SecOps-Architect Secops Frameworks And Threat Response Architecture Practice Test 4 — 15 Questions

Question 1

An architect is deploying Cortex XDR Broker VMs in a DMZ architecture. Which TWO network requirements must be satisfied for successful operation? (Choose two)

Accepted Answer

Inbound syslog or SNMP trap connectivity from local log sources. Option D is correct because the Cortex XDR Broker VM must establish outbound HTTPS (TCP 443) connections to the Cortex XDR cloud tenant to register, receive policy/configuration updates, and forward collected data, so this egress path is mandatory. Option A is correct because the Broker VM's log-collection role requires inbound syslog (UDP/TCP 514) or SNMP trap (UDP 162) connectivity from local log sources so those devices can deliver their logs to the broker for forwarding to the cloud. Option B is wrong because inbound RDP from public internet addresses is never a Cortex XDR Broker VM requirement and would be a serious security exposure. Option C is wrong because the Broker VM does not perform direct PostgreSQL database replication on port 5432 to external client workstations. Option E is wrong because unencrypted FTP is not used for Broker VM configuration uploads; management and data transfer occur over secure channels to the Cortex XDR tenant.

Answer

Inbound RDP access from public internet IP addresses

Answer

Direct database replication port 5432 to external client workstations

Answer

Unencrypted FTP access for configuration file uploads

Question 2

When designing a threat hunting architecture using XQL in Cortex XSIAM, which TWO best practices improve query performance and efficiency? (Choose two)

Accepted Answer

Use indexed fields and precise matching operators where possible. Option A is correct because using indexed fields and precise matching operators (e.g., =, in, or exact string comparisons instead of wildcard or regex-heavy filters) lets Cortex XSIAM's XQL engine prune data at the index level, drastically reducing the number of events scanned and improving query speed. Option B is correct because filtering by specific datasets (e.g., xdr_data, panw_ngfw_traffic_raw) and applying narrow time ranges early in the query pipeline limits the volume of data the engine must process before subsequent stages, which is the single most effective way to reduce XQL execution time and resource consumption. Option C is incorrect because unbounded queries across all historical data force full scans of massive datasets, causing slow execution, high resource usage, and potential timeouts. Option D is incorrect because aggregation functions like count, sum, and summarize are essential for efficient threat hunting and are optimized in XQL; avoiding them does not improve performance. Option E is incorrect because selecting all raw unparsed logs and avoiding specific field names increases data volume and prevents the engine from leveraging field-level indexing and parsing optimizations.

Answer

Run unbounded queries across all historical data without time constraints

Answer

Avoid using aggregation functions like count or summarize

Answer

Select all raw unparsed logs and avoid using specific field names

Question 3

An architect is planning the deployment of Cortex XDR agents across a heterogeneous enterprise environment. Which TWO deployment methods are officially supported? (Choose two)

Accepted Answer

Active Directory Group Policy Object (GPO) deployment. Option B is correct because Cortex XDR supports deploying the agent via Active Directory Group Policy Object (GPO), which lets administrators push the installer to domain-joined Windows endpoints through a computer startup script or software installation policy. Option D is correct because Cortex XDR officially supports distribution through centralized endpoint management platforms such as Microsoft Intune, Microsoft SCCM, and Jamf, which are the standard mechanisms for large-scale, heterogeneous fleets. Option A is not a supported deployment method, as emailing installers as spam attachments is insecure and unreliable and is not an official Cortex XDR deployment channel. Option C is not supported because floppy disks are obsolete media and Cortex XDR does not provide floppy-based installation. Option E is not supported because mailing unencrypted USB drives is insecure and is not an official deployment method for Cortex XDR agents.

Answer

Embedding the agent installer inside public spam email attachments

Answer

Manual floppy disk installation on every workstation

Answer

Mailing unencrypted USB flash drives to employees' home addresses

Question 4

When configuring Cortex XSOAR incident classification and mapping, which TWO elements must be defined for an incoming alert type? (Choose two)

Accepted Answer

Field mapping schema between incoming alerts and XSOAR incident fields. In Cortex XSOAR, incident classification and mapping requires defining how incoming alert data is translated into XSOAR incident fields, which is exactly what option A (field mapping schema between incoming alerts and XSOAR incident fields) provides — without a mapping schema, the raw alert fields cannot populate the incident fields correctly. Option C (associated default playbook) is also required because classification and mapping ties an alert type to a default playbook that automatically runs when that incident type is created, enabling automated response. Options B, D, and E are unrelated to XSOAR classification and mapping: CPU core allocation, BIOS vendor name, and printer queue ID are infrastructure/hardware details that play no role in defining how alerts are classified, mapped, or automated in Cortex XSOAR.

