SecOps-Pro Cortex XSIAM Practice Test 1 — 15 Questions

Question 1

A security analyst notices that raw log data is reaching the Cortex XSIAM platform but is not being parsed into the unified data model. Which configuration setting should the analyst inspect to ensure log normalization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Log Ingestion Data Modeling configuration. Log parsing and normalization depend on the correct Data Ingestion mapping and transformation rules.

Answer

Incident response playbooks

Answer

Dashboard widgets

Answer

Agent Policy Profiles

Question 2

You are configuring a new Logstash data collector to ingest logs into Cortex XSIAM. Which specific component must be deployed within the customer environment to facilitate secure, authenticated log forwarding?

Accepted Answer

Cortex XSIAM Forwarder. The Log Forwarder is the designated component for on-premise log ingestion.

Answer

Cortex Collector Pro

Answer

Cortex Agent Relay

Answer

XSIAM API Gateway

Question 3

Where do you view the status of endpoints currently connected to the Cortex XSIAM platform?

Accepted Answer

Asset Management. The Asset/Endpoint management page displays the health and status of all agents.

Answer

Data Ingestion menu

Answer

Incident Response console

Answer

System Logs

Question 4

You need to export data from Cortex XSIAM to a third-party SIEM. Which feature facilitates the automated forwarding of data?

Accepted Answer

Log Forwarding. Log Forwarding profiles or API-based integration tools are used to send data out of XSIAM.

Answer

Data Ingestion Pipeline

Answer

XQL Export Tool

Answer

Incident Export API

Question 5

You need to trigger an alert when a user fails to log in five times within one minute. Which XSIAM feature should be used?

Accepted Answer

XQL Aggregation rule. Detection rules support threshold-based logic, including frequency/time windows.

Answer

Data ingestion filter

Answer

Playbook incident trigger

Answer

Dashboard alert threshold

Question 6

Which THREE of the following are components of a standard XSIAM detection rule?

Accepted Answer

Incident Trigger Logic. Detection rules require a query, severity, and defined action/trigger.

Answer

Physical asset location

Answer

Database schema index

Question 7

Which TWO actions can be taken via the XSIAM agent?

Accepted Answer

Remote shell execution for forensics. The agent can isolate hosts and execute forensic commands.

Answer

Physical hard drive wiping

Answer

Automatic software installation

Answer

Changing system BIOS passwords

Question 8

A security analyst at a retail company suspects that an attacker used a compromised service account to perform lateral movement via SMB. The analyst wants to identify all unique hosts that the account connected to over the past 24 hours using Cortex XSIAM's XQL. Which query structure will correctly return the distinct destination IP addresses for the specified account and protocol?

Accepted Answer

config timeframe = 24h | dataset = xdr_data | filter action_local_ip != null and action_remote_ip != null and actor_effective_username = "svc_backup" and action_remote_port = 445 | fields action_remote_ip as dest_ip | dedup dest_ip. The query must filter events for the specific service account and SMB port, then extract the destination IP addresses and remove duplicates. The `dedup` stage is the correct XQL construct for this. Other options either omit deduplication, use invalid syntax, or return aggregated counts instead of unique hosts. The timeframe is also properly constrained to 24 hours.

Answer

dataset = xdr_data | filter actor_effective_username = "svc_backup" and action_remote_port = 445 | fields action_remote_ip | limit 100

Answer

dataset = xdr_data | filter actor_effective_username = "svc_backup" and action_remote_port = 445 | comp count() by action_remote_ip

Answer

dataset = xdr_data | filter actor_effective_username = "svc_backup" and action_remote_port = 445 | fields action_remote_ip | distinct action_remote_ip

Question 9

A Cortex XSIAM administrator is planning to ingest logs from a custom application that writes JSON-formatted events to a local file on a Linux server. The administrator wants to use the Broker VM to collect these logs. Which two components must be configured on the Broker VM to enable this log collection? (Choose two.)

Accepted Answer

Logstash. To collect custom JSON logs from a local file on a Linux server via the Broker VM, the administrator needs Filebeat to read and ship the log file, and Logstash to parse and transform the JSON events before sending them to Cortex XSIAM. Together, these components handle file monitoring, data parsing, and forwarding, ensuring the logs are properly structured for XDM mapping and analysis.

Answer

Syslog collector

Answer

XQL query engine

Answer

Cortex XDR agent

Question 10

A SOC analyst is building an XQL query against the Cortex XSIAM `xdr_data` dataset to identify all network connections made by a specific process. The analyst writes: `dataset = xdr_data | filter event_type = NETWORK and actor_process_image_name = "chrome.exe" | fields agent_hostname, action_remote_ip, action_remote_port`. After running the query, the analyst notices the results are missing columns for the remote IP and port. Which action should the analyst take to return the expected data?

