SecOps-Architect Practice Test 22 — 15 Questions

Question 1

A security operations architect is designing a SOC that follows the NIST Cybersecurity Framework. The architect needs to ensure that the SOC can effectively respond to incidents. According to the NIST Cybersecurity Framework, which function encompasses the activities to take action regarding a detected cybersecurity incident?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Respond. The NIST Cybersecurity Framework's Respond function encompasses the activities necessary to take action after an incident is detected, including containment, eradication, and recovery. The other functions focus on understanding risks, implementing safeguards, or detecting events, but not on the response actions themselves.

Answer

Identify

Answer

Protect

Answer

Detect

Question 2

An architect is configuring a Palo Alto Networks firewall and wants to block traffic based on geographic location (e.g., blocking traffic originating from specific countries). Which feature enables this?

Accepted Answer

GeoIP matching in Security Policy rules based on source or destination country tags.. Palo Alto Networks firewalls support GeoIP filtering directly inside Security Policy rules, where you can specify source and/or destination countries (region objects) as match criteria. The firewall resolves the source IP of a session to a country using its built-in GeoIP database and enforces the rule accordingly. This is the native, supported way to block or allow traffic by geography.

Answer

Static TCP port filtering rules.

Answer

GlobalProtect client version checks.

Answer

DNS root hint server configuration.

Question 3

A multinational SOC architect is designing a metrics framework for the incident response program. Leadership wants a measure that reflects how long it takes from the moment a security event is detected to the moment the incident is fully contained. Which metric should the architect define?

Accepted Answer

Mean time to contain (MTTC). The requested metric spans from detection to full containment, which is exactly what mean time to contain captures. MTTD stops at detection, MTTA stops at acknowledgement, and MTTR extends through resolution and closure. Only MTTC isolates the interval between detection and containment, giving leadership a clear view of how quickly the SOC stops active threats.

Answer

Mean time to detect (MTTD)

Answer

Mean time to resolve (MTTR)

Answer

Mean time to acknowledge (MTTA)

Question 4

An architect is designing an integration between Prisma Access and a third-party SIEM to ingest all security telemetry, traffic logs, and threat logs. Which TWO methods are officially supported for exporting logs from Prisma Access to external SIEMs? (Choose two)

Accepted Answer

Configure Log Forwarding Profiles within Prisma Access (Panorama managed) to export syslog directly to external SIEM collectors.. Option C is correct because Prisma Access, when managed through Panorama, supports Log Forwarding Profiles that let you define syslog servers and select which log types (traffic, threat, URL, etc.) are forwarded directly to external SIEM collectors over syslog (UDP/TCP 514 or TLS 6514). Option E is correct because Prisma Access stores logs in Cortex Data Lake, and the officially supported cloud-native mechanism is to configure Cortex Data Lake log forwarding to send those logs to external SIEM endpoints using HTTPS or syslog. Option A is wrong because SNMP traps are for device health/alarm monitoring, not for exporting security telemetry, traffic logs, or threat logs, and Prisma Access does not expose logs that way. Option B is wrong because there is no supported SSH access into the Prisma Access cloud backend hypervisor to pull raw log files; that would violate the managed-service model. Option D is wrong because you cannot install third-party agents on Prisma Access cloud infrastructure nodes; the service is fully managed by Palo Alto Networks.

Answer

Use SNMP traps polled every 5 seconds by the SIEM against the Prisma Access public IP.

Answer

Configure an SSH tunnel directly into the Prisma Access cloud backend hypervisor to pull raw log files.

Answer

Install a physical syslog agent on the Prisma Access cloud infrastructure gateway nodes.

Question 5

When reporting on SOC operational efficiency using Cortex XSOAR and XSIAM, which TWO metrics measure analyst productivity and throughput? (Choose two)

Accepted Answer

Number of incidents successfully resolved and closed per analyst. Option C is correct because the number of incidents successfully resolved and closed per analyst is a direct throughput metric that quantifies how many cases each analyst completes, which is a standard way to measure SOC analyst productivity. Option D is correct because the average time spent per incident triage phase measures the efficiency of the triage workflow, showing how quickly analysts move incidents through each stage and highlighting bottlenecks that affect overall productivity. The remaining options do not belong: A concerns physical firewall hardware redundancy, B is a WildFire signature version indicator, and E is an endpoint agent exclusion configuration, none of which measure analyst productivity or incident throughput.