Answer

Physical server CPU core allocation

Answer

Endpoint BIOS vendor name

Answer

Local printer queue ID

Question 5

An architect is designing an enterprise incident response communication plan. Which THREE components are critical for effective operational coordination during a major security incident? (Choose three)

Accepted Answer

Pre-defined stakeholder and legal notification escalation trees. Option A is correct because pre-defined stakeholder and legal notification escalation trees establish who must be informed, in what order, and within what regulatory timeframes (e.g., GDPR 72-hour breach notification), which is essential for coordinated operational response. Option B is correct because a centralized incident war room with a ticketing audit trail provides a single source of truth, preserves chain-of-custody evidence, and enables real-time task tracking and after-action review. Option C is correct because secure out-of-band communication channels (e.g., encrypted messaging or dedicated conference bridges separate from compromised corporate email) ensure responders can coordinate even if primary infrastructure is breached or unavailable. Option D is not appropriate because publishing unredacted forensic disk images exposes sensitive data, violates privacy and legal obligations, and compromises the investigation. Option E is not appropriate because disabling documentation destroys the audit trail needed for coordination, compliance, and post-incident analysis.

Answer

Publicly posting all unredacted forensic disk images on social media

Answer

Disabling all documentation to maintain total secrecy

Question 6

An enterprise security architect is reviewing threat detection coverage using the MITRE ATT&CK Navigator. Which THREE strategic objectives can be achieved using this exercise? (Choose three)

Accepted Answer

Identifying detection gaps and blind spots across security monitoring tools. Option A is correct because the ATT&CK Navigator heatmap layers visually expose which techniques have no coverage, directly revealing detection gaps and blind spots across monitoring tools. Option B is correct because Navigator layers can be built from SIEM/XSIAM analytics rule mappings, tying each rule to the specific ATT&CK technique it detects so coverage can be assessed per technique. Option C is correct because gap analysis in Navigator identifies high-priority techniques lacking coverage, which drives decisions on which telemetry sources to onboard and where to invest detection engineering effort. Options D and E are incorrect because overclocking workstation CPUs and assigning static IP addresses to firewall interfaces are hardware/network configuration tasks unrelated to threat detection coverage mapping in ATT&CK Navigator.

Answer

Automatically overclocking enterprise workstation CPUs

Answer

Configuring static IP addresses on firewall interfaces

Question 7

An architect is designing an automated threat hunting and containment architecture with Cortex XSIAM. Which THREE actions can be triggered automatically upon confirming a high-fidelity behavioral threat detection? (Choose three)

Accepted Answer

Revoking user session tokens and triggering password resets in Active Directory / Azure AD. Option B is correct because Cortex XSIAM playbooks can integrate with identity providers such as Active Directory and Microsoft Entra ID to revoke session tokens and force password resets, immediately cutting off an attacker's authenticated access. Option D is correct because XSIAM can automatically push confirmed malicious indicators (IPs, domains, hashes) to dynamic blocklists on network firewalls, preventing further command-and-control or lateral movement. Option E is correct because the Cortex XDR agent supports automated endpoint isolation, which severs the compromised host's network connectivity while preserving forensic telemetry for investigation. Option A is incorrect because physically disconnecting power cables is a manual, disruptive facility action that no software orchestration platform can perform and would cause unnecessary outage. Option C is incorrect because formatting intranet web server drives is a destructive, manual remediation step that would destroy evidence and is not an automated containment action in XSIAM.

Answer

Physically disconnecting all power cables in the data center

Answer

Formatting the corporate intranet web server hard drives

Question 8

An architect is designing an incident response lifecycle based on the NIST SP 800-61 framework for a Security Operations Center (SOC). Which phase immediately follows the Containment, Eradication, and Recovery phase?

Accepted Answer

Post-Incident Activity. According to NIST SP 800-61, the lifecycle phases are Preparation, Detection and Analysis, Containment, Eradication, and Recovery, and finally Post-Incident Activity (Lessons Learned).

Answer

Detection and Analysis

Answer

Threat Intelligence Enrichment

Answer

Risk Assessment

Question 9

When designing a threat hunting architecture, an architect must differentiate between indicator-based searching and hypothesis-driven hunting. Which approach represents a hypothesis-driven threat hunt?

Accepted Answer

Developing a query to detect potential lateral movement using PowerShell remoting based on recent red team exercises. Hypothesis-driven hunting starts with a theory about potential adversary behavior or TTPs and uses analytics to search for undiscovered activity.

