SecOps-Architect Practice Test 20 — 15 Questions

Question 1

A multinational SOC architect is building a threat response architecture that must correlate adversary behavior across endpoint, network, and cloud telemetry. The CISO wants detections expressed in a vendor-neutral format that can be shared with an external ISAC and mapped to a common adversary taxonomy. Which framework combination should the architect adopt to satisfy both the sharing and mapping requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

MITRE ATT&CK for adversary tactic mapping combined with STIX/TAXII for structured indicator exchange. Adversary behavior mapping requires a named tactic and technique taxonomy, which MITRE ATT&CK provides, and external sharing requires a structured, transportable intelligence format, which STIX objects carried over TAXII deliver. Pairing these two satisfies both constraints simultaneously, whereas the other combinations substitute vulnerability scoring, legacy indicator formats, statistical breach schemas, or analytic models that do not enumerate techniques.

Answer

MITRE ATT&CK for adversary tactic mapping combined with the VERIS schema for structured incident exchange

Answer

CVSS for scoring adversary behavior combined with OpenIOC for structured indicator exchange

Answer

The Diamond Model for adversary tactic mapping combined with STIX/TAXII for structured indicator exchange

Question 2

An architect is designing a threat response workflow that must enrich indicators with multiple external intelligence sources before creating a case. The design uses Cortex XSOAR playbooks. Which approach best ensures the workflow continues even when one intelligence source is temporarily unavailable?

Accepted Answer

Configure each enrichment task with continue-on-error behavior so the playbook proceeds and records the failure.. Resilience in a multi-source enrichment playbook comes from isolating failures so one unavailable integration does not stop the entire workflow. Marking enrichment tasks to continue on error lets the playbook gather what it can, log the failure, and still create the case. Delays, permanent removal, and single-platform aggregation all either reduce coverage or introduce new failure points.

Answer

Route all enrichment through a single aggregated intelligence platform.

Answer

Add a long delay before each enrichment task to wait for the source to recover.

Answer

Remove the failing intelligence source from the playbook permanently.

Question 3

An architect is configuring a Palo Alto Networks firewall and wants to control application traffic (such as allowing Skype business calls while blocking Skype file transfers). Which security policy match enables this granularity?

Accepted Answer

App-ID based security policy rules specifying application and sub-features.. App-ID is Palo Alto Networks' patented traffic classification technology that identifies applications regardless of port, protocol, encryption, or evasion tactics. Security policy rules can match on a specific application and then use the application's sub-features (e.g., Skype business calls vs. Skype file transfers) to allow or deny granular functions within the same application. This is the only mechanism in the listed options that provides application-layer and function-level control.

Answer

Destination IP address matching only.

Answer

TCP port number matching (e.g., port 80/443).

Answer

Source MAC address filtering.

Question 4

A SecOps architect at a financial services company needs to demonstrate the operational value of their Cortex XSIAM deployment to the executive committee. They want a metric that quantifies the proportion of security incidents that were resolved by automated playbooks without any human analyst intervention. Which Cortex XSIAM metric should they present?

Accepted Answer

Automated Incident Resolution Rate. The Automated Incident Resolution Rate is the only metric that directly measures the proportion of incidents resolved without human intervention, which is exactly what the executive committee needs to see. It ties automation investments to operational outcomes and can be sourced from Cortex XSIAM incident data, such as close reasons and playbook execution logs.

Answer

Mean Time to Detect (MTTD)

Answer

Automation Rate

Answer

False Positive Rate

Question 5

A newly formed SOC uses Cortex XSIAM and wants a single headline metric that tells leadership whether the team is keeping pace with incoming incidents, independent of how severe those incidents are. Which metric best fits that purpose?

Accepted Answer

Incident backlog trend, measured as open incidents at period end compared with incidents created and closed during the period.. Backlog trend compares open incidents at period end against creations and closures, so it directly answers whether the team keeps pace regardless of severity mix. Severity-scoped resolution times, assignment speed, and automation activity can all look healthy while the open queue grows, which is why the backlog trend is the right headline indicator.

