SecOps-Architect Secops Frameworks And Threat Response Architecture Practice Test 3 — 15 Questions

Question 1

When setting up automated email parsing in Cortex XSOAR for phishing triage, which integration is specifically required to connect to Microsoft Office 365 using modern authentication (OAuth 2.0)?

Accepted Answer

Microsoft Graph Mail integration. The Microsoft Graph Mail integration is the correct choice because it is the only Cortex XSOAR integration designed to authenticate to Microsoft Office 365 using modern OAuth 2.0 authentication via an Microsoft Entra ID app registration. Microsoft has deprecated Basic Authentication for Exchange Online, so legacy protocols like IMAP and SMTP with basic auth no longer work for automated mailbox access. Graph Mail uses the Microsoft Graph API, which supports application-level permissions (e.g., Mail.Read) and OAuth 2.0 client credentials flow, making it the required integration for phishing triage email parsing.

Answer

SMTP Relay Server integration

Answer

Legacy Exchange IMAP integration

Answer

Active Directory LDAP integration

Question 2

An enterprise is designing a zero-trust architecture where Cortex XDR integrates with Palo Alto Networks Next-Generation Firewalls. Which protocol and component facilitate real-time dynamic blocklisting of compromised endpoints across both the firewall and the endpoint?

Accepted Answer

Cortex XDR incident handler pushing dynamic IP/URL lists to firewalls via PAN-OS API. The Cortex XDR enforcement service pushes dynamic block lists (EDL / IP lists) via XML API or PAN-OS integration to the firewalls.

Answer

Syslog forwarding from firewalls to the local endpoint agent

Answer

SNMP traps sent from endpoints to the firewall management plane

Answer

User-ID agent querying Active Directory via LDAP

Question 3

An architect is designing an enterprise threat hunting program utilizing Cortex XSIAM. They want to create a custom analytics rule that triggers when a specific sequence of three distinct event types occurs within a 10-minute window on the same endpoint. Which feature should be used?

Accepted Answer

XQL Correlation Rules (Sequence matching). XQL Correlation Rules with sequence matching is the correct feature because it is purpose-built in Cortex XSIAM to detect ordered or unordered sequences of distinct events occurring within a defined time window across a shared entity such as an endpoint. The rule engine correlates multiple event types (e.g., process creation, network connection, registry modification) using join/sequence semantics and a sliding window, which is exactly what the architect needs. Static blocklists, email parsing, and agent local analysis cannot express multi-event temporal correlation logic.

Answer

Static IP Blocklist configuration

Answer

XSOAR Email Parsing Rules

Answer

Cortex XDR Agent Local Analysis settings

Question 4

You are configuring Cortex XSOAR integration instances and need to ensure that API keys and passwords are stored securely without appearing in plaintext within playbook logs or incident data. Where should these credentials be stored?

Accepted Answer

As encrypted integration parameters / Vault-managed credentials. Integration credentials in Cortex XSOAR should be stored as encrypted integration parameters (credentials type) managed by the platform vault.

Answer

Inside public incident context data fields

Answer

Hardcoded in custom Python automation scripts

Answer

Plaintext in the playbook YAML file

Question 5

An architect is integrating Cortex XSIAM with ServiceNow to automatically create IT service management (ITSM) tickets when incidents are promoted. Where is the field mapping between Cortex XSIAM incident fields and ServiceNow incident fields configured?

Accepted Answer

ServiceNow Integration Instance Mapper configuration. In Cortex XSIAM, field mapping between XSIAM incident fields and ServiceNow incident fields is configured in the ServiceNow integration instance's Mapper configuration. This mapper defines how XSIAM incident data is transformed and populated into ServiceNow ITSM ticket fields when an incident is promoted. The other options relate to unrelated features (ML thresholds, syslog forwarding, endpoint agent policies) and have no role in ITSM field mapping.

Answer

Magnifier machine learning threshold slider

Answer

Syslog server forwarding configuration

Answer

Cortex XDR Agent policy settings

Question 6

When planning an incident response table-top exercise for a Security Operations team, which framework provides a standardized taxonomy for describing adversary behaviors and tactics?

