XSIAM-Analyst Practice Test 19 — 15 Questions

Question 1

An analyst is validating that Cortex XSIAM threat intelligence is being applied correctly to internal telemetry. The analyst wants to confirm which internal data sources are being matched against ingested indicators. Which TWO capabilities should the analyst use to verify indicator matches against internal telemetry? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run a query in the XQL search over the relevant datasets filtered by the indicator value to confirm matching events.. Cortex XSIAM provides two direct ways to validate that ingested indicators are matching internal telemetry: indicator detail views that list associated alerts and incidents, and XQL search over datasets filtered by indicator value. The first shows platform-generated associations, while the second exposes the raw matching events. Together they give both a summary and an auditable trail, which is exactly what validation requires.

Answer

Export all indicators to CSV and compare them manually against raw log exports from each data source.

Answer

Check the feed integration's fetch logs to see which internal hosts responded to the provider's API calls.

Answer

Disable the feed and observe whether incident volume drops to infer which indicators were matching.

Question 2

An administrator is preparing to deploy Cortex XDR agents across a mixed Windows and macOS environment. Which TWO prerequisites must be validated to ensure successful deployment and full functionality of the agent? (Choose two)

Accepted Answer

Ensure local administrative privileges are available for the installation process.. Option A is correct because the Cortex XDR agent installer requires local administrative (root on macOS, local admin on Windows) privileges to install kernel-level components and services needed for full protection. Option B is correct because agents must reach the Cortex XSIAM tenant over outbound HTTPS (TCP 443) to register, download policy/content updates, and upload telemetry; without this connectivity, deployment or full functionality fails. Option C is incorrect because SNMP traps are a monitoring/alerting mechanism and are not a prerequisite for agent deployment or operation. Option D is incorrect because the agent uses its own local storage for event buffering and does not require Microsoft SQL Server on endpoints. Option E is incorrect because inbound TCP 22 (SSH) is not needed by the agent, which initiates outbound connections rather than accepting inbound management traffic.

Answer

Establish a direct SNMP trap listener on the XSIAM management console.

Answer

Install a local Microsoft SQL Server instance on every endpoint for event buffering.

Answer

Configure an inbound TCP port 22 forwarding rule on every workstation firewall.

Question 3

An XSIAM analyst is investigating a phishing incident where a user clicked a malicious link and downloaded a payload. The analyst needs to determine the scope of the compromise by identifying all endpoints that communicated with the malicious domain. Which TWO XSIAM capabilities should the analyst use to efficiently identify affected endpoints? (Choose two.)

Accepted Answer

Use XQL to query network logs for the malicious domain and extract endpoint identifiers.. Using XQL to query network logs and the Indicators module to search for the malicious domain both enable efficient identification of endpoints that communicated with the threat. XQL provides flexible querying across data sources, while the Indicators module offers a curated view of threat intelligence matches. Together, they allow rapid scoping without disrupting endpoints.

Answer

Create a correlation rule to alert on future connections to the malicious domain.

Answer

Initiate a 'Collect Endpoint Evidence' action on all endpoints to capture network connections.

Answer

Run a 'File Search' action on all endpoints to find the downloaded payload by hash.

Question 4

An administrator is configuring the Cortex XDR agent on a group of endpoints and wants to ensure that users cannot uninstall the agent or stop its service without providing a password. Which setting should the administrator enable in the XSIAM management console?

Accepted Answer

Agent password protection. The correct answer is agent password protection. This setting requires a password to uninstall the Cortex XDR agent or stop its service, directly preventing unauthorized users and malware from disabling protection. Other features like behavioral threat protection, exploit protection, and device control serve different security purposes and do not control agent uninstallation.

Answer

Device control

Answer

Behavioral threat protection

Answer

Exploit protection

Question 5

A security analyst needs to review authentication events from the last 24 hours and display only the username, source IP address, and timestamp. The events are stored in the dataset xdr_data with event_type ENUM.AUTHENTICATION. Which XQL query correctly filters the time range and selects the required fields?

Accepted Answer

dataset = xdr_data | filter event_type = ENUM.AUTHENTICATION and timestamp > current_time() - 24h | fields username, src_ip, timestamp. The correct query must use the valid time function current_time() to define the 24-hour window, and the fields command to project the required columns. The field name for source IP is src_ip, not source_ip. Only the query that uses current_time() and fields with src_ip satisfies all conditions.

Answer

dataset = xdr_data | filter event_type = ENUM.AUTHENTICATION and timestamp > current_time() - 24h | fields username, source_ip, timestamp

Answer

dataset = xdr_data | filter event_type = ENUM.AUTHENTICATION and timestamp > current_time() - 24h | select username, src_ip, timestamp

Answer

dataset = xdr_data | filter event_type = ENUM.AUTHENTICATION and timestamp > now() - 24h | fields username, src_ip, timestamp

Question 6

An analyst wants to enrich Cortex XSIAM incidents with context from an external threat intelligence provider so that severity and indicator reputation appear directly on the incident. The provider exposes a REST API keyed by indicator value. Which Cortex XSIAM capability should the analyst use to bring this context into incidents?

