SecOps-Pro Cortex XSIAM Practice Test 3 — 15 Questions

Question 1

When reviewing an incident in the Investigation area, what does the 'Graph' view display?

Accepted Answer

The relationships between entities and alerts. The Graph view provides a visual representation of the relationships between entities involved in an incident.

Answer

The raw log structure

Answer

The status of the agent

Answer

The timeline of events only

Question 2

Which TWO of the following are valid ways to ingest log data into Cortex XSIAM?

Accepted Answer

API-based ingestion. API-based ingestion (A) is correct because Cortex XSIAM supports programmatic data ingestion through its public APIs, allowing external sources and custom integrations to push logs directly into the platform. XSIAM Log Collector (B) is correct because it is the dedicated broker/collector component used to receive and forward logs from various sources into XSIAM, supporting both agent-based and agentless collection. Manual file upload through the browser (C) is not a supported ingestion method for ongoing log data, as XSIAM is designed for automated, scalable data pipelines rather than ad hoc uploads. Physical media shipping (D) is not part of XSIAM's ingestion architecture, which relies on network-based collection rather than offline transfer. Direct database query connection (E) is not a valid ingestion method, since XSIAM does not ingest logs by querying source databases directly; data must be sent via supported collectors or APIs.

Answer

Manual file upload through the browser

Answer

Physical media shipping

Answer

Direct database query connection

Question 3

Which TWO of the following are considered 'Entities' in the Cortex XSIAM investigation workbench?

Accepted Answer

User. In the Cortex XSIAM investigation workbench, an 'Entity' is a security-relevant object that can be pivoted on and enriched with threat intelligence, and both A (User) and C (Host) are canonical entity types representing accounts and endpoints involved in an incident. Users and hosts are the primary actors and assets that XSIAM correlates across alerts, so they appear as entities in the workbench graph and timeline. The remaining options are not entities: B (Log file size) is a metric about telemetry volume, D (Dashboard color) is a UI display setting, and E (Query execution speed) is a performance measurement of XQL queries, none of which represent an identifiable security object.

Answer

Log file size

Answer

Dashboard color

Answer

Query execution speed

Question 4

Which THREE items can be performed within the XSIAM Playbook editor?

Accepted Answer

Define incident remediation steps. In the Cortex XSIAM Playbook editor, C is correct because playbooks are built precisely to define and orchestrate incident remediation steps as a sequence of tasks, conditions, and actions that automate response workflows. D is correct because the editor lets you add integration commands and API-based tasks (for example, calling third-party tools through configured integration instances) so external systems can be invoked as part of the playbook. E is correct because the editor supports mapping task outputs to playbook context keys/variables (using the task output schema) so later tasks can reference and transform those values. A is not part of the Playbook editor, since user role and access permissions are managed in RBAC settings under administration, not inside playbook authoring. B is also unrelated, as database replication is an infrastructure/configuration concern handled outside the Playbook editor.

Answer

Manage user role access permissions

Answer

Configure database replication

Question 5

Which THREE of the following represent common data sources for Cortex XSIAM?

Accepted Answer

Cloud infrastructure logs (e.g., AWS CloudTrail). Cortex XSIAM ingests cloud infrastructure logs such as AWS CloudTrail (A) because CloudTrail provides API activity and audit events from AWS accounts that feed its analytics and detection engines. Endpoint EDR telemetry (B) is a core data source since XSIAM correlates process, file, network, and registry events from endpoint agents to detect and investigate threats. Network firewall traffic logs (C) are also commonly ingested, as they supply connection, allow/deny, and flow metadata used for network-based detections and correlation. Employee payroll database (D) is not a standard security telemetry source and is unrelated to XSIAM's threat detection data ingestion. Coffee machine diagnostic logs (E) are irrelevant operational data with no security detection value for XSIAM.

Answer

Employee payroll database

Answer

Coffee machine diagnostic logs

Question 6

Which TWO features are included in the Cortex XSIAM 'Unified SOC' dashboard capabilities?