Accepted Answer

MITRE ATT&CK Framework. The MITRE ATT&CK Framework is the industry-standard knowledge base that provides a standardized taxonomy of adversary tactics, techniques, and procedures (TTPs), making it the correct choice for structuring a table-top exercise around realistic adversary behaviors. It gives the SOC a common vocabulary to describe what attackers do at each phase of an intrusion, which is exactly what a table-top exercise needs to simulate and discuss.

Answer

PCI-DSS v4.0

Answer

ITIL v4 Service Management

Answer

ISO/IEC 27001

Question 7

You are configuring log ingestion in Cortex XSIAM from a third-party firewall using a generic syslog collector. The logs are arriving, but the parser is failing to extract destination IP addresses correctly. What is the recommended troubleshooting step?

Accepted Answer

Modify or create a custom XDM parsing rule for the vendor log format. Cortex XSIAM uses XDM (Extended Data Model) to normalize ingested logs into a common schema. When a generic syslog collector receives logs from a third-party firewall, the default parser may not correctly map vendor-specific fields to XDM attributes like destination IP. Creating or modifying a custom XDM parsing rule allows you to define extraction patterns (e.g., regex, delimiters) that correctly identify and map the destination IP field.

Answer

Increase the Syslog port number from 514 to 6514

Answer

Disable Magnifier behavioral analytics

Answer

Reinstall the Cortex XDR agent on the third-party firewall

Question 8

Which role in a well-structured Security Operations Center (SOC) is primarily responsible for performing tier-2 incident triage, deep investigation, and playbook execution?

Accepted Answer

SOC Tier-2 Analyst / Incident Responder. The SOC Tier-2 Analyst / Incident Responder role is specifically responsible for deeper investigation, incident triage beyond initial alert validation, and executing response playbooks. Tier-2 analysts handle escalated incidents that Tier-1 cannot resolve, performing root-cause analysis and coordinating containment. This matches the question's description of tier-2 triage, deep investigation, and playbook execution.

Answer

Compliance Auditor

Answer

Chief Information Security Officer (CISO)

Answer

Helpdesk Support Technician

Question 9

An architect is configuring automated containment in Cortex XSOAR where analyst approval is required before isolating an executive's laptop. Which task type in the playbook accomplishes this?

Accepted Answer

Approval Task (Prompt / Questionnaire task). A Data Collection or Manual/Approval task pauses the playbook and sends a notification for user input.

Answer

Syslog Export Task

Answer

Indicator Enrichment Task

Answer

Auto-Remediation Task

Question 10

When evaluating the maturity of an Incident Response program using the CMMI (Capability Maturity Model Integration) framework, what characterizes a 'Managed' (Level 2) process?

Accepted Answer

Processes are planned, executed, measured, and controlled at the project level. In CMMI, a Managed (Level 2) process is characterized by being planned, performed, measured, and controlled at the project level. Work products and services are managed against a documented plan, and performance is tracked so corrective action can be taken. This is a project-specific discipline, not yet an organization-wide standard.

Answer

Processes are standardized across the entire organization

Answer

Processes are entirely ad-hoc and reactive

Answer

Processes are quantitatively optimized through statistical data

Question 11

Which framework is widely recognized as a comprehensive guideline for establishing a foundational cybersecurity program through five core functions: Identify, Protect, Detect, Respond, and Recover?

Accepted Answer

NIST Cybersecurity Framework (CSF). The NIST Cybersecurity Framework (CSF) is structured around these five core functions.

Answer

CIS Critical Security Controls

Answer

ISO/IEC 27017

Answer

MITRE D3FEND

Question 12

An architect is designing an incident response automation strategy in Cortex XSOAR. Which TWO best practices should be followed when developing custom playbooks? (Choose two)

Accepted Answer

Implement robust error handling and conditional branching for integration failures. Option A is correct because custom Cortex XSOAR playbooks must anticipate integration failures (e.g., API timeouts, authentication errors, rate limits) and use conditional branching, task conditions, and error-handling paths so the playbook can retry, fall back, or escalate rather than aborting mid-incident. Option D is correct because modular sub-playbooks encapsulate repetitive logic (enrichment, containment, notification), making playbooks reusable across incident types, easier to maintain, and simpler to test and version. Option B is not correct: running every integration command synchronously in one monolithic block serializes execution, wastes time, and prevents parallel task execution and granular error isolation. Option C is not correct: hardcoding API credentials in Python script tasks exposes secrets in playbook content and violates credential management; XSOAR provides the Credentials store and integration instances for secure secret handling. Option E is not correct: disabling incident context output removes the data needed for investigation, reporting, and downstream task inputs, and storage savings do not justify losing context.

