SecOps-Architect Secops Frameworks And Threat Response Architecture — 25 Questions

Question 1

In a multi-tenant Cortex XSOAR deployment, an architect needs to restrict access to specific playbooks so that Tenant A analysts cannot view or execute playbooks owned by Tenant B. Where is this access control configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Role-Based Access Control (RBAC) settings under Settings > Common > Roles. In Cortex XSOAR multi-tenant deployments, playbook-level access control is enforced through Role-Based Access Control (RBAC) configured under Settings > Common > Roles. RBAC roles define which playbooks, integrations, and content a user or tenant can view and execute, so restricting Tenant A from Tenant B's playbooks requires assigning roles with scoped playbook permissions. This is the only supported mechanism for granular, per-tenant content isolation in XSOAR.

Answer

Global Server Configuration settings

Answer

Playbook JSON source code permissions

Answer

Integration instance parameters

Question 2

You are designing an automated phishing response workflow in Cortex XSOAR. The playbook needs to extract all URLs from an incoming email body and check their reputation using VirusTotal. Which built-in task type should you use to evaluate each URL concurrently?

Accepted Answer

Loop / For-Each Task. A loop task in Cortex XSOAR iterates over lists or arrays, such as extracted URLs, allowing parallel or sequential processing.

Answer

Data Collection Task

Answer

Transformation Script Task

Answer

Manual Review Task

Question 3

An architect is designing an automated containment workflow in Cortex XDR where an endpoint must be isolated only if it is confirmed to be communicating with a known Command and Control (C2) server. Which XQL query logic accurately identifies this condition before triggering isolation?

Accepted Answer

dataset = xdr_data | filter alert_name = 'C2 Communication' and causal_agent_id != null | fields agent_id, C2_ip. XQL queries aggregate alerts and network events to confirm C2 communication status before automated action.

Answer

dataset = endpoint_logs | summarize failed_logins = count() by user_name

Answer

dataset = xdr_data | filter event_type = 'network' and action = 'allowed' | stats count() by actor_process_image_path

Answer

dataset = network_traffic | filter bytes > 1000000

Question 4

An organization wants to measure the efficiency of its SOC by tracking how quickly analysts acknowledge incoming high-priority alerts. Which metric is being measured?

Accepted Answer

Mean Time to Acknowledge (MTA). Mean Time to Acknowledge (MTA) or Mean Time to Respond (MTTR) tracks acknowledgement and response speed.

Answer

Mean Time to Detect (MTTD)

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Patch (MTTP)

Question 5

An enterprise security architect is designing high availability for Cortex XSOAR engines. If the primary engine fails, what mechanism ensures zero data loss and uninterrupted playbook execution for active incidents?

Accepted Answer

Active-Active cluster architecture backed by external PostgreSQL and Redis. Cortex XSOAR engines achieve high availability and zero data loss through an Active-Active cluster architecture where multiple engine instances share state via external PostgreSQL (for incident/playbook data) and Redis (for caching and message queuing). This design ensures that if the primary engine fails, another engine in the cluster immediately picks up active playbook executions without losing context or data. The externalized data stores are the key: because state is not held locally on any single engine, failover is seamless and no incident data is lost.

Answer

Periodic XML configuration exports via cron jobs

Answer

Automatic client-side browser caching of playbook states

Answer

DNS round-robin load balancing between local SQLite storage files

Question 6

An architect is designing a multi-region threat intelligence sharing architecture using Cortex XSOAR. They need to synchronize indicators across independent regional XSOAR instances without creating circular loops. Which protocol and architecture pattern should be implemented?

Accepted Answer

TAXII 2.1 Server and Client integration feeds across instances. TAXII (Trusted Automated Exchange of Intelligence Information) client-server architecture is standard for federated indicator sharing.

Answer

Direct database replication of the internal SQLite tables

Answer

Unencrypted FTP file drops of CSV indicator lists

Answer

Raw Syslog forwarding of indicator JSON blobs

Question 7

An enterprise security architect is designing data residency compliance controls for Cortex XSIAM. European Union customer data must not leave the EU region. Where is data residency enforced in Cortex XSIAM?

