SecOps-Architect Practice Test 21 — 15 Questions

Question 1

Your security leadership requests a monthly report showing the percentage of security alerts that are automatically remediated by Cortex XSOAR playbooks versus those requiring manual intervention. What is this metric commonly called?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automation Rate / Playbook Resolution Percentage. Automation Rate or Automation Coverage measures the proportion of security operations tasks handled programmatically by orchestration tools compared to manual analyst effort.

Answer

Incident Escalation Velocity

Answer

Alert Suppression Ratio

Answer

Mean Time to Ingest

Question 2

When planning an incident response table-top exercise for a Security Operations team, which framework provides a standardized taxonomy for describing adversary behaviors and tactics?

Accepted Answer

MITRE ATT&CK Framework. The MITRE ATT&CK Framework is the industry-standard knowledge base that provides a standardized taxonomy of adversary tactics, techniques, and procedures (TTPs), making it the correct choice for structuring a table-top exercise around realistic adversary behaviors. It gives the SOC a common vocabulary to describe what attackers do at each phase of an intrusion, which is exactly what a table-top exercise needs to simulate and discuss.

Answer

PCI-DSS v4.0

Answer

ITIL v4 Service Management

Answer

ISO/IEC 27001

Question 3

An architect is defining a 'detection efficacy' metric for Cortex XSIAM that must not be gamed by simply creating more detection rules. The team wants to know whether the rules already deployed are finding real threats. Which definition best resists that gaming?

Accepted Answer

Ratio of confirmed true positive incidents to the total incidents generated by deployed rules, tracked per rule family.. A per-family true positive ratio ties the metric to confirmed outcomes rather than rule inventory or alert volume, so adding noisy content lowers the score instead of raising it. Tracking by rule family preserves granularity and prevents strong detections from masking weak ones, giving a gaming-resistant view of whether deployed rules find real threats.

Answer

Number of enabled detection rules in production, tracked month over month.

Answer

Average number of MITRE ATT&CK techniques covered by enabled rules.

Answer

Total alerts generated per week across all detection content.

Question 4

A security operations architect must present a monthly report to executive leadership showing whether the SOC is responding to incidents faster than the previous quarter. Which metric most directly communicates improvement in response speed over time?

Accepted Answer

Mean Time to Respond (MTTR) trend. Mean Time to Respond trend is the clearest indicator of response speed improvement because it measures elapsed time from detection to response action and shows directional change across periods. A downward trend is easily understood by executives as faster response. Volume, coverage, and automation-activity metrics describe how much work occurs or how much is deployed, not how quickly the SOC acts, so they cannot substantiate a claim of faster response.

Answer

Total incidents closed this quarter

Answer

Count of playbooks executed

Answer

Number of enabled detection rules

Question 5

An architect is designing a Panorama-managed deployment where firewall logs must be forwarded to a Cortex Data Lake tenant for centralized retention and analytics. Which TWO configuration elements are required to make Panorama forward firewall logs to Cortex Data Lake? (Choose two.)

Accepted Answer

Configure a Log Forwarding profile with a Cortex Data Lake destination and attach it to the relevant security policy rules.. Forwarding firewall logs to Cortex Data Lake requires two things: authenticating and registering Panorama and its managed firewalls to the tenant, and attaching a Log Forwarding profile with a Cortex Data Lake destination to the security rules that generate logs. Log Collector VMs, syslog, and custom formats do not enable the cloud destination.

Answer

Enable syslog forwarding on every managed firewall and set the Cortex Data Lake tenant as the syslog server.

Answer

Install a dedicated Log Collector VM in each region and point Panorama at its management interface.

Answer

Create a custom log format template that matches the Cortex Data Lake schema and apply it to all firewall interfaces.

Question 6

An architect is designing a Panorama deployment to manage 100 firewalls. To ensure high availability and redundancy for Panorama itself, which deployment architecture should the architect recommend?

Accepted Answer

Panorama High Availability (HA) Active/Passive pair with state and configuration synchronization.. Panorama High Availability uses an Active/Passive pair configuration sharing configuration state via sync mechanisms.

Answer

Panorama HA Active/Active pair with split-brain data routing.

Answer

Clustered Kubernetes deployment using raw etcd replication without PAN-OS HA.

Answer

A single standalone virtual machine backed up by nightly AWS snapshots only.

Question 7

An architect is deploying Palo Alto Networks Prisma Access to secure remote users. The organization requires that all traffic from remote users, including internet-bound traffic, be inspected by Prisma Access security services. Which Prisma Access component should the architect configure to meet this requirement?

Accepted Answer

Mobile users. Prisma Access provides secure remote access through the Mobile Users component. When configured with GlobalProtect, all traffic from remote users can be routed through Prisma Access for inspection by security services. Other components like Remote Network and Service Connection serve different purposes, such as connecting sites or data centers.

Answer

Remote network

Answer

Service connection

Answer

Explicit proxy

Question 8

A security architect is designing a detection and response strategy using Cortex XSIAM. The architect needs to ensure that the platform can automatically correlate alerts from multiple sources and prioritize them based on severity. Which Cortex XSIAM capability should the architect leverage to achieve this?

Accepted Answer

Analytics. Cortex XSIAM Analytics is designed to automatically correlate alerts from disparate sources and apply risk-based prioritization. It uses advanced analytics to group related alerts into incidents and assign severity, enabling efficient triage. The other options are supporting components that do not provide the required correlation and prioritization.

