CCNA Secops Frameworks And Threat Response Architecture Questions

Egress filtering and DNS sinkholing sever the outbound channels adversaries use to receive instructions and exfiltrate data. Targeting the Command and Control phase directly disrupts beaconing traffic from compromised endpoints to attacker infrastructure, satisfying the requirement to break the intrusion lifecycle after exploitation but before lateral movement or action on objectives.

Cortex XSOAR conditional tasks evaluate task outputs against built-in operators and route execution down the matching branch without custom code. By comparing the enrichment confidence score against the defined threshold, the playbook can proceed to the blocklist action only when the score qualifies, satisfying the conditional automation requirement natively.

Approval tasks pause playbook execution and present a prompt or questionnaire to a designated approver, gating the containment action until the analyst authorises isolation. This enforces the required human approval before the executive's laptop is quarantined.

The Cyber Kill Chain, developed by Lockheed Martin, consists of seven stages: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. This sequence describes the steps an adversary takes from initial planning to achieving their goal. Mapping controls to these stages helps organizations identify where they can detect and disrupt an attack. This is the correct and complete list in the proper order.

The core engine processes the spooler queue to create incidents.

The query filters PROCESS_START events where winword.exe spawns cmd.exe, a classic LotLB pattern indicating a document launching a shell. Restricting to actor and target process image names isolates anomalous parent-child relationships rather than normal command execution.

Cortex XSIAM's unified data model normalizes events from multiple sources into consistent schema fields, which is what allows disparate telemetry to be correlated into a single incident timeline. Without normalization, endpoint process events, firewall logs, and identity authentication records would use incompatible field names and could not be joined reliably for response actions.

Preparation is the first phase of the NIST Incident Response Lifecycle, encompassing activities to establish and maintain an incident response capability. This includes creating an incident response plan, defining communication protocols, and training staff. These are exactly the activities described, making Preparation the correct phase.

Revoking session tokens and forcing password resets in Microsoft Entra ID neutralises stolen credentials and active sessions tied to the compromised identity. This satisfies automated containment by cutting the attacker's authenticated access path, complementing endpoint and network actions within the XSIAM response playbook.

Indexed fields let Cortex XSIAM skip scanning unindexed columns, and exact-match operators such as = avoid expensive wildcard or regex evaluation. This directly reduces the volume of data processed per query, satisfying the performance and efficiency requirement.

A structured handoff record preserves the investigative state, including what has been ruled out and what remains open, so the incoming region continues rather than restarts. Pairing it with a live briefing lets the receiving analyst ask clarifying questions that a written record alone cannot cover. This addresses the root cause of context loss directly.

The Incident Storyline visualisation correlates and groups related alerts into one chronological attack narrative, letting the architect trace root cause across stages rather than reviewing isolated alerts, which directly satisfies the requirement to aggregate related alerts into a single storyline.

The Microsoft Graph Mail integration authenticates to Microsoft Office 365 through Microsoft Entra ID using OAuth 2.0, enabling mailbox and message operations without legacy basic authentication. Cortex XSOAR requires it to parse and remediate phishing emails via Graph APIs.

CMMI Level 2 requires project-level management discipline: work is planned, performed, measured and controlled against documented plans, with resources, responsibilities and progress tracked. This satisfies the stem's maturity constraint by distinguishing Managed from Level 1 (performed, ad hoc) and Level 3 (organisation-wide standardised processes).

Gating destructive actions behind analyst approval keeps automated enrichment, which is low risk and high value, running at machine speed while preventing a misconfigured playbook from deleting mailboxes or isolating endpoints incorrectly. This directly limits blast radius and preserves analyst judgment at the irreversible step. It satisfies both the automation goal and the safety requirement in the scenario, making it a sound architectural control for phishing response.

In NIST SP 800-61, the Containment, Eradication, and Recovery phase includes containing the threat, eliminating the adversary's foothold, and verifying that systems are clean before restoring normal operations. Validating removal of access is an eradication activity performed inside this phase, making it the correct lifecycle stage for the architect to reference.

Isolating the endpoint through the Cortex XDR integration halts lateral spread and encrypting processes at the host level while the machine stays powered, preserving volatile memory and running processes for forensic capture. This satisfies the stem's dual constraint: effective containment without destroying evidence, unlike shutdown or reimaging.

Splitting hot analytical storage from cold compliance tiers satisfies both constraints: high-frequency queries stay fast on active storage, while aged data moves to cheaper cold tiers for regulatory retention. This tiering avoids compromising search performance against long-term mandates.

In Cortex XSOAR, Reputation Calculation allows architects to define custom logic that aggregates and scores indicators from multiple intelligence sources. It uses a JavaScript expression to compute a reputation score based on factors like source reliability and indicator severity, enabling automated risk-based decisions. This is the correct component for correlating and scoring IOCs from different sources.

Accuracy and false positive rate determine whether indicators can be trusted for automated blocking and enrichment. High false positives cause alert fatigue and disrupt legitimate business traffic, directly undermining the operational value Cortex XSOAR playbooks deliver.

Cortex XDR network isolation severs the endpoint's communication with the C2 server while keeping the agent's management channel open, so analysts retain control and can collect forensic data remotely. This satisfies immediate containment without destroying evidence. Reimaging or powering off would eliminate volatile artifacts needed for root-cause analysis.

Tier 2 handles escalated incidents requiring deeper expertise: performing forensic investigation, determining root cause, and executing containment actions such as isolating hosts. This distinguishes it from Tier 1 triage and Tier 3 proactive hunting or engineering work.