XSIAM-Analyst Practice Test 16 — 15 Questions

Question 1

A Cortex XSIAM analyst is reviewing external attack surface findings and wants to reduce noise from ASM by focusing only on genuinely risky exposures. The analyst plans to use ASM finding attributes to filter and triage. Which TWO attributes are most useful for identifying externally exposed services that represent elevated risk and warrant immediate investigation? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Services with weak or misconfigured TLS, such as expired or self-signed certificates. Elevated-risk ASM triage centers on exposures that an external attacker could realistically exploit or that reveal neglected security posture. Exposed services running known vulnerable software and services with weak or misconfigured TLS both meet that bar, because they represent concrete, exploitable weaknesses on the internet-facing surface. Reachability and hosting attributes such as ICMP response, CDN fronting, or private addressing do not indicate exploitable risk and only add noise.

Answer

Assets whose hostnames resolve to a content delivery network

Answer

Services listening only on private RFC 1918 address ranges

Answer

Assets that respond to ICMP echo requests

Question 2

A Cortex XSIAM analyst notices that a threat intelligence feed integration shows a status of 'Disconnected' and no new indicators have appeared in the indicator store for several hours. The feed uses an API key that the vendor recently rotated. What is the most likely cause and the appropriate first action?

Accepted Answer

The API key credential is invalid; update the credential in the feed integration instance and test connectivity. A vendor-rotated API key makes the credential stored in the feed integration instance stale, so authentication fails, the integration reports Disconnected, and no indicators are ingested. Updating the credential and testing connectivity restores the integration, after which indicator fetching resumes normally. The other actions do not address the authentication failure indicated by the Disconnected status.

Answer

The correlation rules referencing the feed's indicator set have been disabled; re-enable them

Answer

The indicator store has reached its maximum capacity; purge old indicators to resume ingestion

Answer

The feed's fetch interval is set too long; reduce it to force an immediate fetch

Question 3

An analyst is reviewing the results of an Attack Surface Management scan in Cortex XSIAM and sees a finding for an exposed service on a non-standard port. The analyst wants to understand the potential risk and remediation steps. Where can the analyst find detailed information about this finding, including the service banner and recommended actions?

Accepted Answer

In the 'ASM Findings' table, click on the finding to open a side panel with details and remediation guidance.. The ASM Findings table is the central place to review and investigate individual findings. Clicking a finding opens a side panel with comprehensive details, including service banners and remediation guidance. This allows analysts to quickly assess risk and take action, making it the correct choice.

Answer

In the 'Incidents' module, search for an incident related to the finding to view its details.

Answer

In the 'Threat Intelligence' tab of the asset's entity page, look for the finding's context.

Answer

In the 'Reports' section, generate an ASM report and locate the finding in the report output.

Question 4

An analyst is reviewing XQL query results and notices that the 'actor_process_command_line' field contains long command-line strings that make the output difficult to read. The analyst wants to extract only the first 100 characters of this field into a new field named 'short_cmd' for easier triage. Which XQL stage and function should the analyst use?

Accepted Answer

Use the alter stage with the substr() function to create short_cmd as a substring of actor_process_command_line.. The alter stage is the correct XQL stage for creating derived fields using expressions. By applying the substr() function to actor_process_command_line, the analyst creates a new short_cmd field containing only the first 100 characters. This preserves the original field while providing a more readable version for triage, which is a common practice when dealing with verbose command-line data.

Answer

Use the comp stage with the substr() function to aggregate command-line strings into 100-character segments.

Answer

Use the fields stage with the substr() function to select and truncate actor_process_command_line.

Answer

Use the filter stage with the substr() function to replace actor_process_command_line with its first 100 characters.

Question 5

An analyst is triaging an alert in Cortex XSIAM where an internal host contacted an external IP address that appears in multiple threat intelligence feeds. The analyst wants to determine, within the platform, why the indicator is considered malicious and how it relates to known campaigns. Which TWO actions help the analyst understand the indicator's context and provenance? (Choose two.)

Accepted Answer

Open the indicator's detail view to review its sources, confidence, and associated threat intelligence metadata. Understanding an indicator requires both provenance and relationships. The indicator detail view shows contributing sources, confidence, and metadata that explain the verdict, while pivoting to related indicators and campaign associations places the address in operational context. Disabling feeds, manually inflating severity, and inspecting raw payloads do not answer why the indicator is considered malicious.

