XSIAM-Analyst Practice Test 12 — 15 Questions

Question 1

An analyst is reviewing endpoint alerts in Cortex XSIAM and notices repeated 'Local Analysis' verdicts on a custom in-house application executable. The application is business-critical and the analyst wants to prevent future false-positive blocks without disabling malware protection globally. What is the most appropriate action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an allowlist exception for the file hash in the malware profile applied to the affected endpoint group.. A hash-based allowlist exception in the malware profile is the precise, minimally invasive control: it stops the false positives on the known-good in-house binary while preserving local analysis and blocking for all other files. This keeps the endpoint group's security posture intact and follows XSIAM's exception model for trusted applications.

Answer

Add the application's parent folder path to the 'Behavioral Threat Protection' exception list.

Answer

Disable 'Local Analysis' on the endpoint group so the agent stops generating verdicts for unknown files.

Answer

Set the endpoint's malware profile action to 'Report' instead of 'Block' for all files.

Question 2

An administrator needs to verify that the Cortex XDR agent is installed and running on a specific Windows endpoint. The administrator has access to the XSIAM management console. Which section of the console should the administrator use to check the agent's status and version?

Accepted Answer

Endpoints > Endpoint Management. The Endpoint Management section under the Endpoints menu is specifically designed to list all endpoints with the Cortex XDR agent, showing status, version, and other details. It allows administrators to search for a specific endpoint and verify that the agent is installed and running. The other sections focus on incidents, policies, or global settings, not endpoint-specific agent status.

Answer

Incidents > Incident Management

Answer

Policies > Policy Management

Answer

Settings > Agent Configuration

Question 3

An analyst is investigating a Linux server where the Cortex XDR agent is installed but has not reported any events for several hours. The analyst confirms the agent process is running and the server has network connectivity. Which XSIAM feature should the analyst use first to verify whether the agent is properly registered and communicating with the tenant?

Accepted Answer

Endpoint Management page, filtering by the endpoint's hostname to view its status and last check-in time.. The Endpoint Management page is the central location for monitoring agent health, including registration status and last check-in time. When an agent is silent, this page quickly reveals whether the endpoint is still communicating. If the last check-in is recent, the issue may be event forwarding; if stale, the agent-server connection is likely broken, guiding further troubleshooting.

Answer

Agent Installations page, verifying the installation package used for this server.

Answer

Incident Response view, searching for the endpoint's IP address to see if any alerts were generated.

Answer

Threat Intelligence module, checking for any indicators associated with the server.

Question 4

An analyst is reviewing an endpoint's status in the XSIAM Endpoints page and sees that the Cortex XDR agent's status is 'Disconnected' while the endpoint itself is online and reachable over the network. The analyst confirms the endpoint has network connectivity to the XSIAM tenant. Which action should the analyst take FIRST to determine why the agent is not reporting?

Accepted Answer

Check the agent diagnostic logs and service status on the endpoint to identify why the agent cannot reach the tenant.. An online endpoint whose agent reports Disconnected points to a communication or service problem on the endpoint itself, not a network outage. Inspecting the agent's diagnostic logs and confirming the service is running surfaces the specific failure, such as proxy, DNS, or certificate issues, so the analyst can remediate the true cause rather than applying disruptive containment or unnecessary reinstallation.

Answer

Immediately isolate the endpoint from the network to prevent potential lateral movement while investigating.

Answer

Reinstall the Cortex XDR agent on the endpoint to restore communications with the tenant.

Answer

Create a new agent installation package and redistribute it to the endpoint through the deployment console.

Question 5

A security administrator wants to prevent end users from disabling the Cortex XDR agent through the endpoint's system tray or command line. Which setting should the administrator configure in the XSIAM agent policy?

Accepted Answer

Enable password protection for the agent and set a strong uninstall password.. Password protection is the agent policy control designed specifically to gate stop, uninstall, and configuration changes behind a credential. Enabling it with a strong password ensures only authorized administrators can disable protection, which directly addresses the requirement that end users cannot turn the agent off from the tray or command line.

Answer

Set the agent to run in report-only mode so it cannot be uninstalled by users.

Answer

Configure a behavioral threat protection rule that blocks attempts to stop security services.

Answer

Apply a malware exception for the agent's own binaries so they are never flagged.

