SecOps-Architect Practice Test 14 — 15 Questions

Question 1

An architect is designing a metric to measure the 'Automation Coverage' of incident response in Cortex XSOAR. The metric is defined as the percentage of incidents that were fully resolved by automated playbooks without human intervention. The architect notices that some incidents are closed by playbooks but still require manual approval steps. The organization wants the metric to exclude incidents that required any human approval, even if the playbook completed the remediation. Which Cortex XSOAR feature should the architect use to accurately identify incidents that were fully automated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Query the incident's playbook execution log for tasks of type 'Manual Approval' or 'Manual Task' and exclude incidents where any such task was completed by a user.. To accurately measure fully automated incident resolution, the architect must inspect the playbook execution log for manual approval or manual task completions by users. This data is natively captured in Cortex XSOAR and provides an auditable trail of human intervention. Excluding incidents with any such tasks ensures the automation coverage metric reflects only those resolved end-to-end without human input.

Answer

Filter incidents by the 'Playbook Run Status' field set to 'Completed' and assume all such incidents are fully automated.

Answer

Use the 'Manual Intervention' flag that is automatically set when an analyst interacts with a playbook task.

Answer

Configure a custom incident field that is set to 'true' only if no analyst logs into the Cortex XSOAR UI during the incident's lifetime.

Question 2

A security architect is mapping the SOC's detection and response capabilities to the MITRE ATT&CK framework. The CISO wants to know which adversary tactic is most directly addressed by correlating endpoint process creation events with network connection events in Cortex XDR. Which ATT&CK tactic does this correlation primarily support?

Accepted Answer

Command and Control. Pairing process creation with network connection events exposes which executables are generating outbound traffic, the defining signal of Command and Control. Cortex XDR's causality chain links the initiating process to its remote destinations, enabling detection of beaconing and unauthorized egress. The other tactics either occur earlier in the kill chain or rely on different telemetry, so Command and Control is the correct mapping.

Answer

Initial Access

Answer

Persistence

Answer

Privilege Escalation

Question 3

A security architect at a financial services firm is designing a threat intelligence sharing program. The firm wants to automatically ingest high-fidelity indicators of compromise (IOCs) from an external partner into Cortex XSOAR to enrich alerts. The architect must select a standard that defines a structured, machine-readable format for representing cyber threat intelligence, including indicators, observed data, and relationships. Which standard should the architect choose?

Accepted Answer

STIX 2.1. STIX 2.1 is the correct choice because it provides a standardized, machine-readable format for representing cyber threat intelligence, including indicators, observed data, and relationships. It is specifically designed for automation and is widely adopted in threat intelligence sharing, enabling Cortex XSOAR to ingest and act on IOCs from external partners efficiently.

Answer

CybOX

Answer

TAXII 2.1

Answer

OpenIOC

Question 4

A SOC architect is defining the containment step in the incident response lifecycle for ransomware affecting a single endpoint. The endpoint is managed by Cortex XDR and is still communicating with its command-and-control server. Which action best satisfies immediate containment while preserving forensic evidence?

Accepted Answer

Isolate the endpoint using the Cortex XDR network isolation capability, which blocks all network traffic except the management channel.. Network isolation through Cortex XDR cuts off the C2 channel while preserving the agent's management path, allowing remote forensic collection and analyst control. Reimaging, powering off, and deleting files either destroy evidence or fail to stop live adversary communication. Isolation is the standard containment action that balances stopping the threat with retaining investigative data.

Answer

Delete the malicious files identified by the Cortex XDR alert and continue monitoring the endpoint.

Answer

Power off the endpoint to stop encryption and prevent further C2 communication.

Answer

Immediately reimage the endpoint to remove the ransomware and restore it to a known-good state.

Question 5

An architect is defining severity scoring for a SOC that consumes vulnerability data from multiple scanners. Leadership wants scores that reflect exploitability in the wild rather than only theoretical severity. Which framework should the architect adopt as the primary prioritization input for this requirement?

Accepted Answer

Exploit Prediction Scoring System (EPSS) combined with CISA's Known Exploited Vulnerabilities catalog. EPSS provides a forward-looking probability of exploitation, while the CISA KEV catalog confirms exploitation has already occurred. Combining them prioritizes vulnerabilities that matter in the wild, which is the stated requirement. CVSS base scores, OWASP categories, and CWE frequencies describe severity, risk classes, or weakness types rather than real-world exploitation likelihood.