Accepted Answer

Verify that the network event type uses `action_remote_ip` and `action_remote_port` as the correct field names in the XDM, and adjust the query accordingly.. The XDM defines specific field names for each event type. For network events, remote IP and port are stored as `action_remote_ip` and `action_remote_port`. If the query returns no data for these fields, the most likely cause is that the event type or field mapping differs from what the analyst expects. Verifying the XDM schema and adjusting the query to match the actual mapped field names resolves the issue.

Answer

Add the `comp` stage before the `fields` stage to extract the remote IP and port from the raw event.

Answer

Change the `fields` stage to `alter` and manually rename `action_remote_ip` and `action_remote_port` to match the schema.

Answer

Add a `limit` stage to restrict the number of returned rows, which forces XQL to populate all available fields.

Question 11

A security engineer is configuring a new correlation rule in Cortex XSIAM to detect a specific attack pattern. They need to define the rule's logic using XQL. Which two XQL clauses are essential for defining the time window and the condition that triggers the alert? (Choose two.)

Accepted Answer

| window duration. To build a correlation rule in Cortex XSIAM, the XQL query must specify the events of interest and the timeframe over which they should be correlated. The 'filter' clause applies the specific condition that identifies malicious or suspicious activity, while the 'window' clause defines the sliding time period for grouping those events. Together, they form the core logic for detecting patterns like multiple failed logins or a sequence of actions within a short time.

Answer

| bin _time span=5m

Answer

| limit 1000

Answer

| sort by _time

Question 12

A SOC manager wants to ensure that Cortex XSIAM automatically enriches incidents with threat intelligence and then routes them to the correct analyst queue based on severity. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Create a playbook that includes a task to query the threat intelligence integration and a task to assign the incident to a queue based on severity.. To automatically enrich and route incidents, you need a playbook that performs the enrichment and assignment tasks, and a correlation rule that triggers the playbook when incidents are created or updated. The playbook defines the actions, while the correlation rule defines when those actions occur. Together, they form the automation workflow.

Answer

Create a custom dashboard widget that displays incidents by severity and queue.

Answer

Configure an incident type with a severity field and map it to a queue using the incident field mapping settings.

Answer

Enable the Threat Intelligence Management add-on and subscribe to a feed.

Question 13

A Cortex XSIAM administrator is configuring a new data source that sends logs in a custom JSON format. The logs contain a field named 'src_ip' that should map to the XDM 'action_local_ip' field. However, after ingestion, the XDM field is not populated. The administrator has verified that the logs are arriving and the parsing rules are applied. What is the most likely reason for the mapping failure?

Accepted Answer

The parsing rule does not correctly extract the 'src_ip' field from the raw log.. For a custom log source, the parsing rules must be configured to extract the necessary fields from the raw log. If the parsing rule does not correctly identify and extract the 'src_ip' field, that field will not be available for XDM mapping. Even if the XDM mapping rule for 'action_local_ip' is correctly defined, it relies on the source field being present. Thus, a parsing error is the most probable cause of the missing XDM data.

Answer

The 'action_local_ip' field is already mapped from another source field.

Answer

The XDM mapping rule for 'action_local_ip' is disabled.

Answer

The 'src_ip' field is not included in the dataset's schema.

Question 14

A Cortex XSIAM administrator is creating a new custom dashboard for the security operations center. The dashboard must show a count of incidents by severity, a trend of alerts over the last seven days, and a table of the top ten most frequent MITRE ATT&CK techniques observed. Which two widget types should the administrator use to build these components? (Choose two.)

Accepted Answer

Pie chart widget. The dashboard requires a proportional breakdown of incidents by severity and a time-based view of alert volume. A pie chart widget conveys proportions across categories, and a line chart widget plots values over a time axis. Together they satisfy the severity count and the seven-day trend. The remaining widget types either show a single value or static text and cannot represent these multi-category and time-series views.

Answer

Single value widget

Answer

Text widget

Answer

Gauge widget

Question 15

What is the primary function of the 'Cortex XSIAM Agent' when installed on an endpoint?

Accepted Answer

To collect data and provide endpoint protection. The agent provides both endpoint protection and telemetry collection for XSIAM.

Answer

To replace the need for network security

Answer

To store all log data locally on the host

Answer

To manage firewall rules on the local host