Answer

Blocking known malicious domains using PAN-OS DNS Security

Answer

Automating the ingestion of STIX/TAXII feeds into Cortex XSOAR

Answer

Searching for specific file hashes provided in a recent vendor threat intelligence report

Question 10

An architect is designing an automated containment workflow in Cortex XSOAR. The requirement is to isolate a compromised endpoint running Cortex XDR agent without disrupting critical domain controllers. Which configuration parameter must be validated in the isolation command?

Accepted Answer

Exclusion lists and targeted device IDs to prevent critical asset isolation. When executing endpoint isolation in Cortex XDR via XSOAR, the architect must ensure exceptions or proper scoping are applied to prevent isolating essential infrastructure like Domain Controllers.

Answer

PAN-OS external dynamic list expiration timers

Answer

Global firewall rule bypass codes

Answer

Syslog forwarding facility levels

Question 11

An organization is adopting the Cyber Kill Chain framework to evaluate their intrusion detection capabilities across the network and endpoint layers. During which phase should security architects implement egress filtering and DNS sinkholing to disrupt adversary operations?

Accepted Answer

Command and Control (C2). Egress filtering and DNS sinkholing are defensive measures that disrupt the Command and Control (C2) phase of the Cyber Kill Chain, where compromised hosts attempt to communicate with adversary-controlled infrastructure. By blocking outbound traffic to known malicious IPs/domains and sinkholing DNS requests, defenders prevent the adversary from issuing commands or exfiltrating data. This directly targets the C2 channel rather than earlier phases like Reconnaissance or Exploitation.

Answer

Reconnaissance

Answer

Exploitation

Answer

Installation

Question 12

An architect is designing a Zero Trust Network Access (ZTNA) incident response strategy using Prisma Access. When a compromised user device is detected, which action should the automated response workflow trigger to prevent lateral movement?

Accepted Answer

Apply a dynamic user group or quarantine security policy to immediately revoke network access. In a ZTNA architecture built on Prisma Access, access decisions are identity- and context-driven rather than network-location-driven. Applying a dynamic user group or quarantine security policy immediately removes the compromised device/user from the trusted access path by re-evaluating policy at the cloud-delivered security edge, which halts lateral movement without disrupting the rest of the environment. This is the surgical, automated response that aligns with Zero Trust 'never trust, always verify' principles.

Answer

Purge the corporate DNS root servers

Answer

Factory reset the physical core switches

Answer

Reboot all enterprise domain controllers

Question 13

A security architect is establishing an operational metrics dashboard for executive leadership. Which metric best demonstrates the risk reduction impact of automated security orchestration and response (SOAR) playbooks?

Accepted Answer

Mean Time to Respond (MTTR) / Containment Time. Mean Time to Respond (MTTR) or Containment Time directly shows how automation accelerates remediation and reduces organizational exposure time.

Answer

Total number of raw logs ingested per second (EPS)

Answer

Average CPU utilization of the SIEM collector nodes

Answer

Number of security personnel trained on phishing awareness

Question 14

An enterprise security architect is configuring automated threat intelligence sharing between Cortex XSOAR and external ISACs using STIX/TAXII. Which component within Cortex XSOAR is primarily responsible for managing incoming threat indicators, deduplication, and indicator scoring?

Accepted Answer

Threat Intelligence Management (TIM) module. The Threat Intelligence Management (TIM) module within Cortex XSOAR handles indicator lifecycle management, deduplication, scoring, and propagation to enforcement points.

Answer

Cortex XDR Analytics Engine

Answer

Incident Investigation Canvas

Answer

Machine Learning Service Broker

Question 15

An architect is designing a threat hunting architecture that leverages Cortex XSIAM XQL (XDR Query Language). To identify potential living-off-the-land binaries (LotLB) execution, which query structure correctly filters process execution events for anomalous parent-child relationships?

Accepted Answer

dataset = xdr_data | filter event_type = 'PROCESS_START' and actor_process_image_name = 'winword.exe' and target_process_image_name = 'cmd.exe'. XQL queries operate on datasets such as xdr_data and use a pipe-based syntax with filter stages. The correct structure filters PROCESS_START events where the parent (actor) process is winword.exe and the child (target) process is cmd.exe, which is the classic Office-spawning-shell living-off-the-land pattern. The other options use SQL, syslog, or CLI syntax that is not valid XQL.

Answer

search threat_intel where ip = '10.0.0.1' action = block

Answer

select * from syslog where facility = auth and action = drop

Answer

panos_log_generator --filter process_start --output xdr