Accepted Answer

By selecting the appropriate EU-hosted cloud tenant region during initial tenant provisioning. Data residency is determined by the geographic location of the tenant tenant cluster provisioned during onboarding.

Answer

By configuring log filtering rules in XSOAR playbooks

Answer

By enabling TLS 1.3 encryption on the Broker VM

Answer

By setting local registry keys on each Windows endpoint agent

Question 8

When configuring role-based access control (RBAC) in Cortex XSOAR for an Incident Response team, which TWO permissions can be assigned to restrict unauthorized modifications? (Choose two)

Accepted Answer

Allow Incident Deletion. In Cortex XSOAR RBAC, permissions are granular role settings that govern what a user can do within the platform, and both 'Allow Incident Deletion' (A) and 'Allow Server Configuration Edits' (C) are legitimate XSOAR role permissions that directly restrict destructive or administrative modifications. Option A is correct because incident deletion is a sensitive, destructive action that RBAC can deny so IR team members cannot remove incident records or evidence. Option C is correct because server configuration edits control global platform settings, and withholding this permission prevents unauthorized changes to the XSOAR server. Options B, D, and E are incorrect because kernel module loading, BIOS firmware flashing, and local firewall port opening are operating-system or hardware-level operations, not Cortex XSOAR RBAC permissions.

Answer

Allow Kernel Module Loading

Answer

Allow BIOS Firmware Flashing

Answer

Allow Local Firewall Port Opening

Question 9

An organization wants to implement the MITRE ATT&CK framework into their threat detection engineering lifecycle within Cortex XSIAM. Which specific feature enables architects to map incoming telemetry and custom correlation rules directly to ATT&CK tactics and techniques to measure coverage?

Accepted Answer

ATT&CK Coverage Dashboard and Analytics Mapping. Cortex XSIAM includes a built-in MITRE ATT&CK matrix view that automatically maps triggered alerts and analytics rules to tactics and techniques to track coverage.

Answer

Panorama Dynamic Address Groups

Answer

AutoFocus Tagging Engine

Answer

Traps Agent Policy Editor

Question 10

A SOC architect is integrating Cortex XSOAR with Palo Alto Networks Cortex XDR to automate the triage of high-severity alerts. Which specific architecture component should be configured to ensure seamless bi-directional incident synchronization and automated playbook execution?

Accepted Answer

Cortex XSOAR Content Pack for Cortex XDR. The Cortex XSOAR integration utilizes the Cortex XDR incident management APIs via an instance-configured integration to fetch incidents, update statuses, and run playbooks.

Answer

Prisma Access Remote Network Connector

Answer

AutoFocus Tag Synchronizer

Answer

Minemeld Global Feed Engine

Question 11

An architect is configuring log ingestion for Cortex XSIAM. Which native Palo Alto Networks collector type is designed to gather syslog and CEF formatted logs from third-party security devices without requiring an external forwarder VM?

Accepted Answer

Cortex XSIAM Broker VM. Cortex XSIAM supports Cloud Identity Engine and Broker VM architectures, where the Broker VM acts as a local collector for syslog, SNMP, and other third-party formats.

Answer

AutoFocus Cloud API connector

Answer

Panorama Management Server direct API

Answer

GlobalProtect Gateway agent

Question 12

A security architect is designing an incident escalation matrix for a multinational SOC. Which metric is most critical to measure the effectiveness of the Tier 1 triage team before escalating incidents to Tier 2?

Accepted Answer

Mean Time to Acknowledge (MTTA) and Triage accuracy. Mean Time to Triage (MTTT) or Mean Time to Acknowledge (MTTA) measures how quickly Tier 1 processes and validates incoming alerts before escalating.