Answer

Execute all integration commands synchronously in a single monolithic task block

Answer

Hardcode API credentials directly inside Python script tasks for fast execution

Answer

Disable incident context output to save database storage space

Question 13

An architect is designing an automated threat intelligence enrichment pipeline in Cortex XSOAR. Which THREE actions are typically performed during indicator lifecycle management? (Choose three)

Accepted Answer

Correlating and calculating composite reputation scores across multiple sources. Indicator lifecycle management in Cortex XSOAR centers on ingesting, scoring, and retiring indicators as their relevance changes. Option B is correct because the platform correlates indicators from multiple feeds and computes composite reputation scores (e.g., via the reputation commands and DBotScore) so analysts see an aggregated verdict rather than isolated source data. Option C is correct because structured ingestion from STIX/TAXII feeds is a standard, automated way to bring external threat intel into the indicator store for enrichment and matching. Option D is correct because indicators must be aged out or expired based on a TTL so stale IOCs do not generate false positives or clutter the database, which is a core lifecycle stage. Options A and E are incorrect because replacing server motherboards and recompiling the Linux kernel are hardware/OS maintenance tasks unrelated to threat intelligence indicator lifecycle management.

Answer

Physically replacing the server motherboard every 90 days

Answer

Manually recompiling the Linux kernel for every IOC added

Question 14

An enterprise security architect is configuring Cortex XSIAM data ingestion and analytics. Which THREE data sources are essential for comprehensive endpoint and cloud threat detection? (Choose three)

Accepted Answer

Endpoint EDR telemetry (process execution, file modifications, network connections). Option A is correct because endpoint EDR telemetry supplies the process-execution, file-modification, and network-connection events that Cortex XSIAM's analytics engine needs to detect host-based threats such as malicious process trees, ransomware file encryption, and command-and-control connections. Option C is correct because cloud provider audit logs like AWS CloudTrail and Azure Activity Logs record control-plane API activity (e.g., IAM changes, resource creation, privilege escalation), which is essential for detecting cloud account compromise and misconfiguration abuse. Option E is correct because network traffic flow logs and firewall security logs provide the north-south and east-west visibility needed to identify lateral movement, exfiltration, and policy violations that endpoint and cloud logs alone may miss. Options B and D are incorrect because local calculator cache files and printer driver configuration backups are low-value, host-local artifacts with no security telemetry relevance to endpoint or cloud threat detection.

Answer

Local calculator application cache files

Answer

Local printer driver configuration backups

Question 15

An organization is integrating Cortex XSIAM with third-party security tools for automated remediation. Which THREE mechanisms are supported for triggering external actions from XSIAM/XSOAR? (Choose three)

Accepted Answer

Leveraging Python automation scripts using the Demisto/XSOAR API library. Option A is correct because XSIAM/XSOAR supports custom Python automation scripts that use the Demisto/XSOAR API library (demisto-sdk / demisto-py) to programmatically trigger external actions and orchestrate third-party tools. Option C is correct because playbooks can execute integration commands (built-in or custom integrations) to invoke actions on external security tools as part of automated remediation workflows. Option D is correct because HTTP Request automation scripts allow XSIAM/XSOAR to call external webhooks over HTTP/HTTPS, enabling outbound triggers to third-party systems. Options B and E are incorrect because physical rewiring of Ethernet patch panels and punch cards are hardware/manual operations unrelated to XSIAM/XSOAR automation capabilities.

Answer

Direct physical rewiring of Ethernet patch panels

Answer

Inserting punch cards into magnetic readers