SecOps-Architect Secops Frameworks And Threat Response Architecture Practice Test 7 — 15 Questions

Question 1

A security architect is defining the incident response lifecycle for a new SOC built on Cortex XSIAM. The CISO asks which phase of the NIST SP 800-61 lifecycle is responsible for validating that containment actions actually removed the adversary's access before returning the environment to normal operations. Which phase should the architect identify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Containment, Eradication, and Recovery. The NIST SP 800-61 lifecycle places containment, eradication, and recovery together, and eradication specifically includes confirming that the adversary's access and artifacts have been removed before recovery begins. Validation of that removal is therefore an activity within this phase, not in detection, preparation, or post-incident review.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Detection and Analysis

Question 2

A multinational SOC architect is building a threat response architecture that must correlate adversary behavior across endpoint, network, and cloud telemetry. The CISO wants detections expressed in a vendor-neutral format that can be shared with an external ISAC and mapped to a common adversary taxonomy. Which framework combination should the architect adopt to satisfy both the sharing and mapping requirements?

Accepted Answer

MITRE ATT&CK for adversary tactic mapping combined with STIX/TAXII for structured indicator exchange. Adversary behavior mapping requires a named tactic and technique taxonomy, which MITRE ATT&CK provides, and external sharing requires a structured, transportable intelligence format, which STIX objects carried over TAXII deliver. Pairing these two satisfies both constraints simultaneously, whereas the other combinations substitute vulnerability scoring, legacy indicator formats, statistical breach schemas, or analytic models that do not enumerate techniques.

Answer

MITRE ATT&CK for adversary tactic mapping combined with the VERIS schema for structured incident exchange

Answer

CVSS for scoring adversary behavior combined with OpenIOC for structured indicator exchange

Answer

The Diamond Model for adversary tactic mapping combined with STIX/TAXII for structured indicator exchange

Question 3

A security architect is designing a threat response architecture using the MITRE ATT&CK framework. The SOC wants to prioritize detection engineering efforts based on the most relevant adversary techniques for their industry. The architect must ensure that the framework is used effectively to map existing detections and identify gaps. Which approach best aligns with the MITRE ATT&CK framework for this purpose?

Accepted Answer

Use the ATT&CK Navigator to overlay existing detections against techniques and identify gaps. The ATT&CK Navigator is specifically designed to help organizations map their detection coverage to the ATT&CK matrix and identify gaps. By using it to overlay existing detections, the architect can systematically prioritize detection engineering based on industry-relevant techniques. Other approaches like red teaming or implementing all techniques are either too narrow or too broad, and relying solely on vendor content does not ensure alignment with the organization's specific threat landscape.

Answer

Conduct a red team exercise and map all observed techniques to ATT&CK

Answer

Rely on vendor-provided detection content without customization

Answer

Implement all techniques listed in the ATT&CK framework sequentially

Question 4

A financial services SOC is architecting a threat response workflow in Cortex XSOAR that must query an internal threat intelligence platform, enrich indicators, and automatically create a blocklist entry only when the indicator's confidence score exceeds a defined threshold. The architect needs the playbook to evaluate the score and conditionally branch without writing custom Python. Which mechanism should be used?

Accepted Answer

A conditional task that evaluates the confidence score and routes execution to a blocklist branch. Conditional tasks are the native Cortex XSOAR construct for evaluating task outputs with built-in operators and routing execution down the appropriate branch. Comparing the enrichment confidence score to the threshold inside a conditional task lets the playbook block only qualifying indicators, achieving threshold-based automation without custom Python.

Answer

A data collection task that stores the score in the incident context for later review

Answer

A manual task assigned to a Tier 2 analyst to review the score and click approve

Answer

A sub-playbook that always executes the blocklist integration command

Question 5

A SOC architect must design a response architecture where automated playbooks can isolate endpoints, disable user accounts, and block domains without a human approving each action. Legal has mandated that every automated containment action be attributable to a named analyst, that actions be reversible, and that a full audit trail exist. Which architectural control best satisfies these requirements while preserving automation speed?

Accepted Answer

Implement just-in-time privileged role assumption per analyst with session recording, paired with playbook actions that capture pre-change state for rollback. Attribution, reversibility, and auditability can all be met without sacrificing speed by scoping privileged access to individual analysts through just-in-time role assumption, recording sessions for the audit trail, and designing playbook actions that snapshot prior state so they can be undone. Shared accounts break attribution, human approval gates break speed, and read-only credentials break the response capability entirely.

