SecOps-Architect Operationalizing Security Metrics Practice Test 6 — 15 Questions

Question 1

An architect is establishing a metrics program in Cortex XSIAM to measure the efficiency of threat hunting. The team wants to quantify how many hunts resulted in the identification of a new threat that was not previously detected by automated systems. Which metric is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Threat Hunt Yield. Threat Hunt Yield is the metric that directly counts the number of new threats identified through hunting that evaded automated detection. It provides a quantitative measure of hunting effectiveness and justifies the investment in proactive hunting. Other metrics like MTTD or false positive rate do not capture the unique contribution of hunting to threat discovery.

Answer

Mean Time to Detect (MTTD)

Answer

Coverage Rate

Answer

False Positive Rate

Question 2

An architect is designing a metrics program for a Cortex XSIAM deployment and wants to ensure that reported security metrics drive continuous improvement rather than merely describe past activity. The SOC director requires that each metric be tied to a decision or action. Which TWO characteristics must the architect build into the metric definitions to satisfy this requirement? (Choose two.)

Accepted Answer

Each metric has an explicit target or threshold that triggers a defined response when breached. Metrics drive improvement only when they are connected to decisions. An explicit target or threshold defines when action is needed, and a named owner ensures that action actually occurs. Together they turn a measurement into an operational feedback loop. Precision, dedicated storage, and annual-only review do not create that linkage, so they cannot satisfy the requirement that each metric be tied to a decision or action.

Answer

Each metric is stored in a separate dedicated dataset to simplify long-term retention

Answer

Each metric is reported with the highest possible decimal precision to avoid rounding ambiguity

Answer

Each metric is reviewed only once per year during the annual audit cycle

Question 3

An architect is designing a metrics program for a Cortex XSIAM deployment. The CISO wants to understand the financial impact of security incidents by measuring the average cost incurred per incident, including analyst time, tool usage, and business disruption. Which approach should the architect take to operationalize this metric?

Accepted Answer

Calculate the average cost per incident by integrating Cortex XSIAM incident data with financial systems and applying a cost model that includes analyst hours, tool licensing, and business impact estimates.. The correct approach integrates Cortex XSIAM incident data with financial systems and a tailored cost model. This captures analyst time, tool usage, and business impact, providing an accurate average cost per incident. It enables the CISO to make informed decisions about security investments and demonstrate financial accountability.

Answer

Use the Mean Time to Resolution (MTTR) multiplied by a fixed hourly rate to estimate the cost per incident.

Answer

Measure the total cost of the security operations center (SOC) and divide by the number of incidents handled.

Answer

Track the number of incidents per month and multiply by the average cost of a data breach from industry reports.

Question 4

A security operations architect is defining metrics to evaluate the effectiveness of the incident response process in Cortex XSIAM. The SOC manager wants to understand how often incidents are reopened after being marked resolved, as this indicates potential gaps in resolution quality. Which metric should the architect track?

Accepted Answer

Incident Reopen Rate. The SOC manager wants to assess resolution quality by tracking how often incidents are reopened. Incident Reopen Rate is the only metric that directly quantifies this behavior. MTTR, False Positive Rate, and Incident Volume per Analyst address speed, alert accuracy, and workload, respectively, and none of them measure the frequency of reopened incidents.

Answer

Mean Time to Resolve (MTTR)

Answer

False Positive Rate

Answer

Incident Volume per Analyst

Question 5

A security operations team wants to report how quickly its detection content is keeping pace with the evolving threat landscape. The architect proposes tracking the median age of detection rules at the time they first generate a true positive. What does this metric most directly indicate about the detection program?

Accepted Answer

The currency and responsiveness of detection coverage relative to emerging threats. Rule age at first true positive measures how fresh detection content was when it proved effective. A low median indicates the team quickly develops coverage for emerging threats, while a high median signals lagging or stale content. This makes it a direct indicator of detection currency and responsiveness, unlike ROI, analyst workload, or traffic inspection coverage, none of which address detection timeliness.

Answer

The percentage of total network traffic inspected by the detection stack

Answer

The average number of alerts each analyst investigates per shift

Answer

The financial return on investment of the detection engineering team

Question 6

A security architect is designing a metrics program for a Cortex XSIAM deployment. The SOC wants to measure the effectiveness of its incident response process by tracking the percentage of incidents that are resolved within the defined Service Level Agreement (SLA) targets. Which metric should the architect implement?