Answer

Percentage of incidents assigned to an analyst within the first hour.

Answer

Mean time to resolution (MTTR) for critical-severity incidents only.

Answer

Total number of playbook executions per day across all incident types.

Question 6

An architect is designing an integration between Cortex XDR and an existing third-party SIEM. The requirement is to forward all raw and enriched Cortex XDR incidents and alerts in real time. Which architectural mechanism should be configured within Cortex XDR?

Accepted Answer

Configure a Syslog Server profile or Cortex XDR Streaming API connector to export log data in CEF or JSON format.. Cortex XDR supports forwarding alerts and incidents to third-party SIEMs using Syslog or HTTP/HTTPS via a configured Cortex XDR Streaming API or Syslog Collector profile.

Answer

Configure an explicit proxy on Panorama to intercept XDR database traffic and mirror it to the SIEM.

Answer

Install a dedicated firewall between the XDR agent and the cloud backend to sniff telemetry.

Answer

Deploy an SNMP trap receiver on the SIEM and enable SNMPv1 polling on the XDR agent.

Question 7

An architect is configuring a Palo Alto Networks firewall and wants to inspect traffic for spyware callback communications to command-and-control servers. Which security profile should be configured?

Accepted Answer

Anti-Spyware security profile. The Anti-Spyware security profile on a Palo Alto Networks firewall is specifically designed to detect and block spyware, including command-and-control (C2) callback communications, by inspecting traffic against signatures for known spyware, DNS sinkholes, and C2 patterns. It is the correct profile for identifying spyware callback traffic to C2 servers. The profile can be applied to security policy rules to scan allowed traffic for spyware activity.

Answer

URL Filtering profile

Answer

Data Filtering profile

Answer

WildFire analysis profile

Question 8

An architect is defining a Service Level Objective (SLO) for critical-severity incidents in Cortex XSIAM. Leadership wants a metric that measures how consistently the SOC meets its committed response deadline, expressed as a percentage of incidents handled within the target time. Which metric should the architect select?

Accepted Answer

SLO Compliance Rate. SLO Compliance Rate directly answers whether the SOC meets its committed deadline by reporting the percentage of incidents handled within the target time. This percentage-based view preserves visibility into breaches that averages conceal, making it suitable for accountability reporting on critical incidents. Incident age, alert-to-incident ratio, and automation coverage describe handling duration, correlation efficiency, and automation deployment respectively, none of which express adherence to a defined response deadline.

Answer

Alert-to-incident ratio

Answer

Automation coverage percentage

Answer

Average incident age at closure

Question 9

An organization utilizing Prisma Cloud calculates Mean Time to Remediate (MTTR) for cloud misconfigurations. The SecOps team notices that the baseline MTTR is heavily skewed by a small number of lingering legacy assets. Which statistical approach should the architect recommend to executive management to provide a more accurate representation of typical remediation performance?

Accepted Answer

Transition reporting from the mean to the median remediation time. When a metric like MTTR is heavily skewed by a small number of extreme outliers (legacy assets with very long remediation times), the median is a robust measure of central tendency that reflects the typical remediation time without being distorted by those outliers. Recommending the median gives executive management a more accurate picture of normal SecOps performance while still allowing the mean to be reported separately for outlier analysis.

Answer

Apply a logarithmic transformation to the incident timestamps before calculating the mean

Answer

Report the arithmetic mean alongside standard deviation

Answer

Exclude all assets older than 90 days from the telemetry database

Question 10

A security operations architect is formalizing how the SOC will apply the MITRE ATT&CK framework during live incident response rather than only during retrospective reporting. Which TWO practices correctly embed ATT&CK into the active response workflow? (Choose two.)

