SecOps-Architect Secops Frameworks And Threat Response Architecture Practice Test 5 — 15 Questions

Question 1

During a major security incident, a SOC architect needs to ensure that all evidence collected adheres to chain of custody principles. Which foundational security concept is primarily being enforced?

Accepted Answer

Integrity and non-repudiation of digital evidence. Chain of custody ensures that evidence is collected, handled, analyzed, and preserved in a manner that maintains its integrity and admissibility in legal proceedings.

Answer

High availability and redundant storage arrays

Answer

Role-based access control permission inheritance

Answer

Network bandwidth optimization and traffic shaping

Question 2

An architect is designing an integration between Cortex XSOAR and a third-party ticketing system (e.g., ServiceNow). The requirement is to ensure that when an incident severity is updated in XSOAR, the ticket in ServiceNow is automatically updated. Which architectural feature facilitates this synchronization?

Accepted Answer

Bi-directional incident field mapping and integration commands. Bi-directional incident mapping and mapping rules in XSOAR integration instances allow field values to sync automatically between XSOAR and ticketing systems.

Answer

Syslog forwarding over UDP port 514

Answer

PAN-OS Dynamic Address Group API push

Answer

GlobalProtect client certificate renewal protocol

Question 3

An enterprise security architect is designing an automated threat response architecture using Cortex XSOAR. The design requires parsing unstructured phishing emails received in a dedicated mailbox. Which XSOAR capability should be leveraged to automatically extract indicators such as URLs, file hashes, and sender domains from the email body?

Accepted Answer

Phishing parser and indicator extraction engines. Cortex XSOAR utilizes built-in email parsing parsers and regex-based extraction mechanisms, often enhanced by parsers within the Phishing integration pack, to extract indicators.

Answer

Cortex XDR file quarantine policy engine

Answer

Minemeld RSS feed collector

Answer

PAN-OS WildFire sandbox detonation queue

Question 4

When designing a Security Operations Center (SOC) tiering model, what is the primary operational responsibility typically assigned to Tier 2 (Incident Responders)?

Accepted Answer

In-depth forensic investigation, root cause analysis, and containment execution. Tier 2 (Incident Responders) in a SOC tiering model is responsible for in-depth forensic investigation, root cause analysis, and containment execution. Tier 1 handles initial triage and false positive closure, while Tier 3 focuses on threat hunting and advanced detection engineering. Tier 2 takes escalated incidents from Tier 1 and performs deeper analysis and response actions.

Answer

Developing custom machine learning detection models and threat hunting hypotheses

Answer

High-volume initial alert triage and closing false positives based on strict runbooks

Answer

Managing physical datacenter security and badge access

Question 5

An architect is designing log retention and data tiering policies in Cortex XSIAM. To balance regulatory compliance requirements (long-term storage) with high-performance analytics (short-term fast search), how should the data architecture be structured?

Accepted Answer

Configure active analytical storage for high-frequency queries and cold storage tiers for long-term compliance retention. Cortex XSIAM supports tiered storage architecture where high-performance active storage is used for immediate analytics and threat hunting, while colder storage tiers handle long-term retention.

Answer

Store all telemetry in volatile RAM cache indefinitely

Answer

Forward all raw logs exclusively to an external FTP server in plain text

Answer

Disable all log compression to ensure faster grep searches

Question 6

When designing a Security Operations Center (SOC) using the NIST cybersecurity framework, which TWO functions are categorized under the 'Detect' core function? (Choose two)

Accepted Answer

Security Continuous Monitoring (SCM). Security Continuous Monitoring (SCM) (C) is correct because the NIST Cybersecurity Framework's Detect function includes the category 'Security Continuous Monitoring' (DE.CM), which covers monitoring the network, systems, and assets to identify cybersecurity events and verify the effectiveness of protective measures. Detection Processes and Procedures (E) is also correct because the Detect function includes the category 'Detection Processes' (DE.DP), which ensures that detection activities, roles, responsibilities, and reporting are properly defined, tested, and communicated. The other options belong to different functions: Disaster Recovery plan execution (A) and Incident Recovery Planning (B) fall under the Recover function, while Access Control policy enforcement (D) is part of the Protect function (specifically PR.AC), not Detect.