Accepted Answer

SLA Compliance Rate. SLA Compliance Rate is the metric that calculates the percentage of incidents resolved within defined SLA targets. It directly answers the SOC's need to measure adherence to service commitments. MTTR, Incident Volume, and First Contact Resolution Rate provide different insights—average resolution time, workload, and initial resolution efficiency—but none directly quantify SLA compliance. Thus, SLA Compliance Rate is the correct choice.

Answer

First Contact Resolution Rate

Answer

Incident Volume

Answer

Mean Time to Resolve (MTTR)

Question 7

A SecOps architect is building a dashboard in Cortex XSIAM to monitor the health of the incident response process. They want to include metrics that together provide a balanced view of both efficiency and effectiveness. Which two metrics should they include? (Choose two.)

Accepted Answer

Incident Closure Rate. MTTR and Incident Closure Rate together provide a balanced view: MTTR measures efficiency (speed) and Incident Closure Rate measures effectiveness (throughput). Both are directly derived from Cortex XSIAM incident data and are standard metrics for assessing incident response process health. They complement each other to highlight both how fast and how completely incidents are handled.

Answer

Number of open incidents

Answer

Average analyst overtime hours

Answer

Total alerts ingested

Question 8

A SecOps architect is rolling out a new 'automation coverage' KPI in Cortex XSOAR. The KPI must measure the proportion of incidents that were resolved without any manual analyst task, so leadership can track how much repetitive triage work automation has absorbed. Which definition should the architect implement?

Accepted Answer

Count of incidents closed with no analyst-assigned task divided by total incidents closed in the period.. Automation coverage should be expressed at the incident level, because the business question is how many incidents automation resolves end to end without analyst task assignment, divided by all closures in the window. Playbook-internal counters such as task success or trigger source measure mechanics rather than outcomes, and latency ratios measure speed rather than share of work absorbed.

Answer

Median time from incident creation to first automated task completion, expressed as a percentage of total incident duration.

Answer

Count of playbook tasks that completed successfully divided by total playbook tasks executed.

Answer

Count of playbook executions triggered by automation divided by total playbook executions.

Question 9

An architect must present a monthly operational review showing whether the SOC's incident response process is becoming more efficient over time. The team wants a single trend metric that normalizes for changes in incident volume, so that a busy month does not automatically look worse than a quiet one. Which metric best meets this need?

Accepted Answer

Median time from incident creation to containment per incident. A trend metric for efficiency must be normalized so that incident volume does not distort comparisons. Median time to containment per incident achieves this because each incident contributes one duration, making busy and quiet months directly comparable. Raw totals of closures, staffing counts, and playbook executions all vary with volume or reflect inputs, so none can reliably show whether the response process itself is improving.

Answer

Total number of incidents closed during the month

Answer

Count of analysts assigned to the incident response queue each day

Answer

Total number of playbooks executed across all incidents

Question 10

An architect is designing a metric to measure the 'Automation Coverage' of incident response in Cortex XSOAR. The metric is defined as the percentage of incidents that were fully resolved by automated playbooks without human intervention. The architect notices that some incidents are closed by playbooks but still require manual approval steps. The organization wants the metric to exclude incidents that required any human approval, even if the playbook completed the remediation. Which Cortex XSOAR feature should the architect use to accurately identify incidents that were fully automated?

Accepted Answer

Query the incident's playbook execution log for tasks of type 'Manual Approval' or 'Manual Task' and exclude incidents where any such task was completed by a user.. To accurately measure fully automated incident resolution, the architect must inspect the playbook execution log for manual approval or manual task completions by users. This data is natively captured in Cortex XSOAR and provides an auditable trail of human intervention. Excluding incidents with any such tasks ensures the automation coverage metric reflects only those resolved end-to-end without human input.

Answer

Filter incidents by the 'Playbook Run Status' field set to 'Completed' and assume all such incidents are fully automated.

Answer

Use the 'Manual Intervention' flag that is automatically set when an analyst interacts with a playbook task.

Answer

Configure a custom incident field that is set to 'true' only if no analyst logs into the Cortex XSOAR UI during the incident's lifetime.

Question 11

A security operations team tracks mean time to detect (MTTD) in Cortex XSIAM. Leadership notices MTTD improved sharply after the team enabled additional low-severity correlation rules, even though no detection engineering work changed. The architect must explain why the metric moved and how to keep it trustworthy. What is the most accurate explanation?

