SecOps-Architect Practice Test 19 — 15 Questions

Question 1

An architect is deploying a Palo Alto Networks VM-Series firewall in a Microsoft Azure environment to protect a multi-tier application. The application uses Azure Load Balancer to distribute traffic to web servers, and the firewall must inspect traffic between the load balancer and the web servers. The architect needs to ensure that the firewall can see the original client IP address for logging and policy enforcement. Which Azure feature should the architect configure to preserve the client IP?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Gateway Load Balancer to insert the VM-Series firewall in the traffic path and preserve the original source IP.. Azure Gateway Load Balancer is purpose-built for chaining NVAs. It encapsulates traffic using Geneve and forwards it to the NVA, preserving the original packet headers. The VM-Series firewall can decapsulate the Geneve traffic and inspect the original packets, seeing the real client IP. This enables accurate logging and policy enforcement without modifying the application or load balancer configuration.

Answer

Configure Azure Load Balancer to use Direct Server Return (DSR) mode.

Answer

Enable Floating IP on the Azure Load Balancer and configure the VM-Series with a loopback interface.

Answer

Configure the Azure Load Balancer to use the HA Ports rule and enable TCP flow symmetry.

Question 2

A security operations architect is reviewing metrics for a Cortex XSIAM deployment. The SOC manager wants to understand the proportion of alerts that are escalated to incidents versus those that are closed as benign. Which metric should the architect recommend?

Accepted Answer

Escalation Rate. Escalation Rate is the metric that specifically tracks the percentage of alerts that are escalated to incidents. It provides a clear view of how many alerts require further investigation versus those resolved as benign at the alert level. This helps the SOC manager understand triage efficiency and workload distribution.

Answer

False Positive Rate

Answer

Alert Closure Rate

Answer

True Positive Rate

Question 3

A SOC manager wants to standardize how analysts document and share threat intelligence about a newly observed malware family. The architect recommends using the Structured Threat Information Expression (STIX) format. Which statement best describes the primary purpose of STIX in a security operations architecture?

Accepted Answer

It provides a standardized language for describing cyber threat intelligence so it can be shared consistently across tools and organizations.. STIX is an open, standardized language for expressing cyber threat intelligence, covering indicators, malware, campaigns, and their relationships. Its purpose is consistent representation so that different platforms and organizations can share and consume intelligence without custom mappings. Transport and authentication are handled by TAXII, and correlation or storage is the job of analytics platforms and threat intelligence platforms respectively.

Answer

It replaces the need for a SIEM by automatically correlating events across multiple data sources.

Answer

It defines the transport protocol and authentication methods used to exchange threat data between platforms.

Answer

It enforces a specific threat intelligence platform vendor's data model for storing indicators.

Question 4

An architect is designing a metrics program for a Cortex XSIAM deployment. The CISO wants to understand the financial impact of security incidents by measuring the average cost incurred per incident, including analyst time, tool usage, and business disruption. Which approach should the architect take to operationalize this metric?

Accepted Answer

Calculate the average cost per incident by integrating Cortex XSIAM incident data with financial systems and applying a cost model that includes analyst hours, tool licensing, and business impact estimates.. The correct approach integrates Cortex XSIAM incident data with financial systems and a tailored cost model. This captures analyst time, tool usage, and business impact, providing an accurate average cost per incident. It enables the CISO to make informed decisions about security investments and demonstrate financial accountability.

Answer

Use the Mean Time to Resolution (MTTR) multiplied by a fixed hourly rate to estimate the cost per incident.

Answer

Measure the total cost of the security operations center (SOC) and divide by the number of incidents handled.

Answer

Track the number of incidents per month and multiply by the average cost of a data breach from industry reports.

Question 5

An architect is deploying Panorama and needs to manage firewalls deployed across different geographic regions with distinct administrative teams. Each team should only be able to view and manage their own local firewalls and policies, but global security rules must apply to all. Which Panorama structural feature should the architect implement?

Accepted Answer

Device Groups combined with Administrator Roles and Access Domains.. Panorama uses Device Groups and Administrative Roles/Domains to implement role-based access control (RBAC) and logical grouping for multi-tenancy or regional separation.

Answer

Multiple virtual routers inside a single device group.

Answer

Separate Panorama virtual appliances for each region configured in an HA mesh cluster.

Answer

Dynamic Address Groups with tag-based RBAC.

Question 6

A SOC architect is designing a threat response architecture that must align with the MITRE ATT&CK framework and support automated containment. The organization wants to ensure that detection, enrichment, and response actions are consistently mapped to adversary tactics and techniques. Which TWO design practices should the architect implement to achieve this alignment? (Choose two.)

Accepted Answer

Map response playbooks to the ATT&CK tactics they mitigate so the correct playbook is selected per incident. Aligning detection and response with ATT&CK requires explicit mappings in both directions. Tagging detection rules with technique IDs establishes what the SOC can see, while mapping response playbooks to the tactics they mitigate establishes what the SOC can do about it. Together these practices enable gap analysis, consistent playbook selection, and defensible reporting, which severity-only or manual approaches cannot provide.

Answer

Rely on analyst experience to manually choose the correct response action for each incident

Answer

Adopt a single universal containment playbook that isolates every endpoint involved in any alert

Answer

Configure automated containment playbooks that trigger on severity alone without reference to the technique involved

Question 7

A security architect is designing a metrics program for a Cortex XSIAM deployment. The SOC wants to measure the effectiveness of its incident response process by tracking the percentage of incidents that are resolved within the defined Service Level Agreement (SLA) targets. Which metric should the architect implement?