Answer

Disaster Recovery plan execution

Answer

Incident Recovery Planning

Answer

Access Control policy enforcement

Question 7

An enterprise security architect is designing an automated containment playbook in Cortex XSOAR for ransomware attacks. Which THREE automated actions should be incorporated into the playbook to effectively contain the threat while preserving forensic evidence? (Choose three)

Accepted Answer

Isolate the affected endpoint via Cortex XDR integration. Option A is correct because isolating the affected endpoint through the Cortex XDR integration cuts off lateral movement and C2 communication while keeping the host powered on, which preserves volatile memory and disk state for later forensics. Option B is correct because triggering an automated memory dump or forensic package collection via Cortex XDR captures volatile evidence (RAM, running processes, network connections) before any remediation or reboot destroys it. Option E is correct because revoking active user sessions and forcing password resets through the identity provider integration neutralizes compromised credentials that ransomware operators commonly use for lateral movement and persistence. Option C is not appropriate because immediately reimaging all domain controllers without investigation destroys forensic evidence and may not address the actual initial access vector. Option D is not appropriate because deleting backup snapshots removes the primary recovery path and is counterproductive to containment and restoration.

Answer

Immediately reimage all domain controllers without investigation

Answer

Delete all backup snapshots across all storage arrays

Question 8

An architect is designing an incident response communications plan for a major data breach affecting regulated customer data. Which TWO stakeholder groups must typically be included in the formal communication escalation matrix during high-severity incidents? (Choose two)

Accepted Answer

Corporate Communications / Public Relations. Corporate Communications / Public Relations (D) must be in the escalation matrix because a major breach of regulated customer data triggers reputational risk and requires coordinated, approved messaging to customers, media, and the public, and in many jurisdictions breach notification timelines and content are prescribed by law. Legal Counsel / Privacy Officer (E) is essential because regulated data breaches invoke mandatory notification duties under laws such as GDPR, HIPAA, or state breach-notification statutes, and legal privilege plus regulatory reporting decisions must be managed by counsel. The building facilities management team (A) is not a formal breach-notification stakeholder; its role is physical building operations, not incident communications. Internal cafeteria catering staff (B) have no incident response or regulatory communication responsibility. Third-party software vendors of unrelated office productivity tools (C) are out of scope because they neither process the affected regulated data nor own breach notification obligations for this incident.

Answer

Building facilities management team

Answer

Internal cafeteria catering staff

Answer

Third-party software vendors of unrelated office productivity tools

Question 9

An architect is integrating Cortex XSOAR with threat intelligence platforms. Which THREE attributes are essential when evaluating the quality and operational value of ingested threat indicators? (Choose three)

Accepted Answer

Accuracy and false positive rate. Option B is correct because accuracy and false positive rate directly determine whether ingested indicators can be trusted for automated enforcement in Cortex XSOAR, since high-FP feeds generate excessive incidents and erode analyst confidence. Option D is correct because context and TTP mapping (e.g., aligning indicators to MITRE ATT&CK techniques and the organization's actual attack surface) let XSOAR playbooks prioritize and enrich only indicators that are operationally relevant. Option E is correct because timeliness—how quickly indicators are delivered relative to adversary campaign velocity—determines whether blocking or hunting actions occur before the infrastructure is rotated or the attack completes. Option A is not a quality or operational-value attribute; storage sizing is a capacity-planning concern, not an indicator-quality metric. Option C is irrelevant, as PDF report typography has no bearing on indicator fidelity, relevance, or detection value.

Answer

Total physical disk space required to store raw indicator text

Answer

Font family used in the vendor's PDF reports

Question 10

When designing an incident post-mortem (lessons learned) process following NIST guidelines, which TWO activities should the security architect mandate? (Choose two)

Accepted Answer

Conducting a root cause analysis review meeting with key stakeholders. Option A is correct because NIST SP 800-61 (Computer Security Incident Handling Guide) explicitly calls for holding a lessons-learned meeting with all key stakeholders after an incident to review what happened, identify the root cause, and determine what could have been done differently. Option D is correct because the post-mortem must feed back into the organization's defensive posture; NIST guidance directs teams to update detection signatures, correlation rules, and automated response playbooks (e.g., SOAR workflows) to close the operational gaps that allowed the incident or slowed response. Options B, C, and E are wrong: destroying firewall and SIEM log archives (B) violates evidence retention and audit requirements, reverting systems to factory defaults without review (C) would erase forensic artifacts and disrupt production, and publicly disclosing employee disciplinary actions (E) breaches privacy and HR policy and has no place in a technical lessons-learned process.

