SecOps-Architect Secops Frameworks And Threat Response Architecture Practice Test 3 — 15 Questions

Question 1

An architect is designing an automated threat intelligence enrichment pipeline in Cortex XSOAR. Which THREE actions are typically performed during indicator lifecycle management? (Choose three)

Accepted Answer

Correlating and calculating composite reputation scores across multiple sources. Indicator lifecycle management involves ingestion, reputation scoring, expiration, and sharing or blocking.

Answer

Physically replacing the server motherboard every 90 days

Answer

Manually recompiling the Linux kernel for every IOC added

Question 2

An enterprise security architect is configuring Cortex XSIAM data ingestion and analytics. Which THREE data sources are essential for comprehensive endpoint and cloud threat detection? (Choose three)

Accepted Answer

Endpoint EDR telemetry (process execution, file modifications, network connections). Comprehensive detection in XSIAM relies on endpoint telemetry, cloud audit logs, and network traffic data.

Answer

Local calculator application cache files

Answer

Local printer driver configuration backups

Question 3

An organization is integrating Cortex XSIAM with third-party security tools for automated remediation. Which THREE mechanisms are supported for triggering external actions from XSIAM/XSOAR? (Choose three)

Accepted Answer

Leveraging Python automation scripts using the Demisto/XSOAR API library. Actions can be triggered via REST APIs, SDKs, and built-in integration commands.

Answer

Direct physical rewiring of Ethernet patch panels

Answer

Inserting punch cards into magnetic readers

Question 4

An architect is deploying Cortex XDR Broker VMs in a DMZ architecture. Which TWO network requirements must be satisfied for successful operation? (Choose two)

Accepted Answer

Inbound syslog or SNMP trap connectivity from local log sources. Broker VMs require outbound HTTPS access to the Cortex cloud and inbound connectivity from log sources.

Answer

Inbound RDP access from public internet IP addresses

Answer

Direct database replication port 5432 to external client workstations

Answer

Unencrypted FTP access for configuration file uploads

Question 5

When designing a threat hunting architecture using XQL in Cortex XSIAM, which TWO best practices improve query performance and efficiency? (Choose two)

Accepted Answer

Use indexed fields and precise matching operators where possible. Filtering early by dataset and time range significantly improves XQL query performance.

Answer

Run unbounded queries across all historical data without time constraints

Answer

Avoid using aggregation functions like count or summarize

Answer

Select all raw unparsed logs and avoid using specific field names

Question 6

An architect is planning the deployment of Cortex XDR agents across a heterogeneous enterprise environment. Which TWO deployment methods are officially supported? (Choose two)

Accepted Answer

Active Directory Group Policy Object (GPO) deployment. Cortex XDR agents can be deployed via Active Directory Group Policy (GPO) or centralized endpoint management tools like SCCM/Intune.

Answer

Embedding the agent installer inside public spam email attachments

Answer

Manual floppy disk installation on every workstation

Answer

Mailing unencrypted USB flash drives to employees' home addresses

Question 7

When configuring Cortex XSOAR incident classification and mapping, which TWO elements must be defined for an incoming alert type? (Choose two)

Accepted Answer

Field mapping schema between incoming alerts and XSOAR incident fields. Incident types require mapping schemas and associated default playbooks.

Answer

Physical server CPU core allocation

Answer

Endpoint BIOS vendor name

Answer

Local printer queue ID

Question 8

An architect is designing an enterprise incident response communication plan. Which THREE components are critical for effective operational coordination during a major security incident? (Choose three)

Accepted Answer

Pre-defined stakeholder and legal notification escalation trees. Effective operational coordination requires secure communication channels, stakeholder notification trees, and centralized logging.

Answer

Publicly posting all unredacted forensic disk images on social media

Answer

Disabling all documentation to maintain total secrecy

Question 9

An enterprise security architect is reviewing threat detection coverage using the MITRE ATT&CK Navigator. Which THREE strategic objectives can be achieved using this exercise? (Choose three)

Accepted Answer

Identifying detection gaps and blind spots across security monitoring tools. MITRE ATT&CK Navigator helps identify detection gaps, prioritize security investments, and map telemetry coverage.

Answer

Automatically overclocking enterprise workstation CPUs

Answer

Configuring static IP addresses on firewall interfaces

Question 10

An architect is designing an automated threat intelligence enrichment pipeline in Cortex XSOAR. Which THREE actions are typically performed during indicator lifecycle management? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Revoking user session tokens and triggering password resets in Active Directory / Azure AD. Automated actions can include endpoint isolation, user password resets, and firewall blocklists.

Answer

Physically disconnecting all power cables in the data center

Answer

Formatting the corporate intranet web server hard drives

Question 11

An architect is designing an incident response lifecycle based on the NIST SP 800-61 framework for a Security Operations Center (SOC). Which phase immediately follows the Containment, Eradication, and Recovery phase?

Accepted Answer

Post-Incident Activity. According to NIST SP 800-61, the lifecycle phases are Preparation, Detection and Analysis, Containment, Eradication, and Recovery, and finally Post-Incident Activity (Lessons Learned).

Answer

Detection and Analysis

Answer

Threat Intelligence Enrichment

Answer

Risk Assessment

Question 12

When designing a threat hunting architecture, an architect must differentiate between indicator-based searching and hypothesis-driven hunting. Which approach represents a hypothesis-driven threat hunt?

Accepted Answer

Developing a query to detect potential lateral movement using PowerShell remoting based on recent red team exercises. Hypothesis-driven hunting starts with a theory about potential adversary behavior or TTPs and uses analytics to search for undiscovered activity.

Answer

Blocking known malicious domains using PAN-OS DNS Security

Answer

Automating the ingestion of STIX/TAXII feeds into Cortex XSOAR

Answer

Searching for specific file hashes provided in a recent vendor threat intelligence report

Question 13

An organization wants to implement the MITRE ATT&CK framework into their threat detection engineering lifecycle within Cortex XSIAM. Which specific feature enables architects to map incoming telemetry and custom correlation rules directly to ATT&CK tactics and techniques to measure coverage?

Accepted Answer

ATT&CK Coverage Dashboard and Analytics Mapping. Cortex XSIAM includes a built-in MITRE ATT&CK matrix view that automatically maps triggered alerts and analytics rules to tactics and techniques to track coverage.

Answer

Panorama Dynamic Address Groups

Answer

AutoFocus Tagging Engine

Answer

Traps Agent Policy Editor

Question 14

A SOC architect is integrating Cortex XSOAR with Palo Alto Networks Cortex XDR to automate the triage of high-severity alerts. Which specific architecture component should be configured to ensure seamless bi-directional incident synchronization and automated playbook execution?

Accepted Answer

Cortex XSOAR Content Pack for Cortex XDR. The Cortex XSOAR integration utilizes the Cortex XDR incident management APIs via an instance-configured integration to fetch incidents, update statuses, and run playbooks.

Answer

Prisma Access Remote Network Connector

Answer

AutoFocus Tag Synchronizer

Answer

Minemeld Global Feed Engine

Question 15

An architect is designing an automated containment workflow in Cortex XSOAR. The requirement is to isolate a compromised endpoint running Cortex XDR agent without disrupting critical domain controllers. Which configuration parameter must be validated in the isolation command?

Accepted Answer

Exclusion lists and targeted device IDs to prevent critical asset isolation. When executing endpoint isolation in Cortex XDR via XSOAR, the architect must ensure exceptions or proper scoping are applied to prevent isolating essential infrastructure like Domain Controllers.

Answer

PAN-OS external dynamic list expiration timers

Answer

Global firewall rule bypass codes

Answer

Syslog forwarding facility levels