SecOps-Architect Practice Test 13 — 15 Questions

Question 1

An architect is auditing security operations metrics and notices that the False Positive Rate (FPR) for endpoint detection alerts in Cortex XDR has steadily increased over the past two quarters. What is the most appropriate remediation strategy to address this trend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tune analytic profiles and update local exception/suppression lists in Cortex XDR. Tuning analytics rules and suppression lists based on historical feedback directly reduces false positives in Cortex XDR.

Answer

Increase the alert severity threshold globally to hide low-priority alerts

Answer

Disable behavioral analytics modules to stop generating anomaly-based alerts

Answer

Reduce the log retention period to purge historical false positive data

Question 2

An architect is designing a threat hunting architecture that leverages Cortex XSIAM XQL (XDR Query Language). To identify potential living-off-the-land binaries (LotLB) execution, which query structure correctly filters process execution events for anomalous parent-child relationships?

Accepted Answer

dataset = xdr_data | filter event_type = 'PROCESS_START' and actor_process_image_name = 'winword.exe' and target_process_image_name = 'cmd.exe'. XQL queries operate on datasets such as xdr_data and use a pipe-based syntax with filter stages. The correct structure filters PROCESS_START events where the parent (actor) process is winword.exe and the child (target) process is cmd.exe, which is the classic Office-spawning-shell living-off-the-land pattern. The other options use SQL, syslog, or CLI syntax that is not valid XQL.

Answer

search threat_intel where ip = '10.0.0.1' action = block

Answer

select * from syslog where facility = auth and action = drop

Answer

panos_log_generator --filter process_start --output xdr

Question 3

An enterprise deploying Cortex XSIAM notices that a specific custom BIQL (Behavioral Incident Query Language) dashboard reporting on metric trends is timing out during peak hours. What is the most appropriate architectural remediation?

Accepted Answer

Optimize the BIQL query by narrowing the time range, applying indexed filters earlier in the query, and leveraging pre-aggregated summary tables.. Optimizing the BIQL query by narrowing the time range, applying indexed filters early, and leveraging pre-aggregated summary tables directly addresses the performance issue. These techniques reduce the amount of data scanned and processed, improving query speed during peak hours without compromising data ingestion or dashboard functionality.

Answer

Switch the dashboard from BIQL to standard CSV export.

Answer

Disable data ingestion for all endpoints during peak business hours.

Answer

Increase the browser timeout limit on the client workstation.

Question 4

A security operations team is using Cortex XSIAM to track the 'Mean Time to Detect' (MTTD) metric for endpoint alerts. The team defines MTTD as the time between the initial malicious activity on an endpoint and the creation of an alert in Cortex XSIAM. The architect needs to ensure that the metric is calculated consistently across all endpoint alerts. Which Cortex XSIAM data source should the architect use to obtain the timestamp of the initial malicious activity?

Accepted Answer

The 'Event Timestamp' from the Cortex XSIAM endpoint data sources, such as the EDR telemetry or the endpoint agent logs.. Accurate MTTD calculation requires the timestamp of the initial malicious activity, which is captured in endpoint telemetry events ingested by Cortex XSIAM. The 'Event Timestamp' from EDR or endpoint logs provides this ground truth. Correlating it with the alert creation time yields the true detection latency, ensuring consistent measurement across all endpoint alerts.

Answer

The 'Incident Start Time' field in the Cortex XSIAM incidents table.

Answer

The 'First Seen' timestamp of the endpoint in the asset inventory.

Answer

The 'Alert Creation Time' field in the Cortex XSIAM alerts table.

Question 5

An architect is reviewing Cortex XSIAM dashboards designed to monitor threat detection coverage against the MITRE ATT&CK framework. Which THREE components are critical to measure accurately for this coverage analysis? (Choose three)

Accepted Answer

Validation status of detection rules against simulated attacks (e.g., adversary emulation). Option A is correct because the validation status of detection rules against simulated attacks (adversary emulation) confirms whether mapped detections actually fire, turning theoretical ATT&CK coverage into verified, tested coverage. Option C is correct because the percentage of MITRE ATT&CK techniques with active, tested detection rules is the core quantitative coverage metric that directly measures how much of the framework is addressed. Option D is correct because identifying telemetry gaps where required log sources are missing reveals blind spots — without the necessary data sources, techniques cannot be detected regardless of rule content. Option B does not belong because power-supply temperature is physical hardware health data unrelated to ATT&CK detection coverage. Option E does not belong because a Cortex XDR license renewal date is an administrative/commercial detail with no bearing on detection coverage analysis.

