SecOps-Architect Practice Test 18 — 15 Questions

Question 1

An architect is establishing baselines for Security Operations Center (SOC) performance metrics. Which THREE operational factors must be accounted for to ensure the baseline accurately reflects normal operating conditions? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analyst shift schedules and staffing level variations. Option A is correct because SOC baselines must account for analyst shift schedules and staffing level variations, since detection, triage, and response throughput naturally dips during nights, weekends, and handoff periods, and ignoring these would skew metrics such as mean time to detect (MTTD) and mean time to respond (MTTR). Option C is correct because changes in enterprise asset inventory and attack surface scope directly alter alert volume and workload; onboarding new endpoints, cloud workloads, or external-facing services increases telemetry and incidents, so the baseline must be normalized to the monitored estate. Option E is correct because seasonal business cycles and holiday operational slowdowns change both attacker activity and internal user/change activity, producing predictable shifts in alert counts and response times that must be modeled rather than treated as anomalies. Option B is not relevant because office interior wall paint colors have no measurable effect on SOC telemetry, alert generation, or analyst performance. Option D is not relevant because the brand of coffee in the breakroom is a morale or comfort factor, not an operational variable that influences security monitoring metrics.

Answer

Office interior wall paint colors

Answer

The brand of coffee consumed in the SOC breakroom

Question 2

What is the primary value of tracking 'False Positive Rate' (FPR) as an operational security metric in a SOC?

Accepted Answer

It helps identify noisy detection rules that contribute to analyst fatigue and require tuning.. False Positive Rate measures the proportion of benign activity incorrectly flagged as malicious. Tracking FPR highlights noisy detection rules that generate excessive false alerts, driving analyst fatigue and eroding trust in the SOC. Tuning those rules reduces noise and improves operational efficiency.

Answer

It determines the exact number of active endpoints in Cortex XDR.

Answer

It calculates the physical power consumption of security appliances.

Answer

It measures the total network bandwidth consumed by the organization.

Question 3

A SecOps architect is rolling out a new 'automation coverage' KPI in Cortex XSOAR. The KPI must measure the proportion of incidents that were resolved without any manual analyst task, so leadership can track how much repetitive triage work automation has absorbed. Which definition should the architect implement?

Accepted Answer

Count of incidents closed with no analyst-assigned task divided by total incidents closed in the period.. Automation coverage should be expressed at the incident level, because the business question is how many incidents automation resolves end to end without analyst task assignment, divided by all closures in the window. Playbook-internal counters such as task success or trigger source measure mechanics rather than outcomes, and latency ratios measure speed rather than share of work absorbed.

Answer

Median time from incident creation to first automated task completion, expressed as a percentage of total incident duration.

Answer

Count of playbook tasks that completed successfully divided by total playbook tasks executed.

Answer

Count of playbook executions triggered by automation divided by total playbook executions.

Question 4

A security operations team tracks mean time to detect (MTTD) in Cortex XSIAM. Leadership notices MTTD improved sharply after the team enabled additional low-severity correlation rules, even though no detection engineering work changed. The architect must explain why the metric moved and how to keep it trustworthy. What is the most accurate explanation?

Accepted Answer

MTTD is measured from the first alert of any severity, so adding low-severity rules shifts the start timestamp earlier; the team should measure from the first high-severity or confirmed alert.. When MTTD starts at the first alert regardless of severity, adding low-severity correlation rules mechanically moves the start timestamp earlier and improves the number without better detection. Anchoring the measurement to the first high-severity or confirmed alert keeps the KPI tied to meaningful compromise signals and preserves comparability across periods.

Answer

MTTD improvement indicates the SOC's triage capacity increased, so the team should raise severity thresholds to preserve the gain.

Answer

Cortex XSIAM recalculates historical MTTD when new rules are enabled, so the improvement is a backfill artifact that should be ignored entirely.

Answer

Low-severity rules generate alerts earlier in the attack chain, so MTTD genuinely improves and no adjustment is needed.

Question 5

An architect is defining a set of metrics in Cortex XSIAM to evaluate the performance of the security operations center (SOC) in terms of incident containment and response efficiency. The SOC manager wants to track how quickly incidents are contained after detection and how efficiently analysts handle incidents. Which TWO metrics should be included? (Choose two.)

Accepted Answer

Mean Time to Contain (MTTC). Mean Time to Contain and Incidents Closed per Analyst per Day are the two metrics that directly address the SOC's containment speed and analyst efficiency. MTTC measures how quickly incidents are contained after detection, while incidents closed per analyst per day quantifies analyst productivity. Together, they provide a balanced view of response efficiency and workload handling.

Answer

Alert Volume

Answer

Mean Time to Detect (MTTD)

Answer

False Positive Rate

Question 6

An architect is configuring High Availability (HA) Active/Passive on two PA-5220 firewalls. During a failover event, active TCP sessions are maintained without requiring re-authentication. Which feature makes this possible?

