XSIAM-Analyst Practice Test 15 — 15 Questions

Question 1

An analyst notices that a query joining two XQL datasets on a hostname field returns fewer rows than expected. Many hostnames in one dataset appear in uppercase while the other uses lowercase. Which XQL technique should the analyst apply to make the join match consistently?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply the `lowercase` function to the hostname field in both datasets before the join.. Case sensitivity in string fields causes join keys to fail to match when hostnames differ only in capitalization. Applying the `lowercase` function to both hostname fields before the join normalizes the keys so that logically identical hosts are paired correctly, restoring the expected row count without discarding data.

Answer

Use the `join` stage with the `type = outer` parameter to include unmatched rows.

Answer

Use the `regex` operator in the join condition to perform a case-insensitive match.

Answer

Add a `filter` stage that removes hostnames containing uppercase letters.

Question 2

An XSIAM analyst is investigating a false positive alert that repeatedly triggers for a legitimate administrative script. The analyst wants to prevent future alerts from this specific script without disabling the entire analytic rule. Which XSIAM feature should the analyst use to suppress alerts based on specific criteria?

Accepted Answer

Exception rules in the analytic rule configuration. Exception rules in XSIAM allow analysts to suppress alerts based on specific criteria without altering the core detection logic. By adding an exception for the legitimate administrative script, the analyst can prevent false positives while keeping the analytic rule active for other activities. This targeted approach maintains detection coverage and is the recommended method for handling known false positives.

Answer

Modifying the query to exclude the script

Answer

Disabling the analytic rule entirely

Answer

Creating a custom prioritization rule to lower the alert score

Question 3

An XSIAM analyst receives an alert for a suspicious PowerShell execution on a finance department workstation. The analyst wants to quickly determine whether this alert is part of a larger incident or is an isolated event. Which XSIAM feature should the analyst use to view the alert's relationship to other alerts and incidents?

Accepted Answer

The Incident Detail view with the related alerts section. The Incident Detail view in XSIAM includes a related alerts section that lists all alerts correlated into the same incident. When an analyst opens the incident containing the suspicious PowerShell alert, they can see other alerts sharing entities or time proximity, immediately revealing whether the alert is part of a larger attack. This is the correct feature for assessing alert relationships and incident scope.

Answer

The BIOC Indicator Management console

Answer

The Alert Exclusion Rules page

Answer

The Custom Prioritization Rules configuration panel

Question 4

An XSIAM Analyst is investigating a series of alerts related to a suspicious login from an unfamiliar IP address. The analyst wants to quickly see all alerts that share the same causality chain to understand the full scope of the activity. Which XSIAM feature provides this view directly from an alert?

Accepted Answer

The Causality Chain view accessible from the alert details. The Causality Chain view in XSIAM is designed to show all alerts and events connected by a shared causality chain. Accessible from an alert's details, it enables analysts to pivot from one alert to the full context of related activity, which is exactly what is needed to investigate the suspicious login from an unfamiliar IP.

Answer

The Custom Prioritization configuration menu

Answer

The Alert Exclusion Rules page

Answer

The Incident Timeline tab in the incident view

Question 5

An XSIAM analyst is reviewing the Analytics page and observes that some alerts are marked as 'Incident-Bound' while others are not. The analyst needs to understand the implication of this designation for triage. What does it mean when an alert is labeled 'Incident-Bound' in XSIAM?

Accepted Answer

The alert has been correlated into an existing or new incident. The 'Incident-Bound' label in XSIAM indicates that the correlation engine has grouped the alert into an incident, either by attaching it to an existing incident or by creating a new one. This means the alert should be triaged within the context of that incident, considering related alerts and entities. It is a signal that the alert is not isolated and requires incident-level investigation.

Answer

The alert has been manually escalated by a previous analyst

Answer

The alert is pending review by a senior analyst before incident creation

Answer

The alert has been excluded from incident correlation due to suppression rules

Question 6

A security analyst in Cortex XSIAM wants to enrich incoming alerts with context from an external threat intelligence source. The analyst needs the platform to automatically query the source and attach reputation and related indicators to matching alerts. Which Cortex XSIAM capability should the analyst configure to achieve this enrichment?

Accepted Answer

A threat intelligence feed integration instance that fetches indicators and enables enrichment. Automatic alert enrichment with external reputation and related indicators is achieved through a threat intelligence feed integration instance configured with enrichment enabled. ASM scopes, correlation suppression rules, and report templates serve different purposes and do not query external sources to attach context to alerts.

