SecOps-Architect Secops Frameworks And Threat Response Architecture — Timed 15 Questions

Question 1

In a multi-tenant Cortex XSOAR deployment, an architect needs to restrict access to specific playbooks so that Tenant A analysts cannot view or execute playbooks owned by Tenant B. Where is this access control configured?

15 minute time limit — choose an answer to begin.

Accepted Answer

Role-Based Access Control (RBAC) settings under Settings > Common > Roles. In Cortex XSOAR multi-tenant deployments, playbook-level access control is enforced through Role-Based Access Control (RBAC) configured under Settings > Common > Roles. RBAC roles define which playbooks, integrations, and content a user or tenant can view and execute, so restricting Tenant A from Tenant B's playbooks requires assigning roles with scoped playbook permissions. This is the only supported mechanism for granular, per-tenant content isolation in XSOAR.

Answer

Global Server Configuration settings

Answer

Playbook JSON source code permissions

Answer

Integration instance parameters

Question 2

You are designing an automated phishing response workflow in Cortex XSOAR. The playbook needs to extract all URLs from an incoming email body and check their reputation using VirusTotal. Which built-in task type should you use to evaluate each URL concurrently?

Accepted Answer

Loop / For-Each Task. A loop task in Cortex XSOAR iterates over lists or arrays, such as extracted URLs, allowing parallel or sequential processing.

Answer

Data Collection Task

Answer

Transformation Script Task

Answer

Manual Review Task

Question 3

An architect is designing an automated containment workflow in Cortex XDR where an endpoint must be isolated only if it is confirmed to be communicating with a known Command and Control (C2) server. Which XQL query logic accurately identifies this condition before triggering isolation?

Accepted Answer

dataset = xdr_data | filter alert_name = 'C2 Communication' and causal_agent_id != null | fields agent_id, C2_ip. XQL queries aggregate alerts and network events to confirm C2 communication status before automated action.

Answer

dataset = endpoint_logs | summarize failed_logins = count() by user_name

Answer

dataset = xdr_data | filter event_type = 'network' and action = 'allowed' | stats count() by actor_process_image_path

Answer

dataset = network_traffic | filter bytes > 1000000

Question 4

An organization wants to measure the efficiency of its SOC by tracking how quickly analysts acknowledge incoming high-priority alerts. Which metric is being measured?

Accepted Answer

Mean Time to Acknowledge (MTA). Mean Time to Acknowledge (MTA) or Mean Time to Respond (MTTR) tracks acknowledgement and response speed.

Answer

Mean Time to Detect (MTTD)

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Patch (MTTP)

Question 5

An enterprise security architect is designing high availability for Cortex XSOAR engines. If the primary engine fails, what mechanism ensures zero data loss and uninterrupted playbook execution for active incidents?

Accepted Answer

Active-Active cluster architecture backed by external PostgreSQL and Redis. Cortex XSOAR engines achieve high availability and zero data loss through an Active-Active cluster architecture where multiple engine instances share state via external PostgreSQL (for incident/playbook data) and Redis (for caching and message queuing). This design ensures that if the primary engine fails, another engine in the cluster immediately picks up active playbook executions without losing context or data. The externalized data stores are the key: because state is not held locally on any single engine, failover is seamless and no incident data is lost.

Answer

Periodic XML configuration exports via cron jobs

Answer

Automatic client-side browser caching of playbook states

Answer

DNS round-robin load balancing between local SQLite storage files

Question 6

An architect is designing a multi-region threat intelligence sharing architecture using Cortex XSOAR. They need to synchronize indicators across independent regional XSOAR instances without creating circular loops. Which protocol and architecture pattern should be implemented?

Accepted Answer

TAXII 2.1 Server and Client integration feeds across instances. TAXII (Trusted Automated Exchange of Intelligence Information) client-server architecture is standard for federated indicator sharing.