Answer

Number of global security patents filed

Answer

Mean Time to Patch (MTTP)

Answer

Total volume of firewall rules configured

Question 13

An architect is designing a threat detection architecture using Cortex XSIAM analytics. Which THREE types of data sources are critical to ingest to provide comprehensive visibility for detecting lateral movement and credential dumping? (Choose three)

Accepted Answer

Active Directory / Authentication logs (e.g., Windows Security Event logs for Kerberos/NTLM). Option A is correct because Active Directory and authentication logs, such as Windows Security Event logs for Kerberos and NTLM, are essential for detecting credential dumping and lateral movement through suspicious logon events, ticket anomalies, and pass-the-hash or pass-the-ticket activity. Option B is correct because network traffic flow logs, such as PAN-OS Traffic and Threat logs, provide visibility into east-west movement, unusual internal connections, command-and-control traffic, and data exfiltration that often accompany lateral movement. Option C is correct because endpoint process execution and OS telemetry, such as Cortex XDR agent logs, capture process creation, memory access, credential dumping tools like Mimikatz, and suspicious parent-child process relationships that reveal host-level compromise. Option D does not belong because HVAC temperature and humidity sensor telemetry is building management data with no relevance to detecting credential dumping or lateral movement. Option E does not belong because cafeteria POS terminal receipt printer error logs are unrelated operational data and provide no security visibility into authentication, endpoint, or network adversary behavior.

Answer

HVAC temperature and humidity sensor telemetry

Answer

Cafeteria POS terminal receipt printer error logs

Question 14

An architect is configuring role-based access control (RBAC) in Cortex XSIAM for a multi-tenant SOC environment. Which TWO principles should guide the design of security analyst roles? (Choose three - wait, prompt says Which TWO for multi_select half. Let's provide TWO). Which TWO principles should guide the design of security analyst roles? (Choose two)

Accepted Answer

Principle of least privilege (granting only necessary permissions for job functions). Option A is correct because the principle of least privilege is a foundational RBAC design rule: each security analyst role should be granted only the specific permissions required for their job function, minimizing the blast radius if an account is compromised or misused. Option E is correct because segregation of duties ensures that incident responders and system administrators hold distinct, non-overlapping roles, preventing any single user from both detecting/responding to incidents and altering the underlying system configurations, which reduces the risk of insider abuse and accidental conflicts of interest. Options B, C, and D are incorrect: sharing a single root administrator account destroys individual accountability and non-repudiation; granting full Super Administrator privileges to all Tier 1 analysts violates least privilege and dramatically expands the attack surface; and disabling audit logging for administrator actions removes the forensic trail needed for compliance and incident investigation, saving disk space at an unacceptable security cost.

Answer

Sharing a single root administrator account across the entire global SOC team

Answer

Assigning full Super Administrator privileges to all Tier 1 analysts to accelerate triage

Answer

Disabling audit logging for administrator actions to save disk space

Question 15

An organization is building a Threat Intelligence Program aligned with the Diamond Model of Intrusion Analysis. Which THREE core vertices must be analyzed for every adversary event in the incident tracking database? (Choose three)

Accepted Answer

Capability (the tools and techniques used by the adversary). The Diamond Model of Intrusion Analysis defines every intrusion event through four core features, three of which are named here: Adversary (E), Capability (A), and Infrastructure (C). Adversary (E) is correct because it identifies the actor or organization responsible for the intrusion, which is the 'who' vertex of the model. Capability (A) is correct because it captures the tools, malware, and techniques the adversary uses, representing the 'how' of the event. Infrastructure (C) is correct because it describes the physical or logical communication channels (e.g., C2 servers, IP addresses, domains) that connect the adversary to the victim, forming the 'where/how delivered' vertex. Options B (HVAC cooling capacity) and D (cafeteria menu pricing) are facility-management data points with no role in the Diamond Model's adversary-event vertices and are therefore incorrect.

Answer

Office HVAC cooling capacity metrics

Answer

Local cafeteria menu pricing structures

Question 16

A SOC architect is designing a threat response architecture that integrates Cortex XSOAR with various tools to automate incident response. The architect must ensure that the playbooks can dynamically decide the next steps based on the severity and type of the incident. Which TWO Cortex XSOAR features are essential for enabling conditional, context-aware automation in playbooks? (Choose two.)

