XSIAM-Analyst Practice Test 17 — 15 Questions

Question 1

An administrator is setting up Attack Surface Management (ASM) discovery scopes in XSIAM. Which THREE types of seed assets can be provided to initiate external discovery? (Choose three)

Accepted Answer

Domain names (e.g., example.com). In XSIAM Attack Surface Management, external discovery is seeded with internet-facing identifiers that the discovery engine can enumerate and scan. Option A (Domain names such as example.com) is correct because domains are a primary seed type: ASM resolves them to subdomains, IPs, and exposed services. Option C (Autonomous System Numbers, ASNs) is correct because an ASN seed lets ASM enumerate all IP prefixes and netblocks announced by that organization, expanding discovery to owned internet ranges. Option E (CIDR IP address ranges such as 192.0.2.0/24) is correct because CIDR blocks are directly scanned and mapped to hosts and open services. Option B (local endpoint MAC addresses) is not valid because MAC addresses are layer-2 identifiers that are not routable or discoverable on the public internet. Option D (Active Directory user SIDs) is not valid because SIDs are internal identity objects, not externally resolvable assets, and belong to identity/AD rather than external ASM seeding.

Answer

Local endpoint MAC addresses

Answer

Local Active Directory user security identifiers (SIDs)

Question 2

An analyst is investigating an incident where a suspicious file was dropped on a host. To verify if other hosts across the enterprise have seen this exact file hash, which XSIAM search tool should the analyst use?

Accepted Answer

Query Center using XQL to search endpoint datasets for the file hash. Global hash searches across all ingested endpoint telemetry in XSIAM are efficiently executed using Query Center (XQL) searching the endpoint datasets.

Answer

Incident Timeline Rebuilder

Answer

Local Quarantine Explorer

Answer

Agent Upgrade Wizard

Question 3

An analyst needs to assign an unassigned incident to a specific Tier 2 response engineer within the XSIAM incident management interface. Which field must the analyst modify?

Accepted Answer

Assigned To. Assigning ownership of an incident in XSIAM is handled by updating the Assigned To or Owner field of the incident.

Answer

Resolution Status

Answer

Incident Source

Answer

Severity Level

Question 4

Which of the following best describes the purpose of 'analytic alert types' in XSIAM?

Accepted Answer

They represent high-fidelity detections generated by XSIAM behavioral and machine learning analytics.. Analytic alerts represent machine learning, behavioral, or signature-based detections generated by XSIAM's built-in detection engines.

Answer

They are manual notes added by analysts during incident investigation.

Answer

They are raw log entries forwarded directly from third-party firewalls without processing.

Answer

They are predefined XQL queries used exclusively for scheduled reporting.

Question 5

An analyst notices that a custom PowerShell script used by system administrators is repeatedly blocked by the Cortex XDR agent as a suspicious execution. The analyst has verified the script's safety and wants to prevent future blocks without weakening overall script security for other scripts. How should this exception be configured in XSIAM?

Accepted Answer

Add a specific exception using the script file hash or signed certificate in the Cortex XDR exception rules.. Creating a script-specific exception using file hash or signer verification within the Agent Settings or Behavioral Threat Protection exclusions avoids blanket profile disabling.

Answer

Change the endpoint agent profile from Prevention to Reporting mode.

Answer

Disable PowerShell execution policy enforcement globally across all endpoint profiles.

Answer

Modify the Windows Defender exclusions via Group Policy.

Question 6

An analyst is investigating an incident where an endpoint downloaded a suspicious file. Which TWO XSIAM tools or views can the analyst use to inspect the file's characteristics, hash, and reputation across the tenant? (Choose two)

Accepted Answer

XQL Search querying file execution and hash datasets. Option A is correct because XQL Search lets the analyst query XSIAM datasets such as file execution and file hash events, returning the file's hash values, execution context, and related telemetry across the tenant. Option E is correct because the Global Context / Hash Lookup view in XSIAM provides reputation and prevalence information for a file hash, aggregating intelligence and tenant-wide sightings to assess whether the file is malicious. Option B is incorrect because Active Directory Group Policy Management Editor manages AD policy objects, not file characteristics or reputation. Option C is incorrect because the Printer Spooler Activity Dashboard monitors print spooler behavior and has no file hash or reputation inspection capability. Option D is incorrect because a Network DHCP Lease Viewer only maps IP addresses to MAC addresses and leases, which is unrelated to file inspection.

