SecOps-Pro Cortex XSIAM — Timed 20 Questions

Question 1

A security analyst notices that raw log data is reaching the Cortex XSIAM platform but is not being parsed into the unified data model. Which configuration setting should the analyst inspect to ensure log normalization?

20 minute time limit — choose an answer to begin.

Accepted Answer

Log Ingestion Data Modeling configuration. Log parsing and normalization depend on the correct Data Ingestion mapping and transformation rules.

Answer

Incident response playbooks

Answer

Dashboard widgets

Answer

Agent Policy Profiles

Question 2

You are configuring a new Logstash data collector to ingest logs into Cortex XSIAM. Which specific component must be deployed within the customer environment to facilitate secure, authenticated log forwarding?

Accepted Answer

Cortex XSIAM Forwarder. The Log Forwarder is the designated component for on-premise log ingestion.

Answer

Cortex Collector Pro

Answer

Cortex Agent Relay

Answer

XSIAM API Gateway

Question 3

Where do you view the status of endpoints currently connected to the Cortex XSIAM platform?

Accepted Answer

Asset Management. The Asset/Endpoint management page displays the health and status of all agents.

Answer

Data Ingestion menu

Answer

Incident Response console

Answer

System Logs

Question 4

You need to export data from Cortex XSIAM to a third-party SIEM. Which feature facilitates the automated forwarding of data?

Accepted Answer

Log Forwarding. Log Forwarding profiles or API-based integration tools are used to send data out of XSIAM.

Answer

Data Ingestion Pipeline

Answer

XQL Export Tool

Answer

Incident Export API

Question 5

You need to trigger an alert when a user fails to log in five times within one minute. Which XSIAM feature should be used?

Accepted Answer

XQL Aggregation rule. Detection rules support threshold-based logic, including frequency/time windows.

Answer

Data ingestion filter

Answer

Playbook incident trigger

Answer

Dashboard alert threshold

Question 6

Which THREE of the following are components of a standard XSIAM detection rule?

Accepted Answer

Incident Trigger Logic. Detection rules require a query, severity, and defined action/trigger.

Answer

Physical asset location

Answer

Database schema index

Question 7

Which TWO actions can be taken via the XSIAM agent?

Accepted Answer

Remote shell execution for forensics. The agent can isolate hosts and execute forensic commands.

Answer

Physical hard drive wiping

Answer

Automatic software installation

Answer

Changing system BIOS passwords

Question 8

A security analyst at a retail company suspects that an attacker used a compromised service account to perform lateral movement via SMB. The analyst wants to identify all unique hosts that the account connected to over the past 24 hours using Cortex XSIAM's XQL. Which query structure will correctly return the distinct destination IP addresses for the specified account and protocol?

Accepted Answer

config timeframe = 24h | dataset = xdr_data | filter action_local_ip != null and action_remote_ip != null and actor_effective_username = "svc_backup" and action_remote_port = 445 | fields action_remote_ip as dest_ip | dedup dest_ip. The query must filter events for the specific service account and SMB port, then extract the destination IP addresses and remove duplicates. The `dedup` stage is the correct XQL construct for this. Other options either omit deduplication, use invalid syntax, or return aggregated counts instead of unique hosts. The timeframe is also properly constrained to 24 hours.

Answer

dataset = xdr_data | filter actor_effective_username = "svc_backup" and action_remote_port = 445 | fields action_remote_ip | limit 100

Answer

dataset = xdr_data | filter actor_effective_username = "svc_backup" and action_remote_port = 445 | comp count() by action_remote_ip

Answer

dataset = xdr_data | filter actor_effective_username = "svc_backup" and action_remote_port = 445 | fields action_remote_ip | distinct action_remote_ip

Question 9

A Cortex XSIAM administrator is planning to ingest logs from a custom application that writes JSON-formatted events to a local file on a Linux server. The administrator wants to use the Broker VM to collect these logs. Which two components must be configured on the Broker VM to enable this log collection? (Choose two.)

Accepted Answer

Logstash. To collect custom JSON logs from a local file on a Linux server via the Broker VM, the administrator needs Filebeat to read and ship the log file, and Logstash to parse and transform the JSON events before sending them to Cortex XSIAM. Together, these components handle file monitoring, data parsing, and forwarding, ensuring the logs are properly structured for XDM mapping and analysis.

Answer

Syslog collector

Answer

XQL query engine

Answer

Cortex XDR agent

Question 10

A SOC analyst is building an XQL query against the Cortex XSIAM `xdr_data` dataset to identify all network connections made by a specific process. The analyst writes: `dataset = xdr_data | filter event_type = NETWORK and actor_process_image_name = "chrome.exe" | fields agent_hostname, action_remote_ip, action_remote_port`. After running the query, the analyst notices the results are missing columns for the remote IP and port. Which action should the analyst take to return the expected data?

Accepted Answer

Verify that the network event type uses `action_remote_ip` and `action_remote_port` as the correct field names in the XDM, and adjust the query accordingly.. The XDM defines specific field names for each event type. For network events, remote IP and port are stored as `action_remote_ip` and `action_remote_port`. If the query returns no data for these fields, the most likely cause is that the event type or field mapping differs from what the analyst expects. Verifying the XDM schema and adjusting the query to match the actual mapped field names resolves the issue.

Answer

Add the `comp` stage before the `fields` stage to extract the remote IP and port from the raw event.

Answer

Change the `fields` stage to `alter` and manually rename `action_remote_ip` and `action_remote_port` to match the schema.

Answer

Add a `limit` stage to restrict the number of returned rows, which forces XQL to populate all available fields.