Accepted Answer

Real-time incident queue tracking. Option A is correct because the Cortex XSIAM Unified SOC dashboard is designed to give analysts a live, prioritized view of incidents, so real-time incident queue tracking is a core capability that lets teams monitor open cases, severity, and status as events stream in. Option E is correct because the dashboard is built on customizable widgets, allowing SOC teams to create and arrange widgets that surface the specific metrics, threat feeds, or case data relevant to their environment. The remaining options do not belong: Cortex agent update scheduling (B) is an endpoint management function handled through Cortex XDR policies rather than the Unified SOC dashboard, physical security badge tracking (C) is a facility-access concern outside XSIAM's SOC analytics, and automated code deployment (D) is a CI/CD pipeline activity unrelated to SOC monitoring and incident response.

Answer

Cortex agent update scheduling

Answer

Physical security badge tracking

Answer

Automated code deployment

Question 7

Which TWO of the following are benefits of using the XDM schema in XSIAM?

Accepted Answer

Simplified XQL queries. Option D is correct because the XDM (Extended Data Model) schema in Cortex XSIAM maps ingested data from many sources into a consistent set of fields, so analysts can write XQL queries against stable, predictable field names instead of vendor-specific ones, greatly simplifying query authoring. Option E is correct because XDM normalizes data across different products and telemetry types (endpoint, network, cloud, identity, etc.) into a common taxonomy, enabling cross-source correlation and detection without per-vendor parsing logic. The unmarked options do not belong: XDM is a data-modeling/normalization layer and does not perform automated hardware replacement (A), does not directly increase endpoint processing speed (B), and while normalization can improve storage efficiency, it does not guarantee a specific 90% storage-cost reduction (C).

Answer

Automated hardware replacement

Answer

Increased endpoint processing speed

Answer

Reduced storage costs by 90%

Question 8

Which THREE types of information are typically visible in the XSIAM 'Incident' record?

Accepted Answer

Associated logs and alerts. In the Cortex XSIAM Incident record, option A (Associated logs and alerts) is correct because an incident aggregates the underlying alerts and their raw log evidence that triggered or contributed to the case, giving analysts the source telemetry. Option C (Timeline of events) is correct because XSIAM builds a chronological timeline that correlates alerts, activity, and analyst actions to show how the incident unfolded. Option D (Impacted entities) is correct because the incident record identifies the affected entities such as hosts, users, IP addresses, and accounts, which is essential for scoping and response. Option B (Employee performance reviews) is not part of incident data, as that is HR information unrelated to security telemetry. Option E (Platform billing history) is also not included, since licensing and billing records are administrative data, not incident evidence.

Answer

Employee performance reviews

Answer

Platform billing history

Question 9

Which THREE elements must be considered when configuring a Log Forwarder in Cortex XSIAM?

Accepted Answer

Network connectivity to the XSIAM cloud. Option A is correct because the Log Forwarder must have outbound network connectivity to the Cortex XSIAM cloud endpoints (e.g., over TCP 443) so it can reliably forward collected logs to the tenant. Option D is correct because the forwarder must authenticate to XSIAM using the proper credentials, such as an authentication key or certificate, before it is trusted to transmit data. Option E is correct because logs must be parsed and mapped into XSIAM's schema (for example, via Broker VM parsing rules or data model mappings) so events are normalized and usable in detection and analytics. Options B and C are not required configuration elements: employee department codes are business metadata irrelevant to forwarding, and the physical location of the server room does not affect how the Log Forwarder is configured or authenticated.

Answer

Employee department codes

Answer

Physical location of the server room

Question 10

You are creating a new detection rule. How do you ensure it only alerts on specific high-severity events?

Accepted Answer

By applying a severity filter in the detection rule configuration. In Cortex XSIAM/XDR detection rules, you can apply a severity filter directly in the rule configuration to ensure the rule only triggers alerts for events that meet specific severity criteria. This is done by defining conditions on the severity field within the rule logic, so only high-severity events generate alerts.