Answer

Common Vulnerability Scoring System (CVSS) base score alone

Answer

Common Weakness Enumeration (CWE) identifier frequency across the environment

Answer

Open Web Application Security Project (OWASP) Top 10 category ranking

Question 6

A security operations architect is establishing a metrics framework in Cortex XSIAM to measure the efficiency of the incident triage process. The SOC manager wants to know the average time it takes for an analyst to acknowledge an incident after it is created. Which metric should the architect implement?

Accepted Answer

Mean Time to Acknowledge (MTTA). The SOC manager wants the average time from incident creation to analyst acknowledgment, which is precisely Mean Time to Acknowledge (MTTA). MTTR covers the full resolution cycle, MTTD measures detection speed, and Dwell Time measures attacker presence; none isolate the acknowledgment step. MTTA is the correct metric for triage efficiency.

Answer

Mean Time to Resolve (MTTR)

Answer

Incident Dwell Time

Answer

Mean Time to Detect (MTTD)

Question 7

An architect is designing a security operations architecture where a Palo Alto Networks NGFW must forward all traffic logs and threat logs to an external syslog server at 10.10.20.5 using TCP port 514. The firewall is managed by Panorama. The architect needs to ensure that logs are sent in a structured format that includes all fields. Which configuration should the architect use?

Accepted Answer

Configure a Syslog server profile with the server address, transport TCP, port 514, and format IETF.. The requirement is to send logs to an external syslog server using TCP port 514 in a structured format that includes all fields. Palo Alto Networks firewalls support syslog formats: BSD, IETF, and CEF. IETF format is structured and includes all fields, while BSD is unstructured and CEF includes only a subset. Therefore, configuring a syslog server profile with IETF format over TCP port 514 meets the requirement.

Answer

Configure a Syslog server profile with the server address, transport SSL, port 6514, and format IETF.

Answer

Configure a Syslog server profile with the server address, transport TCP, port 514, and format CEF.

Answer

Configure a Syslog server profile with the server address, transport TCP, port 514, and format BSD.

Question 8

A security operations architect is designing a threat response architecture that integrates Cortex XSOAR with various security tools. The architect must ensure that the playbooks can automatically gather enriched context from external sources and make informed decisions. Which TWO components are essential for enabling automated enrichment and decision-making in Cortex XSOAR playbooks? (Choose two.)

Accepted Answer

Integrations. Integrations provide the external connectivity and commands needed to enrich data, while Playbook Tasks define the logic and sequence of actions that use that data to make decisions. Together, they enable automated enrichment and decision-making in Cortex XSOAR playbooks. The other components support organization and visualization but are not directly involved in the automation logic.

Answer

Dashboards

Answer

Indicator Types

Answer

Incident Types

Question 9

An architect is integrating Prisma Access with a cloud-native SOAR platform. The SOAR needs to pull Prisma Access traffic, threat, and URL filtering telemetry on a recurring schedule, and the architect must choose the most reliable, supported collection method that avoids vendor lock-in to a specific SIEM. Which integration approach should the architect select?

Accepted Answer

Use the Prisma Access Cortex Data Lake Query API to retrieve logs programmatically on a schedule.. The Cortex Data Lake Query API is the supported programmatic interface for retrieving Prisma Access telemetry, giving the SOAR a scheduled, paginated pull that avoids SIEM lock-in and delivers normalized records. Push-based syslog, direct collector disk access, and email parsing either lack reliability, lack support, or cannot scale to the required log volume.

Answer

Deploy a dedicated Log Collector VM in the VPC and query its local disk for historical telemetry.

Answer

Configure a syslog forwarding profile on Prisma Access to send logs to the SOAR's syslog receiver.

Answer

Enable email notifications from Prisma Access for each log type and parse the resulting mailbox.

Question 10

An architect is deploying Cortex XDR to protect endpoints across a hybrid environment. The security team wants to ensure that if an endpoint loses connectivity to the Cortex XDR management console, it continues to enforce security policies and can later upload forensic data. Which Cortex XDR component provides this capability?

Accepted Answer

Cortex XDR agent with local policy caching. The Cortex XDR agent is designed to operate autonomously when disconnected from the management console. It caches policies locally, so security enforcement continues uninterrupted. Additionally, it stores endpoint telemetry and forensic data locally, then uploads it once connectivity is restored. This ensures both protection and data integrity during network outages, which is critical for remote or hybrid endpoints.