Answer

Playbooks

Answer

Data Model

Answer

Threat Intelligence Management

Question 9

During a major security incident, a SOC architect needs to ensure that all evidence collected adheres to chain of custody principles. Which foundational security concept is primarily being enforced?

Accepted Answer

Integrity and non-repudiation of digital evidence. Chain of custody ensures that evidence is collected, handled, analyzed, and preserved in a manner that maintains its integrity and admissibility in legal proceedings.

Answer

High availability and redundant storage arrays

Answer

Role-based access control permission inheritance

Answer

Network bandwidth optimization and traffic shaping

Question 10

An architect is establishing a metrics program in Cortex XSIAM to measure the efficiency of threat hunting. The team wants to quantify how many hunts resulted in the identification of a new threat that was not previously detected by automated systems. Which metric is most appropriate?

Accepted Answer

Threat Hunt Yield. Threat Hunt Yield is the metric that directly counts the number of new threats identified through hunting that evaded automated detection. It provides a quantitative measure of hunting effectiveness and justifies the investment in proactive hunting. Other metrics like MTTD or false positive rate do not capture the unique contribution of hunting to threat discovery.

Answer

Mean Time to Detect (MTTD)

Answer

Coverage Rate

Answer

False Positive Rate

Question 11

An architect is designing a Zero Trust Network Access (ZTNA) incident response strategy using Prisma Access. When a compromised user device is detected, which action should the automated response workflow trigger to prevent lateral movement?

Accepted Answer

Apply a dynamic user group or quarantine security policy to immediately revoke network access. In a ZTNA architecture built on Prisma Access, access decisions are identity- and context-driven rather than network-location-driven. Applying a dynamic user group or quarantine security policy immediately removes the compromised device/user from the trusted access path by re-evaluating policy at the cloud-delivered security edge, which halts lateral movement without disrupting the rest of the environment. This is the surgical, automated response that aligns with Zero Trust 'never trust, always verify' principles.

Answer

Purge the corporate DNS root servers

Answer

Factory reset the physical core switches

Answer

Reboot all enterprise domain controllers

Question 12

A SecOps architect must design a 'false positive reduction' report in Cortex XSIAM that leadership will use to justify tuning investment. The report must show whether tuning is genuinely reducing analyst noise rather than just shifting it. Which TWO metric definitions should the architect include? (Choose two.)

Accepted Answer

Ratio of alerts closed as benign to total alerts closed, tracked per detection rule over time.. To prove tuning reduces noise rather than shifting it, the report must combine a per-rule benign closure ratio with a per-rule comparison of escalations against automated benign closures. Together they show whether a rule's output became cleaner and whether any apparent improvement came from better logic or merely from automation absorbing the same noise.

Answer

Total alert volume per analyst per shift, aggregated across all detection rules.

Answer

Percentage of incidents with no analyst comments recorded in the war room.

Answer

Average number of playbook tasks executed per incident, grouped by severity.

Question 13

What is the primary benefit of tracking Mean Time to Detect (MTTD) in a Security Operations Center?

Accepted Answer

It measures how quickly potential security incidents are identified after they occur.. MTTD (Mean Time to Detect) is a core SOC operational metric that measures the average elapsed time between when a security incident actually occurs and when the SOC detects/identifies it. It is a detection-effectiveness KPI used to gauge monitoring coverage, sensor tuning, and analyst responsiveness — not a financial or infrastructure metric.

Answer

It calculates the exact financial loss resulting from a data breach.

Answer

It measures the bandwidth consumption of threat intelligence feeds.

Answer

It determines the CPU utilization of the Cortex XDR agent.

Question 14

An architect is designing log forwarding from a Prisma Access tenant to an on-premises syslog collector that requires mutual TLS and cannot accept the default certificate. The collector's private CA is not trusted by the Prisma Access infrastructure. What is the correct approach?

Accepted Answer

Import the collector's CA certificate and client certificate into the Prisma Access configuration, then configure the syslog profile to use them for the outbound connection.. Mutual TLS requires trust in both directions: the sender must validate the receiver and present a client certificate the receiver trusts. Since the collector's private CA is not in the default trust store, it must be imported into Prisma Access alongside the client certificate and referenced by the syslog profile. Without those imports, the handshake cannot complete regardless of other network changes.

Answer

Generate a self-signed certificate on the collector and add the Prisma Access public certificate to the collector's trust store only.

Answer

Disable certificate validation on the syslog profile so the collector accepts the connection without presenting a trusted client certificate.

Answer

Route syslog through a Cortex Data Lake forwarder that terminates TLS and re-encrypts traffic to the collector with a public certificate.

Question 15

A security architect is designing a threat response architecture using the MITRE ATT&CK framework. The SOC wants to prioritize detection engineering efforts based on the most relevant adversary techniques for their industry. The architect must ensure that the framework is used effectively to map existing detections and identify gaps. Which approach best aligns with the MITRE ATT&CK framework for this purpose?

Accepted Answer

Use the ATT&CK Navigator to overlay existing detections against techniques and identify gaps. The ATT&CK Navigator is specifically designed to help organizations map their detection coverage to the ATT&CK matrix and identify gaps. By using it to overlay existing detections, the architect can systematically prioritize detection engineering based on industry-relevant techniques. Other approaches like red teaming or implementing all techniques are either too narrow or too broad, and relying solely on vendor content does not ensure alignment with the organization's specific threat landscape.

Answer

Conduct a red team exercise and map all observed techniques to ATT&CK

Answer

Rely on vendor-provided detection content without customization

Answer

Implement all techniques listed in the ATT&CK framework sequentially