Answer

Direct database replication of the internal SQLite tables

Answer

Unencrypted FTP file drops of CSV indicator lists

Answer

Raw Syslog forwarding of indicator JSON blobs

Question 7

An enterprise security architect is designing data residency compliance controls for Cortex XSIAM. European Union customer data must not leave the EU region. Where is data residency enforced in Cortex XSIAM?

Accepted Answer

By selecting the appropriate EU-hosted cloud tenant region during initial tenant provisioning. Data residency is determined by the geographic location of the tenant tenant cluster provisioned during onboarding.

Answer

By configuring log filtering rules in XSOAR playbooks

Answer

By enabling TLS 1.3 encryption on the Broker VM

Answer

By setting local registry keys on each Windows endpoint agent

Question 8

When configuring role-based access control (RBAC) in Cortex XSOAR for an Incident Response team, which TWO permissions can be assigned to restrict unauthorized modifications? (Choose two)

Accepted Answer

Allow Incident Deletion. In Cortex XSOAR RBAC, permissions are granular role settings that govern what a user can do within the platform, and both 'Allow Incident Deletion' (A) and 'Allow Server Configuration Edits' (C) are legitimate XSOAR role permissions that directly restrict destructive or administrative modifications. Option A is correct because incident deletion is a sensitive, destructive action that RBAC can deny so IR team members cannot remove incident records or evidence. Option C is correct because server configuration edits control global platform settings, and withholding this permission prevents unauthorized changes to the XSOAR server. Options B, D, and E are incorrect because kernel module loading, BIOS firmware flashing, and local firewall port opening are operating-system or hardware-level operations, not Cortex XSOAR RBAC permissions.

Answer

Allow Kernel Module Loading

Answer

Allow BIOS Firmware Flashing

Answer

Allow Local Firewall Port Opening

Question 9

An organization wants to implement the MITRE ATT&CK framework into their threat detection engineering lifecycle within Cortex XSIAM. Which specific feature enables architects to map incoming telemetry and custom correlation rules directly to ATT&CK tactics and techniques to measure coverage?

Accepted Answer

ATT&CK Coverage Dashboard and Analytics Mapping. Cortex XSIAM includes a built-in MITRE ATT&CK matrix view that automatically maps triggered alerts and analytics rules to tactics and techniques to track coverage.

Answer

Panorama Dynamic Address Groups

Answer

AutoFocus Tagging Engine

Answer

Traps Agent Policy Editor

Question 10

A SOC architect is integrating Cortex XSOAR with Palo Alto Networks Cortex XDR to automate the triage of high-severity alerts. Which specific architecture component should be configured to ensure seamless bi-directional incident synchronization and automated playbook execution?

Accepted Answer

Cortex XSOAR Content Pack for Cortex XDR. The Cortex XSOAR integration utilizes the Cortex XDR incident management APIs via an instance-configured integration to fetch incidents, update statuses, and run playbooks.

Answer

Prisma Access Remote Network Connector

Answer

AutoFocus Tag Synchronizer

Answer

Minemeld Global Feed Engine

Question 11

An architect is configuring log ingestion for Cortex XSIAM. Which native Palo Alto Networks collector type is designed to gather syslog and CEF formatted logs from third-party security devices without requiring an external forwarder VM?

Accepted Answer

Cortex XSIAM Broker VM. Cortex XSIAM supports Cloud Identity Engine and Broker VM architectures, where the Broker VM acts as a local collector for syslog, SNMP, and other third-party formats.

Answer

AutoFocus Cloud API connector

Answer

Panorama Management Server direct API

Answer

GlobalProtect Gateway agent

Question 12

A security architect is designing an incident escalation matrix for a multinational SOC. Which metric is most critical to measure the effectiveness of the Tier 1 triage team before escalating incidents to Tier 2?

Accepted Answer

Mean Time to Acknowledge (MTTA) and Triage accuracy. Mean Time to Triage (MTTT) or Mean Time to Acknowledge (MTTA) measures how quickly Tier 1 processes and validates incoming alerts before escalating.