Answer

Physical temperature of the firewall appliance power supplies

Answer

Cortex XDR license renewal date

Question 6

A SOC architect is designing a metrics program in Cortex XSIAM to demonstrate continuous improvement in detection engineering. Leadership wants evidence that newly deployed detection rules are effective and that tuning reduces wasted analyst effort. Which TWO metrics should the architect include to best support this goal? (Choose two.)

Accepted Answer

True Positive Rate per detection rule. True Positive Rate and False Positive Rate per detection rule together reveal rule quality and noise burden. The true positive rate shows which rules deliver genuine security value, while the false positive rate exposes rules that waste analyst time and are prime tuning targets. Tracking both per rule produces the actionable evidence needed to demonstrate continuous improvement. Rule counts, MTTR, and login activity do not isolate detection quality and therefore cannot substantiate detection engineering progress.

Answer

Total number of detection rules deployed

Answer

Number of analyst logins to the console

Answer

Mean Time to Resolution (MTTR) for all incidents

Question 7

A SecOps architect is designing an automated containment workflow in Cortex XSOAR that must isolate a compromised endpoint, block the attacker's IP at the perimeter firewall, and open a ticket in the ITSM system. The containment playbook must execute these actions in parallel with a strict 15-minute SLA, and each action must produce an independent audit trail for post-incident review. Which Cortex XSOAR feature should the architect use to meet these requirements?

Accepted Answer

Playbook tasks configured as 'parallel' tasks that fork independent execution branches. Parallel tasks in Cortex XSOAR fork a playbook into concurrent branches, which is the native mechanism for executing containment actions simultaneously. Because each branch records its own task results in the war room, the architecture satisfies both the 15-minute SLA and the requirement for independent, reviewable audit trails without splitting the investigation into multiple incidents.

Answer

Three separate playbooks triggered by an indicator-based incident type classifier

Answer

A single script task using the Demisto REST API to invoke all three integrations

Answer

Playbook tasks configured as 'section headers' with dependent branching

Question 8

An architect is configuring Panorama to manage software and content updates across managed firewalls. Which TWO update deployment workflows are supported by Panorama? (Choose two)

Accepted Answer

Staged deployment where updates are pushed to test device groups before rolling out to production device groups.. Panorama allows scheduling updates, deploying content updates to specific device groups first (staged rollout), and managing PAN-OS software image downloads and installations.

Answer

Using FTP to push Windows desktop OS patches to firewalls.

Answer

Automatically downloading and installing PAN-OS major upgrades on all production firewalls during peak business hours without review.

Answer

Forcing all firewalls to boot into maintenance mode every 10 minutes.

Question 9

An architect is designing a high-availability Cortex XDR deployment. Which TWO architectural elements are critical for ensuring reliable agent telemetry delivery and management? (Choose two)

Accepted Answer

Deploying Cortex XDR Broker VMs to act as local proxies and event collectors, reducing WAN traffic.. Cortex XDR architecture relies on Cortex XDR Broker VMs for local log collection and proxying, and reliable outbound HTTPS connectivity from agents to the cloud backend.

Answer

Configuring SNMPv1 polling on all endpoint loopback interfaces.

Answer

Using raw FTP daemons to transfer endpoint RAM dumps across unencrypted networks.

Answer

Installing physical serial console cables between every workstation and the XDR cloud data center.

Question 10

A security architect is designing a threat intelligence ingestion pipeline for a Cortex XSOAR deployment. The SOC receives feeds from multiple providers, but analysts complain about duplicate indicators and conflicting verdicts. The architect needs to ensure that indicators are automatically deduplicated, scored, and enriched before being used in playbooks. Which Cortex XSOAR feature should be implemented to achieve this?

Accepted Answer

Indicator reputation and deduplication settings. The requirement is to automatically deduplicate, score, and enrich indicators from multiple feeds to avoid duplicates and conflicting verdicts. Cortex XSOAR's indicator reputation and deduplication settings are designed exactly for this purpose, providing centralized management of indicator lifecycle. Other features like extraction rules or playbook branching do not provide automatic deduplication and scoring at the indicator level, making them insufficient for this scenario.

