XSIAM-Analyst Practice Test 18 — 15 Questions

Question 1

When an analytic alert triggers in XSIAM, what role does confidence play in alert prioritization?

Accepted Answer

Confidence is combined with severity to determine the overall alert score and priority ranking.. Confidence measures the certainty that the detection represents true malicious activity, influencing the overall score.

Answer

Confidence determines how many raw logs are retained in cold storage.

Answer

Confidence dictates which playbook is automatically attached to the incident.

Answer

Confidence controls the encryption level of the alert payload.

Question 2

An XSIAM analyst is investigating an incident that contains multiple alerts. The analyst wants to determine the incident's overall severity score. Which TWO factors contribute to the calculation of an incident's severity score in XSIAM? (Choose two.)

Accepted Answer

The number of alerts associated with the incident.. Incident severity in XSIAM is calculated by aggregating the severity of associated alerts and weighting them by the criticality of involved assets. The number of alerts can increase the score, as multiple alerts may indicate a more significant or widespread threat. Asset criticality ensures that incidents affecting important systems are prioritized higher.

Answer

The number of users assigned to the incident.

Answer

The time of day when the alerts were generated.

Answer

The length of time the incident has been open.

Question 3

An XSIAM analyst is leading the response to a confirmed ransomware outbreak. The incident was created automatically by the platform. The analyst needs to locate all affected endpoints and initiate remote live terminal sessions to contain the threat. Which area of the XSIAM console should the analyst use?

Accepted Answer

The Incident War Room. The Incident War Room is the primary interface for incident response in XSIAM. It aggregates all relevant artifacts, including affected endpoints and users, and provides one-click actions for containment and investigation. Remote live terminal sessions are initiated directly from the War Room, allowing analysts to quickly respond to threats like ransomware without switching tools.

Answer

The Data Sources configuration page

Answer

The Threat Intelligence management page

Answer

The Correlation Rules engine

Question 4

An analyst is investigating a possible data exfiltration incident and needs to build an XQL query that detects a single source IP address making outbound connections to more than 20 distinct destination IP addresses within a 5-minute window. The analyst decides to use the `bin` command to group events into 5-minute buckets. Which command sequence correctly aggregates the data to identify the suspicious source IP?

Accepted Answer

bin timestamp span=5m as time_bucket | stats dc(dst_ip) as unique_dsts by src_ip, time_bucket | filter unique_dsts > 20. The correct sequence uses `bin` to create 5-minute time buckets, then `stats` with `dc(dst_ip)` to count distinct destination IPs per source IP per bucket, and filters for counts exceeding 20. This precisely identifies a source IP connecting to many unique destinations in a short period. Other options either count all connections instead of distinct ones, misuse aggregate functions, or fail to group by the time bucket.

Answer

bin timestamp span=5m as time_bucket | stats count(dst_ip) as total_conns by src_ip, time_bucket | filter total_conns > 20

Answer

bin timestamp span=5m as time_bucket | stats dc(dst_ip) as unique_dsts by src_ip | filter unique_dsts > 20

Answer

bin timestamp span=5m as time_bucket | stats sum(dst_ip) as total_dsts by src_ip, time_bucket | filter total_dsts > 20

Question 5

An XSIAM analyst is triaging a new incident that was created from a single high-severity analytic alert. The analyst wants to determine which specific detection rule generated the alert and what raw event data triggered it. Where should the analyst look within the incident view?

Accepted Answer

In the Alerts tab, by expanding the alert and viewing its 'Detection' and 'Raw Events' sections.. To identify the detection rule and raw event data, the analyst must navigate to the Alerts tab within the incident. Expanding the alert provides access to the detection metadata and the raw events that triggered it. This allows the analyst to understand why the alert fired and to perform further investigation on the underlying data.

Answer

In the Timeline tab, by reviewing the chronological sequence of events.

Answer

In the Incident Summary tab, under the 'Description' field.

Answer

In the War Room tab, by checking the automated playbook execution logs.