Answer

Firewall hardware power supply redundancy status

Answer

Global WildFire malware detection signature version

Answer

Cortex XDR agent disk space exclusion list

Question 6

An architect is configuring Cortex XSOAR incident automation. Which TWO core components are fundamental to building an effective XSOAR playbook? (Choose two)

Accepted Answer

Integration instances that execute specific API commands against third-party and Palo Alto Networks tools.. Option C is correct because integration instances are the configured connections (with credentials, server URL, and API key) that let XSOAR playbook tasks invoke specific API commands against third-party tools and Palo Alto Networks products, providing the automation actions a playbook needs. Option D is correct because tasks and conditions are the building blocks of the playbook canvas: tasks perform actions or sub-playbooks, while conditional tasks evaluate outputs and route execution down different branches, defining the logical flow and decision-making of the incident response workflow. The remaining options do not belong: Panorama Dynamic Address Group tags (A) are a network enforcement mechanism for firewall policy, not a storage database for XSOAR playbooks; physical firewall interface cards (B) and kernel-level device drivers (E) are hardware/OS-level concerns irrelevant to authoring playbook logic in Cortex XSOAR.

Answer

Panorama Dynamic Address Group tags used as storage databases.

Answer

Physical firewall interface cards plugged into the XSOAR server PCI slots.

Answer

Direct kernel-level device drivers installed on the XSOAR server operating system.

Question 7

A multinational corporation is architecting a Security Operations Center (SOC) using the MITRE ATT&CK framework to prioritize detection engineering efforts. The SOC has limited resources and wants to focus on techniques that are most relevant to its industry and threat landscape. The architect must recommend a systematic approach to map existing detection rules to ATT&CK techniques and identify gaps. Which activity best accomplishes this?

Accepted Answer

Perform a detection coverage assessment using ATT&CK Navigator to visualize mapped techniques and identify unmitigated areas.. Using ATT&CK Navigator to map existing detection rules and visualize coverage is the most systematic and repeatable way to identify gaps. It allows the SOC to prioritize techniques relevant to their industry and allocate resources effectively, directly addressing the need to focus limited resources on the most pertinent threats.

Answer

Conduct a red team exercise and map observed techniques to ATT&CK.

Answer

Subscribe to a commercial threat intelligence feed and automatically ingest all indicators into the SIEM.

Answer

Implement a honeypot network and analyze attacker behavior to derive detection rules.

Question 8

A security architect is designing a threat response playbook in Cortex XSOAR for a large enterprise. To ensure that the playbook can automatically contain threats across the entire environment, the architect needs to integrate with the endpoint protection platform. Which integration should the architect configure to enable automated endpoint isolation and remediation actions?

Accepted Answer

Cortex XDR. Cortex XDR is the endpoint protection platform that natively integrates with Cortex XSOAR to enable automated endpoint isolation and remediation. The other options are network or data analytics solutions that lack endpoint containment capabilities. Thus, Cortex XDR is the correct integration for achieving automated endpoint response.

Answer

Palo Alto Networks Next-Generation Firewall

Answer

Prisma Access

Answer

Cortex Data Lake

Question 9

When aligning a security operations center (SOC) with the NIST Incident Response lifecycle, which phase immediately follows 'Containment, Eradication, and Recovery'?

Accepted Answer

Post-Incident Activity (Lessons Learned). The NIST SP 800-61 lifecycle phases are Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity (Lessons Learned).

Answer

Vulnerability Assessment

Answer

Triage and Scoping

Answer

Threat Hunting

Question 10

Which framework is widely recognized as a comprehensive guideline for establishing a foundational cybersecurity program through five core functions: Identify, Protect, Detect, Respond, and Recover?

Accepted Answer

NIST Cybersecurity Framework (CSF). The NIST Cybersecurity Framework (CSF) is structured around these five core functions.

Answer

CIS Critical Security Controls

Answer

ISO/IEC 27017

Answer

MITRE D3FEND

Question 11

An architect is designing an integration where Cortex XDR alerts must trigger automated response actions in Cortex XSOAR, and the SOC team requires that a single XSOAR incident be created for multiple related XDR alerts that share the same host and causality chain. Which Cortex XDR feature should the architect leverage to group alerts into one incident?