Accepted Answer

MTTD is measured from the first alert of any severity, so adding low-severity rules shifts the start timestamp earlier; the team should measure from the first high-severity or confirmed alert.. When MTTD starts at the first alert regardless of severity, adding low-severity correlation rules mechanically moves the start timestamp earlier and improves the number without better detection. Anchoring the measurement to the first high-severity or confirmed alert keeps the KPI tied to meaningful compromise signals and preserves comparability across periods.

Answer

MTTD improvement indicates the SOC's triage capacity increased, so the team should raise severity thresholds to preserve the gain.

Answer

Cortex XSIAM recalculates historical MTTD when new rules are enabled, so the improvement is a backfill artifact that should be ignored entirely.

Answer

Low-severity rules generate alerts earlier in the attack chain, so MTTD genuinely improves and no adjustment is needed.

Question 12

A Cortex XSIAM customer wants to report the proportion of high-severity incidents that were fully resolved within the agreed service level. The architect must define the metric so that it cannot be inflated by simply closing incidents without completing remediation. Which definition best prevents that distortion?

Accepted Answer

Percentage of high-severity incidents where all required remediation tasks were completed and verified within the SLA window. To prevent inflation, the SLA metric must require evidence of completed and verified remediation, not merely a closed status. Counting all closures regardless of reason allows premature or benign closure to pad the number. Workload and opening counts describe different aspects of operations and cannot confirm resolution quality. The definition tied to verified remediation tasks within the SLA window is the only one that reliably reflects true service attainment.

Answer

Total count of high-severity incidents opened during the SLA window

Answer

Percentage of high-severity incidents closed within the SLA window, regardless of closure reason

Answer

Average number of high-severity incidents assigned to each analyst within the SLA window

Question 13

A security operations team is using Cortex XSIAM to track the 'Mean Time to Detect' (MTTD) metric for endpoint alerts. The team defines MTTD as the time between the initial malicious activity on an endpoint and the creation of an alert in Cortex XSIAM. The architect needs to ensure that the metric is calculated consistently across all endpoint alerts. Which Cortex XSIAM data source should the architect use to obtain the timestamp of the initial malicious activity?

Accepted Answer

The 'Event Timestamp' from the Cortex XSIAM endpoint data sources, such as the EDR telemetry or the endpoint agent logs.. Accurate MTTD calculation requires the timestamp of the initial malicious activity, which is captured in endpoint telemetry events ingested by Cortex XSIAM. The 'Event Timestamp' from EDR or endpoint logs provides this ground truth. Correlating it with the alert creation time yields the true detection latency, ensuring consistent measurement across all endpoint alerts.

Answer

The 'Incident Start Time' field in the Cortex XSIAM incidents table.

Answer

The 'First Seen' timestamp of the endpoint in the asset inventory.

Answer

The 'Alert Creation Time' field in the Cortex XSIAM alerts table.

Question 14

A security operations architect is building a Cortex XSIAM dashboard to track the operational health of the automation layer. The SOC wants to know how often playbooks complete without manual intervention versus how often they fail or time out. Which metric should the architect implement to directly quantify the reliability of automated response execution?

Accepted Answer

Playbook Success Rate. Playbook Success Rate is the metric that directly captures whether automated response executions complete as intended. By comparing successful runs against total runs, it surfaces failures and timeouts that undermine automation dependability. MTTD, alert volume, and analyst utilization describe detection speed, workload, and alert throughput respectively, none of which measure execution outcomes. For an operational health view of the automation layer, execution success is the defining reliability indicator.

Answer

Analyst Utilization Rate

Answer

Mean Time to Detect (MTTD)

Answer

Alert Volume Trend

Question 15

A SecOps architect must design a 'false positive reduction' report in Cortex XSIAM that leadership will use to justify tuning investment. The report must show whether tuning is genuinely reducing analyst noise rather than just shifting it. Which TWO metric definitions should the architect include? (Choose two.)

Accepted Answer

Ratio of alerts closed as benign to total alerts closed, tracked per detection rule over time.. To prove tuning reduces noise rather than shifting it, the report must combine a per-rule benign closure ratio with a per-rule comparison of escalations against automated benign closures. Together they show whether a rule's output became cleaner and whether any apparent improvement came from better logic or merely from automation absorbing the same noise.

Answer

Total alert volume per analyst per shift, aggregated across all detection rules.

Answer

Percentage of incidents with no analyst comments recorded in the war room.

Answer

Average number of playbook tasks executed per incident, grouped by severity.