Answer

Active Directory Group Policy Management Editor

Answer

Printer Spooler Activity Dashboard

Answer

Network DHCP Lease Viewer

Question 7

Which THREE factors are dynamically evaluated by XSIAM when calculating the default severity score of an analytic alert? (Choose three)

Accepted Answer

Analytic Confidence Level. XSIAM dynamically evaluates the Analytic Confidence Level (A) because the confidence that the detection logic correctly identifies malicious activity directly scales the resulting alert severity. Asset Criticality Context (B) is also evaluated, since the same analytic firing on a high-value asset (e.g., a domain controller or crown-jewel server) should yield a higher severity than on a low-value endpoint. The Base Severity assigned to the Analytic Type (C) is a core input, as each analytic carries an inherent base severity that is then adjusted by dynamic factors such as confidence and asset criticality. The remaining options do not belong: the color theme selected in the user profile settings (D) is purely a cosmetic UI preference with no bearing on alert scoring, and local weather conditions at the data center (E) are entirely irrelevant to security severity calculation.

Answer

Color theme selected in the user profile settings

Answer

Local Weather Conditions at the Data Center

Question 8

An administrator needs to manage endpoint security profiles in XSIAM. Which TWO types of prevention profiles can be configured and assigned to endpoints? (Choose two)

Accepted Answer

Malware Protection Profile. In Cortex XSIAM, endpoint security is enforced through prevention profiles that are assigned to endpoint groups, and the two supported profile types are the Malware Protection Profile (A) and the Exploit Prevention Profile (B). The Malware Protection Profile (A) is correct because it defines how the endpoint agent handles malicious files and processes, including actions such as blocking or quarantining malware based on configured security modules and threat signatures. The Exploit Prevention Profile (B) is correct because it controls behavioral protection against exploitation techniques—such as memory corruption, process injection, and other exploit methods—by specifying which exploit-protection modules and actions are enabled. The remaining options do not belong: BGP Routing Profile (C) relates to network routing configuration, DNS Sinkhole Profile (D) is a network/DNS security construct rather than an endpoint prevention profile, and VPN Tunnel Profile (E) pertains to VPN connectivity settings, none of which are assignable endpoint prevention profile types in XSIAM.

Answer

BGP Routing Profile

Answer

DNS Sinkhole Profile

Answer

VPN Tunnel Profile

Question 9

Which TWO objects or concepts are fundamental building blocks in a Cortex XSIAM playbook? (Choose two)

Accepted Answer

Tasks (representing actions, conditions, or scripts). In Cortex XSIAM playbooks, Tasks (option B) are the fundamental units of work: each task represents an action, condition, or script that the playbook executes, such as running a command, querying a data source, or branching logic. Links (option C) are equally fundamental because they define the execution flow between tasks, including the directional connections and the conditions under which the playbook proceeds from one task to the next. Together, tasks and links form the directed graph that constitutes a playbook's logic. The remaining options are unrelated to playbook construction: physical server rack elevations (A) are data-center infrastructure documentation, cafeteria lunch menus (D) are facilities information, and employee payroll spreadsheets (E) are HR/finance records, none of which are playbook building blocks.

Answer

Physical server rack elevations

Answer

Cafeteria lunch menus

Answer

Employee payroll spreadsheets

Question 10

An analyst is investigating how XSIAM processes incoming analytic alerts and determines their initial lifecycle state. Which THREE characteristics or actions are associated with analytic alerts upon generation? (Choose three)

Accepted Answer

They are mapped to security frameworks such as MITRE ATT&CK when applicable.. Option C is correct because when XSIAM generates analytic alerts, it enriches them by mapping the underlying activity to security frameworks such as MITRE ATT&CK whenever a technique or tactic match applies, giving analysts immediate context. Option D is correct because each analytic alert is automatically assigned a severity score derived either from built-in analytics or from custom prioritization rules configured in the platform, which drives triage order. Option E is correct because generated analytic alerts are fed into the correlation engine, which evaluates them against existing incidents and grouping logic to decide whether they join an existing incident or spawn a new one. Option A is incorrect because analytic alerts are not permanently locked; analysts can modify, tag, and manage them during investigation. Option B is incorrect because XSIAM does not automatically contain all endpoints on every analytic alert without analyst review; containment is a separate, typically policy- or playbook-driven response action.

Answer

They are permanently locked and cannot be modified or tagged by analysts.