Answer

Configure the SOAR platform to run all containment playbooks under a shared service account with elevated permissions

Answer

Deploy read-only API credentials to the SOAR platform so playbooks cannot make destructive changes

Answer

Require dual human approval for every containment action before the playbook executes

Question 6

A security architect is defining the incident response lifecycle for a new SOC built on Cortex XSIAM. The CISO asks which phase of the NIST SP 800-61 lifecycle is responsible for validating that containment actions actually removed the adversary's access before returning the environment to normal operations. Which phase should the architect identify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. NIST SP 800-61 outlines the incident response lifecycle in four sequential phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. This order ensures a structured and effective response. Preparation establishes the necessary capabilities, Detection and Analysis identifies and understands the incident, Containment and Recovery mitigates the threat, and Post-Incident Activity captures lessons learned. Any deviation from this order would disrupt the logical flow of incident handling.

Answer

Containment, Eradication, and Recovery; Detection and Analysis; Preparation; Post-Incident Activity

Answer

Detection and Analysis; Preparation; Containment, Eradication, and Recovery; Post-Incident Activity

Answer

Preparation; Containment, Eradication, and Recovery; Detection and Analysis; Post-Incident Activity

Question 7

A security architect is designing the threat intelligence ingestion pipeline for a Cortex XSOAR deployment. The organization wants to automatically block IP addresses that appear in high-confidence threat feeds, but the SOC team is concerned about false positives disrupting business-critical applications. Which capability of Cortex XSOAR should the architect configure to safely automate this response while maintaining an audit trail?

Accepted Answer

Playbook tasks with manual approval steps and conditional branching before executing the block. Automating enforcement safely requires a control point between detection and action. Cortex XSOAR playbooks support manual approval tasks and conditional logic that let analysts validate high-impact blocks before they execute, while the incident war room preserves a complete audit trail. This balances the speed of automation with the caution needed to avoid disrupting business-critical applications when feed confidence is imperfect.

Answer

Indicator expiration policies that automatically age out feed indicators after a fixed interval

Answer

Indicator exclusion lists that suppress matching indicators from all future feed ingestion

Answer

Feed reputation scoring that lowers the confidence value of indicators from untrusted sources

Question 8

A SOC manager wants to standardize how analysts document and share threat intelligence about a newly observed malware family. The architect recommends using the Structured Threat Information Expression (STIX) format. Which statement best describes the primary purpose of STIX in a security operations architecture?

Accepted Answer

It provides a standardized language for describing cyber threat intelligence so it can be shared consistently across tools and organizations.. STIX is an open, standardized language for expressing cyber threat intelligence, covering indicators, malware, campaigns, and their relationships. Its purpose is consistent representation so that different platforms and organizations can share and consume intelligence without custom mappings. Transport and authentication are handled by TAXII, and correlation or storage is the job of analytics platforms and threat intelligence platforms respectively.

Answer

It replaces the need for a SIEM by automatically correlating events across multiple data sources.

Answer

It defines the transport protocol and authentication methods used to exchange threat data between platforms.

Answer

It enforces a specific threat intelligence platform vendor's data model for storing indicators.

Question 9

A multinational SOC architect is defining threat response requirements for Cortex XSIAM that must support both automated and analyst-driven investigations across endpoint, network, and identity telemetry. The architect must select the platform capabilities that directly enable correlation of disparate telemetry into a single incident timeline for response actions. (Choose two.)

Accepted Answer

Unified data model that normalizes endpoint, network, and identity events into common schema fields. The two capabilities that directly enable cross-domain correlation are the unified data model, which normalizes events into a common schema, and automated indicator extraction with alert stitching, which groups related events into a single incident. Together they produce the correlated timeline that both automated playbooks and analysts rely on for response actions.

Answer

Endpoint agent heartbeat monitoring for license compliance reporting

Answer

Role-based access control assignment for SOC tier analysts

Answer

Scheduled vulnerability scan integration for asset risk scoring

Question 10

A security operations architect is formalizing how the SOC will apply the MITRE ATT&CK framework during live incident response rather than only during retrospective reporting. Which TWO practices correctly embed ATT&CK into the active response workflow? (Choose two.)

Accepted Answer

Tag each detection rule and alert with the ATT&CK technique identifiers it observes so responders see adversary context at triage time. Embedding ATT&CK into active response means surfacing technique context where responders actually work and using coverage gaps to steer detection engineering priorities. Tagging detections with technique identifiers gives triage-time context, and gap-driven prioritization turns the framework into a planning instrument. The remaining practices either corrupt severity logic, create staffing bottlenecks, or block incident closure on unattainable documentation completeness.

