SecOps-Architect Secops Frameworks And Threat Response Architecture Practice Test 2 — 15 Questions

Question 1

A SOC architect is designing a threat response architecture that integrates Cortex XSOAR with various tools to automate incident response. The architect must ensure that the playbooks can dynamically decide the next steps based on the severity and type of the incident. Which TWO Cortex XSOAR features are essential for enabling conditional, context-aware automation in playbooks? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tasks with conditional branching using built-in filters and transformers. Conditional branching tasks and the 'condition' built-in task are essential for enabling playbooks to dynamically decide next steps based on incident context. These features allow the playbook to evaluate data and choose appropriate actions, such as escalating or enriching, which is critical for context-aware automation in Cortex XSOAR.

Answer

Integration instances with API keys for connecting to external systems

Answer

Playbook triggers based on incident creation or updates

Answer

Incident types and layouts for customizing incident fields and display

Question 2

An architect is designing automated threat-intelligence ingestion for a SOC. Analysts complain that the current feed floods the SIEM with low-fidelity indicators and produces excessive false positives. The architect decides to apply the Traffic Light Protocol (TLP) 2.0 markings to control sharing and handling of received intelligence. Which handling decision is consistent with TLP 2.0?

Accepted Answer

TLP:AMBER+STRICT restricts sharing to the recipient's own organization only, without sharing to clients. TLP 2.0 adds AMBER+STRICT, which confines handling to the recipient organization and removes the client-sharing allowance of standard AMBER. RED is limited to named recipients, AMBER allows limited client sharing, and GREEN allows community sharing without public release. Correct marking interpretation prevents both over-sharing and unnecessary restriction of threat intelligence.

Answer

TLP:AMBER information may be shared with the wider community as long as the source is cited

Answer

TLP:RED information may be shared only with the primary recipient's SOC analysts and no further

Answer

TLP:GREEN information may be shared with peers and partners but never published publicly

Question 3

An architect is mapping a new security operations capability to the MITRE ATT&CK framework. The goal is to detect adversary behavior that occurs after initial access but before any payload is executed on a host. Which TWO ATT&CK tactic categories should the detection content prioritize? (Choose two.)

Accepted Answer

Initial Access. The scenario asks for tactics that occur after initial access begins but before payload execution on a host. Reconnaissance captures pre-attack information gathering, and Initial Access captures the entry attempt itself. Together they let the SOC detect the adversary before code runs. Execution, Persistence, and Command and Control all require or follow host-level execution, so they fall outside the requested window.

Answer

Command and Control

Answer

Execution

Answer

Persistence

Question 4

A healthcare organization is architecting its incident response capabilities using the NIST Cybersecurity Framework (CSF) 2.0. The architect must ensure that the organization can effectively respond to and recover from a ransomware incident. Which CSF 2.0 function and category combination should the architect prioritize to establish a formal incident response plan, including communication and analysis procedures?

Accepted Answer

Respond (RS) - Incident Management (RS.MA) and Analysis (RS.AN). In NIST CSF 2.0, the Respond function encompasses the activities needed to take action regarding a detected cybersecurity incident. Within Respond, the Incident Management (RS.MA) and Analysis (RS.AN) categories specifically cover the execution of response plans, including communication and analysis. Prioritizing these ensures a formal plan is in place, aligning with the requirement.

Answer

Recover (RC) - Recovery Planning (RC.RP)

Answer

Protect (PR) - Awareness and Training (PR.AT)

Answer

Identify (ID) - Asset Management (ID.AM)

Question 5

A newly formed SOC is defining its incident response lifecycle and the CISO asks the architect to align it with the de facto international standard covering preparation, detection and analysis, containment eradication and recovery, and post-incident activity. Which reference should the architect cite as the governing framework for this lifecycle?

Accepted Answer

NIST SP 800-61 Computer Security Incident Handling Guide. NIST SP 800-61 is the reference that defines the four-phase incident handling lifecycle matching the phases the CISO described, covering preparation through post-incident activity. ISO/IEC 27035 is a valid international companion but has a different structure, the NIST Cybersecurity Framework describes program functions rather than an incident lifecycle, and ATT&CK is an adversary knowledge base rather than a process standard.

Answer

ISO/IEC 27035 information security incident management

Answer

NIST Cybersecurity Framework core functions of Identify, Protect, Detect, Respond, and Recover

Answer

The MITRE ATT&CK framework enterprise matrix

Question 6

When designing a threat hunting methodology aligned with the MITRE ATT&CK framework, an architect wants to identify adversary persistence mechanisms. Which tactic category should the analyst focus queries on?

Accepted Answer

Persistence. In MITRE ATT&CK, Persistence is the tactic category (TA0003) that covers techniques adversaries use to maintain footholds across restarts, credential changes, or other interruptions — such as registry Run keys, scheduled tasks, services, and web shells. An analyst hunting for persistence mechanisms should query for these specific techniques (T1547, T1053, T1543, T1505) rather than tactics focused on gaining initial entry or collecting data.

Answer

Initial Access

Answer

Collection

Answer

Execution

Question 7

An architect is designing an incident response workflow in Cortex XSOAR using the Incident Spooler. Which component is primarily responsible for processing queued events into actionable incidents?