Answer

Indicator extraction and enrichment rules

Answer

Playbook task conditional branching

Answer

Incident type classification rules

Question 11

A security architect is designing the threat intelligence ingestion pipeline for a Cortex XSOAR deployment. The organization wants to automatically block IP addresses that appear in high-confidence threat feeds, but the SOC team is concerned about false positives disrupting business-critical applications. Which capability of Cortex XSOAR should the architect configure to safely automate this response while maintaining an audit trail?

Accepted Answer

Playbook tasks with manual approval steps and conditional branching before executing the block. Automating enforcement safely requires a control point between detection and action. Cortex XSOAR playbooks support manual approval tasks and conditional logic that let analysts validate high-impact blocks before they execute, while the incident war room preserves a complete audit trail. This balances the speed of automation with the caution needed to avoid disrupting business-critical applications when feed confidence is imperfect.

Answer

Indicator expiration policies that automatically age out feed indicators after a fixed interval

Answer

Indicator exclusion lists that suppress matching indicators from all future feed ingestion

Answer

Feed reputation scoring that lowers the confidence value of indicators from untrusted sources

Question 12

An architect is configuring Indicator Sharing in Cortex XSOAR using the Threat Intel Management module. How are incoming STIX/TAXII indicator feeds prioritized when conflicting reputation scores are received from multiple sources?

Accepted Answer

By configuring source reliability and vendor weight settings. Cortex XSOAR's Threat Intel Management module resolves conflicting indicator reputations by letting the analyst define source reliability (how trustworthy a feed is, e.g., A-F rating) and vendor weight (relative influence of each source). These two parameters are combined to compute a weighted aggregate reputation score, so a high-reliability feed can override a low-reliability one even if the latter arrived later. This gives deterministic, configurable prioritization rather than arbitrary ordering.

Answer

Alphabetical sorting of feed names

Answer

Manual override for every single indicator

Answer

First-in, first-out ingestion timestamp priority

Question 13

An organization wants to define a Key Performance Indicator (KPI) in Cortex XSOAR that measures the average time taken by an analyst to acknowledge an incoming high-severity incident. Which metric category best captures this measurement?

Accepted Answer

Mean Time to Acknowledge (MTTA). Mean Time to Acknowledge (MTTA) is a core incident response metric measuring the latency between incident creation and the first human interaction or acknowledgment, reflecting triage efficiency.

Answer

False Positive Rate (FPR)

Answer

Mean Time to Resolution (MTTR)

Answer

Mean Time to Contain (MTTC)

Question 14

An architect is setting up continuous monitoring of SOC performance metrics in Cortex XSIAM. They want to ensure that incident backlog growth is detected before it impacts analyst morale and SLA compliance. Which derived metric should be established?

Accepted Answer

Net Backlog Growth Rate (Incoming Incidents minus Resolved Incidents over time). Net Backlog Growth Rate is the derived metric that captures the delta between incoming incidents and resolved incidents over a time window. A positive trend signals the SOC is falling behind, which directly predicts SLA breaches and analyst burnout — exactly what the architect wants to detect early.

Answer

Cortex XDR License Expiration Countdown

Answer

WildFire Sample Submission Latency

Answer

Total Endpoint Disk Capacity Utilization

Question 15

An architect is designing an automated incident response workflow in Cortex XSOAR. When a critical phishing incident is reported, the playbook must automatically extract URLs, submit them to WildFire for analysis, and isolate the endpoint if malicious. Which integration instance is responsible for submitting the URL to WildFire within the XSOAR playbook?

Accepted Answer

WildFire v2 integration integration instance. The WildFire v2 integration instance in Cortex XSOAR is specifically designed to submit files and URLs to the WildFire cloud service for analysis. When the playbook needs to submit a URL for WildFire analysis, it calls the WildFire v2 integration's commands (e.g., wildfire-submit-url). This integration handles authentication, submission, and retrieval of the verdict.

Answer

Active Directory LDAP integration

Answer

Prisma Cloud compliance integration

Answer

Panorama threat-feed integration