Question 6

An XSIAM administrator is configuring a new custom prioritization rule to escalate incidents involving critical servers. The administrator needs to define the rule's conditions and actions. Which TWO of the following are required components when creating a custom prioritization rule? (Choose two.)

Accepted Answer

A set of conditions that match incidents based on fields like severity, asset criticality, or alert type.. A custom prioritization rule must have conditions to select which incidents to evaluate and an action to apply when those conditions are met. Conditions define the scope, and actions define the outcome, such as raising severity. Without both, the rule cannot perform its intended function of escalating critical incidents.

Answer

A schedule specifying when the rule should run.

Answer

A name and description for the rule.

Answer

An approval workflow to authorize the rule's changes.

Question 7

An analyst needs to assess the external attack surface of a newly acquired subsidiary whose primary domain is registered under a different parent organization. The analyst plans to configure an Attack Surface Management (ASM) scan in Cortex XSIAM. Which TWO configuration elements must be defined so that ASM can discover external assets associated with this subsidiary? (Choose two.)

Accepted Answer

A discovery scope that includes the subsidiary's root domain and any known subdomains. ASM discovery is driven by explicit scope definitions. To find external assets for a subsidiary whose registration sits under a different parent, the analyst must supply the subsidiary's domains and subdomains and its known external IP ranges or CIDR blocks. Feeds, schedules, and detection allowlists do not expand the discovery target set, so they cannot surface the subsidiary's external footprint.

Answer

An ASM scan schedule configured with a recurrence that matches the subsidiary's change window

Answer

An allowlist rule in the correlation rules engine that permits traffic from the subsidiary's IP space

Answer

A Cortex XSIAM threat intelligence feed subscribed to a commercial IP reputation provider

Question 8

An analyst wants to reuse the same sequence of enrichment, scoring, and notification tasks across five different playbooks without duplicating the logic in each. Which XSIAM construct should be used to achieve this reuse?

Accepted Answer

A sub-playbook that encapsulates the shared tasks and is called from each parent playbook, receiving inputs and returning outputs.. Sub-playbooks are designed for exactly this reuse pattern, encapsulating a sequence of tasks behind a defined input and output interface that parent playbooks invoke as one step. This keeps logic centralized so updates propagate to all callers. Scheduled jobs, global inputs, and monolithic scripts do not provide inline, context-aware task-sequence reuse with native logging and error handling.

Answer

A global playbook input that stores the task sequence as a reusable variable referenced by all five playbooks.

Answer

A scheduled job that runs the shared sequence on a timer and writes results to a shared list variable.

Answer

A custom automation script that reimplements every task's API calls in code and is called from each parent playbook.

Question 9

An analyst is building an XQL query to detect suspicious PowerShell execution. They want to exclude any command line that contains the string 'Invoke-WebRequest' and also exclude any command line that contains 'DownloadString'. Which XQL filter expression correctly applies both exclusions?

Accepted Answer

filter not (command_line contains "Invoke-WebRequest" or command_line contains "DownloadString"). To exclude command lines that contain either of two substrings, the correct approach is to negate a disjunction of contains conditions. The expression 'not (command_line contains "A" or command_line contains "B")' keeps only events where neither substring appears. Using inequality operators or exact-match lists would only filter exact matches and miss embedded occurrences, leaving many suspicious commands undetected.

Answer

filter command_line not in ("Invoke-WebRequest", "DownloadString")

Answer

filter command_line not contains "Invoke-WebRequest" and command_line not contains "DownloadString"

Answer

filter command_line != "Invoke-WebRequest" and command_line != "DownloadString"

Question 10

An analyst needs to ensure that all incidents assigned to a specific threat group are automatically tagged with a custom label upon creation. Where can the analyst configure automatic tagging rules?

Accepted Answer

Incident Classification and Tagging settings. Automatic tagging rules for incidents, including tagging based on the assigned threat group, are configured in the Incident Classification and Tagging settings. This area lets analysts define rules that apply labels automatically when incidents are created or updated, ensuring consistent categorization without manual effort. The other options relate to data ingestion, normalization, or endpoint policy, not incident tagging.

