XSIAM-Analyst Practice Test 10 — 10 Questions

Question 1

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to connect to the XSIAM tenant through a corporate proxy server. Which THREE proxy configuration parameters must be correctly supplied to the agent installation or policy to ensure successful connectivity? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Proxy authentication credentials (username and password) if required. Proxy configurations require server address/IP, port, and authentication credentials if the proxy requires them.

Answer

Primary domain controller NetBIOS name

Answer

Local BGP autonomous system number (ASN)

Question 2

When writing a custom Python automation script to be executed as a Cortex XSIAM playbook task, which built-in library function is used to output results directly into the incident context?

Accepted Answer

demisto.results() or CommandResults. In Cortex XSIAM (and the underlying Demisto/Cortex XSOAR engine), automation scripts return data to the playbook and incident context via demisto.results() for legacy scripts or the CommandResults object for modern Python integrations. These APIs serialize the output into the war room and write entries into the incident context under the specified key.

Answer

sys.stdout.write()

Answer

print()

Answer

requests.post()

Question 3

An analyst is examining an alert timeline in XSIAM. What does the timestamp on a security event represent?

Accepted Answer

The exact time the event occurred on the source or was ingested and processed by XSIAM. In XSIAM, the timestamp on a security event represents the time the event occurred at the source (the endpoint, log source, or sensor) or, if the source time is unavailable, the time it was ingested and processed by XSIAM. This timestamp is the anchor for timeline reconstruction and correlation across data sources.

Answer

The time the analyst opened the incident investigation view

Answer

The expiration time of the Cortex XDR agent license

Answer

The scheduled time for the next playbook execution

Question 4

An analyst needs to export a detailed report of all closed incidents over the last 30 days for an executive summary. Where can this report generation be initiated within XSIAM?

Accepted Answer

Reporting module. In XSIAM, the Reporting module is where you can generate, schedule, and export detailed reports, including incident summaries over a specified time range. To create an executive summary of closed incidents over the last 30 days, you would use the Reporting module to build a report with the appropriate filters and export it.

Answer

Content Hub

Answer

XQL Schema Viewer

Answer

Agent Health Monitoring view

Question 5

An analyst is investigating an incident where an attacker attempted to clear Windows Event Logs to hide malicious activity. Which XSIAM behavioral detection category typically flags this suspicious administrative tampering?

Accepted Answer

Behavioral Indicators of Compromise (BIOCs) / Analytics. Clearing Windows Event Logs is a classic behavioral indicator of attacker defense evasion, and XSIAM's BIOCs/Analytics category detects such suspicious administrative tampering by correlating process, command-line, and audit-log events. This category is designed for behaviors rather than static signatures.

Answer

Network port scanning signatures

Answer

Cloud IAM permission boundary checks

Answer

Static file signature matching

Question 6

You need to export a custom playbook from your development XSIAM tenant and import it into your production XSIAM tenant. What is the standard packaging format used?

Accepted Answer

ZIP file containing Content Packs or JSON export. Cortex XSIAM content, including custom playbooks, is packaged and moved between tenants using ZIP files that contain Content Packs or JSON exports. The platform's content management workflow expects this format so that playbooks, integrations, and related objects can be imported and validated in the target tenant. Raw database dumps, Python wheels, and MSI packages are not recognized packaging formats for XSIAM content.

Answer

Raw SQL database dump (.bak)

Answer

Python Wheel (.whl)

Answer

Windows Installer Package (.msi)

Question 7

When configuring a manual task in a playbook that requires an analyst to approve or reject a host isolation action, which element defines the available response buttons?

Accepted Answer

Task Custom Choices / Answers. In Cortex XSIAM playbooks, a manual task that requires analyst input (such as approving or rejecting host isolation) presents configurable response buttons defined by the Task's Custom Choices/Answers field. This field lets the playbook author specify the exact button labels (e.g., 'Approve' and 'Reject') and map each choice to a distinct output path in the playbook logic. Without custom choices, the manual task would have no defined responses for the analyst to select.

Answer

Parser Grok Patterns

Answer

Agent Isolation Policies

Answer

XQL Query Filters

Question 8

What is the primary difference between an 'analytic alert' and an 'XQL correlation alert' in XSIAM?

Accepted Answer

Analytic alerts are built-in XSIAM behavioral/ML detections, while XQL correlation alerts are user-defined query rules.. Analytic alerts are built-in behavioral/ML detections provided by XSIAM, whereas XQL correlation alerts are user-defined rules written in XQL.

Answer

Analytic alerts are only generated for network traffic, while XQL rules are only for endpoints.

Answer

Analytic alerts cannot be prioritized, whereas XQL alerts can.

Answer

Analytic alerts do not show up in the incident queue.

Question 9

An analyst wants to check the details of a specific security alert triggered on an endpoint, including the process tree and causality chain. Which XSIAM module contains the Causality Analysis View (CAV)?

Accepted Answer

Incident Viewer > Alert Details > Causality Analysis. The Causality Analysis View (CAV) in XSIAM is accessed through the Incident Viewer by opening an alert's details and selecting the Causality Analysis tab. This view visualizes the process tree and causality chain — showing which process spawned which, the originating user, and the sequence of events — enabling analysts to trace an alert back to its root cause.

Answer

Endpoint Security > Asset Management > Process Explorer

Answer

Data Lake > Query Explorer > Causality View

Answer

Settings > Threat Intelligence > CAV

Question 10

When analyzing security events in XSIAM, what are THREE key benefits of data normalization? (Choose three)

Accepted Answer

Facilitates cross-vendor correlation rules and analytics. Normalization standardizes disparate log formats into a common schema, facilitating consistent querying, correlation, and threat hunting across different vendors.

Answer

Increases local storage capacity on the log collector

Answer

Automatically encrypts hard drives on all endpoints