XSIAM-Analyst Practice Test 2 — 10 Questions

Question 1

A junior analyst is reviewing XQL query results and notices that the 'event_id' field is present in some rows but missing in others. They need to filter the results to only include rows where 'event_id' is not null. Which XQL filter condition should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

filter event_id is not null. To filter for rows where a field is not null, XQL provides the 'is not null' operator. This explicitly checks that the field contains a value, correctly excluding rows where the field is missing or null. Other approaches like comparing to null or empty string do not accurately handle null semantics and can lead to incorrect results.

Answer

filter event_id != null

Answer

filter event_id exists

Answer

filter event_id <> ""

Question 2

An analyst is reviewing an endpoint that has been flagged for suspicious behavior. The analyst wants to retrieve the agent's diagnostic logs directly from the XSIAM console to investigate why certain events were not detected. Which action should the analyst take?

Accepted Answer

Use the 'Retrieve Agent Logs' action on the endpoint details page. The 'Retrieve Agent Logs' action on the endpoint details page is designed to collect and deliver the agent's diagnostic logs to the XSIAM console. This enables analysts to troubleshoot detection gaps, service issues, or configuration problems without remote shell access. It is the most direct and supported method for obtaining agent logs for investigation.

Answer

Run a Live Terminal session and execute a log collection script

Answer

Export the endpoint's alert history to a CSV file

Answer

Configure a new policy that enables verbose logging and wait for logs to appear in the console

Question 3

A Cortex XSIAM administrator notices that an ASM scan completed successfully but a known external web application was not listed in the results. The application is reachable from the internet and is owned by the organization. Which troubleshooting step is most appropriate to determine why the asset was missed?

Accepted Answer

Verify that the asset's hostname or address falls within the configured discovery seeds and that the relevant ports are included in the scan scope. A reachable asset that does not appear in ASM results is usually outside the configured seed set or listening on a port that is not scanned. Verifying seed coverage and port scope directly addresses the discovery boundary. Re-running discovery, tuning request rates, or manually adding the asset all skip the diagnostic step and leave the coverage gap in place.

Answer

Re-run the entire discovery configuration from scratch to force a fresh enumeration of all seeds

Answer

Add the web application to the asset inventory manually so it appears in ASM reports going forward

Answer

Increase the scan's request rate to ensure the web application responds before the scan times out

Question 4

An administrator is configuring the Cortex XDR agent's self-protection settings to prevent tampering by malicious actors. The administrator wants to ensure that the agent cannot be stopped or uninstalled without proper authorization. Which TWO measures should the administrator implement? (Choose two.)

Accepted Answer

Enable password protection for agent uninstallation and stopping of the agent service.. Password protection and running as a protected process (PPL) are both direct self-protection mechanisms. Password protection blocks unauthorized uninstallation or service stop, while PPL prevents other processes from terminating or modifying the agent. Together, they significantly harden the agent against tampering attempts, meeting the administrator's requirement.

Answer

Configure the agent to scan for and remove other security tools that might conflict.

Answer

Set the agent to automatically update to the latest version without user intervention.

Answer

Enable detailed logging of all agent actions to a remote syslog server.

Question 5

An incident response team wants to customize the incident severity scoring in XSIAM to better reflect organizational risk. Where are incident risk scoring and severity mapping configurations managed?

Accepted Answer

Incident Configuration settings. Incident severity and scoring rules, which determine how alerts roll up into incidents and their resulting priority, are configured under Incident Configuration settings in XSIAM.

Answer

Agent Installation Settings

Answer

Role-Based Access Control (RBAC) definitions

Answer

Data Stitching Schema Builder

Question 6

An XSIAM Analyst is investigating an analytic alert that has an unusually high priority score. The analyst wants to audit how the final score was calculated, specifically looking at the base score versus modifier weights. Where can the analyst inspect the score breakdown for an alert?

Accepted Answer

Alert Details slide-out panel > Score Breakdown / Scoring Factors tab. The alert details pane in XSIAM provides an analytical breakdown showing the base severity and any applied custom prioritization modifiers.

Answer

Reports > Audit Logs > System Activities

Answer

Investigation > Graph View > Edge Weights

Answer

Settings > Incident Settings > Scoring Matrix

Question 7

A Cortex XSIAM analyst is reviewing how threat intelligence indicators flow from an enabled feed into detection. The analyst wants to understand which actions occur when the feed integration polls and new indicators are retrieved. (Choose two.)

Accepted Answer

Indicators can be enriched or matched against telemetry during correlation and used to raise alerts or populate the incident view.. When an enabled feed polls, XSIAM normalizes retrieved indicators into its schema and stores them in the indicator repository with a reputation and expiration, making them available platform-wide. Those indicators are then evaluated during correlation against telemetry and used for enrichment, which can raise alerts or feed incidents. Automatic rule modification, endpoint blocklisting, and mandatory manual approval are not part of the standard ingestion flow.

Answer

Every retrieved indicator is immediately pushed to all managed endpoint agents as a blocklist entry.

Answer

Newly retrieved indicators are automatically written into every enabled correlation rule's indicator filter without analyst action.

Answer

Retrieved indicators are quarantined in a staging area and require manual approval before they become visible to any XSIAM component.

Question 8

A Cortex XSIAM analyst is building a playbook that must pause and wait for an analyst to review a quarantined file before deciding whether to restore or delete it. The playbook should resume automatically once the analyst completes the review task. Which task type should the analyst use to implement this pause and resume behavior?

Accepted Answer

Manual task. A manual task is the XSIAM construct that pauses a playbook, presents an action to an analyst, and resumes automatically when the action is completed. Conditional, data collection, and timer tasks do not provide an interactive review step that captures a restore-or-delete decision.

Answer

Timer task

Answer

Data collection task

Answer

Conditional task

Question 9

A Cortex XSIAM analyst is configuring an Attack Surface Management (ASM) discovery scope for a subsidiary and wants to ensure that only externally reachable assets are included in the inventory, excluding internal-only hosts. Which configuration should the analyst apply to the scope?

Accepted Answer

Define the scope using external seed assets such as public domain names and public IP ranges so ASM discovers only internet-facing assets.. ASM discovery is driven by the seeds defined in the scope. Providing public domain names and public IP ranges as seeds naturally limits discovery to internet-facing assets, which is the intended way to exclude internal-only hosts from the inventory.

Answer

Enable the 'internal only' option in the ASM scope settings and then manually tag external assets for removal.

Answer

Add internal RFC 1918 address ranges as seeds and enable a filter that removes private IPs from the inventory after discovery.

Answer

Create the scope with no seeds and rely on passive DNS and certificate transparency data to populate the inventory.

Question 10

An automation script requires secure storage of an API token used to query an external threat intel feed. Where should this token be stored within Cortex XSIAM?

Accepted Answer

Integration Instance Configuration Parameters (marked as Encrypted/Password). Integration Instance Configuration Parameters marked as Encrypted/Password are the designated secure store for credentials such as API tokens in Cortex XSIAM. When a parameter is flagged as encrypted, the value is stored in the tenant's credential vault and masked in the UI, so playbooks and integrations reference it without ever exposing the plaintext secret. This is the platform-supported pattern for secrets used by external threat intel feed queries.

Answer

Within unencrypted XQL lookup CSV files.

Answer

Hardcoded directly inside the playbook JSON file.

Answer

Inside public dashboard notes.