SecOps-Pro Cortex XSIAM Practice Test 4 — 15 Questions

Question 1

A Cortex XSIAM administrator needs to ensure that all endpoint telemetry from a critical server group is collected and forwarded to the platform, even if the endpoint's network connection is intermittent. The solution must be resilient and not lose data during outages. Which component of the Cortex XSIAM agent architecture is responsible for this reliable data handling?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The agent's local event buffer. Reliable endpoint data collection during network disruptions requires a mechanism at the source. The Cortex XSIAM agent's local event buffer stores telemetry on the endpoint when it cannot communicate with the platform, and forwards it upon reconnection. This store-and-forward capability is critical for maintaining complete visibility from endpoints in unstable network environments, which is a core requirement for effective security operations.

Answer

The platform's ingestion pipeline

Answer

The XQL query engine

Answer

The Cortex XSIAM Broker VM

Question 2

A SOC manager wants Cortex XSIAM to automatically enrich every new incident with the reputation of the involved IP addresses before an analyst opens it. Which Cortex XSIAM capability should the manager use to accomplish this?

Accepted Answer

A playbook that runs automatically on incident creation and calls the enrichment integrations.. Automated enrichment on incident creation is implemented through playbooks, which can be configured to trigger when an incident is created and to invoke integrations that return IP reputation. Dashboards, XQL-only approaches, and exclusions do not execute response or enrichment actions, so a playbook is the correct capability for adding context before analyst review.

Answer

A custom XQL query that runs on a schedule and writes IP reputation into the incidents table.

Answer

An alert exclusion that prevents incidents from being created until reputation is available.

Answer

A dashboard widget that displays the reputation of IPs observed in the last 24 hours.

Question 3

A Cortex XSIAM administrator needs to ensure that all endpoint telemetry from a critical server group is collected and forwarded to the platform, even if the endpoint's network connection is intermittent. The solution must be resilient and not lose data during outages. Which component of the Cortex XSIAM agent architecture is responsible for this reliable data handling?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A parsing rule attached to the data source.. Normalization of vendor-specific log fields into the XDM schema is the responsibility of parsing rules. These rules run during ingestion, extracting values from raw JSON and mapping them to standard XDM fields so that correlation rules, XQL queries, and dashboards can operate consistently. Correlation rules, dashboards, and playbooks all consume already-normalized data and cannot perform the required mapping.

Answer

A correlation rule that matches the vendor's field names directly.

Answer

A playbook that renames fields after the event is stored.

Answer

A dashboard widget configured with a custom filter.

Question 4

A Cortex XSIAM administrator is preparing to onboard a new firewall log source and wants to validate that the data will be parsed and mapped correctly before it affects production detections. Which two actions should the administrator take to validate the ingestion and mapping? (Choose two.)

Accepted Answer

Use the data source onboarding wizard to preview parsed fields from a sample of the log data.. Validating ingestion and mapping requires observing the parsed output, which the onboarding wizard's preview provides, and then confirming the mapped fields in ingested data with XQL. Disabling rules, waiting for incidents, or editing mappings without previewing the data do not provide reliable validation and can harm production detection quality.

Answer

Edit the XDM mapping directly in the dataset schema without previewing the source data.

Answer

Disable all correlation rules that reference firewall data until the new source is confirmed working.

Answer

Add the source to a production dataset and wait for an incident to be generated before checking field values.

Question 5

A Cortex XSIAM analyst is investigating an incident and wants to see the sequence of causally related events that led to a suspicious process execution, including parent-child relationships across endpoints. Which Cortex XSIAM feature should the analyst use?

Accepted Answer

The Causality view in the incident's investigation timeline.. The Causality view is purpose-built in Cortex XSIAM to visualize the chain of events behind an alert, connecting parent processes to child processes and showing the order in which actions occurred. It gives analysts a fast way to understand how a suspicious execution originated. The Issues table, asset inventory, and a basic XQL select do not present causal relationships between process events.

Answer

The Issues table filtered by the incident's severity.

Answer

The XQL query builder with a simple select statement.

Answer

The asset inventory page for the affected endpoint.

Question 6

A SOC analyst is building a scheduled XQL query in Cortex XSIAM that must run every 15 minutes and automatically create a high-severity incident whenever a Cortex XDR endpoint generates a 'Malware Detected' event on a server asset. The analyst has written the query and validated the results manually. Which XSIAM component must the analyst configure to make this query run on a schedule and generate the incident automatically?