Accepted Answer

A threat intelligence feed integration configured to fetch indicators and enable indicator enrichment.. Cortex XSIAM threat intelligence feed integrations are the supported way to ingest indicators from external REST-based providers. When enrichment is enabled on the feed, reputation and related provider context are attached to matching indicators and to the incidents that reference them. This directly satisfies the requirement to surface external provider context on incidents without custom code or endpoint-side distribution.

Answer

A dashboard widget that queries the provider's API on a schedule and displays results alongside incident metrics.

Answer

An endpoint policy that pushes the provider's indicator list to every managed agent for local matching.

Answer

A custom correlation rule that calls the provider's API from within the rule logic at evaluation time.

Question 7

A security engineer wants to reuse the same set of containment steps across several different playbooks that handle malware, phishing, and unauthorized access incidents. The steps include isolating an endpoint, disabling a user account, and blocking a hash. The engineer wants to maintain these steps in one place so that updates propagate to all playbooks. What should the engineer do in Cortex XSIAM?

Accepted Answer

Create a sub-playbook containing the containment steps and call it from each parent playbook.. The engineer needs a reusable, centrally maintained set of containment steps. A sub-playbook is the XSIAM construct that packages tasks for invocation by multiple parent playbooks. Updating the sub-playbook propagates changes to all callers, ensuring consistency and reducing maintenance effort. Copying tasks, using a monolithic playbook, or duplicating scripts all fail to provide a single point of maintenance.

Answer

Copy the tasks into each playbook and update them individually when changes are needed.

Answer

Create a single playbook that contains all containment steps and assign it to every incident type.

Answer

Use a script task that performs all containment actions and paste the script into each playbook.

Question 8

An XSIAM analyst is triaging a new high-severity incident. During investigation, the analyst determines that the activity is benign and wants to close the incident while ensuring that similar alerts are not re-triggered for this known-good activity. Which incident resolution action should the analyst take?

Accepted Answer

Mark the incident as a false positive and add an exception in the relevant detection rule. When an analyst confirms benign activity, the correct resolution is to mark the incident as a false positive and tune the detection rule with an exception. This closes the incident accurately and prevents future identical alerts, reducing noise while preserving audit trails. Other actions either delete evidence, delay closure, or fail to suppress recurrence.

Answer

Lower the severity of the incident to informational and leave it open for monitoring

Answer

Close the incident as resolved and delete the associated alert from the database

Answer

Reassign the incident to a different analyst for a second opinion before closure

Question 9

A playbook contains a parallel task branch where two different enrichment integrations run simultaneously. One integration fails due to a rate limit. How can you prevent the entire playbook from failing and allow the other branch to complete successfully?

Accepted Answer

Enable 'Continue on error' in the failing task's configuration options.. In Cortex XSIAM playbooks, each task has configuration options that control error handling, and enabling 'Continue on error' allows the playbook to proceed even if that specific task fails. This is the correct approach for a parallel branch where one integration hits a rate limit, because the other branch can still complete and the overall playbook does not abort.

Answer

Clear the XSIAM Redis cache via CLI.

Answer

Convert the playbook into a sub-playbook with synchronous execution.

Answer

Increase the global playbook execution timeout limit.

Question 10

An analyst needs to create an XQL query that enriches network connection events with geographic location data. The analyst has a lookup table named 'ip_geolocation' that maps IP addresses to country codes. The goal is to add a 'country' field to each event based on the destination IP address. Which XQL stage and syntax correctly performs this enrichment?

Accepted Answer

dataset = xdr_data | filter event_type = ENUM.NETWORK | lookup ip_geolocation destination_ip as ip_address return country. The lookup stage is specifically designed for enriching XQL query results with data from lookup tables. By matching destination_ip against the ip_address field in the ip_geolocation table and returning the country field, the analyst efficiently adds geographic context to network events. This is the standard enrichment pattern in XSIAM for adding external data to query results.

Answer

dataset = xdr_data | filter event_type = ENUM.NETWORK | join type = left (dataset = ip_geolocation) as geo ip_address = geo.ip | fields destination_ip, geo.country

Answer

dataset = xdr_data | filter event_type = ENUM.NETWORK | alter country = map_lookup("ip_geolocation", destination_ip)

Answer

dataset = xdr_data | filter event_type = ENUM.NETWORK | enrich ip_geolocation destination_ip as ip_address return country

Question 11

An analyst is building a Cortex XSIAM playbook that enriches indicators by calling an external REST API. The API enforces a rate limit of 10 requests per minute, and the playbook may process incidents containing hundreds of indicators. Which playbook task configuration should the analyst apply to avoid HTTP 429 responses while still processing every indicator?

