SecOps-Architect Practice Test 2 — 10 Questions

Question 1

Which TWO practices ensure that security metric reports generated from Cortex XSIAM remain meaningful and actionable over time? (Choose two)

Accepted Answer

Assigning clear accountability and ownership for actioning insights generated by the reports. Meaningful reporting requires regular review and tuning of metric thresholds to match organizational growth, and establishing clear ownership for actioning insights derived from the reports.

Answer

Eliminating all historical trend data every 24 hours

Answer

Restricting dashboard access solely to external auditors

Answer

Archiving all metric reports into unreadable binary formats with no search capability

Question 2

What is the primary value of tracking 'False Positive Rate' (FPR) as an operational security metric in a SOC?

Accepted Answer

It helps identify noisy detection rules that contribute to analyst fatigue and require tuning.. Tracking FPR helps identify noisy detection rules that waste analyst time, driving alert tuning and rule refinement.

Answer

It determines the exact number of active endpoints in Cortex XDR.

Answer

It calculates the physical power consumption of security appliances.

Answer

It measures the total network bandwidth consumed by the organization.

Question 3

When designing an operational dashboard in Cortex XSIAM to monitor SOC analyst workload distribution, which metric is most useful?

Accepted Answer

Number of assigned open incidents per analyst. Tracking open incidents per analyst or incidents closed per shift helps supervisors identify workload imbalances and burnout risks.

Answer

WildFire malicious verdict percentage

Answer

Cortex XDR agent version distribution

Answer

Total firewall throughput in gigabits per second

Question 4

When designing a comprehensive security metrics dashboard in Cortex XSIAM for C-level executives, which THREE categories of metrics should be included to provide a balanced view of security posture? (Choose three)

Accepted Answer

Risk and Vulnerability Exposure Trends. Executive dashboards require a balance of risk posture, operational efficiency (such as MTTR/MTTD), and coverage/visibility metrics rather than low-level technical granular data.

Answer

Individual firewall rule line numbers and syntax formatting

Answer

Cortex XSOAR playbook Python script syntax errors

Question 5

Which TWO metrics are commonly used to measure the impact and ROI of a Cortex XSOAR implementation in a SOC? (Choose two)

Accepted Answer

Reduction in Mean Time to Resolve (MTTR) for standard incident types. ROI and impact for SOAR are measured by tracking reductions in Mean Time to Resolve (MTTR) and increases in automation rates (hours saved).

Answer

Total gigabytes of firewall log traffic archived per month

Answer

WildFire file detonation queue length

Answer

Number of physical security badge swipes at the SOC entrance

Question 6

A security architect is integrating Cortex XDR with an on-premises Palo Alto Networks NGFW via the Syslog Collector. The XDR agent is installed on endpoints, but network-based detections from the firewall are not appearing in the Cortex XDR Incident Viewer. What is the most likely root cause of this integration failure?

Accepted Answer

The firewall Syslog Server profile is missing the correct custom log format or CEF mapping required by Cortex XDR.. Integration requires proper forwarding format (LEEFT/CEF) and correct log forwarding profile mapping so the Cortex XDR agent or Broker VM successfully ingests and parses the syslog stream.

Answer

The firewall's WildFire public cloud connection is disabled.

Answer

The firewall management plane CPU is running above 90%, causing it to drop all syslog packets.

Answer

Cortex XDR requires an explicit PAN-OS XML API credential rather than syslog to ingest firewall alerts.

Question 7

Which tool within Cortex XSIAM allows an architect to build customized graphical widgets and dashboards for tracking operational metrics?

Accepted Answer

Cortex XSIAM Dashboards and Widget Builder. Cortex XSIAM provides built-in Dashboards and BIQL-powered widget builders for visualizing security metrics and operational KPIs.

Answer

Prisma Access Cloud Management

Answer

Panorama Policy Optimizer

Answer

WildFire Web Portal

Question 8

An architect is designing an executive security operations dashboard using Cortex XSIAM to report on security posture trends. Which TWO metrics are essential to include when demonstrating operational scalability and capacity management to senior leadership? (Choose two)

Accepted Answer

Alert Volume vs. Incident Conversion Rate. Analyst Workload Capacity and Alert Volume vs. Incident Conversion Rate directly demonstrate how well the SOC handles scaling workloads without compromising effectiveness.

Answer

Active directory domain controller CPU temperatures

Answer

Local firewall packet drop counts

Answer

Cortex XDR agent installation deployment scripts

Question 9

An architect is configuring Cortex XSOAR incident automation. Which TWO core components are fundamental to building an effective XSOAR playbook? (Choose two)

Accepted Answer

Integration instances that execute specific API commands against third-party and Palo Alto Networks tools.. Cortex XSOAR playbooks consist of tasks, integration commands, conditions, scripts, and inputs/outputs to orchestrate incident response workflows.

Answer

Panorama Dynamic Address Group tags used as storage databases.

Answer

Physical firewall interface cards plugged into the XSOAR server PCI slots.

Answer

Direct kernel-level device drivers installed on the XSOAR server operating system.

Question 10

An architect is troubleshooting why security metric trends in Cortex XSIAM appear erratic and unreliable. Which THREE factors commonly cause metric distortion in a SOC? (Choose three)

Accepted Answer

Intermittent log ingestion pipeline failures or collector outages. Metric distortion is frequently caused by log source ingestion failures, inconsistent log parsing/normalization, and sudden shifts in business operations or endpoint coverage.

Answer

Configuring browser bookmarks for dashboard access

Answer

Using dark mode instead of light mode in the Cortex XSIAM web UI