Accepted Answer

Tasks with conditional branching using built-in filters and transformers. Conditional branching tasks and the 'condition' built-in task are essential for enabling playbooks to dynamically decide next steps based on incident context. These features allow the playbook to evaluate data and choose appropriate actions, such as escalating or enriching, which is critical for context-aware automation in Cortex XSOAR.

Answer

Integration instances with API keys for connecting to external systems

Answer

Playbook triggers based on incident creation or updates

Answer

Incident types and layouts for customizing incident fields and display

Question 17

An architect is designing automated threat-intelligence ingestion for a SOC. Analysts complain that the current feed floods the SIEM with low-fidelity indicators and produces excessive false positives. The architect decides to apply the Traffic Light Protocol (TLP) 2.0 markings to control sharing and handling of received intelligence. Which handling decision is consistent with TLP 2.0?

Accepted Answer

TLP:AMBER+STRICT restricts sharing to the recipient's own organization only, without sharing to clients. TLP 2.0 adds AMBER+STRICT, which confines handling to the recipient organization and removes the client-sharing allowance of standard AMBER. RED is limited to named recipients, AMBER allows limited client sharing, and GREEN allows community sharing without public release. Correct marking interpretation prevents both over-sharing and unnecessary restriction of threat intelligence.

Answer

TLP:AMBER information may be shared with the wider community as long as the source is cited

Answer

TLP:RED information may be shared only with the primary recipient's SOC analysts and no further

Answer

TLP:GREEN information may be shared with peers and partners but never published publicly

Question 18

An architect is mapping a new security operations capability to the MITRE ATT&CK framework. The goal is to detect adversary behavior that occurs after initial access but before any payload is executed on a host. Which TWO ATT&CK tactic categories should the detection content prioritize? (Choose two.)

Accepted Answer

Initial Access. The scenario asks for tactics that occur after initial access begins but before payload execution on a host. Reconnaissance captures pre-attack information gathering, and Initial Access captures the entry attempt itself. Together they let the SOC detect the adversary before code runs. Execution, Persistence, and Command and Control all require or follow host-level execution, so they fall outside the requested window.

Answer

Command and Control

Answer

Execution

Answer

Persistence

Question 19

A healthcare organization is architecting its incident response capabilities using the NIST Cybersecurity Framework (CSF) 2.0. The architect must ensure that the organization can effectively respond to and recover from a ransomware incident. Which CSF 2.0 function and category combination should the architect prioritize to establish a formal incident response plan, including communication and analysis procedures?

Accepted Answer

Respond (RS) - Incident Management (RS.MA) and Analysis (RS.AN). In NIST CSF 2.0, the Respond function encompasses the activities needed to take action regarding a detected cybersecurity incident. Within Respond, the Incident Management (RS.MA) and Analysis (RS.AN) categories specifically cover the execution of response plans, including communication and analysis. Prioritizing these ensures a formal plan is in place, aligning with the requirement.

Answer

Recover (RC) - Recovery Planning (RC.RP)

Answer

Protect (PR) - Awareness and Training (PR.AT)

Answer

Identify (ID) - Asset Management (ID.AM)

Question 20

A newly formed SOC is defining its incident response lifecycle and the CISO asks the architect to align it with the de facto international standard covering preparation, detection and analysis, containment eradication and recovery, and post-incident activity. Which reference should the architect cite as the governing framework for this lifecycle?

Accepted Answer

NIST SP 800-61 Computer Security Incident Handling Guide. NIST SP 800-61 is the reference that defines the four-phase incident handling lifecycle matching the phases the CISO described, covering preparation through post-incident activity. ISO/IEC 27035 is a valid international companion but has a different structure, the NIST Cybersecurity Framework describes program functions rather than an incident lifecycle, and ATT&CK is an adversary knowledge base rather than a process standard.

Answer

ISO/IEC 27035 information security incident management

Answer

NIST Cybersecurity Framework core functions of Identify, Protect, Detect, Respond, and Recover

Answer

The MITRE ATT&CK framework enterprise matrix