SecOps-Architect Secops Frameworks And Threat Response Architecture — 20 Questions

Question 1

When designing a threat hunting methodology aligned with the MITRE ATT&CK framework, an architect wants to identify adversary persistence mechanisms. Which tactic category should the analyst focus queries on?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Persistence. Persistence tactics include techniques such as Registry Run Keys, Startup Folder, and Scheduled Tasks.

Answer

Initial Access

Answer

Collection

Answer

Execution

Question 2

An architect is designing an incident response workflow in Cortex XSOAR using the Incident Spooler. Which component is primarily responsible for processing queued events into actionable incidents?

Accepted Answer

Cortex XSOAR Server engine. The War Room is where manual actions and playbooks execute, but the Server engine handles the queue processing and ingestion from the Incident Spooler.

Answer

Demisto REST API

Answer

Threat Intel Management module

Answer

Cortex XSIAM Data Lake collector

Question 3

An incident response architect is defining severity levels for security alerts in Cortex XDR. Which severity classification typically triggers automated containment playbooks without human intervention?

Accepted Answer

Critical. High or Critical severity alerts are commonly mapped to automated containment responses in modern SOAR architectures.

Answer

Debugging

Answer

Low

Answer

Informational

Question 4

An organization is integrating Prisma Cloud with Cortex XSOAR to automate cloud incident response. When configuring the Prisma Cloud integration instance in XSOAR, which authentication mechanism is recommended to securely fetch alerts without using static user credentials?

Accepted Answer

OAuth 2.0 Client Credentials grant via a dedicated Service Account. Prisma Cloud integration instances in XSOAR use Access Key ID and Secret Key generated via Service Accounts for secure API access.

Answer

LDAP bind credentials through a Cortex XDR Broker VM

Answer

HTTP Basic Authentication with administrative credentials

Answer

SAML 2.0 Federation token exchange

Question 5

In a multi-tenant Cortex XSOAR deployment, an architect needs to restrict access to specific playbooks so that Tenant A analysts cannot view or execute playbooks owned by Tenant B. Where is this access control configured?

Accepted Answer

Role-Based Access Control (RBAC) settings under Settings > Common > Roles. Role-Based Access Control (RBAC) in Cortex XSOAR allows restricting playbook and incident type visibility based on assigned roles.

Answer

Global Server Configuration settings

Answer

Playbook JSON source code permissions

Answer

Integration instance parameters

Question 6

An enterprise security architect is integrating Cortex XSIAM with an external SIEM using the Syslog Export feature. The security team notices that certain sensitive fields need to be redacted before export. Where should the architect configure this transformation?

Accepted Answer

Data Forwarding Rules / Log Forwarding Profiles. Log Forwarding profiles in Cortex XSIAM allow filtering, masking, and transforming logs before they are exported via Syslog or HTTP.

Answer

Magnifier machine learning configuration

Answer

Cortex XDR Agent installation parameters

Answer

XSOAR automation playbook script tasks

Question 7

You are deploying Cortex XSIAM and need to ensure that endpoint logs collected from remote agents are normalized into a unified schema before analytics runs. Which feature performs this normalization?

Accepted Answer

XDM (XDR Data Model) mapping and parsing rules. XSIAM utilizes Agent Content and parsing rules to normalize raw logs into the XDM schema during ingestion.

Answer

Cortex XDR Agent Collector Engine

Answer

Magnifier behavioral analytics engine

Answer

Local Analysis Engine (LAE)

Question 8

You are designing an automated phishing response workflow in Cortex XSOAR. The playbook needs to extract all URLs from an incoming email body and check their reputation using VirusTotal. Which built-in task type should you use to evaluate each URL concurrently?

Accepted Answer

Loop / For-Each Task. A loop task in Cortex XSOAR iterates over lists or arrays, such as extracted URLs, allowing parallel or sequential processing.

Answer

Data Collection Task

Answer

Transformation Script Task

Answer

Manual Review Task

Question 9

An architect is deploying the Cortex XDR Broker VM to serve as a syslog collector for legacy network devices. The Broker VM loses connectivity to the Cortex XDR cloud. What happens to the collected syslog data during the outage?

Accepted Answer

The data is buffered locally on the Broker VM and forwarded once reconnected. The Broker VM buffers incoming syslog messages locally up to a designated storage threshold until cloud connectivity is restored.

Answer

The Broker VM automatically switches to backup SMTP forwarding

Answer

The syslog sender devices resend the packets automatically via TCP retry

Answer

The data is permanently dropped until connectivity returns

Question 10

When aligning a security operations center (SOC) with the NIST Incident Response lifecycle, which phase immediately follows 'Containment, Eradication, and Recovery'?

Accepted Answer

Post-Incident Activity (Lessons Learned). The NIST SP 800-61 lifecycle phases are Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity (Lessons Learned).

Answer

Vulnerability Assessment

Answer

Triage and Scoping

Answer

Threat Hunting

Question 11

An architect is reviewing the Cortex XSIAM Analytics dashboard to identify root causes of security incidents. Which data visualization component aggregates related alerts into a single attack storyline?

Accepted Answer

Incident Storyline. Incident Storyline in Cortex XSIAM automatically correlates related alerts and events into a unified narrative graph.