Question 6

A Cortex XSIAM analyst is building a playbook that must enrich an indicator by querying an external threat intelligence provider and then, based on the returned score, either close the incident or escalate it. The analyst wants to ensure the playbook can use the provider's response in later tasks. Which TWO actions should the analyst take when configuring the enrichment task? (Choose two.)

Accepted Answer

Configure the task to continue on error so a provider outage does not halt the playbook.. The analyst must map the provider's response fields into context so later tasks can reference the threat score, and should enable continue on error so a provider outage does not halt the playbook. Hard-coding credentials, isolating the task in a separate playbook, or disabling logging do not support using the response safely and effectively.

Answer

Hard-code the provider API key directly in the task arguments.

Answer

Set the task to run in a separate playbook so the response is isolated.

Answer

Disable the task's output logging to reduce noise in the war room.

Question 7

An administrator is troubleshooting a Windows endpoint where the Cortex XDR agent installed successfully but the endpoint never appears in the XSIAM Endpoints inventory. The endpoint has internet access. Which two conditions should the administrator verify to resolve the missing registration? (Choose two.)

Accepted Answer

Verify outbound connectivity to the required XSIAM service endpoints and ports is permitted by the firewall and proxy.. A successful install with no inventory entry almost always means the agent could not authenticate or reach the tenant. Verifying the tenant identifier and registration credentials in the package, plus outbound connectivity to the required service endpoints and ports, isolates the two most common causes and lets the administrator correct enrollment or network policy to complete registration.

Answer

Check whether the endpoint is assigned to a different endpoint group with a conflicting policy.

Answer

Confirm the endpoint has a valid, activated license for the endpoint protection module.

Answer

Ensure the endpoint's operating system build is newer than the agent's minimum supported version.

Question 8

A playbook is designed to isolate an endpoint when a malware incident is detected. The isolation task occasionally fails because the endpoint is offline. The analyst wants the playbook to continue processing other tasks and record the failure for later review instead of stopping the entire playbook. Which playbook task configuration should the analyst apply?

Accepted Answer

Set the task's 'Continue on error' property to true and add a subsequent task that checks the task result for failure.. The analyst needs the playbook to keep running when isolation fails and to capture that failure for later review. Setting 'Continue on error' on the task prevents the failure from stopping the playbook, and a follow-up task can evaluate the result and log or alert on it. This combination provides non-blocking error handling with an audit trail, which is the intended XSIAM pattern for this scenario.

Answer

Change the task's execution mode to 'Run in parallel' so that other tasks execute regardless of the isolation outcome.

Answer

Add a conditional task before the isolation task that verifies the endpoint is online, and skip isolation if it is not.

Answer

Wrap the isolation task in a loop that retries until the endpoint comes online.

Question 9

An administrator is troubleshooting a Windows endpoint where the Cortex XDR agent fails to start after a system update. The administrator needs to collect diagnostic information to determine the cause. Which two actions can be performed from the XSIAM management console to assist with this troubleshooting? (Choose two.)

Accepted Answer

View the agent's operational status and last check-in time in the Endpoint Management page.. From the Endpoint Management page, administrators can retrieve agent diagnostic logs and view the agent's operational status and last check-in time. These two actions provide essential diagnostic data to understand why the agent fails to start after a system update. Other actions like upgrading, running scripts, or reinstalling are either remediation steps or not directly available for this purpose.

Answer

Run a remote script on the endpoint to check the Windows Event Log for agent-related errors.

Answer

Initiate a remote agent upgrade to the latest version from the Endpoint Management page.

Answer

Reset the agent's registration by generating a new installation package and reinstalling.

Question 10

An administrator is configuring a new Cortex XDR agent installation on a group of macOS endpoints managed through Cortex XSIAM. The administrator needs to ensure the agent has the required macOS permissions to monitor and block malicious activity. Which TWO actions must be performed? (Choose two.)

Accepted Answer

Grant Full Disk Access to the Cortex XDR agent application.. On macOS, the Cortex XDR agent requires both approval of its system extension and Full Disk Access to perform kernel-level monitoring and scan protected file locations. These two permissions are what allow the agent to observe process activity and inspect files that macOS otherwise shields, enabling reliable detection and blocking.

Answer

Disable System Integrity Protection (SIP) on each endpoint to allow agent kernel hooks.

Answer

Install the agent using a signed PKG and enroll the endpoint in the Apple Business Manager device management service.

