SecOps-Architect Secops Frameworks And Threat Response Architecture — Timed 10 Questions

Question 1

In a multi-tenant Cortex XSOAR deployment, an architect needs to restrict access to specific playbooks so that Tenant A analysts cannot view or execute playbooks owned by Tenant B. Where is this access control configured?

10 minute time limit — choose an answer to begin.

Accepted Answer

Role-Based Access Control (RBAC) settings under Settings > Common > Roles. In Cortex XSOAR multi-tenant deployments, playbook-level access control is enforced through Role-Based Access Control (RBAC) configured under Settings > Common > Roles. RBAC roles define which playbooks, integrations, and content a user or tenant can view and execute, so restricting Tenant A from Tenant B's playbooks requires assigning roles with scoped playbook permissions. This is the only supported mechanism for granular, per-tenant content isolation in XSOAR.

Answer

Global Server Configuration settings

Answer

Playbook JSON source code permissions

Answer

Integration instance parameters

Question 2

You are designing an automated phishing response workflow in Cortex XSOAR. The playbook needs to extract all URLs from an incoming email body and check their reputation using VirusTotal. Which built-in task type should you use to evaluate each URL concurrently?

Accepted Answer

Loop / For-Each Task. A loop task in Cortex XSOAR iterates over lists or arrays, such as extracted URLs, allowing parallel or sequential processing.

Answer

Data Collection Task

Answer

Transformation Script Task

Answer

Manual Review Task

Question 3

An architect is designing an automated containment workflow in Cortex XDR where an endpoint must be isolated only if it is confirmed to be communicating with a known Command and Control (C2) server. Which XQL query logic accurately identifies this condition before triggering isolation?

Accepted Answer

dataset = xdr_data | filter alert_name = 'C2 Communication' and causal_agent_id != null | fields agent_id, C2_ip. XQL queries aggregate alerts and network events to confirm C2 communication status before automated action.

Answer

dataset = endpoint_logs | summarize failed_logins = count() by user_name

Answer

dataset = xdr_data | filter event_type = 'network' and action = 'allowed' | stats count() by actor_process_image_path

Answer

dataset = network_traffic | filter bytes > 1000000

Question 4

An organization wants to measure the efficiency of its SOC by tracking how quickly analysts acknowledge incoming high-priority alerts. Which metric is being measured?

Accepted Answer

Mean Time to Acknowledge (MTA). Mean Time to Acknowledge (MTA) or Mean Time to Respond (MTTR) tracks acknowledgement and response speed.

Answer

Mean Time to Detect (MTTD)

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Patch (MTTP)

Question 5

An enterprise security architect is designing high availability for Cortex XSOAR engines. If the primary engine fails, what mechanism ensures zero data loss and uninterrupted playbook execution for active incidents?

Accepted Answer

Active-Active cluster architecture backed by external PostgreSQL and Redis. Cortex XSOAR engines achieve high availability and zero data loss through an Active-Active cluster architecture where multiple engine instances share state via external PostgreSQL (for incident/playbook data) and Redis (for caching and message queuing). This design ensures that if the primary engine fails, another engine in the cluster immediately picks up active playbook executions without losing context or data. The externalized data stores are the key: because state is not held locally on any single engine, failover is seamless and no incident data is lost.

Answer

Periodic XML configuration exports via cron jobs

Answer

Automatic client-side browser caching of playbook states

Answer

DNS round-robin load balancing between local SQLite storage files

Question 6

An architect is designing a multi-region threat intelligence sharing architecture using Cortex XSOAR. They need to synchronize indicators across independent regional XSOAR instances without creating circular loops. Which protocol and architecture pattern should be implemented?

Accepted Answer

TAXII 2.1 Server and Client integration feeds across instances. TAXII (Trusted Automated Exchange of Intelligence Information) client-server architecture is standard for federated indicator sharing.

Answer

Direct database replication of the internal SQLite tables

Answer

Unencrypted FTP file drops of CSV indicator lists

Answer

Raw Syslog forwarding of indicator JSON blobs

Question 7

An enterprise security architect is designing data residency compliance controls for Cortex XSIAM. European Union customer data must not leave the EU region. Where is data residency enforced in Cortex XSIAM?

Accepted Answer

By selecting the appropriate EU-hosted cloud tenant region during initial tenant provisioning. Data residency is determined by the geographic location of the tenant tenant cluster provisioned during onboarding.

Answer

By configuring log filtering rules in XSOAR playbooks

Answer

By enabling TLS 1.3 encryption on the Broker VM

Answer

By setting local registry keys on each Windows endpoint agent

Question 8

When configuring role-based access control (RBAC) in Cortex XSOAR for an Incident Response team, which TWO permissions can be assigned to restrict unauthorized modifications? (Choose two)

Accepted Answer

Allow Incident Deletion. In Cortex XSOAR RBAC, permissions are granular role settings that govern what a user can do within the platform, and both 'Allow Incident Deletion' (A) and 'Allow Server Configuration Edits' (C) are legitimate XSOAR role permissions that directly restrict destructive or administrative modifications. Option A is correct because incident deletion is a sensitive, destructive action that RBAC can deny so IR team members cannot remove incident records or evidence. Option C is correct because server configuration edits control global platform settings, and withholding this permission prevents unauthorized changes to the XSOAR server. Options B, D, and E are incorrect because kernel module loading, BIOS firmware flashing, and local firewall port opening are operating-system or hardware-level operations, not Cortex XSOAR RBAC permissions.

Answer

Allow Kernel Module Loading

Answer

Allow BIOS Firmware Flashing

Answer

Allow Local Firewall Port Opening

Question 9

An organization wants to implement the MITRE ATT&CK framework into their threat detection engineering lifecycle within Cortex XSIAM. Which specific feature enables architects to map incoming telemetry and custom correlation rules directly to ATT&CK tactics and techniques to measure coverage?

Accepted Answer

ATT&CK Coverage Dashboard and Analytics Mapping. Cortex XSIAM includes a built-in MITRE ATT&CK matrix view that automatically maps triggered alerts and analytics rules to tactics and techniques to track coverage.

Answer

Panorama Dynamic Address Groups

Answer

AutoFocus Tagging Engine

Answer

Traps Agent Policy Editor

Question 10

A SOC architect is integrating Cortex XSOAR with Palo Alto Networks Cortex XDR to automate the triage of high-severity alerts. Which specific architecture component should be configured to ensure seamless bi-directional incident synchronization and automated playbook execution?

Accepted Answer

Cortex XSOAR Content Pack for Cortex XDR. The Cortex XSOAR integration utilizes the Cortex XDR incident management APIs via an instance-configured integration to fetch incidents, update statuses, and run playbooks.

Answer

Prisma Access Remote Network Connector

Answer

AutoFocus Tag Synchronizer

Answer

Minemeld Global Feed Engine