Accepted Answer

Add a sleep task before the HTTP request inside a loop over the indicator list.. Respecting an external API's request quota requires controlling the pace of calls, not just their number. Adding a sleep task before each HTTP request inside the indicator loop throttles the playbook so it stays under the 10-requests-per-minute ceiling, allowing every indicator to be enriched without triggering HTTP 429 responses. Changing the HTTP verb or enabling continue-on-error does not alter request frequency.

Answer

Change the HTTP request method from GET to POST to reduce the request count.

Answer

Enable the 'continue on error' flag on the HTTP request task.

Answer

Wrap the HTTP request task inside a loop that iterates over the indicator list.

Question 12

What information does an indicator's 'TLP' (Traffic Light Protocol) designation provide in XSIAM?

Accepted Answer

The sharing and distribution boundaries for the threat intelligence data. TLP defines sharing boundaries and restrictions for sensitive information and threat intelligence.

Answer

The technical severity level of the indicator (Low, Medium, High, Critical)

Answer

The network protocol associated with the indicator (TCP, UDP, HTTP)

Answer

The speed at which the feed is polled by the XSIAM ingestion engine

Question 13

An analyst discovers that a threat intelligence feed is ingesting indicators with expiration dates far in the future, causing stale indicators to remain active. The analyst wants to enforce a maximum indicator lifespan of 30 days from the feed's own 'last_seen' field, regardless of what the source provides. Which setting in the Cortex XSIAM threat intelligence feed integration should be configured to achieve this?

Accepted Answer

Set the 'Indicator Expiration Method' to 'Expire indicators based on the feed's last_seen field' and configure the 'Indicator Expiration Interval' to 30 days.. The correct setting is the indicator expiration method that uses the feed's last_seen field with a 30-day interval. This allows XSIAM to automatically expire indicators based on their activity, ensuring stale data is removed. Other options either do not control expiration or rely on manual intervention, which is inefficient and not scalable.

Answer

Configure the 'Feed Fetch Interval' to 30 days to ensure indicators are refreshed only every 30 days, implicitly expiring older ones.

Answer

Enable the 'Reputation Calculation' option and set the 'Reputation Threshold' to expire indicators with a reputation score below 30.

Answer

Use the 'Indicator Exclusion List' to manually add indicators older than 30 days, preventing them from being ingested.

Question 14

A Cortex XSIAM analyst is validating an incoming TAXII 2.1 threat intelligence feed that keeps returning a 401 Unauthorized error during the 'Test' step of the feed configuration. The feed URL, collection ID, and API root are correct, and the same credentials work in a browser. What should the analyst verify first to resolve the failure?

Accepted Answer

That the TAXII 2.1 feed is configured with the correct username and API key (or Basic/Bearer credential) in the integration instance, since TAXII handshakes authenticate per request and a mismatched auth header returns 401.. A 401 Unauthorized from a TAXII 2.1 server indicates that the credential presented in the request was rejected. Because XSIAM sends the credential stored in the integration instance on every request, the analyst must confirm that the instance's username/API key or Bearer token matches what the server expects. The URL, collection ID, and API root are independent of authentication and were already verified as correct.

Answer

That the feed's indicator type mapping includes 'STIX Pattern' entries, because unmapped STIX patterns cause the server to return 401.

Answer

That the reputation calculation method is set to 'Manual' instead of 'Automatic', since manual reputation blocks the initial TAXII handshake.

Answer

That the indicator expiration policy is set to a value longer than the feed's polling interval, because expired indicators can cause the server to reject the request.

Question 15

When designing robust error-handling workflows in XSIAM playbooks, which THREE strategies can be implemented to handle task failures gracefully? (Choose three)

Accepted Answer

Configure task-level 'Continue on error' settings.. Option B is correct because XSIAM playbook tasks expose a 'Continue on error' setting that lets the playbook proceed past a failed task instead of aborting the whole run, which is essential for graceful degradation. Option C is correct because configuring automated retries with backoff intervals handles transient failures (e.g., API rate limits or temporary network issues) by re-attempting the task after a delay rather than failing outright. Option D is correct because conditional error branches let the playbook evaluate task failure conditions and route execution to alternative remediation tasks, providing a fallback path. Option A is not appropriate because deleting an incident on any error destroys evidence and prevents investigation or remediation. Option E is not appropriate because rebooting the entire Cortex XSIAM tenant cloud cluster is a disruptive, unsupported action that would affect all tenants and is not a playbook-level error-handling strategy.

Answer

Delete the incident immediately upon any error.

Answer

Instantly reboot the entire Cortex XSIAM tenant cloud cluster.