SecOps-Architect Operationalizing Security Metrics Practice Question
An organization wants to define a Key Performance Indicator (KPI) in Cortex XSOAR that measures the average time taken by an analyst to acknowledge an incoming high-severity incident. Which metric category best captures this measurement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mean Time to Acknowledge (MTTA)
Mean Time to Acknowledge (MTTA) is a core incident response metric measuring the latency between incident creation and the first human interaction or acknowledgment, reflecting triage efficiency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Mean Time to Acknowledge (MTTA)
Why this is correct
MTTA directly captures the time elapsed from incident ingestion to the start of analyst handling.
- ✗
False Positive Rate (FPR)
Why it's wrong here
FPR measures the ratio of incorrect alerts to total alerts, unrelated to time latency.
- ✗
Mean Time to Resolution (MTTR)
Why it's wrong here
MTTR measures the total time to fully resolve and close an incident, not just the acknowledgment phase.
- ✗
Mean Time to Contain (MTTC)
Why it's wrong here
MTTC measures the time required to isolate or contain a threat, which occurs later in the incident lifecycle.
About these practice questions
Courseiva writes every SecOps-Architect question from scratch — 224 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This SecOps-Architect practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SecOps-Architect exam.