SecOps-Pro Cortex XSIAM — Timed 10 Questions

Question 1

A security analyst notices that raw log data is reaching the Cortex XSIAM platform but is not being parsed into the unified data model. Which configuration setting should the analyst inspect to ensure log normalization?

10 minute time limit — choose an answer to begin.

Accepted Answer

Log Ingestion Data Modeling configuration. Log parsing and normalization depend on the correct Data Ingestion mapping and transformation rules.

Answer

Incident response playbooks

Answer

Dashboard widgets

Answer

Agent Policy Profiles

Question 2

You are configuring a new Logstash data collector to ingest logs into Cortex XSIAM. Which specific component must be deployed within the customer environment to facilitate secure, authenticated log forwarding?

Accepted Answer

Cortex XSIAM Forwarder. The Log Forwarder is the designated component for on-premise log ingestion.

Answer

Cortex Collector Pro

Answer

Cortex Agent Relay

Answer

XSIAM API Gateway

Question 3

Where do you view the status of endpoints currently connected to the Cortex XSIAM platform?

Accepted Answer

Asset Management. The Asset/Endpoint management page displays the health and status of all agents.

Answer

Data Ingestion menu

Answer

Incident Response console

Answer

System Logs

Question 4

You need to export data from Cortex XSIAM to a third-party SIEM. Which feature facilitates the automated forwarding of data?

Accepted Answer

Log Forwarding. Log Forwarding profiles or API-based integration tools are used to send data out of XSIAM.

Answer

Data Ingestion Pipeline

Answer

XQL Export Tool

Answer

Incident Export API

Question 5

You need to trigger an alert when a user fails to log in five times within one minute. Which XSIAM feature should be used?

Accepted Answer

XQL Aggregation rule. Detection rules support threshold-based logic, including frequency/time windows.

Answer

Data ingestion filter

Answer

Playbook incident trigger

Answer

Dashboard alert threshold

Question 6

Which THREE of the following are components of a standard XSIAM detection rule?

Accepted Answer

Incident Trigger Logic. Detection rules require a query, severity, and defined action/trigger.

Answer

Physical asset location

Answer

Database schema index

Question 7

Which TWO actions can be taken via the XSIAM agent?

Accepted Answer

Remote shell execution for forensics. The agent can isolate hosts and execute forensic commands.

Answer

Physical hard drive wiping

Answer

Automatic software installation

Answer

Changing system BIOS passwords

Question 8

A security analyst at a retail company suspects that an attacker used a compromised service account to perform lateral movement via SMB. The analyst wants to identify all unique hosts that the account connected to over the past 24 hours using Cortex XSIAM's XQL. Which query structure will correctly return the distinct destination IP addresses for the specified account and protocol?

Accepted Answer

config timeframe = 24h | dataset = xdr_data | filter action_local_ip != null and action_remote_ip != null and actor_effective_username = "svc_backup" and action_remote_port = 445 | fields action_remote_ip as dest_ip | dedup dest_ip. The query must filter events for the specific service account and SMB port, then extract the destination IP addresses and remove duplicates. The `dedup` stage is the correct XQL construct for this. Other options either omit deduplication, use invalid syntax, or return aggregated counts instead of unique hosts. The timeframe is also properly constrained to 24 hours.

Answer

dataset = xdr_data | filter actor_effective_username = "svc_backup" and action_remote_port = 445 | fields action_remote_ip | limit 100

Answer

dataset = xdr_data | filter actor_effective_username = "svc_backup" and action_remote_port = 445 | comp count() by action_remote_ip

Answer

dataset = xdr_data | filter actor_effective_username = "svc_backup" and action_remote_port = 445 | fields action_remote_ip | distinct action_remote_ip

Question 9

A Cortex XSIAM administrator is planning to ingest logs from a custom application that writes JSON-formatted events to a local file on a Linux server. The administrator wants to use the Broker VM to collect these logs. Which two components must be configured on the Broker VM to enable this log collection? (Choose two.)

Accepted Answer

Logstash. To collect custom JSON logs from a local file on a Linux server via the Broker VM, the administrator needs Filebeat to read and ship the log file, and Logstash to parse and transform the JSON events before sending them to Cortex XSIAM. Together, these components handle file monitoring, data parsing, and forwarding, ensuring the logs are properly structured for XDM mapping and analysis.

Answer

Syslog collector

Answer

XQL query engine

Answer

Cortex XDR agent

Question 10

A SOC analyst is building an XQL query against the Cortex XSIAM `xdr_data` dataset to identify all network connections made by a specific process. The analyst writes: `dataset = xdr_data | filter event_type = NETWORK and actor_process_image_name = "chrome.exe" | fields agent_hostname, action_remote_ip, action_remote_port`. After running the query, the analyst notices the results are missing columns for the remote IP and port. Which action should the analyst take to return the expected data?

Accepted Answer

Verify that the network event type uses `action_remote_ip` and `action_remote_port` as the correct field names in the XDM, and adjust the query accordingly.. The XDM defines specific field names for each event type. For network events, remote IP and port are stored as `action_remote_ip` and `action_remote_port`. If the query returns no data for these fields, the most likely cause is that the event type or field mapping differs from what the analyst expects. Verifying the XDM schema and adjusting the query to match the actual mapped field names resolves the issue.

Answer

Add the `comp` stage before the `fields` stage to extract the remote IP and port from the raw event.

Answer

Change the `fields` stage to `alter` and manually rename `action_remote_ip` and `action_remote_port` to match the schema.

Answer

Add a `limit` stage to restrict the number of returned rows, which forces XQL to populate all available fields.