Accepted Answer

HA2 session synchronization. HA2 is the dedicated HA link between Palo Alto firewalls used for synchronizing session state (and other stateful information) so that the passive peer already has the active TCP session table. When failover occurs, the passive firewall takes over with the session state intact, so established TCP sessions continue without re-authentication or re-handshake.

Answer

GlobalProtect cookie persistence

Answer

Dynamic DNS updates

Answer

Panorama configuration push

Question 7

An architect is designing an incident response communications plan for a major data breach affecting regulated customer data. Which TWO stakeholder groups must typically be included in the formal communication escalation matrix during high-severity incidents? (Choose two)

Accepted Answer

Corporate Communications / Public Relations. Corporate Communications / Public Relations (D) must be in the escalation matrix because a major breach of regulated customer data triggers reputational risk and requires coordinated, approved messaging to customers, media, and the public, and in many jurisdictions breach notification timelines and content are prescribed by law. Legal Counsel / Privacy Officer (E) is essential because regulated data breaches invoke mandatory notification duties under laws such as GDPR, HIPAA, or state breach-notification statutes, and legal privilege plus regulatory reporting decisions must be managed by counsel. The building facilities management team (A) is not a formal breach-notification stakeholder; its role is physical building operations, not incident communications. Internal cafeteria catering staff (B) have no incident response or regulatory communication responsibility. Third-party software vendors of unrelated office productivity tools (C) are out of scope because they neither process the affected regulated data nor own breach notification obligations for this incident.

Answer

Building facilities management team

Answer

Internal cafeteria catering staff

Answer

Third-party software vendors of unrelated office productivity tools

Question 8

An architect is designing an integration between Prisma Cloud and AWS to perform Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) scanning. Which TWO AWS architectural permissions or resources must be established for complete CSPM and CWPP integration? (Choose two)

Accepted Answer

An AWS IAM Role configured with SecurityAudit and read-only access policies, secured via an External ID.. Option A is correct because Prisma Cloud's CSPM/CWPP integration requires a cross-account AWS IAM Role that the platform assumes to inventory and assess resources; the SecurityAudit managed policy plus read-only policies grant the necessary visibility, and the External ID enforces the confused-deputy safeguard required by AWS for third-party access. Option C is correct because ingesting AWS CloudTrail API audit logs into Prisma Cloud provides the account activity and event telemetry needed for real-time threat detection, runtime/network segmentation visibility, and audit-based posture monitoring. Options B, D, and E are incorrect because AWS is a managed cloud service: customers never receive root SSH access to the hypervisor management plane, cannot modify VPC router BIOS/firmware, and have no physical access to serial consoles in AWS data centers—none of these are valid or possible integration mechanisms.

Answer

Direct root SSH access to the AWS hypervisor management plane.

Answer

Modifying the AWS VPC core router BIOS code.

Answer

Physical serial console cables plugged into AWS data center racks.

Question 9

A SOC architect at a healthcare provider is mapping detection coverage to the MITRE ATT&CK framework using Cortex XSIAM. The CISO wants a heat map that shows which adversary techniques are covered by existing analytics and which are blind spots, using the native ATT&CK coverage view. Which prerequisite must the architect satisfy for techniques to be correctly attributed in that view?

Accepted Answer

Each analytics rule must be tagged with the corresponding ATT&CK technique IDs. The ATT&CK coverage heat map in Cortex XSIAM is generated from technique metadata attached to detection content. Tagging each analytics rule with the specific MITRE technique IDs it detects is what lets the platform attribute coverage and reveal blind spots. Other telemetry or licensing actions do not affect how techniques are mapped in the native view.

Answer

Every detection rule must be converted into a correlation rule with a severity threshold

Answer

The healthcare organization must subscribe to a commercial ATT&CK intelligence feed

Answer

All endpoints must forward full packet capture to the XSIAM broker

Question 10

An organization is integrating Cortex XSIAM with third-party security tools for automated remediation. Which THREE mechanisms are supported for triggering external actions from XSIAM/XSOAR? (Choose three)

Accepted Answer

Leveraging Python automation scripts using the Demisto/XSOAR API library. Option A is correct because XSIAM/XSOAR supports custom Python automation scripts that use the Demisto/XSOAR API library (demisto-sdk / demisto-py) to programmatically trigger external actions and orchestrate third-party tools. Option C is correct because playbooks can execute integration commands (built-in or custom integrations) to invoke actions on external security tools as part of automated remediation workflows. Option D is correct because HTTP Request automation scripts allow XSIAM/XSOAR to call external webhooks over HTTP/HTTPS, enabling outbound triggers to third-party systems. Options B and E are incorrect because physical rewiring of Ethernet patch panels and punch cards are hardware/manual operations unrelated to XSIAM/XSOAR automation capabilities.