Answer

An ASM discovery scope that includes the organization's external IP ranges

Answer

A report template that includes indicator fields for scheduled distribution

Answer

A correlation rule that suppresses alerts matching known benign indicators

Question 7

An analyst is building a query to detect brute-force login attempts. The analyst wants to count failed logins per source IP within each 5-minute window and only surface IPs exceeding 10 failures. Which XQL construct is designed for this time-bucketed aggregation?

Accepted Answer

The `bin` command to group timestamps into 5-minute buckets, followed by `stats count() by source_ip, bin`.. Time-bucketed aggregation requires creating fixed intervals from timestamps and then counting events within each interval. The `bin` command produces those intervals, and `stats count()` grouped by source IP and the bucket returns failures per IP per 5-minute window, enabling the threshold check for brute-force activity.

Answer

The `sort` command on the timestamp field followed by `limit 10`.

Answer

The `dedup` command on the timestamp field to collapse events into 5-minute intervals.

Answer

The `join` command to combine login events with a reference table of time windows.

Question 8

A security analyst is investigating a potential data exfiltration incident. They need to identify all unique destination IP addresses that received more than 100 MB of outbound traffic from any internal host during the last 24 hours, and then display the total bytes sent to each of those IPs. The relevant network traffic data is stored in the 'xdr_data' dataset with fields 'action_local_ip', 'action_remote_ip', and 'action_remote_bytes'. Which XQL query correctly produces the required result?

Accepted Answer

dataset = xdr_data | filter action_local_ip in ipv4_private() | comp sum(action_remote_bytes) as total_bytes by action_remote_ip | filter total_bytes > 100000000. To find destinations that received more than 100 MB in total, the query must first sum all outbound bytes per destination IP, then filter on that sum. Filtering individual events before aggregation would exclude smaller transfers that contribute to the total. Using sum is correct because the requirement is about data volume, not event count. The filter after aggregation must reference the aggregated alias, not the original field.

Answer

dataset = xdr_data | filter action_local_ip in ipv4_private() | comp count(action_remote_bytes) as total_bytes by action_remote_ip | filter total_bytes > 100000000

Answer

dataset = xdr_data | filter action_local_ip in ipv4_private() | comp sum(action_remote_bytes) as total_bytes by action_remote_ip | filter action_remote_bytes > 100000000

Answer

dataset = xdr_data | filter action_local_ip in ipv4_private() and action_remote_bytes > 100000000 | comp sum(action_remote_bytes) as total_bytes by action_remote_ip | filter total_bytes > 100000000

Question 9

A Cortex XSIAM Attack Surface Management scan has discovered an internet-facing server, but its hostname and open ports are recorded while the owning business unit and criticality are blank. The analyst wants subsequent ASM findings on this asset to be routed to the correct team and prioritized correctly. What should the analyst do to enrich the asset with ownership and criticality context?

Accepted Answer

Assign the asset to a classification or tag that maps to an owner and criticality in ASM asset management. ASM asset management supports applying classifications or tags to discovered assets, and those classifications can encode ownership and criticality. When the internet-facing server is classified correctly, subsequent ASM findings on that asset inherit the owner and priority, so alerts route to the responsible team and are prioritized according to business impact rather than appearing as unowned, low-context findings.

Answer

Re-run the ASM discovery scan with a broader IP range to capture more context

Answer

Create a correlation rule that matches the server's hostname and sets severity to high

Answer

Add the server's IP address to a threat intelligence blocklist feed

Question 10

An analyst notices that a threat intelligence feed integration in Cortex XSIAM has been running for three days, but the Indicators view shows zero new indicators since the initial sync. The integration's health dashboard shows a green status and no error logs. Which action should the analyst take FIRST to determine why indicators are not appearing?

Accepted Answer

Check the feed's indicator expiration settings and the 'Fetch indicators' configuration in the integration instance.. When an integration is healthy but produces no new indicators after the initial sync, the cause is usually a configuration detail rather than a failure. The 'Fetch indicators' toggle controls whether the integration continues to pull new data on its schedule, and expiration settings determine how long indicators remain visible. Verifying both settings is the fastest, least disruptive diagnostic step.

Answer

Reinstall the threat intelligence content pack to force a schema migration.

Answer

Increase the integration's timeout value because large feeds often silently drop indicators.

Answer

Disable the integration instance and re-enable it to force a full re-fetch of all historical indicators.

Question 11

A security analyst is configuring a new external attack surface scan in Cortex XSIAM. The analyst wants to ensure that the scan only targets IP addresses and domains that are explicitly owned by the organization, avoiding any third-party assets. Which configuration step should the analyst take to define the scope of the scan?

Accepted Answer

Upload a CSV file containing the organization's owned IP ranges and domains to the ASM scan configuration.. Defining the scan scope by uploading a CSV of owned IP ranges and domains ensures that only authorized assets are scanned. This is the standard method in XSIAM ASM to prevent scanning third-party assets. Other options either do not restrict scope or could inadvertently include unauthorized assets.