Accepted Answer

A Correlation Rule in the Detection Rules engine that references the saved XQL query and defines the severity and incident fields.. Detection engineering in Cortex XSIAM centers on Correlation Rules, which bind an XQL query to a schedule and to incident-generation settings such as severity, category, and field mapping. The analyst has already validated the query, so the remaining work is scheduling and incident creation, both native to a Correlation Rule. Reports, dashboard widgets, and playbook triggers all operate after detection or serve presentation, so none creates the required automatic high-severity incident.

Answer

A Playbook trigger defined on the Cortex XDR 'Malware Detected' event type with a cron schedule of every 15 minutes.

Answer

A Report Template that includes the XQL query as a data source and is scheduled for delivery every 15 minutes.

Answer

A Dashboard widget bound to the XQL query with a 15-minute refresh interval and a severity threshold configured on the widget.

Question 7

A Cortex XSIAM administrator needs to grant a new tier-1 analyst the ability to view and triage incidents but not to modify correlation rules or delete data. Which Cortex XSIAM access control mechanism should the administrator configure?

Accepted Answer

Assign the analyst to a role with read and triage permissions scoped to incidents only.. Role-based access control with scoped permissions is the correct way to give a tier-1 analyst incident view and triage rights while denying rule-editing and data-deletion privileges. Separate tenants, read-only API keys, and audit logging do not provide the required preventive, least-privilege access control within the existing environment.

Answer

Create a separate tenant for the analyst and migrate the incident data into it.

Answer

Provide the analyst with a read-only API key that can be used to query incidents.

Answer

Enable audit logging for the analyst account so that any rule changes are recorded.

Question 8

A Cortex XSIAM administrator is designing a detection strategy for credential abuse. The administrator wants to leverage XQL to identify suspicious authentication behavior. Which two XQL capabilities should the administrator use to detect a user account that authenticates successfully from multiple geographically distant locations within a short time window? (Choose two.)

Accepted Answer

Use the comp function to aggregate distinct source locations per user within each time bucket.. Detecting impossible travel in XQL requires bucketing authentication events by time and then aggregating distinct source locations per user within those buckets. The bin function creates the time windows, and the comp function counts distinct locations, exposing users who authenticated from multiple distant geographies in a short period. Joining with process events, deduplicating, or filtering out successful logins do not produce this specific detection.

Answer

Use the filter stage to exclude all successful authentications from the query results.

Answer

Use the join function to combine authentication events with endpoint process events.

Answer

Use the dedup function to remove duplicate authentication events from the dataset.

Question 9

A security engineer is onboarding a new firewall log source into Cortex XSIAM. Raw logs are arriving in the tenant and are visible in the raw data view, but the parsed events show empty fields for source IP, destination IP, and action, and no incidents are being generated from this source. The engineer needs to correct the parsing so the fields populate and detections can fire. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Create or update a parsing rule in the data normalization configuration that maps the raw log fields to the XDM schema attributes.. When raw events arrive but XDM fields remain empty, the fault lies in the normalization path: either the raw fields lack mappings to XDM attributes, or the source is not associated with the dataset and vendor/product that selects the correct parser. Both must be addressed together, since a correct mapping on a misrouted source never executes. Retention, endpoint agents, and licensing tiers cannot populate missing fields or restore detection coverage for this firewall source.

Answer

Enable the Cortex XSIAM agent on the firewall appliance so the logs can be normalized locally before forwarding.

Answer

Raise the ingestion license tier so additional parsing capacity is allocated to the tenant for this source.

Answer

Increase the retention period of the raw logs dataset so the parser has more time to process the backlog of events.

Question 10

A Cortex XSIAM analyst is reviewing an incident and wants to see the raw, unnormalized log entries that contributed to the alert. The analyst needs to examine the original fields as they were received from the source. Where in the incident investigation interface can the analyst access these raw logs?

Accepted Answer

The 'Events' tab. When investigating an incident in Cortex XSIAM, the 'Events' tab lists all the individual events that contributed to the alert. Each event entry contains the original raw log fields as they were ingested, in addition to the normalized fields. This allows an analyst to inspect the exact data received from the source system, which is crucial for verifying detection logic and understanding the context of the alert.