Answer

Direct physical rewiring of Ethernet patch panels

Answer

Inserting punch cards into magnetic readers

Question 11

An architect is configuring High Availability (HA) on Palo Alto Networks firewalls. Which TWO failure conditions can trigger an automatic HA failover in an Active/Passive deployment? (Choose two)

Accepted Answer

Link monitoring failure (loss of connectivity on a monitored critical interface).. Option A is correct because Palo Alto Networks HA link monitoring (via the Link Monitoring and Path Monitoring settings) detects loss of connectivity on a monitored critical interface and, if the failure threshold is exceeded, triggers a failover to the passive peer. Option C is correct because the HA1 link carries the heartbeat and control communication between peers; losing the HA1 heartbeat causes the peer to be declared down and initiates failover to the passive firewall. Option B is incorrect because a Panorama software inventory check is a management/reporting task and has no role in HA failover decisions. Option D is incorrect because changing the hostname is a configuration change that does not by itself trigger an HA failover. Option E is incorrect because changing the GUI theme color is purely cosmetic and has no effect on HA state or failover.

Answer

A scheduled Panorama software inventory check.

Answer

Changing the firewall hostname string.

Answer

An administrator manually changing the firewall GUI theme color from dark to light mode.

Question 12

An architect is designing an integrated security architecture combining Prisma Cloud and Palo Alto Networks NGFWs. Which TWO architectural capabilities does this integration provide? (Choose two)

Accepted Answer

Providing end-to-end visibility and compliance posture for multi-cloud resources alongside network threat protection.. Option B is correct because the Prisma Cloud and Palo Alto Networks NGFW integration is designed to deliver end-to-end visibility and compliance posture across multi-cloud resources (AWS, Azure, GCP) while combining that with the NGFW's network threat protection, giving security teams a unified view of cloud misconfigurations and active threats. Option C is correct because the integration shares cloud workload context and security tags (such as VM name, account, VPC, and custom tags) from Prisma Cloud with the NGFWs, enabling dynamic, metadata-driven policy enforcement so firewall rules can automatically adapt as cloud workloads change. Option A is incorrect because the integration is a software/API-level security capability, not a physical cabling solution for connecting AWS data centers to corporate offices. Option D is incorrect because GlobalProtect gateway software is not deployed inside S3 storage buckets; S3 is object storage, not a compute platform for running gateway services. Option E is incorrect because the integration does not replace NGFW data plane processors with software container pods; the NGFWs retain their hardware/software data plane while consuming cloud context from Prisma Cloud.

Answer

Physically connecting AWS data centers to corporate offices using copper Ethernet cables.

Answer

Running GlobalProtect gateway software inside AWS S3 storage buckets.

Answer

Replacing all firewall data plane processors with software container pods.

Question 13

An architect is integrating Cortex XSIAM with ServiceNow to automatically create IT service management (ITSM) tickets when incidents are promoted. Where is the field mapping between Cortex XSIAM incident fields and ServiceNow incident fields configured?

Accepted Answer

ServiceNow Integration Instance Mapper configuration. In Cortex XSIAM, field mapping between XSIAM incident fields and ServiceNow incident fields is configured in the ServiceNow integration instance's Mapper configuration. This mapper defines how XSIAM incident data is transformed and populated into ServiceNow ITSM ticket fields when an incident is promoted. The other options relate to unrelated features (ML thresholds, syslog forwarding, endpoint agent policies) and have no role in ITSM field mapping.

Answer

Magnifier machine learning threshold slider

Answer

Syslog server forwarding configuration

Answer

Cortex XDR Agent policy settings

Question 14

Which metric category is primarily used to evaluate the financial and operational cost savings delivered by a security orchestration and automation (SOAR) implementation?

Accepted Answer

Hours Saved through Automation / Manual Labor Hours Reclaimed. SOAR platforms are justified to leadership primarily through operational efficiency gains, and the standard metric for that is the number of analyst hours reclaimed by automating repetitive tasks like alert triage, enrichment, and response playbooks. 'Hours Saved through Automation / Manual Labor Hours Reclaimed' directly quantifies the labor cost reduction that translates into financial and operational ROI. This is the metric SOAR vendors and SecOps architects use in business cases to demonstrate value.

Answer

Firewall Packet Inspection Latency

Answer

Endpoint Agent Crash Frequency

Answer

Threat Intelligence Feed Ingestion Bandwidth

Question 15

A security operations architect is building a Cortex XSIAM dashboard to track the operational health of the automation layer. The SOC wants to know how often playbooks complete without manual intervention versus how often they fail or time out. Which metric should the architect implement to directly quantify the reliability of automated response execution?

Accepted Answer

Playbook Success Rate. Playbook Success Rate is the metric that directly captures whether automated response executions complete as intended. By comparing successful runs against total runs, it surfaces failures and timeouts that undermine automation dependability. MTTD, alert volume, and analyst utilization describe detection speed, workload, and alert throughput respectively, none of which measure execution outcomes. For an operational health view of the automation layer, execution success is the defining reliability indicator.

Answer

Analyst Utilization Rate

Answer

Mean Time to Detect (MTTD)

Answer

Alert Volume Trend