Answer

By editing the dashboard widget settings

Answer

By modifying the XQL query syntax

Answer

By creating a playbook that changes severity

Question 11

A security analyst at a retail company is investigating a Cortex XSIAM incident that shows an unusual outbound connection from a point-of-sale terminal to a known command-and-control IP. The analyst wants to gather additional context about the process that initiated the connection without leaving the incident view. Which XSIAM feature should the analyst use to retrieve process details, parent-child relationships, and command-line arguments?

Accepted Answer

Causality view. The Causality view is purpose-built for incident investigation in Cortex XSIAM. It aggregates endpoint telemetry into an interactive graph that shows process execution chains, command-line arguments, and network connections. This lets an analyst quickly determine how a suspicious outbound connection originated, which parent process spawned it, and what other actions occurred, all without switching tools or writing queries.

Answer

Threat intelligence management

Answer

Playbook automation

Answer

XQL query builder

Question 12

A security analyst is investigating a possible insider threat. They need to see all normal activity for a specific user over the past 90 days to establish a baseline before reviewing anomalous events. Which Cortex XSIAM capability should they use to efficiently visualize this historical, entity-centric data?

Accepted Answer

Entity Timeline. Establishing a behavioral baseline requires viewing an entity's complete activity history across all relevant data sources in a consolidated, chronological format. The Entity Timeline is specifically designed for this entity-centric analysis, allowing an analyst to quickly review normal patterns before focusing on anomalies. Other tools are either too query-focused or incident-specific to provide this broad historical context efficiently.

Answer

Query Center

Answer

Threat Intelligence module

Answer

Incident Investigation view

Question 13

A security analyst at a healthcare company notices that a Cortex XSIAM correlation rule is generating an incident every time a clinician accesses a patient record after hours, even though the access is expected during on-call shifts. The analyst wants to stop these recurring incidents without disabling the underlying rule entirely. Which action should the analyst take?

Accepted Answer

Add an exception to the correlation rule that excludes the on-call clinician accounts from triggering the incident.. Exceptions are the surgical control for recurring false positives because they scope the exclusion to the specific accounts, hosts, or indicators that are generating noise while leaving the rule active for everything else. Disabling, re-scoping, or suppressing incidents either removes detection coverage or only hides individual occurrences, so the exception is the only option that preserves both signal and coverage.

Answer

Disable the correlation rule and create a new rule that only fires for accounts outside the clinical department.

Answer

Increase the severity threshold of the correlation rule so that only high-severity events generate incidents.

Answer

Suppress the incident from the Incidents table and rely on the audit log to capture future occurrences.

Question 14

A security analyst is triaging a malware incident in Cortex XSIAM. The analyst wants to isolate the affected Windows endpoint from the network directly from the incident's War Room while preserving the forensic evidence on the disk. Which action should the analyst take?

Accepted Answer

Run the 'isolate endpoint' action on the agent from the incident's response actions.. Containment during triage in Cortex XSIAM is performed through response actions on the endpoint agent. The isolate endpoint action cuts network communication except for the management channel, which stops lateral movement and command-and-control traffic while keeping the disk and memory available for forensic collection. Other options either fail to stop the malicious process or destroy investigative evidence.

Answer

Disable the endpoint's user account in Active Directory to prevent further access.

Answer

Delete the endpoint record from the Endpoints inventory to sever its connection.

Answer

Create a firewall rule on the perimeter to block the endpoint's IP address.

Question 15

A Cortex XSIAM administrator is configuring a new correlation rule to detect brute-force attacks against a cloud identity provider. The rule should trigger only when there are more than 10 failed authentication events from the same source IP within a 5-minute window. Which XSIAM component should the administrator use to define this time-based aggregation logic?

Accepted Answer

Correlation rule with a threshold condition. Correlation rules in Cortex XSIAM provide the logic engine for defining multi-event detections with conditions such as thresholds, time windows, and grouping. By configuring a threshold condition, the administrator can trigger an alert only when the count of failed authentication events from the same source IP exceeds 10 within a 5-minute window, thereby reducing false positives from isolated failures.

Answer

IOC (Indicator of Compromise) rule

Answer

BIOC (Behavioral Indicator of Compromise) rule

Answer

XQL query with a time-based aggregation function