SecOps-Architect Secops Frameworks And Threat Response Architecture Practice Test 4 — 15 Questions

Question 1

An organization is adopting the Cyber Kill Chain framework to evaluate their intrusion detection capabilities across the network and endpoint layers. During which phase should security architects implement egress filtering and DNS sinkholing to disrupt adversary operations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Command and Control (C2). Command and Control (C2) is the phase where the adversary establishes communication with their infrastructure. Egress filtering and DNS sinkholing are key controls to disrupt this phase.

Answer

Reconnaissance

Answer

Exploitation

Answer

Installation

Question 2

An architect is configuring log ingestion for Cortex XSIAM. Which native Palo Alto Networks collector type is designed to gather syslog and CEF formatted logs from third-party security devices without requiring an external forwarder VM?

Accepted Answer

Cortex XSIAM Broker VM. Cortex XSIAM supports Cloud Identity Engine and Broker VM architectures, where the Broker VM acts as a local collector for syslog, SNMP, and other third-party formats.

Answer

AutoFocus Cloud API connector

Answer

Panorama Management Server direct API

Answer

GlobalProtect Gateway agent

Question 3

A security architect is designing an incident escalation matrix for a multinational SOC. Which metric is most critical to measure the effectiveness of the Tier 1 triage team before escalating incidents to Tier 2?

Accepted Answer

Mean Time to Acknowledge (MTTA) and Triage accuracy. Mean Time to Triage (MTTT) or Mean Time to Acknowledge (MTTA) measures how quickly Tier 1 processes and validates incoming alerts before escalating.

Answer

Number of global security patents filed

Answer

Mean Time to Patch (MTTP)

Answer

Total volume of firewall rules configured

Question 4

An architect is designing a Zero Trust Network Access (ZTNA) incident response strategy using Prisma Access. When a compromised user device is detected, which action should the automated response workflow trigger to prevent lateral movement?

Accepted Answer

Apply a dynamic user group or quarantine security policy to immediately revoke network access. Prisma Access allows administrators to dynamically quarantine or restrict access for compromised users or devices by modifying security rules or session states.

Answer

Purge the corporate DNS root servers

Answer

Factory reset the physical core switches

Answer

Reboot all enterprise domain controllers

Question 5

A security architect is establishing an operational metrics dashboard for executive leadership. Which metric best demonstrates the risk reduction impact of automated security orchestration and response (SOAR) playbooks?

Accepted Answer

Mean Time to Respond (MTTR) / Containment Time. Mean Time to Respond (MTTR) or Containment Time directly shows how automation accelerates remediation and reduces organizational exposure time.

Answer

Total number of raw logs ingested per second (EPS)

Answer

Average CPU utilization of the SIEM collector nodes

Answer

Number of security personnel trained on phishing awareness

Question 6

An enterprise security architect is configuring automated threat intelligence sharing between Cortex XSOAR and external ISACs using STIX/TAXII. Which component within Cortex XSOAR is primarily responsible for managing incoming threat indicators, deduplication, and indicator scoring?

Accepted Answer

Threat Intelligence Management (TIM) module. The Threat Intelligence Management (TIM) module within Cortex XSOAR handles indicator lifecycle management, deduplication, scoring, and propagation to enforcement points.

Answer

Cortex XDR Analytics Engine

Answer

Incident Investigation Canvas

Answer

Machine Learning Service Broker

Question 7

An architect is designing a threat hunting architecture that leverages Cortex XSIAM XQL (XDR Query Language). To identify potential living-off-the-land binaries (LotLB) execution, which query structure correctly filters process execution events for anomalous parent-child relationships?

Accepted Answer

dataset = xdr_data | filter event_type = 'PROCESS_START' and actor_process_image_name = 'winword.exe' and target_process_image_name = 'cmd.exe'. XQL queries in XSIAM use datasets like `dataset = xdr_data` with specific filtering commands (`| filter`) to examine process execution telemetry (e.g., cmd.exe spawned by winword.exe).

Answer

search threat_intel where ip = '10.0.0.1' action = block

Answer

select * from syslog where facility = auth and action = drop

Answer

panos_log_generator --filter process_start --output xdr

Question 8

During a major security incident, a SOC architect needs to ensure that all evidence collected adheres to chain of custody principles. Which foundational security concept is primarily being enforced?