Answer

They immediately trigger an automated containment action on all endpoints without analyst review.

Question 11

An organization wants to configure custom threat intelligence scoring in XSIAM. Which THREE factors can influence the composite threat score of an indicator within the platform? (Choose three)

Accepted Answer

Custom severity mapping overrides. In XSIAM, the composite threat score of an indicator is derived from multiple weighted attributes, and custom severity mapping overrides (B) are correct because they let analysts redefine how a given severity level contributes to the score, directly changing the resulting composite value. Source reliability rating (C) is correct because the trustworthiness of the intelligence source is a scoring input, so indicators from highly reliable feeds score differently than those from questionable sources. Indicator confidence score (D) is also correct because confidence reflects how certain the source is that the indicator is malicious, and it is factored into the composite score calculation. The physical location of the XSIAM cloud data center (A) does not affect indicator scoring, and the brand of the firewall generating internal traffic logs (E) is irrelevant to the threat intelligence scoring algorithm.

Answer

The physical geographic location of the XSIAM cloud data center

Answer

The brand of the firewall generating internal traffic logs

Question 12

An analyst is optimizing a slow-running XQL query in XSIAM. Which TWO best practices should be implemented to improve query performance? (Choose two)

Accepted Answer

Use specific dataset names rather than broader wildcard dataset groups whenever possible.. Option D is correct because specifying exact dataset names (for example, dataset = xdr_data) instead of wildcard groups such as dataset = * limits the scan to only the relevant data, reducing the volume of records XQL must process and thereby improving performance. Option E is correct because XQL pipelines execute stage by stage, so placing 'filter' (or 'where') commands early reduces the number of events passed to subsequent stages, minimizing CPU and memory usage for parsing, aggregation, and joins. Option A is incorrect because nesting subqueries for every filtering condition adds execution overhead and complexity rather than optimizing the query. Option B is incorrect because running complex regular expression parsing before filtering forces the engine to evaluate regex against the full, unfiltered dataset, which is far more expensive than filtering first. Option C is incorrect because ignoring the time range selector and filtering timestamps at the end of the query prevents XSIAM from pruning data at the storage/scan level, causing the query to read far more data than necessary.

Answer

Use nested subqueries for every single filtering condition.

Answer

Perform complex regular expression parsing before applying any filters.

Answer

Avoid using the time range selector and instead filter timestamps at the very end of the query.

Question 13

During a routine audit, an analyst notices that several endpoints have an agent status of 'Unmanaged' or 'Disconnected' for over 30 days. What is the standard behavior of XSIAM regarding endpoints that remain disconnected for extended periods?

Accepted Answer

The assets remain in the inventory as disconnected, and administrators can manually purge or retain them based on retention policies.. XSIAM retains disconnected or unmanaged endpoints in the asset inventory rather than deleting them automatically. Historical telemetry remains subject to configured retention policies, and administrators can manually purge or retain assets based on those policies. This preserves forensic and audit data while giving organizations control over data lifecycle.

Answer

All historical telemetry for those hosts is immediately deleted from the data lake.

Answer

The agent automatically converts the endpoint into a cloud collector proxy.

Answer

XSIAM automatically uninstalls the Cortex XDR agent remotely to reclaim licenses.

Question 14

A security administrator needs to confirm that a newly deployed Cortex XDR agent on a macOS endpoint is communicating with the Cortex XSIAM tenant and receiving policy updates. Which endpoint status indicator in the XSIAM console should the administrator check first?

Accepted Answer

The endpoint's last seen timestamp and connection status on the Endpoints page. Agent communication health is verified through the last seen timestamp and connection status shown on the Endpoints page. These fields are updated by agent heartbeats, so a recent timestamp confirms the agent is checking in and receiving policies, whereas incident counts, OS version, and group assignment do not reflect live connectivity.

Answer

The endpoint's assigned endpoint group name

Answer

The endpoint's operating system build version

Answer

The number of incidents associated with the endpoint

Question 15

Which XQL command is used to rename a field in the output results dataset?

Accepted Answer

rename. The 'rename' command in XQL is specifically designed to rename one or more fields in the output dataset, allowing analysts to produce cleaner, more readable results without altering the underlying data. It takes the syntax 'rename new_name = old_name' and can rename multiple fields in a single statement. This is a presentation-layer transformation, distinct from 'alter' which creates or modifies field values.

Answer

format

Answer

alter

Answer

fields