Accepted Answer

Cortex XDR alert grouping based on causality chain and host. Cortex XDR automatically groups related alerts into a single alert group based on shared causality chain and host. When integrated with Cortex XSOAR, this grouped alert can trigger one incident, reducing noise and aligning with the SOC requirement. Other methods either require manual intervention or occur after incident creation, failing to meet the single-incident goal at the source.

Answer

Cortex XSOAR incident type with deduplication and merging rules

Answer

Cortex XDR incident grouping via the incident management console

Answer

Cortex XSOAR playbook that queries XDR for all alerts and manually merges them

Question 12

A security architect is designing a ransomware containment playbook in Cortex XSOAR. The playbook must automatically isolate an infected endpoint, extract its forensic artifacts, and then restore it to the production network only after a senior analyst approves. Which Cortex XSOAR task type best enforces the manual approval step before the restoration task executes?

Accepted Answer

A manual task assigned to the senior analyst's role. The requirement is a human decision point that blocks further automation until a senior analyst signs off. In Cortex XSOAR, a manual task creates exactly that pause and can be assigned to a role for accountability. Conditional, data collection, and notification tasks all serve different purposes and none of them enforces a mandatory approval before the restoration task executes.

Answer

A data collection task that gathers analyst input

Answer

A built-in script task that sends an email notification

Answer

A conditional task that checks the endpoint status

Question 13

An architect is designing a multi-tenant Prisma Access architecture. Different business units require separate address spaces, security policies, and administrative boundaries. Which Prisma Access feature enables this logical separation?

Accepted Answer

Panorama Device Groups and Folders with role-based access control (RBAC).. Panorama Device Groups and Folders, combined with role-based access control (RBAC), allow administrators to logically separate policies, objects, and administrative boundaries for different business units. Device Groups group firewalls for policy management, while Folders provide hierarchical organization of firewalls and devices. RBAC ensures that administrators only have access to their assigned scope, enabling multi-tenancy.

Answer

Cortex XDR agent exclusion lists.

Answer

Physical stacking cables linking remote branch routers.

Answer

GlobalProtect client-side registry keys.

Question 14

When designing an automated metric reporting pipeline from Cortex XSIAM to an external SIEM or data warehouse using APIs, which THREE architectural considerations must be addressed? (Choose three)

Accepted Answer

API rate limits and pagination handling to prevent data loss during extraction. Option B is correct because Cortex XSIAM APIs enforce rate limits and return paginated result sets, so the pipeline must implement backoff/retry logic and iterate through pagination tokens to avoid silently dropping events during extraction. Option C is correct because exporting large volumes of metrics and alerts can saturate WAN links, so bandwidth capacity and scheduling around peak hours must be planned to keep the pipeline reliable. Option D is correct because API access requires secure handling of authentication tokens (e.g., API keys or OAuth credentials) plus TLS encryption in transit to protect credentials and sensitive security telemetry. Option A does not belong because analyst workstation screen resolution is irrelevant to a server-side API extraction pipeline, and Option E does not belong because printer cabling has no bearing on API-based metric reporting.

Answer

Monitor screen resolution settings of the analyst workstations

Answer

Physical cable length between the client desktop and the office printer

Question 15

A multinational SOC architect is mapping detection coverage to the MITRE ATT&CK framework for a Cortex XSIAM deployment. Executive leadership wants to know which adversary techniques currently have no detection logic. Which approach should the architect take to produce this gap analysis?

Accepted Answer

Tag each detection rule with the ATT&CK technique IDs it covers, then report techniques with no associated tags. A reliable ATT&CK gap analysis requires an explicit mapping between detection content and technique IDs. Tagging each detection rule with the techniques it addresses allows the architect to query for untagged techniques and produce a precise, maintainable coverage report. Volume-based or name-based comparisons and one-off exercises cannot reliably identify which adversary techniques lack detection logic.

Answer

Export all XSIAM correlation rules and compare rule names against ATT&CK technique titles

Answer

Compare the count of XSIAM analytics per data source against the number of ATT&CK techniques that use that data source

Answer

Run a red team exercise and treat any technique that was not alerted on during the exercise as a coverage gap