Answer

Add the agent process to the macOS firewall exception list for outbound communication.

Question 11

An analyst is building a Cortex XSIAM playbook that must enrich every newly created high-severity incident with asset owner data. The enrichment task must run only when the incident's asset is present in the CMDB; otherwise, the playbook should skip enrichment and continue to the notification task. Which XSIAM construct should the analyst configure immediately after the 'Get Asset' task?

Accepted Answer

A conditional task that checks whether the 'Get Asset' output is not empty, with a default path leading to the notification task.. Conditional tasks in XSIAM inspect the output of a prior task and direct the playbook along different paths. When the 'Get Asset' task returns no record, the condition evaluates as false and the default path continues to notification, cleanly skipping enrichment. This keeps the playbook linear, automatic, and aligned with the requirement to enrich only when the asset exists.

Answer

A task that deletes the incident if the asset is not found, then recreates it with the enrichment data.

Answer

A manual task assigned to the asset owner to confirm whether the asset exists in the CMDB.

Answer

A data collection task that prompts the analyst to enter the asset owner manually.

Question 12

During a live incident, an analyst needs to pause a running XSIAM playbook before a destructive containment task executes, inspect the current task context, then resume execution from that exact point. Which playbook execution capability should the analyst use?

Accepted Answer

Use Task Run Pause on the active playbook execution, review the task context, then use Resume to continue from the same task.. Pausing a live playbook execution and later resuming it lets analysts intervene at a precise task boundary without discarding completed work. This is the correct operational control when a destructive task is imminent and inspection is needed first. Editing definitions or cancelling the run changes future behavior or loses context, neither of which preserves the in-flight execution state.

Answer

Cancel the current execution and create a new manual incident that references the original incident ID for the remaining tasks.

Answer

Enable the playbook's Debug Mode and re-run the entire playbook from the beginning with the original incident data.

Answer

Open the Playbook Designer, modify the destructive task to require manual approval, and save the playbook so the running instance picks up the change.

Question 13

An XSIAM analyst is investigating a malware incident where the endpoint has been isolated from the network. The analyst needs to retrieve a copy of a suspicious executable from the endpoint for further analysis in a sandbox. Which XSIAM capability should the analyst use to obtain the file?

Accepted Answer

Cortex XDR File Retrieval. Cortex XDR File Retrieval is designed specifically to extract files from endpoints, including isolated ones, for further analysis. It ensures secure transfer and maintains forensic integrity. Other options either provide command execution, query capabilities, or orchestration but not direct file extraction, making File Retrieval the correct tool for this scenario.

Answer

XSIAM Action Center

Answer

Cortex XDR Live Terminal

Answer

XSIAM Query Builder

Question 14

A security team wants a Cortex XSIAM playbook to automatically isolate an endpoint whenever a malware alert with high confidence is ingested. They need the playbook to start without any analyst action. Which trigger type should be configured?

Accepted Answer

An alert-based trigger that fires when a matching alert is ingested. The team needs automatic response at the moment a qualifying alert is ingested. An alert-based trigger evaluates incoming alerts against defined criteria and launches the playbook without human involvement, enabling immediate endpoint isolation. Manual triggers need an analyst, scheduled triggers ignore alert context, and webhook triggers depend on an external caller, so none of them provide the required event-driven automation.

Answer

A webhook trigger that waits for an external system to call the XSIAM API

Answer

A scheduled trigger that runs the playbook every five minutes

Answer

A manual trigger initiated by an analyst from the incident war room

Question 15

A security analyst receives an alert that a Cortex XDR agent on a Windows server has not checked in with Cortex XSIAM for over 24 hours. The analyst wants to confirm whether the endpoint is still registered and view its last known status. Where in the XSIAM console should the analyst look?

Accepted Answer

The Endpoints page under Inventory, which lists managed endpoints and their connection status.. The Endpoints inventory is the single place in XSIAM that lists all managed endpoints with their agent status, version, and last check-in timestamp. Reviewing it lets the analyst immediately confirm whether the server is still registered and how long it has been since the last communication.

Answer

The Audit Log under Settings, which records administrative actions performed in the console.

Answer

The Agent Installations page under Settings, which shows deployment packages and installation tokens.

Answer

The Cases page, which lists all open investigations related to endpoint alerts.