Answer

Export the raw feed payload from the integration logs to inspect the original JSON structure

Answer

Disable the feed that reported the indicator to stop further matches while the investigation continues

Answer

Raise the indicator's severity manually so it appears at the top of the alert queue

Question 6

An analyst investigating a phishing alert wants to confirm whether a domain seen in the email headers is associated with known malicious activity. The domain does not appear in any enabled feed. Which Cortex XSIAM capability allows the analyst to check the domain's reputation and enrich the investigation without leaving the platform?

Accepted Answer

Run an indicator enrichment or search against the domain in the Threat Intelligence module to query configured intelligence sources.. On-demand enrichment against configured intelligence sources lets analysts check an artifact's reputation in-platform even when it is absent from the local indicator store. This supports active investigations like phishing triage, where speed matters and new domains may not yet be in feeds. Waiting for syncs, sandboxing, or filing support tickets all fail to deliver an immediate, in-platform reputation answer.

Answer

Open a support ticket asking the vendor to add the domain to the global indicator database.

Answer

Export the domain to an external sandbox and import the results as a new indicator manually.

Answer

Wait for the next scheduled feed sync, which will automatically add the domain if it is malicious anywhere on the internet.

Question 7

A Cortex XSIAM analyst is onboarding a new threat intelligence provider that publishes indicators at a very high rate. Shortly after enabling the feed, the analyst notices that indicator searches are slow and that several other feeds appear to have stopped updating. The platform's resource utilization is elevated. Which action best addresses the root cause while preserving intelligence coverage?

Accepted Answer

Increase the fetch interval for the high-rate feed and apply indicator filtering or allowlisting so only relevant indicators are ingested.. A high-rate feed can saturate ingestion and search resources, degrading indicator queries and starving other feeds of processing time. The most effective remediation is to reduce the load at its source: lengthen the fetch interval and apply filtering so only operationally relevant indicators are ingested. This restores performance for all feeds while retaining coverage of the indicators that matter, addressing the root cause rather than working around it.

Answer

Disable all other feeds temporarily so the high-rate feed has exclusive access to ingestion resources.

Answer

Move the high-rate feed to a separate Cortex XSIAM tenant and forward matched indicators back through an API.

Answer

Raise the indicator retention window so older indicators are kept longer and searches can amortize their cost over a larger dataset.

Question 8

Which THREE features are provided by the XQL search query interface in XSIAM to assist analysts during query authoring? (Choose three)

Accepted Answer

Syntax highlighting for XQL commands, functions, and operators. Option A is correct because the XQL search query interface in XSIAM provides syntax highlighting that visually distinguishes XQL commands, functions, and operators, helping analysts spot typos and structural errors while authoring queries. Option B is correct because the interface includes a schema browser that lets analysts explore available datasets, fields, and their data types, which is essential for constructing accurate queries against the right telemetry. Option D is correct because the query editor offers auto-complete and intelligent code suggestions for dataset and field names, reducing manual typing and lookup effort during query authoring. Option C is not part of query authoring assistance—remediation of endpoint threats is handled through response actions and playbooks, not from the query text box. Option E is incorrect because XQL is not translated into raw assembly language for storage nodes; the platform abstracts query execution and does not expose such low-level translation as an authoring feature.

Answer

Automated remediation of identified endpoint threats directly from the query text box

Answer

Automatic translation of XQL into raw assembly language for the underlying storage nodes

Question 9

An administrator needs to verify whether disk encryption (BitLocker / FileVault) is active and reporting status correctly across managed endpoints in XSIAM. Where can this compliance status be monitored?

Accepted Answer

Endpoint Security > Assets > Disk Encryption column/tab. In Cortex XSIAM, endpoint compliance data such as disk encryption status (BitLocker on Windows, FileVault on macOS) is surfaced in the Endpoint Security > Assets view, where each endpoint record includes a Disk Encryption column/tab showing whether encryption is active and reporting correctly. This is the centralized place to monitor compliance across managed endpoints.

Answer

Settings > Compliance > BitLocker Management

Answer

Data Collection > Endpoints > Encryption Logs

Answer

Response > Actions > Encryption Status

Question 10

An analyst is building an XQL query to detect brute-force login attempts. The query must count failed login events per source IP within 10-minute windows and then filter for counts exceeding 20. Which two XQL commands or functions are essential to achieve this? (Choose two.)

