SecOps-Architect Operationalizing Security Metrics Practice Test 5 — 15 Questions

Question 1

An architect is tasked with creating a comprehensive reporting framework in Cortex XSOAR to measure incident response maturity. Which TWO advanced metrics should be incorporated to evaluate the depth and effectiveness of post-incident analysis and containment? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Containment Effectiveness (percentage of incidents without reinfection or recurrence). Option A, Containment Effectiveness (percentage of incidents without reinfection or recurrence), is correct because it directly measures the quality and durability of containment actions by tracking whether threats are fully eradicated rather than merely suppressed, which is a key indicator of response maturity. Option C, Root Cause Identification Time (Mean Time to Identify origin), is correct because it quantifies the depth of post-incident analysis by measuring how quickly analysts determine the true origin of an incident, a core component of effective lessons-learned and prevention processes. Option B, total disk space consumed by log archives, is a storage-capacity metric that says nothing about analytical depth or containment quality. Option D, number of software licenses assigned to SOC analysts, is a procurement/asset statistic unrelated to incident response effectiveness. Option E, total coffee breaks per shift, is a facetious workplace metric with no bearing on security operations maturity.

Answer

Total disk space consumed by log archives

Answer

Number of software licenses assigned to SOC analysts

Answer

Total number of coffee breaks taken per shift

Question 2

A SecOps architect for a managed security service provider (MSSP) needs to report on the efficiency of automated playbooks in Cortex XSOAR. The MSSP wants to know how much manual analyst effort is being saved by automation. Which metric best represents the percentage of tasks within a playbook that were executed automatically without human intervention?

Accepted Answer

Automation Coverage Rate. Automation Coverage Rate is the appropriate metric because it directly quantifies the proportion of playbook tasks executed automatically, which is exactly what the MSSP needs to measure manual effort saved. Other metrics like MTTA or success rate do not capture the extent of automation within playbooks.

Answer

Playbook Execution Success Rate

Answer

Mean Time to Acknowledge (MTTA)

Answer

Analyst Utilization Rate

Question 3

An architect is designing a metrics framework for a Security Operations Center (SOC) using Cortex XSIAM. The SOC wants to measure the effectiveness of its incident triage process by tracking the proportion of incidents that are correctly classified as true positives versus false positives. Which metric should be used to directly assess the accuracy of incident classification?

Accepted Answer

Precision. Precision directly measures the accuracy of positive classifications by comparing true positives to all incidents flagged as malicious. It captures both correct and incorrect positive classifications, making it the best metric for assessing triage accuracy. Other metrics like FPR or recall only provide partial views.

Answer

False Positive Rate (FPR)

Answer

Recall

Answer

Mean Time to Resolve (MTTR)

Question 4

A security operations architect is designing a metrics framework in Cortex XSIAM to report on the effectiveness of automated playbook execution. The team wants to measure the percentage of playbook runs that completed successfully without manual intervention. Which metric should be used?

Accepted Answer

Playbook Automation Rate. Playbook Automation Rate is the only metric that directly quantifies the proportion of playbook executions that finish without human intervention. It provides a clear indicator of how well automation is working in Cortex XSIAM. Other metrics like MTTR or alert volume reduction measure different aspects of SOC performance and do not isolate autonomous playbook completion.

Answer

Mean Time to Resolution (MTTR)

Answer

False Positive Rate

Answer

Alert Volume Reduction

Question 5

A security operations team is implementing metrics to measure the performance of its Cortex XSOAR automation. The team wants to track the time saved by automation compared to manual execution. Which metric should they use to quantify the efficiency gain from automation?

Accepted Answer

Time Saved by Automation. Time Saved by Automation is the only metric that directly compares automated and manual execution times, providing a clear quantification of efficiency gain. Other metrics like Automation Rate or MTTR Reduction do not isolate the time savings attributable to automation.

Answer

Automation Rate

Answer

Playbook Execution Time

Answer

Mean Time to Resolution (MTTR) Reduction

Question 6

A SecOps architect at a financial services company needs to demonstrate the operational value of their Cortex XSIAM deployment to the executive committee. They want a metric that quantifies the proportion of security incidents that were resolved by automated playbooks without any human analyst intervention. Which Cortex XSIAM metric should they present?

Accepted Answer

Automated Incident Resolution Rate. The Automated Incident Resolution Rate is the only metric that directly measures the proportion of incidents resolved without human intervention, which is exactly what the executive committee needs to see. It ties automation investments to operational outcomes and can be sourced from Cortex XSIAM incident data, such as close reasons and playbook execution logs.

Answer

Mean Time to Detect (MTTD)

Answer

Automation Rate

Answer

False Positive Rate

Question 7

An architect is designing a metrics dashboard in Cortex XSIAM to monitor the health of the SOC's detection and response capabilities. The dashboard should include metrics that indicate the SOC's ability to detect and respond to threats in a timely manner. Which TWO metrics are most appropriate to include? (Choose two.)

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect and Mean Time to Respond are the two metrics that directly measure the SOC's timeliness in detecting and responding to threats. They are complementary and provide a clear picture of the SOC's operational speed, making them ideal for a health dashboard.

Answer

Number of Alerts per Day

Answer

Percentage of False Positives

Answer

Analyst Utilization Rate

Question 8

An architect is defining a set of metrics in Cortex XSIAM to evaluate the performance of the security operations center (SOC) in terms of incident containment and response efficiency. The SOC manager wants to track how quickly incidents are contained after detection and how efficiently analysts handle incidents. Which TWO metrics should be included? (Choose two.)