Answer

Assign each SOC analyst a permanent ownership of specific ATT&CK tactics and route all matching alerts only to that analyst

Answer

Require that every incident be closed only after the adversary's full ATT&CK technique chain has been reconstructed and documented

Answer

Replace the incident severity matrix with ATT&CK tactic names so that severity is derived purely from the tactic observed

Question 11

A security operations architect is designing a threat intelligence program that follows the intelligence cycle. The architect must ensure that the program effectively supports decision-making for the SOC team. Which phase of the intelligence cycle involves defining the intelligence requirements and planning the collection of data to meet those requirements?

Accepted Answer

Direction. The intelligence cycle starts with the Direction phase, where requirements are defined and collection is planned. This phase ensures that subsequent collection and analysis are focused on the needs of decision-makers, which is essential for an effective threat intelligence program in a SOC.

Answer

Collection

Answer

Processing

Answer

Dissemination

Question 12

A multinational SOC architect is mapping detection coverage to the MITRE ATT&CK framework for a Cortex XSIAM deployment. Executive leadership wants to know which adversary techniques currently have no detection logic. Which approach should the architect take to produce this gap analysis?

Accepted Answer

Tag each detection rule with the ATT&CK technique IDs it covers, then report techniques with no associated tags. A reliable ATT&CK gap analysis requires an explicit mapping between detection content and technique IDs. Tagging each detection rule with the techniques it addresses allows the architect to query for untagged techniques and produce a precise, maintainable coverage report. Volume-based or name-based comparisons and one-off exercises cannot reliably identify which adversary techniques lack detection logic.

Answer

Export all XSIAM correlation rules and compare rule names against ATT&CK technique titles

Answer

Compare the count of XSIAM analytics per data source against the number of ATT&CK techniques that use that data source

Answer

Run a red team exercise and treat any technique that was not alerted on during the exercise as a coverage gap

Question 13

A security architect is designing a threat intelligence program for a SOC. The organization wants to leverage the Cyber Kill Chain framework to structure its detection and response strategies. The architect needs to ensure that the SOC can map its existing controls to the stages of the Cyber Kill Chain. Which of the following correctly lists the stages of the Cyber Kill Chain in order?

Accepted Answer

Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives. The Cyber Kill Chain stages are Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. This order reflects the adversary's progression from planning to execution. Understanding this sequence allows security architects to place controls at each stage to detect and disrupt attacks. Any deviation from this order would misalign the mapping of defenses and reduce the effectiveness of the threat intelligence program.

Answer

Reconnaissance, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives, Weaponization

Answer

Reconnaissance, Weaponization, Exploitation, Delivery, Installation, Command and Control, Actions on Objectives

Answer

Reconnaissance, Weaponization, Delivery, Installation, Exploitation, Command and Control, Actions on Objectives

Question 14

An architect is designing a threat response workflow that must enrich indicators with multiple external intelligence sources before creating a case. The design uses Cortex XSOAR playbooks. Which approach best ensures the workflow continues even when one intelligence source is temporarily unavailable?

Accepted Answer

Configure each enrichment task with continue-on-error behavior so the playbook proceeds and records the failure.. Resilience in a multi-source enrichment playbook comes from isolating failures so one unavailable integration does not stop the entire workflow. Marking enrichment tasks to continue on error lets the playbook gather what it can, log the failure, and still create the case. Delays, permanent removal, and single-platform aggregation all either reduce coverage or introduce new failure points.

Answer

Route all enrichment through a single aggregated intelligence platform.

Answer

Add a long delay before each enrichment task to wait for the source to recover.

Answer

Remove the failing intelligence source from the playbook permanently.

Question 15

A SOC architect is designing the incident response workflow for a Cortex XSOAR deployment and must define how incidents move between tiers. The organization wants to ensure that low-severity phishing alerts are handled consistently without consuming senior analyst time, while high-severity malware detections receive immediate expert attention. Which design element should the architect implement to achieve this?

Accepted Answer

Severity-based playbook routing that assigns incidents to tier-appropriate queues automatically. Routing incidents by severity through dedicated playbooks and tier-appropriate queues ensures that low-severity phishing alerts are handled consistently by Tier 1 while high-severity malware detections reach senior analysts immediately. Automated routing removes manual delay and supervisor dependency, and it scales with incident volume, satisfying both consistency and expertise-preservation requirements.

Answer

Manual incident assignment by a shift supervisor at the start of every shift

Answer

Round-robin distribution of all incidents across every analyst regardless of tier

Answer

A single shared queue where all analysts pick incidents in the order they arrive