SecOps-Architect Secops Frameworks And Threat Response Architecture — Timed 10 Questions

Question 1

When designing a threat hunting methodology aligned with the MITRE ATT&CK framework, an architect wants to identify adversary persistence mechanisms. Which tactic category should the analyst focus queries on?

10 minute time limit — choose an answer to begin.

Accepted Answer

Persistence. Persistence tactics include techniques such as Registry Run Keys, Startup Folder, and Scheduled Tasks.

Answer

Initial Access

Answer

Collection

Answer

Execution

Question 2

An architect is designing an incident response workflow in Cortex XSOAR using the Incident Spooler. Which component is primarily responsible for processing queued events into actionable incidents?

Accepted Answer

Cortex XSOAR Server engine. The War Room is where manual actions and playbooks execute, but the Server engine handles the queue processing and ingestion from the Incident Spooler.

Answer

Demisto REST API

Answer

Threat Intel Management module

Answer

Cortex XSIAM Data Lake collector

Question 3

An incident response architect is defining severity levels for security alerts in Cortex XDR. Which severity classification typically triggers automated containment playbooks without human intervention?

Accepted Answer

Critical. High or Critical severity alerts are commonly mapped to automated containment responses in modern SOAR architectures.

Answer

Debugging

Answer

Low

Answer

Informational

Question 4

An organization is integrating Prisma Cloud with Cortex XSOAR to automate cloud incident response. When configuring the Prisma Cloud integration instance in XSOAR, which authentication mechanism is recommended to securely fetch alerts without using static user credentials?

Accepted Answer

OAuth 2.0 Client Credentials grant via a dedicated Service Account. Prisma Cloud integration instances in XSOAR use Access Key ID and Secret Key generated via Service Accounts for secure API access.

Answer

LDAP bind credentials through a Cortex XDR Broker VM

Answer

HTTP Basic Authentication with administrative credentials

Answer

SAML 2.0 Federation token exchange

Question 5

In a multi-tenant Cortex XSOAR deployment, an architect needs to restrict access to specific playbooks so that Tenant A analysts cannot view or execute playbooks owned by Tenant B. Where is this access control configured?

Accepted Answer

Role-Based Access Control (RBAC) settings under Settings > Common > Roles. Role-Based Access Control (RBAC) in Cortex XSOAR allows restricting playbook and incident type visibility based on assigned roles.

Answer

Global Server Configuration settings

Answer

Playbook JSON source code permissions

Answer

Integration instance parameters

Question 6

An enterprise security architect is integrating Cortex XSIAM with an external SIEM using the Syslog Export feature. The security team notices that certain sensitive fields need to be redacted before export. Where should the architect configure this transformation?

Accepted Answer

Data Forwarding Rules / Log Forwarding Profiles. Log Forwarding profiles in Cortex XSIAM allow filtering, masking, and transforming logs before they are exported via Syslog or HTTP.

Answer

Magnifier machine learning configuration

Answer

Cortex XDR Agent installation parameters

Answer

XSOAR automation playbook script tasks

Question 7

You are deploying Cortex XSIAM and need to ensure that endpoint logs collected from remote agents are normalized into a unified schema before analytics runs. Which feature performs this normalization?

Accepted Answer

XDM (XDR Data Model) mapping and parsing rules. XSIAM utilizes Agent Content and parsing rules to normalize raw logs into the XDM schema during ingestion.

Answer

Cortex XDR Agent Collector Engine

Answer

Magnifier behavioral analytics engine

Answer

Local Analysis Engine (LAE)

Question 8

You are designing an automated phishing response workflow in Cortex XSOAR. The playbook needs to extract all URLs from an incoming email body and check their reputation using VirusTotal. Which built-in task type should you use to evaluate each URL concurrently?

Accepted Answer

Loop / For-Each Task. A loop task in Cortex XSOAR iterates over lists or arrays, such as extracted URLs, allowing parallel or sequential processing.

Answer

Data Collection Task

Answer

Transformation Script Task

Answer

Manual Review Task

Question 9

An architect is deploying the Cortex XDR Broker VM to serve as a syslog collector for legacy network devices. The Broker VM loses connectivity to the Cortex XDR cloud. What happens to the collected syslog data during the outage?

Accepted Answer

The data is buffered locally on the Broker VM and forwarded once reconnected. The Broker VM buffers incoming syslog messages locally up to a designated storage threshold until cloud connectivity is restored.

Answer

The Broker VM automatically switches to backup SMTP forwarding

Answer

The syslog sender devices resend the packets automatically via TCP retry

Answer

The data is permanently dropped until connectivity returns

Question 10

When aligning a security operations center (SOC) with the NIST Incident Response lifecycle, which phase immediately follows 'Containment, Eradication, and Recovery'?

Accepted Answer

Post-Incident Activity (Lessons Learned). The NIST SP 800-61 lifecycle phases are Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity (Lessons Learned).

Answer

Vulnerability Assessment

Answer

Triage and Scoping

Answer

Threat Hunting