Answer

The 'War Room'

Answer

The 'Timeline' view

Answer

The 'Issues' tab

Question 11

A security engineer is configuring a correlation rule in Cortex XSIAM to detect brute-force attacks. The rule should trigger only when more than 10 failed login attempts occur from the same source IP within 5 minutes. The engineer creates a rule with a `match` stage on `action_local_ip` and a `timeframe` of 5 minutes, but the rule fires on every failed login. Which configuration change is required to make the rule behave as intended?

Accepted Answer

Replace the `match` stage with a `comp` stage that uses `count()` grouped by `action_local_ip` and then apply a `filter` on the count.. Correlation rules that require counting events within a timeframe need an aggregation stage such as `comp count()` grouped by the relevant field. A `match` stage alone groups events but does not count them; it simply aligns events by a common field. To enforce a threshold, the rule must aggregate counts and then filter on the aggregated value, ensuring it fires only when the count exceeds the defined limit.

Answer

Increase the `timeframe` to 10 minutes and add a `dedup` stage on `action_local_ip` to remove duplicate events.

Answer

Add a `filter` stage after the `match` stage to count the number of events per `action_local_ip` and compare against a threshold.

Answer

Add a `sort` stage on `action_local_ip` and a `limit` stage to return only the top 10 events.

Question 12

A security operations center (SOC) manager wants to ensure that all analysts can quickly see which incidents are assigned to them and their current status. Which Cortex XSIAM dashboard component should the manager use to display a personalized list of incidents for each analyst?

Accepted Answer

Incident widget. The Incident widget is designed to display incident data on dashboards. By configuring it with a filter based on the assignee field, the manager can create a dashboard where each analyst sees only the incidents assigned to them, along with status, severity, and other relevant details. This supports workload management and ensures analysts focus on their own tasks.

Answer

Endpoint health widget

Answer

Data ingestion widget

Answer

Threat intelligence widget

Question 13

A Cortex XSIAM administrator wants to give a new analyst the ability to view and triage incidents but not to modify playbooks or system configurations. Which Cortex XSIAM mechanism should the administrator use to enforce this?

Accepted Answer

Role-based access control with a role scoped to incident handling permissions.. Role-based access control is the correct mechanism for granting a user the ability to view and triage incidents while denying playbook and system configuration changes. Assigning a properly scoped role enforces least privilege within a single tenant. Separate tenants, shared API keys, and dashboard sharing do not provide the granular, per-user permission control required.

Answer

A dashboard shared with the analyst's user group.

Answer

An API key with read-only scope shared with the analyst.

Answer

A separate Cortex XSIAM tenant dedicated to the new analyst.

Question 14

A tier-one analyst receives a Cortex XSIAM incident about a suspicious PowerShell execution on a finance workstation. The analyst wants to immediately determine what the process did on the endpoint, including its parent process, command-line arguments, and any child processes it spawned, without leaving the incident view. Which XSIAM capability should the analyst use?

Accepted Answer

The Causality view for the process, which shows the process tree with parent and child relationships and the associated event details.. The Causality view is designed for exactly this triage need: it renders the process tree around an event so analysts can see the parent, the full command line, and any child processes spawned on the endpoint. It lives inside the investigation experience, so no tool switching is required. Reputation panels, policy pages, and interactive shells either describe something other than runtime behavior or are heavier response actions unsuited to quick context gathering.

Answer

The threat intelligence enrichment panel, which correlates the process hash against known malware families.

Answer

The Cortex XSIAM agent console on the endpoint, where the analyst can run a live terminal session against the host.

Answer

The attack surface rule management page, which lists which endpoint protections were enforced at the time of the event.

Question 15

A Cortex XSIAM administrator needs to create a custom XQL query that correlates failed login events from the 'auth_logs' dataset with successful login events from the same dataset, matching on the 'user' field, to detect potential account compromise. Which XQL operator should the administrator use to combine these two event sets?

Accepted Answer

join. The join operator is specifically designed to combine records from two datasets based on a matching field. By joining failed and successful login events on the 'user' field, the administrator can identify users who experienced a failed login followed by a successful one, which is a common indicator of brute-force or credential-stuffing attacks. This correlation is essential for accurate detection.

Answer

filter

Answer

union

Answer

sort