Answer

Raw Syslog Viewer

Answer

Indicator Grid

Answer

Dashboard Widget Editor

Question 12

An architect is designing an automated containment workflow in Cortex XDR where an endpoint must be isolated only if it is confirmed to be communicating with a known Command and Control (C2) server. Which XQL query logic accurately identifies this condition before triggering isolation?

Accepted Answer

dataset = xdr_data | filter alert_name = 'C2 Communication' and causal_agent_id != null | fields agent_id, C2_ip. XQL queries aggregate alerts and network events to confirm C2 communication status before automated action.

Answer

dataset = endpoint_logs | summarize failed_logins = count() by user_name

Answer

dataset = xdr_data | filter event_type = 'network' and action = 'allowed' | stats count() by actor_process_image_path

Answer

dataset = network_traffic | filter bytes > 1000000

Question 13

An architect is configuring Indicator Sharing in Cortex XSOAR using the Threat Intel Management module. How are incoming STIX/TAXII indicator feeds prioritized when conflicting reputation scores are received from multiple sources?

Accepted Answer

By configuring source reliability and vendor weight settings. Threat Intel Management in XSOAR uses indicator scoring rules and source reliability weights to determine the final composite score.

Answer

Alphabetical sorting of feed names

Answer

Manual override for every single indicator

Answer

First-in, first-out ingestion timestamp priority

Question 14

When setting up automated email parsing in Cortex XSOAR for phishing triage, which integration is specifically required to connect to Microsoft Office 365 using modern authentication (OAuth 2.0)?

Accepted Answer

Microsoft Graph Mail integration. The Microsoft Office 365 Mail integration (or MS Graph Mail) uses OAuth 2.0 to ingest emails securely.

Answer

SMTP Relay Server integration

Answer

Legacy Exchange IMAP integration

Answer

Active Directory LDAP integration

Question 15

An enterprise is designing a zero-trust architecture where Cortex XDR integrates with Palo Alto Networks Next-Generation Firewalls. Which protocol and component facilitate real-time dynamic blocklisting of compromised endpoints across both the firewall and the endpoint?

Accepted Answer

Cortex XDR incident handler pushing dynamic IP/URL lists to firewalls via PAN-OS API. The Cortex XDR enforcement service pushes dynamic block lists (EDL / IP lists) via XML API or PAN-OS integration to the firewalls.

Answer

Syslog forwarding from firewalls to the local endpoint agent

Answer

SNMP traps sent from endpoints to the firewall management plane

Answer

User-ID agent querying Active Directory via LDAP

Question 16

An organization wants to measure the efficiency of its SOC by tracking how quickly analysts acknowledge incoming high-priority alerts. Which metric is being measured?

Accepted Answer

Mean Time to Acknowledge (MTA). Mean Time to Acknowledge (MTA) or Mean Time to Respond (MTTR) tracks acknowledgement and response speed.

Answer

Mean Time to Detect (MTTD)

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Patch (MTTP)

Question 17

An architect is designing an enterprise threat hunting program utilizing Cortex XSIAM. They want to create a custom analytics rule that triggers when a specific sequence of three distinct event types occurs within a 10-minute window on the same endpoint. Which feature should be used?

Accepted Answer

XQL Correlation Rules (Sequence matching). Data Stitching and XQL correlation rules allow multi-event sequence detection across datasets and time windows.

Answer

Static IP Blocklist configuration

Answer

XSOAR Email Parsing Rules

Answer

Cortex XDR Agent Local Analysis settings

Question 18

You are configuring Cortex XSOAR integration instances and need to ensure that API keys and passwords are stored securely without appearing in plaintext within playbook logs or incident data. Where should these credentials be stored?

Accepted Answer

As encrypted integration parameters / Vault-managed credentials. Integration credentials in Cortex XSOAR should be stored as encrypted integration parameters (credentials type) managed by the platform vault.

Answer

Inside public incident context data fields

Answer

Hardcoded in custom Python automation scripts

Answer

Plaintext in the playbook YAML file

Question 19

An enterprise security architect is designing high availability for Cortex XSOAR engines. If the primary engine fails, what mechanism ensures zero data loss and uninterrupted playbook execution for active incidents?

Accepted Answer

Active-Active cluster architecture backed by external PostgreSQL and Redis. Cortex XSOAR high availability utilizes an active-passive or active-active cluster backed by an external PostgreSQL database and Redis data store.

Answer

Periodic XML configuration exports via cron jobs

Answer

Automatic client-side browser caching of playbook states

Answer

DNS round-robin load balancing between local SQLite storage files

Question 20

An architect is integrating Cortex XSIAM with ServiceNow to automatically create IT service management (ITSM) tickets when incidents are promoted. Where is the field mapping between Cortex XSIAM incident fields and ServiceNow incident fields configured?

Accepted Answer

ServiceNow Integration Instance Mapper configuration. Incident fields and ITSM mapping in Cortex XSIAM/XSOAR are configured in the Incident Mirroring and Integrations mapping settings.

Answer

Magnifier machine learning threshold slider

Answer

Syslog server forwarding configuration

Answer

Cortex XDR Agent policy settings