Question 11

A security engineer is configuring a new correlation rule in Cortex XSIAM to detect a specific attack pattern. They need to define the rule's logic using XQL. Which two XQL clauses are essential for defining the time window and the condition that triggers the alert? (Choose two.)

Accepted Answer

| window duration. To build a correlation rule in Cortex XSIAM, the XQL query must specify the events of interest and the timeframe over which they should be correlated. The 'filter' clause applies the specific condition that identifies malicious or suspicious activity, while the 'window' clause defines the sliding time period for grouping those events. Together, they form the core logic for detecting patterns like multiple failed logins or a sequence of actions within a short time.

Answer

| bin _time span=5m

Answer

| limit 1000

Answer

| sort by _time

Question 12

A SOC manager wants to ensure that Cortex XSIAM automatically enriches incidents with threat intelligence and then routes them to the correct analyst queue based on severity. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Create a playbook that includes a task to query the threat intelligence integration and a task to assign the incident to a queue based on severity.. To automatically enrich and route incidents, you need a playbook that performs the enrichment and assignment tasks, and a correlation rule that triggers the playbook when incidents are created or updated. The playbook defines the actions, while the correlation rule defines when those actions occur. Together, they form the automation workflow.

Answer

Create a custom dashboard widget that displays incidents by severity and queue.

Answer

Configure an incident type with a severity field and map it to a queue using the incident field mapping settings.

Answer

Enable the Threat Intelligence Management add-on and subscribe to a feed.

Question 13

A Cortex XSIAM administrator is configuring a new data source that sends logs in a custom JSON format. The logs contain a field named 'src_ip' that should map to the XDM 'action_local_ip' field. However, after ingestion, the XDM field is not populated. The administrator has verified that the logs are arriving and the parsing rules are applied. What is the most likely reason for the mapping failure?

Accepted Answer

The parsing rule does not correctly extract the 'src_ip' field from the raw log.. For a custom log source, the parsing rules must be configured to extract the necessary fields from the raw log. If the parsing rule does not correctly identify and extract the 'src_ip' field, that field will not be available for XDM mapping. Even if the XDM mapping rule for 'action_local_ip' is correctly defined, it relies on the source field being present. Thus, a parsing error is the most probable cause of the missing XDM data.

Answer

The 'action_local_ip' field is already mapped from another source field.

Answer

The XDM mapping rule for 'action_local_ip' is disabled.

Answer

The 'src_ip' field is not included in the dataset's schema.

Question 14

A Cortex XSIAM administrator is creating a new custom dashboard for the security operations center. The dashboard must show a count of incidents by severity, a trend of alerts over the last seven days, and a table of the top ten most frequent MITRE ATT&CK techniques observed. Which two widget types should the administrator use to build these components? (Choose two.)

Accepted Answer

Pie chart widget. The dashboard requires a proportional breakdown of incidents by severity and a time-based view of alert volume. A pie chart widget conveys proportions across categories, and a line chart widget plots values over a time axis. Together they satisfy the severity count and the seven-day trend. The remaining widget types either show a single value or static text and cannot represent these multi-category and time-series views.

Answer

Single value widget

Answer

Text widget

Answer

Gauge widget

Question 15

What is the primary function of the 'Cortex XSIAM Agent' when installed on an endpoint?

Accepted Answer

To collect data and provide endpoint protection. The agent provides both endpoint protection and telemetry collection for XSIAM.

Answer

To replace the need for network security

Answer

To store all log data locally on the host

Answer

To manage firewall rules on the local host

Question 16

An administrator needs to quickly identify a specific alert type across a massive dataset in Cortex XSIAM. Which query language is primarily used to perform this investigation?

Accepted Answer

XQL. XQL (XDR Query Language) is the primary query language for searching and analyzing data in XSIAM.

Answer

SQL

Answer

SPL

Answer

KQL

Question 17

You are troubleshooting an issue where a specific detection rule is failing to trigger despite matching log data. Which tool allows you to simulate the detection rule against historical data?

Accepted Answer

Detection Rule Testing Environment. The rule testing environment allows you to run detection rules against historical data to validate logic.

Answer

Live Dashboard Preview

Answer

Playbook Debugger

Answer

XQL Query Builder

Question 18

In Cortex XSIAM, you want to automate the response to a specific type of Phishing alert. Where do you configure the automated execution logic?

Accepted Answer

Cortex Playbooks. Playbooks are the engine for automated orchestration and response in XSIAM.

Answer

Detection Rules

Answer

XQL Search Filters

Answer

Data Ingestion Pipeline

Question 19

When setting up an alert threshold in Cortex XSIAM, you want to avoid 'alert fatigue'. Which feature helps aggregate related alerts into a single actionable item?

Accepted Answer

Incident Correlation and Grouping. Incident Correlation and Grouping in Cortex XSIAM aggregates related alerts — for example, multiple alerts from the same host or same attack chain — into a single incident, reducing the number of items an analyst must triage. This directly combats alert fatigue by presenting one actionable incident instead of dozens of duplicate alerts.

Answer

Alert Suppression Lists

Answer

Query Aggregation

Answer

Notification Thresholds

Question 20

You are integrating a custom threat intelligence feed into Cortex XSIAM. Where must this feed be defined to ensure it is utilized by the XSIAM correlation engine?

Accepted Answer

Threat Intelligence Management. Threat feeds are configured in the Threat Intelligence management area of XSIAM.

Answer

XQL Global Variables

Answer

Data Ingestion Mapping

Answer

Detection Rule Editor