Answer

XQL data normalization mapping table

Answer

Syslog listener port configuration

Answer

Cortex XDR agent tamper protection policies

Question 11

During an incident investigation in XSIAM, an analyst needs to determine the root cause of a suspicious process execution. The analyst has the process GUID and wants to see the full command line, parent process, and user context. Which XSIAM capability provides this information?

Accepted Answer

Endpoint Process Timeline. The Endpoint Process Timeline is specifically designed to provide detailed process execution data, including command lines, parent-child relationships, and user context. It is the correct tool for investigating a suspicious process using its GUID. Other options provide different types of data that do not address the requirement.

Answer

Authentication Logs

Answer

Registry Change Events

Answer

Network Connection Logs

Question 12

An analyst is building a playbook that must conditionally route incidents based on the severity field returned by an external enrichment integration. Which TWO configuration elements are required for the conditional branching to evaluate that field correctly? (Choose two.)

Accepted Answer

A conditional task whose left operand references the enrichment task's output context path and whose operator and right operand define the match.. Conditional routing needs two things: a conditional task that references the enrichment output via its context path with a defined operator and comparison value, and correct task ordering so the enrichment completes before the condition evaluates. Together these guarantee the severity field is present and correctly compared. Schema changes, extraction rules, and global inputs do not substitute for referencing the actual task output in the right sequence.

Answer

A dedicated incident field schema update that registers the severity attribute as a first-class incident field before the playbook runs.

Answer

A pre-configured indicator extraction rule that automatically converts the severity value into a reputation score before the condition runs.

Answer

A global playbook input that maps the severity value into a list variable used by every downstream task automatically.

Question 13

A security team wants a Cortex XSIAM playbook to run automatically the moment a new high-severity incident is created, without any analyst clicking a button. Which configuration makes the playbook start on its own when the incident is generated?

Accepted Answer

Attach the playbook to the incident type so it triggers automatically when a matching incident is created. Automatic, event-driven execution in Cortex XSIAM comes from binding a playbook to an incident type, so creation of a matching incident immediately launches the playbook with no human involvement. The other mechanisms either distribute, display, or periodically poll, none of which start the playbook at the instant the incident is generated, which is what the scenario requires for immediate automated response.

Answer

Add the playbook to a dashboard widget that refreshes whenever a new incident appears

Answer

Create a scheduled job that launches the playbook every minute to check for new incidents

Answer

Publish the playbook to the marketplace so subscribers receive it and run it on new incidents

Question 14

A Cortex XSIAM analyst is investigating an external-facing asset discovered by Attack Surface Management (ASM). The asset appears in the inventory but has no associated service, certificate, or technology details, and the analyst needs to understand what ASM actually observed. Which action should the analyst take to review the raw discovery evidence for this asset?

Accepted Answer

Open the asset's details page and review the associated findings and evidence collected during the discovery scan.. ASM stores discovery evidence at the asset level, and the asset details page surfaces the observed services, certificates, technologies, and findings. When the inventory summary appears incomplete, the details page is the authoritative place to review what the scan actually collected, making it the correct action for this investigation.

Answer

Run a new ASM scan with a broader port range and wait for the next inventory refresh.

Answer

Export the ASM inventory to CSV and inspect the row for the asset to find its service details.

Answer

Query the threat intelligence indicator store for the asset's IP address to infer its services.

Question 15

An analyst concludes an incident investigation and determines that the alert was a true positive, remediation actions have been completed, and no further steps are needed. What is the correct final state to assign to the incident in XSIAM?

Accepted Answer

Resolved / Closed. When an incident has been fully investigated and remediated, its status should be set to Resolved (or Closed) with the appropriate resolution reason.

Answer

Isolated State

Answer

Quarantined Status

Answer

Pending Further Review (Active)