Accepted Answer

Mean Time to Contain (MTTC). Mean Time to Contain and Incidents Closed per Analyst per Day are the two metrics that directly address the SOC's containment speed and analyst efficiency. MTTC measures how quickly incidents are contained after detection, while incidents closed per analyst per day quantifies analyst productivity. Together, they provide a balanced view of response efficiency and workload handling.

Answer

Alert Volume

Answer

Mean Time to Detect (MTTD)

Answer

False Positive Rate

Question 9

A security operations team uses Cortex XSIAM and Cortex XSOAR. The SOC manager wants to measure how well the team is utilizing automation to reduce manual effort. The manager asks the architect to define a metric that quantifies the proportion of incident response actions that were executed automatically versus manually. Which metric should the architect recommend?

Accepted Answer

Automation Coverage Ratio. Automation Coverage Ratio directly quantifies the share of response actions executed automatically, which is the core of the manager's request. MTTD, Alert Volume Trend, and FPR are valuable but focus on detection speed, workload volume, and detection accuracy respectively, not on the balance between manual and automated response. Thus, Automation Coverage Ratio is the only metric that answers how well automation reduces manual effort.

Answer

Mean Time to Detect (MTTD)

Answer

Alert Volume Trend

Answer

False Positive Rate (FPR)

Question 10

A multinational corporation uses Cortex XSIAM across three geographically dispersed SOCs. The security leadership wants to measure the consistency of incident triage across regions to identify process drift. Which metric best captures the uniformity of triage decisions, such as severity assignment and escalation, across all SOCs?

Accepted Answer

Triage Consistency Score. Triage Consistency Score directly measures how uniformly triage decisions are made across different SOCs. By analyzing Cortex XSIAM incident data, such as severity and escalation choices on comparable alerts, this metric highlights process drift. It provides actionable insight for standardizing triage procedures across regions, which is the core requirement.

Answer

Alert Volume per Analyst

Answer

False Positive Rate

Answer

Mean Time to Resolution (MTTR)

Question 11

A SecOps architect is defining a metric to measure the proportion of security incidents that were resolved within the agreed Service Level Agreement (SLA) time. Which metric should be used?

Accepted Answer

SLA Compliance Rate. SLA Compliance Rate is the only metric that directly measures the proportion of incidents resolved within the agreed SLA time. Other metrics like MTTR or backlog provide related but indirect information, not a direct compliance percentage.

Answer

Backlog of Open Incidents

Answer

Mean Time to Resolve (MTTR)

Answer

First Contact Resolution Rate

Question 12

An architect is setting up a dashboard in Cortex XSIAM to monitor the overall health of the security operations program. The CISO wants a single metric that reflects the proportion of security incidents that were resolved within the agreed service level agreement (SLA). Which metric should be displayed?

Accepted Answer

SLA Compliance Rate. SLA Compliance Rate is the only metric that directly reports the percentage of incidents resolved within the agreed SLA. It provides a clear, quantitative measure of adherence to service levels, which is exactly what the CISO needs to assess operational health against commitments. Other metrics like MTTR or backlog do not express compliance as a proportion.

Answer

Analyst Utilization

Answer

Mean Time to Resolve (MTTR)

Answer

Incident Backlog

Question 13

A SOC manager wants to track the team's efficiency in resolving incidents. The manager asks the architect to define a metric that measures the average time from incident creation to incident closure in Cortex XSIAM. Which metric should the architect implement?

Accepted Answer

Mean Time to Resolve (MTTR). Mean Time to Resolve (MTTR) is specifically designed to measure the average duration from incident creation to closure. It is a core SOC efficiency metric that Cortex XSIAM can calculate automatically using incident timestamps. MTTD, MTTA, and MTBF focus on detection speed, initial response, and system reliability respectively, none of which match the manager's requirement for resolution time.

Answer

Mean Time to Detect (MTTD)

Answer

Mean Time to Acknowledge (MTTA)

Answer

Mean Time Between Failures (MTBF)

Question 14

A security operations architect is reviewing metrics for a Cortex XSIAM deployment. The SOC manager wants to understand the proportion of alerts that are escalated to incidents versus those that are closed as benign. Which metric should the architect recommend?

Accepted Answer

Escalation Rate. Escalation Rate is the metric that specifically tracks the percentage of alerts that are escalated to incidents. It provides a clear view of how many alerts require further investigation versus those resolved as benign at the alert level. This helps the SOC manager understand triage efficiency and workload distribution.

Answer

False Positive Rate

Answer

Alert Closure Rate

Answer

True Positive Rate

Question 15

A SecOps architect is asked to prove that the SOC's automated response playbooks are reducing manual workload. The team already tracks the count of playbook executions, but leadership says that number alone does not demonstrate labor savings. Which metric should the architect present as the primary evidence of reduced manual effort?

Accepted Answer

Number of automated actions executed per incident, compared with the manual steps those actions replaced. To prove reduced manual workload, the metric must connect automated activity to the human steps it replaced. Counting executions or tracking MTTR for a subset of analysts does not establish avoided labor. Comparing automated actions with the manual steps they supplanted gives leadership a direct, quantifiable link between playbook use and reduced analyst effort, making it the strongest evidence.

Answer

Percentage of alerts closed as false positives by automation

Answer

Mean time to resolution (MTTR) for incidents handled only by Tier 3 analysts

Answer

Total number of playbook executions per month