XSIAM-Analyst Practice Test 13 — 15 Questions

Question 1

When configuring a manual task in a playbook that requires an analyst to approve or reject a host isolation action, which element defines the available response buttons?

Accepted Answer

Task Custom Choices / Answers. Manual tasks allow configuring custom choice buttons (e.g., Approve, Reject) for user interaction.

Answer

Parser Grok Patterns

Answer

Agent Isolation Policies

Answer

XQL Query Filters

Question 2

When investigating an endpoint alert in XSIAM, an analyst wants to understand the full scope of potential compromise. Which THREE key data artifacts are typically available within the Causality Analysis View (CAV) for a suspicious process execution? (Choose three)

Accepted Answer

File modifications and registry changes performed by the investigated processes.. The Causality Analysis View provides details on parent-child process chains, associated network connections, and file/registry modifications tied to the causal chain.

Answer

Full Active Directory domain controller database replication logs.

Answer

Real-time physical memory dumps of the endpoint hardware RAM.

Question 3

Which TWO types of triggers can initiate a Cortex XSIAM playbook execution? (Choose two)

Accepted Answer

Manual triggering by an analyst from an incident view. Playbooks can be triggered automatically by incident creation/updates or manually by analysts.

Answer

Automatic execution via local printer error codes

Answer

Webcam motion detection

Answer

Physical keyboard shortcut combinations on agent keyboards

Question 4

An enterprise is experiencing high CPU utilization on a subset of developer endpoints running specialized compilation software. The Cortex XDR agent is suspected to be causing file-system scanning overhead. Which specific configuration setting should be adjusted in the Endpoint Security profile to safely reduce resource utilization without entirely disabling threat prevention?

Accepted Answer

Add targeted file path and process exclusions in the Malware Profile scan settings.. Exclusions and scan settings within the Malware Profile allow tuning of paths, processes, and scan frequencies to alleviate resource bottlenecks on specialized systems.

Answer

Switch the agent operating mode from Full to Collector-only.

Answer

Increase the scheduled full-scan frequency from weekly to daily.

Answer

Disable the Anti-Malware module entirely in the profile.

Question 5

An automation script requires secure storage of an API token used to query an external threat intel feed. Where should this token be stored within Cortex XSIAM?

Accepted Answer

Integration Instance Configuration Parameters (marked as Encrypted/Password). Integration instance parameters or credentials configuration securely stores API tokens and secrets.

Answer

Within unencrypted XQL lookup CSV files.

Answer

Hardcoded directly inside the playbook JSON file.

Answer

Inside public dashboard notes.

Question 6

You need to export a custom playbook from your development XSIAM tenant and import it into your production XSIAM tenant. What is the standard packaging format used?

Accepted Answer

ZIP file containing Content Packs or JSON export. Playbooks are exported and imported as Content Packs or JSON files via the Marketplace/Content management tools.

Answer

Raw SQL database dump (.bak)

Answer

Python Wheel (.whl)

Answer

Windows Installer Package (.msi)

Question 7

Which TWO objects or concepts are fundamental building blocks in a Cortex XSIAM playbook? (Choose two)

Accepted Answer

Tasks (representing actions, conditions, or scripts). Playbooks consist of tasks and the links connecting them.

Answer

Physical server rack elevations

Answer

Cafeteria lunch menus

Answer

Employee payroll spreadsheets

Question 8

An analyst needs to ensure that all incidents assigned to a specific threat group are automatically tagged with a custom label upon creation. Where can the analyst configure automatic tagging rules?

Accepted Answer

Incident Classification and Tagging settings. Automatic tagging and classification of incoming incidents based on specific criteria are configured within Incident Classification and Tagging rules in XSIAM settings.

Answer

XQL data normalization mapping table

Answer

Syslog listener port configuration

Answer

Cortex XDR agent tamper protection policies

Question 9

Which XQL command is used to rename a field in the output results dataset?

Accepted Answer

rename. The 'rename' command in XQL is used to change the display name of fields in the results table.

Answer

format

Answer

alter

Answer

fields

Question 10

An analyst needs to transform an IP address field into an integer representation within an XQL query using the 'alter' command. Which function should be used?

Accepted Answer

alter ip_int = ip_to_int(source_ip). XQL provides utility functions for IP manipulation, such as ip_to_int() or cidr matching functions.

Answer

alter ip_int = cast(source_ip as integer)

Answer

alter ip_int = to_integer(source_ip)

Answer

alter ip_int = parse_ip(source_ip, 'int')

Question 11

An analyst needs to verify which endpoints have out-of-date Cortex XDR agent versions across the organization. Where should the analyst navigate in XSIAM to view a summary dashboard of agent versions and deployment health?

Accepted Answer

Endpoint Security > Dashboards. Endpoint Security > Dashboards or Assets provides overview widgets displaying agent version distribution and compliance status.

Answer

Settings > Infrastructure > Agents

Answer

Marketplace > Content Updates

Answer

XQL Search > Agent Inventory table

Question 12

An administrator is configuring password protection for the Cortex XDR agent on endpoints to prevent unauthorized users or malware from stopping the agent service or modifying its configuration locally. Where is this agent uninstallation/tamper protection password configured in XSIAM?

Accepted Answer

Endpoint Security > Profiles/Settings > Agent Settings > Tamper Protection. Tamper protection and agent password settings are managed within Agent Settings profiles in XSIAM.

Answer

Data Collection > Agent Deployment > Security Passwords

Answer

Settings > Access Management > Endpoint Users

Answer

Response > Containment > Agent Passwords

Question 13

An administrator needs to verify whether disk encryption (BitLocker / FileVault) is active and reporting status correctly across managed endpoints in XSIAM. Where can this compliance status be monitored?

Accepted Answer

Endpoint Security > Assets > Disk Encryption column/tab. Disk encryption compliance status is visible within the endpoint asset inventory and security posture dashboards.

Answer

Settings > Compliance > BitLocker Management

Answer

Data Collection > Endpoints > Encryption Logs

Answer

Response > Actions > Encryption Status

Question 14

An administrator is planning a staged rollout of a new Cortex XDR agent version across the enterprise. To mitigate risk, the administrator wants to deploy the new version to a test group of endpoints first. How is this staged deployment managed in XSIAM?

Accepted Answer

Assign the new agent version specifically to the test endpoint group's assigned Profile / Settings.. Agent software versions are managed under Endpoint Security > Assets > Installers or Agent Settings, where different groups can be assigned specific upgrade versions.

Answer

Use an XQL playbook to push executables via remote shell.

Answer

Configure a Broker VM distribution schedule for software binaries.

Answer

Manually uninstall the agent on test machines and run the MSI installer with a CLI switch.

Question 15

An incident responder is investigating a ransomware outbreak. Which THREE immediate containment or remediation actions can be executed directly from XSIAM to mitigate the threat? (Choose three)

Accepted Answer

Quarantine the malicious ransomware binaries across hosts. XSIAM and Cortex XDR allow response actions such as endpoint isolation, file quarantine, and process termination to stop active attacks.

Answer

Reconfigure physical office door security locks

Answer

Physically replace damaged motherboard hardware on endpoints