Answer

Enable the 'Auto-Discovery' option to automatically detect all assets associated with the organization's name.

Answer

Configure the scan to use a public DNS resolver to resolve domain names to IP addresses, ensuring only publicly accessible assets are scanned.

Answer

Set the scan intensity to 'Low' to minimize the chance of scanning unintended assets.

Question 12

An analyst is reviewing an Attack Surface Management scan that enumerated an external-facing host. The host is flagged with an unauthenticated remote code execution exposure tied to a specific product build, but the analyst needs to prioritize remediation based on whether the exposure is actively being exploited in the wild. Which XSIAM feature should the analyst consult to determine real-world exploitation status for this exposure?

Accepted Answer

The ASM finding's associated CVE entry enriched with Cortex XSIAM Threat Intelligence exploitation signals. Determining whether an exposure is actively exploited requires threat intelligence enrichment rather than static vulnerability data. Cortex XSIAM correlates ASM findings with threat intelligence that tracks exploitation and trending activity, so the analyst can see real-world abuse signals. Asset criticality, scan history, and scan policy all provide useful context but none of them describe whether attackers are currently exploiting the vulnerability.

Answer

The ASM scan policy definition that controls which ports and services are probed for the asset

Answer

The asset inventory record's business criticality and owner assignment fields

Answer

The asset's historical vulnerability scan diff report showing when the exposure first appeared

Question 13

A threat hunter is analyzing DNS activity in XSIAM using XQL. The hunter wants to identify domains that were queried by more than 50 unique endpoints within the last hour, as this could indicate a broad beaconing or DNS tunneling campaign. The hunter writes a query that groups DNS query events by the queried domain name and counts distinct source endpoints. Which TWO XQL components are required to correctly compute the number of unique endpoints per domain? (Choose two.)

Accepted Answer

Apply a filter stage after aggregation to retain only domains where the distinct endpoint count exceeds 50.. To count unique endpoints per domain, the hunter must use the comp stage with distinct_count() on the endpoint identifier grouped by domain, then apply a filter stage to keep only domains exceeding the 50-endpoint threshold. These two components together compute and threshold the distinct endpoint count, enabling detection of broad DNS campaigns.

Answer

Use the arrayexpand stage to expand the list of queried domains into separate rows before counting endpoints.

Answer

Use the join stage to combine DNS events with an endpoint inventory dataset to resolve endpoint identifiers to unique hostnames.

Answer

Use the dedup stage on the endpoint identifier field before aggregation to remove duplicate endpoint entries per domain.

Question 14

During an incident investigation, an analyst opens the Cortex XSIAM Threat Intelligence module and searches for an external IP address observed in the alert. The indicator detail view shows a 'Verdict' of 'Unknown' and no associated sources, even though several feed integrations are enabled and healthy. The analyst confirms the IP appears in logs but not in any indicator store. What is the most likely explanation for the missing verdict and sources?

Accepted Answer

The IP address was never ingested by any enabled feed, so no reputation data exists and the indicator remains unenriched.. The indicator detail view reflects what exists in the indicator store. When no feed has ingested a given IP, XSIAM has nothing to match against, so the verdict stays Unknown and the sources list is empty. Healthy integrations do not guarantee coverage of every possible address, so the analyst must treat this as an intelligence gap and pivot to internal evidence.

Answer

The threat intelligence feed integrations have exceeded their daily API quota and enrichment silently failed for all indicators.

Answer

The analyst's role lacks the Threat Intelligence permission needed to view verdicts and source attribution.

Answer

The indicator was ingested but automatically expired because its time-to-live elapsed, leaving an empty verdict.

Question 15

An analyst is tuning Cortex XSIAM Attack Surface Management (ASM) after a scan generated a large volume of findings, many of which are expected and low risk. The analyst wants to reduce noise so future scans surface only meaningful exposure. Which TWO actions are appropriate for this goal? (Choose two.)

Accepted Answer

Assign severity and ownership to findings so the team can triage and prioritize the ones that matter.. Reducing ASM noise requires distinguishing accepted findings from meaningful exposure. Classification or exclusion rules stop known, accepted items from recurring as issues, while severity and ownership assignment organizes remaining findings for triage. Together they preserve detection of new risk while filtering expected results. Disabling scans, deleting inventory, or blanket-downgrading severity all suppress or destroy useful signal rather than refining it.

Answer

Disable the ASM scan schedule entirely so no further findings are generated until the backlog is cleared.

Answer

Lower the global severity of every ASM finding to informational so nothing alerts the team.

Answer

Delete the ASM inventory of external assets and let the next scheduled scan rebuild it from scratch.