Accepted Answer

stats. To detect brute-force attempts, the analyst must group events into time windows using `bin` and then aggregate counts using `stats`. The `bin` command creates the 10-minute buckets, and `stats` counts the failed logins per source IP within each bucket. A subsequent filter on the count would complete the detection. The other commands are not needed for this specific aggregation.

Answer

arrayindex

Answer

dedup

Answer

join

Question 11

Where in the Cortex XSIAM web interface can an administrator view the graphical flowchart and execution status of a currently running playbook on an active incident?

Accepted Answer

Incidents > [Select Incident] > Work Plan tab. The Incidents page contains the specific incident's Work Plan tab where the active playbook flowchart and task statuses are displayed.

Answer

Data Hub > Pipelines

Answer

Dashboards > Incident Overview

Answer

Settings > Automation > Playbooks

Question 12

An analyst is configuring behavioral threat protection rules and exceptions in XSIAM. Which THREE parameters can typically be used to define a precise exclusion rule for a benign application exhibiting suspicious behavior? (Choose three)

Accepted Answer

Digital certificate signer of the application. Option A is correct because XSIAM behavioral threat protection exceptions can be scoped by the digital certificate signer, allowing trusted vendors' signed binaries to be excluded while still catching unsigned or maliciously signed code. Option B is correct because specifying the exact file path and filename lets the exception apply only to the known benign executable in its known location, avoiding broad exclusions. Option E is correct because the SHA-256 hash uniquely identifies the exact executable version, providing the most precise and tamper-resistant exclusion criterion. Option C is not appropriate because a MAC address identifies a network interface, not an application, so it cannot precisely scope a behavioral rule to a benign program. Option D is likewise irrelevant because a DHCP lease expiration timestamp is a network-address lifetime value and has no bearing on identifying or excluding an application's behavior.

Answer

The MAC address of the endpoint's primary network interface card

Answer

The DHCP lease expiration timestamp

Question 13

An administrator wants to review all endpoints running an outdated operating system version to plan an upgrade cycle. Which XSIAM feature provides grouped inventory data on operating system distribution?

Accepted Answer

Endpoint Security > Assets filtered by Operating System columns. Endpoint Security asset inventory and filtering capabilities allow sorting and grouping by operating system attributes.

Answer

Response > Asset Discovery Reports

Answer

Data Lake > Parsing Rules > OS Summary

Answer

Settings > Endpoint Management > OS Matrix

Question 14

An analyst notices that an analytic alert is repeatedly firing for legitimate administrative activity (a false positive). Aside from custom prioritization, how can an analyst manage this specific alert instance to aid future investigations?

Accepted Answer

Add analyst feedback and tag the alert instance as a false positive within the alert review workflow.. Cortex XSIAM's alert review workflow includes an analyst feedback mechanism that lets you tag an alert instance as a false positive. This feedback is stored as metadata on the alert and is used by the platform's machine learning and analytics to tune future detections, reducing noise for similar activity. Tagging the specific instance preserves the raw evidence while improving future investigation context, unlike destructive actions such as deleting logs or disabling agents.

Answer

Delete the raw log from the underlying storage bucket via the UI.

Answer

Disable the Cortex XDR agent on the administrator's workstation.

Answer

Change the XDM mapping of the source log parser to omit the user account.

Question 15

An analyst is reviewing endpoint security alerts and needs to filter events by specific threat categories. Which TWO threat categories are commonly associated with Cortex XDR endpoint prevention modules? (Choose two)

Accepted Answer

Exploit and memory-based attack techniques. Option B is correct because Cortex XDR endpoint prevention modules include exploit protection that detects and blocks memory-based attack techniques such as buffer overflows, ROP chains, and other exploitation methods targeting vulnerable processes. Option C is correct because Cortex XDR's malware prevention module identifies and blocks malware execution attempts, including known malicious files, ransomware, and other malicious payloads on endpoints. Options A, D, and E are incorrect because badge reader failures, point-of-sale printer jams, and HVAC temperature anomalies are physical or facilities-related issues, not endpoint threat categories monitored by Cortex XDR prevention modules.

Answer

Building badge reader access failures

Answer

Cafeteria point-of-sale receipt printer paper jams

Answer

Physical datacenter HVAC temperature anomalies