Accepted Answer

SLA Compliance Rate. SLA Compliance Rate is the metric that calculates the percentage of incidents resolved within defined SLA targets. It directly answers the SOC's need to measure adherence to service commitments. MTTR, Incident Volume, and First Contact Resolution Rate provide different insights—average resolution time, workload, and initial resolution efficiency—but none directly quantify SLA compliance. Thus, SLA Compliance Rate is the correct choice.

Answer

First Contact Resolution Rate

Answer

Incident Volume

Answer

Mean Time to Resolve (MTTR)

Question 8

A security architect needs to create a custom dashboard widget in Cortex XSOAR to track the average duration of phishing incident investigations over the last quarter. Which widget type should the architect select to display this time-series metric trend over a date range?

Accepted Answer

Line widget. A line widget in Cortex XSOAR is designed to display trends over time, making it ideal for tracking duration metrics chronologically.

Answer

Pie widget

Answer

Counter widget

Answer

Bar widget

Question 9

An architect is designing an enterprise threat hunting program utilizing Cortex XSIAM. They want to create a custom analytics rule that triggers when a specific sequence of three distinct event types occurs within a 10-minute window on the same endpoint. Which feature should be used?

Accepted Answer

XQL Correlation Rules (Sequence matching). XQL Correlation Rules with sequence matching is the correct feature because it is purpose-built in Cortex XSIAM to detect ordered or unordered sequences of distinct events occurring within a defined time window across a shared entity such as an endpoint. The rule engine correlates multiple event types (e.g., process creation, network connection, registry modification) using join/sequence semantics and a sliding window, which is exactly what the architect needs. Static blocklists, email parsing, and agent local analysis cannot express multi-event temporal correlation logic.

Answer

Static IP Blocklist configuration

Answer

XSOAR Email Parsing Rules

Answer

Cortex XDR Agent Local Analysis settings

Question 10

A SOC manager wants to track the team's efficiency in resolving incidents. The manager asks the architect to define a metric that measures the average time from incident creation to incident closure in Cortex XSIAM. Which metric should the architect implement?

Accepted Answer

Mean Time to Resolve (MTTR). Mean Time to Resolve (MTTR) is specifically designed to measure the average duration from incident creation to closure. It is a core SOC efficiency metric that Cortex XSIAM can calculate automatically using incident timestamps. MTTD, MTTA, and MTBF focus on detection speed, initial response, and system reliability respectively, none of which match the manager's requirement for resolution time.

Answer

Mean Time to Detect (MTTD)

Answer

Mean Time to Acknowledge (MTTA)

Answer

Mean Time Between Failures (MTBF)

Question 11

An architect is troubleshooting an issue where Palo Alto Networks VM-Series firewalls deployed in AWS are experiencing asymmetric routing issues across multiple network interfaces. Which AWS networking construct must be correctly configured to ensure traffic enters and exits through the correct firewall data interface?

Accepted Answer

AWS Route Tables associated with subnets pointing traffic to specific Elastic Network Interfaces (ENIs).. AWS Route Tables (specifically custom Route Tables associated with subnets and Elastic Network Interfaces) dictate traffic flow to and from VM-Series interfaces.

Answer

Panorama Template stack backup schedules.

Answer

Palo Alto Networks Management interface static default gateway.

Answer

AWS Security Groups blocking all inbound ports.

Question 12

A security operations architect is designing a threat intelligence program that follows the intelligence cycle. The architect must ensure that the program effectively supports decision-making for the SOC team. Which phase of the intelligence cycle involves defining the intelligence requirements and planning the collection of data to meet those requirements?

Accepted Answer

Direction. The intelligence cycle starts with the Direction phase, where requirements are defined and collection is planned. This phase ensures that subsequent collection and analysis are focused on the needs of decision-makers, which is essential for an effective threat intelligence program in a SOC.

Answer

Collection

Answer

Processing

Answer

Dissemination

Question 13

An architect must present a monthly operational review showing whether the SOC's incident response process is becoming more efficient over time. The team wants a single trend metric that normalizes for changes in incident volume, so that a busy month does not automatically look worse than a quiet one. Which metric best meets this need?

Accepted Answer

Median time from incident creation to containment per incident. A trend metric for efficiency must be normalized so that incident volume does not distort comparisons. Median time to containment per incident achieves this because each incident contributes one duration, making busy and quiet months directly comparable. Raw totals of closures, staffing counts, and playbook executions all vary with volume or reflect inputs, so none can reliably show whether the response process itself is improving.

Answer

Total number of incidents closed during the month

Answer

Count of analysts assigned to the incident response queue each day

Answer

Total number of playbooks executed across all incidents

Question 14

A security operations team is implementing metrics to measure the performance of its Cortex XSOAR automation. The team wants to track the time saved by automation compared to manual execution. Which metric should they use to quantify the efficiency gain from automation?

Accepted Answer

Time Saved by Automation. Time Saved by Automation is the only metric that directly compares automated and manual execution times, providing a clear quantification of efficiency gain. Other metrics like Automation Rate or MTTR Reduction do not isolate the time savings attributable to automation.

Answer

Automation Rate

Answer

Playbook Execution Time

Answer

Mean Time to Resolution (MTTR) Reduction

Question 15

A SecOps architect for a managed security service provider (MSSP) needs to report on the efficiency of automated playbooks in Cortex XSOAR. The MSSP wants to know how much manual analyst effort is being saved by automation. Which metric best represents the percentage of tasks within a playbook that were executed automatically without human intervention?

Accepted Answer

Automation Coverage Rate. Automation Coverage Rate is the appropriate metric because it directly quantifies the proportion of playbook tasks executed automatically, which is exactly what the MSSP needs to measure manual effort saved. Other metrics like MTTA or success rate do not capture the extent of automation within playbooks.

Answer

Playbook Execution Success Rate

Answer

Mean Time to Acknowledge (MTTA)

Answer

Analyst Utilization Rate