Answer

Number of global security patents filed

Answer

Mean Time to Patch (MTTP)

Answer

Total volume of firewall rules configured

Question 13

An architect is designing a threat detection architecture using Cortex XSIAM analytics. Which THREE types of data sources are critical to ingest to provide comprehensive visibility for detecting lateral movement and credential dumping? (Choose three)

Accepted Answer

Active Directory / Authentication logs (e.g., Windows Security Event logs for Kerberos/NTLM). Option A is correct because Active Directory and authentication logs, such as Windows Security Event logs for Kerberos and NTLM, are essential for detecting credential dumping and lateral movement through suspicious logon events, ticket anomalies, and pass-the-hash or pass-the-ticket activity. Option B is correct because network traffic flow logs, such as PAN-OS Traffic and Threat logs, provide visibility into east-west movement, unusual internal connections, command-and-control traffic, and data exfiltration that often accompany lateral movement. Option C is correct because endpoint process execution and OS telemetry, such as Cortex XDR agent logs, capture process creation, memory access, credential dumping tools like Mimikatz, and suspicious parent-child process relationships that reveal host-level compromise. Option D does not belong because HVAC temperature and humidity sensor telemetry is building management data with no relevance to detecting credential dumping or lateral movement. Option E does not belong because cafeteria POS terminal receipt printer error logs are unrelated operational data and provide no security visibility into authentication, endpoint, or network adversary behavior.

Answer

HVAC temperature and humidity sensor telemetry

Answer

Cafeteria POS terminal receipt printer error logs

Question 14

An architect is configuring role-based access control (RBAC) in Cortex XSIAM for a multi-tenant SOC environment. Which TWO principles should guide the design of security analyst roles? (Choose three - wait, prompt says Which TWO for multi_select half. Let's provide TWO). Which TWO principles should guide the design of security analyst roles? (Choose two)

Accepted Answer

Principle of least privilege (granting only necessary permissions for job functions). Option A is correct because the principle of least privilege is a foundational RBAC design rule: each security analyst role should be granted only the specific permissions required for their job function, minimizing the blast radius if an account is compromised or misused. Option E is correct because segregation of duties ensures that incident responders and system administrators hold distinct, non-overlapping roles, preventing any single user from both detecting/responding to incidents and altering the underlying system configurations, which reduces the risk of insider abuse and accidental conflicts of interest. Options B, C, and D are incorrect: sharing a single root administrator account destroys individual accountability and non-repudiation; granting full Super Administrator privileges to all Tier 1 analysts violates least privilege and dramatically expands the attack surface; and disabling audit logging for administrator actions removes the forensic trail needed for compliance and incident investigation, saving disk space at an unacceptable security cost.

Answer

Sharing a single root administrator account across the entire global SOC team

Answer

Assigning full Super Administrator privileges to all Tier 1 analysts to accelerate triage

Answer

Disabling audit logging for administrator actions to save disk space

Question 15

An organization is building a Threat Intelligence Program aligned with the Diamond Model of Intrusion Analysis. Which THREE core vertices must be analyzed for every adversary event in the incident tracking database? (Choose three)

Accepted Answer

Capability (the tools and techniques used by the adversary). The Diamond Model of Intrusion Analysis defines every intrusion event through four core features, three of which are named here: Adversary (E), Capability (A), and Infrastructure (C). Adversary (E) is correct because it identifies the actor or organization responsible for the intrusion, which is the 'who' vertex of the model. Capability (A) is correct because it captures the tools, malware, and techniques the adversary uses, representing the 'how' of the event. Infrastructure (C) is correct because it describes the physical or logical communication channels (e.g., C2 servers, IP addresses, domains) that connect the adversary to the victim, forming the 'where/how delivered' vertex. Options B (HVAC cooling capacity) and D (cafeteria menu pricing) are facility-management data points with no role in the Diamond Model's adversary-event vertices and are therefore incorrect.

Answer

Office HVAC cooling capacity metrics

Answer

Local cafeteria menu pricing structures