SecOps-Architect Operationalizing Security Metrics Practice Question
An architect is troubleshooting why security metric trends in Cortex XSIAM appear erratic and unreliable. Which THREE factors commonly cause metric distortion in a SOC? (Choose three)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Intermittent log ingestion pipeline failures or collector outages
Metric distortion is frequently caused by log source ingestion failures, inconsistent log parsing/normalization, and sudden shifts in business operations or endpoint coverage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configuring browser bookmarks for dashboard access
Why it's wrong here
Bookmarks are browser shortcuts that do not affect data metrics.
- ✓
Intermittent log ingestion pipeline failures or collector outages
Why this is correct
Missing log data during pipeline outages creates artificial drops in metric trends.
- ✗
Using dark mode instead of light mode in the Cortex XSIAM web UI
Why it's wrong here
UI theme settings have zero impact on backend metric data calculation.
- ✓
Inconsistent log parsing or changes in log formats from third-party vendors
Why this is correct
Broken parsing rules cause events to be misclassified or dropped from metric calculations.
- ✓
Unannounced mass deployment or decommissioning of endpoint agents
Why this is correct
Sudden changes in endpoint sensor coverage skew volume-based security metrics.
About these practice questions
This SecOps-Architect question is part of Courseiva's 224-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This SecOps-Architect practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SecOps-Architect exam.