Answer

Deleting all firewall and SIEM log archives immediately

Answer

Reverting all system configurations to factory defaults without review

Answer

Publicly disclosing employee disciplinary actions on social media

Question 11

A SOC architect is standardizing how analysts describe adversary behavior across a multinational team. The CISO mandates adoption of the MITRE ATT&CK framework for all incident documentation. Which structural element of ATT&CK should the architect use to map a specific adversary action such as credential dumping from LSASS memory?

Accepted Answer

A technique identified by its Tactic and Technique IDs (for example, T1003 under Credential Access). Techniques are the correct granularity for documenting a concrete adversary action such as dumping credentials from LSASS memory. Each technique has a stable ID under a tactic, enabling consistent detection mapping, coverage measurement, and intelligence sharing. Groups, software, and mitigations are related objects that enrich context but do not describe the observed behavior itself.

Answer

A software entry describing the specific malware family observed on the endpoint

Answer

A group entry representing the tracked threat actor cluster behind the intrusion

Answer

A mitigation entry that prescribes the defensive control for the observed behavior

Question 12

A multinational SOC architect is designing a threat-intelligence ingestion pipeline into Cortex XSOAR. Analysts complain that indicators from a commercial feed suppress internal detections because the feed marks legitimate corporate VPN egress IPs as malicious. The architect must add a pre-ingestion control that prevents these false positives from reaching the indicator database while retaining the feed's other indicators. Which control should be implemented?

Accepted Answer

Create an indicator allow list in Cortex XSOAR and configure the feed integration's reputation calculation to consult it before writing indicators.. The allow list is the only control that operates during feed ingestion and reputation calculation, so it blocks the known-good corporate VPN egress ranges before they reach the indicator database. Post-ingestion playbooks and threshold changes act too late or in the wrong direction, and disabling the feed sacrifices valuable intelligence. The allow list preserves feed coverage while eliminating the suppression of internal detections.

Answer

Disable the feed integration entirely and manually upload only the indicator types the SOC trusts.

Answer

Deploy a Cortex XSOAR playbook that runs on every incident and closes any incident whose indicators match the corporate VPN range.

Answer

Set the feed integration's indicator reputation threshold to 'Bad' and enable the 'Trust any feed' option in server configuration.

Question 13

A security architect is designing a threat response playbook in Cortex XSOAR for a large enterprise. To ensure that the playbook can automatically contain threats across the entire environment, the architect needs to integrate with the endpoint protection platform. Which integration should the architect configure to enable automated endpoint isolation and remediation actions?

Accepted Answer

Cortex XDR. Cortex XDR is the endpoint protection platform that natively integrates with Cortex XSOAR to enable automated endpoint isolation and remediation. The other options are network or data analytics solutions that lack endpoint containment capabilities. Thus, Cortex XDR is the correct integration for achieving automated endpoint response.

Answer

Palo Alto Networks Next-Generation Firewall

Answer

Prisma Access

Answer

Cortex Data Lake

Question 14

A security architect at a financial services firm is designing a threat intelligence sharing program. The firm wants to automatically ingest high-fidelity indicators of compromise (IOCs) from an external partner into Cortex XSOAR to enrich alerts. The architect must select a standard that defines a structured, machine-readable format for representing cyber threat intelligence, including indicators, observed data, and relationships. Which standard should the architect choose?

Accepted Answer

STIX 2.1. STIX 2.1 is the correct choice because it provides a standardized, machine-readable format for representing cyber threat intelligence, including indicators, observed data, and relationships. It is specifically designed for automation and is widely adopted in threat intelligence sharing, enabling Cortex XSOAR to ingest and act on IOCs from external partners efficiently.

Answer

CybOX

Answer

TAXII 2.1

Answer

OpenIOC

Question 15

An architect is building a threat-response playbook that must enrich indicators of compromise before containment decisions. The team wants to apply the Structured Threat Information Expression (STIX) 2.1 object model when exchanging indicators with partner SOCs. Which statement correctly describes how STIX 2.1 represents a malicious file hash shared between organizations?

Accepted Answer

It is encoded as an Indicator SDO whose pattern references a File SCO containing the hash value. STIX 2.1 separates cyber observables, modeled as SCOs such as File with hashes, from the analytic assertion of maliciousness, modeled as an Indicator SDO whose pattern references that SCO. This clean separation supports independent sharing and automated matching, whereas wrapping the value in Malware, Observed-Data, or Relationship objects misuses those object types.

Answer

It is encoded as a Relationship SRO that connects two Identity objects using the hash as its ID

Answer

It is encoded as a single Malware SDO with the hash stored in its sample_refs property

Answer

It is encoded as an Observed-Data SDO that wraps the hash and the sighting timestamp