SecOps-Architect Operationalizing Security Metrics Practice Question
Which TWO metrics are commonly used to measure the impact and ROI of a Cortex XSOAR implementation in a SOC? (Choose two)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reduction in Mean Time to Resolve (MTTR) for standard incident types
ROI and impact for SOAR are measured by tracking reductions in Mean Time to Resolve (MTTR) and increases in automation rates (hours saved).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Total gigabytes of firewall log traffic archived per month
Why it's wrong here
Archived log volume measures storage capacity, not SOAR efficiency.
- ✗
WildFire file detonation queue length
Why it's wrong here
Queue length measures cloud sandboxing performance.
- ✗
Number of physical security badge swipes at the SOC entrance
Why it's wrong here
Badge swipes measure physical building attendance, not SOAR performance.
- ✓
Reduction in Mean Time to Resolve (MTTR) for standard incident types
Why this is correct
SOAR accelerates remediation, directly lowering MTTR.
- ✓
Total analyst hours saved through automated playbook execution
Why this is correct
Hours saved quantifies direct operational efficiency gains and financial ROI.
Visual reference
About these practice questions
This SecOps-Architect question is part of Courseiva's 217-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This SecOps-Architect practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SecOps-Architect exam.