SecOps-Architect Secops Frameworks And Threat Response Architecture Practice Test 2 — 15 Questions

Question 1

An organization wants to measure the efficiency of its SOC by tracking how quickly analysts acknowledge incoming high-priority alerts. Which metric is being measured?

Accepted Answer

Mean Time to Acknowledge (MTA). Mean Time to Acknowledge (MTA) or Mean Time to Respond (MTTR) tracks acknowledgement and response speed.

Answer

Mean Time to Detect (MTTD)

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Patch (MTTP)

Question 2

An architect is designing an enterprise threat hunting program utilizing Cortex XSIAM. They want to create a custom analytics rule that triggers when a specific sequence of three distinct event types occurs within a 10-minute window on the same endpoint. Which feature should be used?

Accepted Answer

XQL Correlation Rules (Sequence matching). Data Stitching and XQL correlation rules allow multi-event sequence detection across datasets and time windows.

Answer

Static IP Blocklist configuration

Answer

XSOAR Email Parsing Rules

Answer

Cortex XDR Agent Local Analysis settings

Question 3

You are configuring Cortex XSOAR integration instances and need to ensure that API keys and passwords are stored securely without appearing in plaintext within playbook logs or incident data. Where should these credentials be stored?

Accepted Answer

As encrypted integration parameters / Vault-managed credentials. Integration credentials in Cortex XSOAR should be stored as encrypted integration parameters (credentials type) managed by the platform vault.

Answer

Inside public incident context data fields

Answer

Hardcoded in custom Python automation scripts

Answer

Plaintext in the playbook YAML file

Question 4

An enterprise security architect is designing high availability for Cortex XSOAR engines. If the primary engine fails, what mechanism ensures zero data loss and uninterrupted playbook execution for active incidents?

Accepted Answer

Active-Active cluster architecture backed by external PostgreSQL and Redis. Cortex XSOAR high availability utilizes an active-passive or active-active cluster backed by an external PostgreSQL database and Redis data store.

Answer

Periodic XML configuration exports via cron jobs

Answer

Automatic client-side browser caching of playbook states

Answer

DNS round-robin load balancing between local SQLite storage files

Question 5

An architect is integrating Cortex XSIAM with ServiceNow to automatically create IT service management (ITSM) tickets when incidents are promoted. Where is the field mapping between Cortex XSIAM incident fields and ServiceNow incident fields configured?

Accepted Answer

ServiceNow Integration Instance Mapper configuration. Incident fields and ITSM mapping in Cortex XSIAM/XSOAR are configured in the Incident Mirroring and Integrations mapping settings.

Answer

Magnifier machine learning threshold slider

Answer

Syslog server forwarding configuration

Answer

Cortex XDR Agent policy settings

Question 6

When planning an incident response table-top exercise for a Security Operations team, which framework provides a standardized taxonomy for describing adversary behaviors and tactics?

Accepted Answer

MITRE ATT&CK Framework. MITRE ATT&CK provides a comprehensive matrix of adversary tactics and techniques.

Answer

PCI-DSS v4.0

Answer

ITIL v4 Service Management

Answer

ISO/IEC 27001

Question 7

An architect is designing a multi-region threat intelligence sharing architecture using Cortex XSOAR. They need to synchronize indicators across independent regional XSOAR instances without creating circular loops. Which protocol and architecture pattern should be implemented?

Accepted Answer

TAXII 2.1 Server and Client integration feeds across instances. TAXII (Trusted Automated Exchange of Intelligence Information) client-server architecture is standard for federated indicator sharing.

Answer

Direct database replication of the internal SQLite tables

Answer

Unencrypted FTP file drops of CSV indicator lists

Answer

Raw Syslog forwarding of indicator JSON blobs

Question 8

You are configuring log ingestion in Cortex XSIAM from a third-party firewall using a generic syslog collector. The logs are arriving, but the parser is failing to extract destination IP addresses correctly. What is the recommended troubleshooting step?

Accepted Answer

Modify or create a custom XDM parsing rule for the vendor log format. Custom parsing rules in XSIAM can be created or adjusted using XDM mapping tools to correctly parse non-standard log formats.

Answer

Increase the Syslog port number from 514 to 6514

Answer

Disable Magnifier behavioral analytics

Answer

Reinstall the Cortex XDR agent on the third-party firewall

Question 9

Which role in a well-structured Security Operations Center (SOC) is primarily responsible for performing tier-2 incident triage, deep investigation, and playbook execution?

Accepted Answer

SOC Tier-2 Analyst / Incident Responder. Tier-2 analysts handle escalated alerts requiring deeper investigation and active remediation.

Answer

Compliance Auditor

Answer

Chief Information Security Officer (CISO)

Answer

Helpdesk Support Technician

Question 10

An architect is configuring automated containment in Cortex XSOAR where analyst approval is required before isolating an executive's laptop. Which task type in the playbook accomplishes this?

Accepted Answer

Approval Task (Prompt / Questionnaire task). A Data Collection or Manual/Approval task pauses the playbook and sends a notification for user input.

Answer

Syslog Export Task

Answer

Indicator Enrichment Task

Answer

Auto-Remediation Task

Question 11

An enterprise security architect is designing data residency compliance controls for Cortex XSIAM. European Union customer data must not leave the EU region. Where is data residency enforced in Cortex XSIAM?

Accepted Answer

By selecting the appropriate EU-hosted cloud tenant region during initial tenant provisioning. Data residency is determined by the geographic location of the tenant tenant cluster provisioned during onboarding.

Answer

By configuring log filtering rules in XSOAR playbooks

Answer

By enabling TLS 1.3 encryption on the Broker VM

Answer

By setting local registry keys on each Windows endpoint agent

Question 12

When evaluating the maturity of an Incident Response program using the CMMI (Capability Maturity Model Integration) framework, what characterizes a 'Managed' (Level 2) process?

Accepted Answer

Processes are planned, executed, measured, and controlled at the project level. Level 2 (Managed) processes are planned, executed, measured, and controlled at the project or incident level.

Answer

Processes are standardized across the entire organization

Answer

Processes are entirely ad-hoc and reactive

Answer

Processes are quantitatively optimized through statistical data

Question 13

Which framework is widely recognized as a comprehensive guideline for establishing a foundational cybersecurity program through five core functions: Identify, Protect, Detect, Respond, and Recover?

Accepted Answer

NIST Cybersecurity Framework (CSF). The NIST Cybersecurity Framework (CSF) is structured around these five core functions.

Answer

CIS Critical Security Controls

Answer

ISO/IEC 27017

Answer

MITRE D3FEND

Question 14

When configuring role-based access control (RBAC) in Cortex XSOAR for an Incident Response team, which TWO permissions can be assigned to restrict unauthorized modifications? (Choose two)

Accepted Answer

Allow Incident Deletion. RBAC in Cortex XSOAR allows granular control over incident deletion, settings modification, and script execution.

Answer

Allow Kernel Module Loading

Answer

Allow BIOS Firmware Flashing

Answer

Allow Local Firewall Port Opening

Question 15

An architect is designing an incident response automation strategy in Cortex XSOAR. Which TWO best practices should be followed when developing custom playbooks? (Choose two)

Accepted Answer

Implement robust error handling and conditional branching for integration failures. Playbooks should include proper error handling and modular sub-playbooks to maintain scalability and robustness.

Answer

Execute all integration commands synchronously in a single monolithic task block

Answer

Hardcode API credentials directly inside Python script tasks for fast execution

Answer

Disable incident context output to save database storage space