Answer

Cortex XDR agent with cloud-based policy enforcement

Answer

Cortex XDR Broker VM

Answer

Cortex XDR management console with high availability

Question 11

A financial services SOC is architecting a threat response workflow in Cortex XSOAR that must query an internal threat intelligence platform, enrich indicators, and automatically create a blocklist entry only when the indicator's confidence score exceeds a defined threshold. The architect needs the playbook to evaluate the score and conditionally branch without writing custom Python. Which mechanism should be used?

Accepted Answer

A conditional task that evaluates the confidence score and routes execution to a blocklist branch. Conditional tasks are the native Cortex XSOAR construct for evaluating task outputs with built-in operators and routing execution down the appropriate branch. Comparing the enrichment confidence score to the threshold inside a conditional task lets the playbook block only qualifying indicators, achieving threshold-based automation without custom Python.

Answer

A data collection task that stores the score in the incident context for later review

Answer

A manual task assigned to a Tier 2 analyst to review the score and click approve

Answer

A sub-playbook that always executes the blocklist integration command

Question 12

A security architect is defining the incident response lifecycle for a new SOC. The organization wants to align with the NIST SP 800-61 framework. The architect must ensure that the SOC follows the correct sequence of phases. Which of the following represents the correct order of the incident response lifecycle phases according to NIST SP 800-61?

Accepted Answer

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. NIST SP 800-61 outlines the incident response lifecycle in four sequential phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. This order ensures a structured and effective response. Preparation establishes the necessary capabilities, Detection and Analysis identifies and understands the incident, Containment and Recovery mitigates the threat, and Post-Incident Activity captures lessons learned. Any deviation from this order would disrupt the logical flow of incident handling.

Answer

Containment, Eradication, and Recovery; Detection and Analysis; Preparation; Post-Incident Activity

Answer

Detection and Analysis; Preparation; Containment, Eradication, and Recovery; Post-Incident Activity

Answer

Preparation; Containment, Eradication, and Recovery; Detection and Analysis; Post-Incident Activity

Question 13

A SOC architect must design a response architecture where automated playbooks can isolate endpoints, disable user accounts, and block domains without a human approving each action. Legal has mandated that every automated containment action be attributable to a named analyst, that actions be reversible, and that a full audit trail exist. Which architectural control best satisfies these requirements while preserving automation speed?

Accepted Answer

Implement just-in-time privileged role assumption per analyst with session recording, paired with playbook actions that capture pre-change state for rollback. Attribution, reversibility, and auditability can all be met without sacrificing speed by scoping privileged access to individual analysts through just-in-time role assumption, recording sessions for the audit trail, and designing playbook actions that snapshot prior state so they can be undone. Shared accounts break attribution, human approval gates break speed, and read-only credentials break the response capability entirely.

Answer

Configure the SOAR platform to run all containment playbooks under a shared service account with elevated permissions

Answer

Deploy read-only API credentials to the SOAR platform so playbooks cannot make destructive changes

Answer

Require dual human approval for every containment action before the playbook executes

Question 14

An architect is integrating Palo Alto Networks Prisma Access with an on-premises data center. The data center hosts critical applications that must be accessed by mobile users through Prisma Access. The architect needs to ensure that traffic from mobile users to the data center is inspected by security policies and that the data center's internal IP addresses are not exposed to the internet. Which Prisma Access component should be used?

Accepted Answer

Prisma Access Service Connection. The correct component is Prisma Access Service Connection. It establishes an IPsec tunnel between Prisma Access and the on-premises data center, enabling mobile users to securely access internal applications. Traffic is inspected by Prisma Access security policies, and the data center's private IP addresses are not exposed to the internet. This is the recommended architecture for integrating Prisma Access with a data center.

Answer

Prisma Access Remote Network

Answer

Prisma Access Mobile User

Answer

Prisma Access Explicit Proxy

Question 15

An architect is designing a multi-tenant environment where each tenant has its own Prisma Access tenant and needs to enforce consistent security policies across all tenants. The architect wants to centrally manage policies and push them to all tenants. Which Palo Alto Networks solution should be used?

Accepted Answer

Prisma Access Multitenancy with a parent tenant and child tenants. Prisma Access Multitenancy is specifically designed for managed security service providers and large enterprises that need to manage multiple tenants from a single pane of glass. A parent tenant can create policies that are inherited by child tenants, ensuring consistent security posture while maintaining tenant isolation. This native capability eliminates the need for manual policy duplication and reduces operational overhead.

Answer

Panorama with multiple device groups and template stacks

Answer

GlobalProtect with multiple portals and gateways

Answer

Cortex XSOAR with custom playbooks to push policies to each tenant