Accepted Answer

Cortex XSOAR Server engine. The War Room is where manual actions and playbooks execute, but the Server engine handles the queue processing and ingestion from the Incident Spooler.

Answer

Demisto REST API

Answer

Threat Intel Management module

Answer

Cortex XSIAM Data Lake collector

Question 8

An incident response architect is defining severity levels for security alerts in Cortex XDR. Which severity classification typically triggers automated containment playbooks without human intervention?

Accepted Answer

Critical. In Cortex XDR, severity levels range from Informational and Low through Medium, High, and Critical. Critical severity is reserved for the most severe, high-confidence threats (e.g., confirmed ransomware behavior, active C2, credential dumping) and is the level typically wired to automated containment playbooks that isolate endpoints or block execution without waiting for an analyst. Lower severities are queued for human triage.

Answer

Debugging

Answer

Low

Answer

Informational

Question 9

An organization is integrating Prisma Cloud with Cortex XSOAR to automate cloud incident response. When configuring the Prisma Cloud integration instance in XSOAR, which authentication mechanism is recommended to securely fetch alerts without using static user credentials?

Accepted Answer

OAuth 2.0 Client Credentials grant via a dedicated Service Account. The Prisma Cloud integration in Cortex XSOAR supports OAuth 2.0 Client Credentials grant using a dedicated Service Account, which issues short-lived access tokens without embedding static user credentials. This is the recommended secure authentication method for fetching alerts programmatically. It aligns with least-privilege and credential-rotation best practices.

Answer

LDAP bind credentials through a Cortex XDR Broker VM

Answer

HTTP Basic Authentication with administrative credentials

Answer

SAML 2.0 Federation token exchange

Question 10

An enterprise security architect is integrating Cortex XSIAM with an external SIEM using the Syslog Export feature. The security team notices that certain sensitive fields need to be redacted before export. Where should the architect configure this transformation?

Accepted Answer

Data Forwarding Rules / Log Forwarding Profiles. Log Forwarding profiles in Cortex XSIAM allow filtering, masking, and transforming logs before they are exported via Syslog or HTTP.

Answer

Magnifier machine learning configuration

Answer

Cortex XDR Agent installation parameters

Answer

XSOAR automation playbook script tasks

Question 11

You are deploying Cortex XSIAM and need to ensure that endpoint logs collected from remote agents are normalized into a unified schema before analytics runs. Which feature performs this normalization?

Accepted Answer

XDM (XDR Data Model) mapping and parsing rules. XSIAM utilizes Agent Content and parsing rules to normalize raw logs into the XDM schema during ingestion.

Answer

Cortex XDR Agent Collector Engine

Answer

Magnifier behavioral analytics engine

Answer

Local Analysis Engine (LAE)

Question 12

An architect is deploying the Cortex XDR Broker VM to serve as a syslog collector for legacy network devices. The Broker VM loses connectivity to the Cortex XDR cloud. What happens to the collected syslog data during the outage?

Accepted Answer

The data is buffered locally on the Broker VM and forwarded once reconnected. The Cortex XDR Broker VM is designed with local buffering capability to handle temporary loss of connectivity to the Cortex XDR cloud. When the cloud is unreachable, collected syslog data is stored locally on the Broker VM's disk and forwarded once connectivity is restored, ensuring no data loss during transient outages. This store-and-forward behavior is a core resilience feature of the Broker VM.

Answer

The Broker VM automatically switches to backup SMTP forwarding

Answer

The syslog sender devices resend the packets automatically via TCP retry

Answer

The data is permanently dropped until connectivity returns

Question 13

When aligning a security operations center (SOC) with the NIST Incident Response lifecycle, which phase immediately follows 'Containment, Eradication, and Recovery'?

Accepted Answer

Post-Incident Activity (Lessons Learned). The NIST SP 800-61 lifecycle phases are Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity (Lessons Learned).

Answer

Vulnerability Assessment

Answer

Triage and Scoping

Answer

Threat Hunting

Question 14

An architect is reviewing the Cortex XSIAM Analytics dashboard to identify root causes of security incidents. Which data visualization component aggregates related alerts into a single attack storyline?

Accepted Answer

Incident Storyline. The Incident Storyline in Cortex XSIAM aggregates related alerts into a single attack storyline, providing a unified view of an incident. It correlates alerts from multiple sources to show the sequence of events and root cause. This visualization helps architects understand the attack chain.

Answer

Raw Syslog Viewer

Answer

Indicator Grid

Answer

Dashboard Widget Editor

Question 15

An architect is configuring Indicator Sharing in Cortex XSOAR using the Threat Intel Management module. How are incoming STIX/TAXII indicator feeds prioritized when conflicting reputation scores are received from multiple sources?

Accepted Answer

By configuring source reliability and vendor weight settings. Cortex XSOAR's Threat Intel Management module resolves conflicting indicator reputations by letting the analyst define source reliability (how trustworthy a feed is, e.g., A-F rating) and vendor weight (relative influence of each source). These two parameters are combined to compute a weighted aggregate reputation score, so a high-reliability feed can override a low-reliability one even if the latter arrived later. This gives deterministic, configurable prioritization rather than arbitrary ordering.

Answer

Alphabetical sorting of feed names

Answer

Manual override for every single indicator

Answer

First-in, first-out ingestion timestamp priority