Accepted Answer

Integrity and non-repudiation of digital evidence. Chain of custody ensures that evidence is collected, handled, analyzed, and preserved in a manner that maintains its integrity and admissibility in legal proceedings.

Answer

High availability and redundant storage arrays

Answer

Role-based access control permission inheritance

Answer

Network bandwidth optimization and traffic shaping

Question 9

An architect is designing an integration between Cortex XSOAR and a third-party ticketing system (e.g., ServiceNow). The requirement is to ensure that when an incident severity is updated in XSOAR, the ticket in ServiceNow is automatically updated. Which architectural feature facilitates this synchronization?

Accepted Answer

Bi-directional incident field mapping and integration commands. Bi-directional incident mapping and mapping rules in XSOAR integration instances allow field values to sync automatically between XSOAR and ticketing systems.

Answer

Syslog forwarding over UDP port 514

Answer

PAN-OS Dynamic Address Group API push

Answer

GlobalProtect client certificate renewal protocol

Question 10

An enterprise security architect is designing an automated threat response architecture using Cortex XSOAR. The design requires parsing unstructured phishing emails received in a dedicated mailbox. Which XSOAR capability should be leveraged to automatically extract indicators such as URLs, file hashes, and sender domains from the email body?

Accepted Answer

Phishing parser and indicator extraction engines. Cortex XSOAR utilizes built-in email parsing parsers and regex-based extraction mechanisms, often enhanced by parsers within the Phishing integration pack, to extract indicators.

Answer

Cortex XDR file quarantine policy engine

Answer

Minemeld RSS feed collector

Answer

PAN-OS WildFire sandbox detonation queue

Question 11

When designing a Security Operations Center (SOC) tiering model, what is the primary operational responsibility typically assigned to Tier 2 (Incident Responders)?

Accepted Answer

In-depth forensic investigation, root cause analysis, and containment execution. Tier 2 analysts perform in-depth investigation, root cause analysis, containment, and eradication for confirmed incidents escalated by Tier 1.

Answer

Developing custom machine learning detection models and threat hunting hypotheses

Answer

High-volume initial alert triage and closing false positives based on strict runbooks

Answer

Managing physical datacenter security and badge access

Question 12

An architect is designing log retention and data tiering policies in Cortex XSIAM. To balance regulatory compliance requirements (long-term storage) with high-performance analytics (short-term fast search), how should the data architecture be structured?

Accepted Answer

Configure active analytical storage for high-frequency queries and cold storage tiers for long-term compliance retention. Cortex XSIAM supports tiered storage architecture where high-performance active storage is used for immediate analytics and threat hunting, while colder storage tiers handle long-term retention.

Answer

Store all telemetry in volatile RAM cache indefinitely

Answer

Forward all raw logs exclusively to an external FTP server in plain text

Answer

Disable all log compression to ensure faster grep searches

Question 13

When designing a Security Operations Center (SOC) using the NIST cybersecurity framework, which TWO functions are categorized under the 'Detect' core function? (Choose two)

Accepted Answer

Security Continuous Monitoring (SCM). The NIST CSF 'Detect' function includes Anomalies and Events, Security Continuous Monitoring, and Detection Processes.

Answer

Disaster Recovery plan execution

Answer

Incident Recovery Planning

Answer

Access Control policy enforcement

Question 14

An enterprise security architect is designing an automated containment playbook in Cortex XSOAR for ransomware attacks. Which THREE automated actions should be incorporated into the playbook to effectively contain the threat while preserving forensic evidence? (Choose three)

Accepted Answer

Isolate the affected endpoint via Cortex XDR integration. Effective ransomware playbooks isolate the endpoint, revoke user sessions to stop lateral movement, and capture forensic artifacts (like memory or triage packages) before destructive remediation occurs.

Answer

Immediately reimage all domain controllers without investigation

Answer

Delete all backup snapshots across all storage arrays

Question 15

An architect is designing an incident response communications plan for a major data breach affecting regulated customer data. Which TWO stakeholder groups must typically be included in the formal communication escalation matrix during high-severity incidents? (Choose two)

Accepted Answer

Corporate Communications / Public Relations. During major data breaches, legal counsel and corporate communications/PR are critical stakeholders required for regulatory notification and public messaging governance.

Answer

Building facilities management team

Answer

Internal cafeteria catering staff

Answer

Third-party software vendors of unrelated office productivity tools