Accepted Answer

Tag each detection rule and alert with the ATT&CK technique identifiers it observes so responders see adversary context at triage time. Embedding ATT&CK into active response means surfacing technique context where responders actually work and using coverage gaps to steer detection engineering priorities. Tagging detections with technique identifiers gives triage-time context, and gap-driven prioritization turns the framework into a planning instrument. The remaining practices either corrupt severity logic, create staffing bottlenecks, or block incident closure on unattainable documentation completeness.

Answer

Assign each SOC analyst a permanent ownership of specific ATT&CK tactics and route all matching alerts only to that analyst

Answer

Require that every incident be closed only after the adversary's full ATT&CK technique chain has been reconstructed and documented

Answer

Replace the incident severity matrix with ATT&CK tactic names so that severity is derived purely from the tactic observed

Question 11

An architect is configuring Panorama to manage software and content updates across an enterprise fleet of firewalls. To prevent untested dynamic updates (such as Antivirus and WildFire signatures) from breaking production traffic, what is the best practice deployment design in Panorama?

Accepted Answer

Configure a deployment schedule in Panorama that pushes updates to a test device group first before rolling out to production device groups.. Dynamic update schedules in Panorama should use a staging or delayed deployment group strategy rather than applying updates immediately across all firewalls.

Answer

Disable all dynamic updates permanently to ensure zero changes.

Answer

Configure firewalls to download updates directly from the public internet without Panorama oversight.

Answer

Apply updates only during the annual firewall maintenance window.

Question 12

An architect is configuring a Palo Alto Networks firewall and wants to inspect compressed or archived files (such as .zip or .tar files) for embedded malware. Which security profile feature enables this inspection?

Accepted Answer

Antivirus and File Blocking profiles configured with archive unpacking enabled.. Palo Alto Networks inspects compressed and archived files (zip, tar, gzip, rar, etc.) through the Antivirus security profile with 'archive unpacking' enabled, often combined with File Blocking to control which archive types are allowed. When a user downloads an archive, the firewall unpacks it (up to configured depth and size limits) and scans the contents for malware using the antivirus engine.

Answer

Zone Protection profile with SYN cookies.

Answer

URL Filtering profile with SSL decryption disabled.

Answer

DNS Security service sinkhole.

Question 13

A security operations architect is tasked with reporting on the overall health of the SOC's detection capabilities in Cortex XSIAM. The CISO wants a metric that shows the proportion of alerts that are determined to be true positives after investigation. Which metric should the architect use?

Accepted Answer

True Positive Rate (TPR). The CISO wants the proportion of alerts that are true positives after investigation. True Positive Rate is the exact metric for this, as it calculates the percentage of investigated alerts that are confirmed threats. False Positive Rate is the inverse, Alert Volume measures quantity, and MTTD measures speed; none directly provide the true positive proportion.

Answer

Mean Time to Detect (MTTD)

Answer

False Positive Rate (FPR)

Answer

Alert Volume

Question 14

A security operations architect is designing a metrics framework in Cortex XSIAM to report on the effectiveness of automated playbook execution. The team wants to measure the percentage of playbook runs that completed successfully without manual intervention. Which metric should be used?

Accepted Answer

Playbook Automation Rate. Playbook Automation Rate is the only metric that directly quantifies the proportion of playbook executions that finish without human intervention. It provides a clear indicator of how well automation is working in Cortex XSIAM. Other metrics like MTTR or alert volume reduction measure different aspects of SOC performance and do not isolate autonomous playbook completion.

Answer

Mean Time to Resolution (MTTR)

Answer

False Positive Rate

Answer

Alert Volume Reduction

Question 15

An architect is designing a Palo Alto Networks firewall deployment and wants to ensure that security policies are enforced based on applications rather than port numbers. Which core Palo Alto Networks technology achieves this?

Accepted Answer

App-ID application identification engine. App-ID is Palo Alto Networks core signature- and heuristic-based application identification engine.

Answer

Static TCP port filtering tables

Answer

DNS reverse lookup cache

Answer

MAC address table lookup