direct PostgreSQL database replication on port 5432 to external client workstations. Option E is wrong because unencrypted FTP is not used for Broker VM configuration uploads; management and data transfer occur over secure channels to the Cortex XDR tenant.

Answer

Inbound RDP access from public internet IP addresses

Answer

Direct database replication port 5432 to external client workstations

Answer

Unencrypted FTP access for configuration file uploads