XSIAM-Analyst Practice Test 20 — 15 Questions

Question 1

An analyst notices that a specific registry modification performed by a legitimate software installer is triggering a 'Suspicious Registry Modification' alert in XSIAM. The analyst wants to suppress this specific alert across all endpoints without disabling the underlying Behavioral Threat Protection module. What is the correct way to build this exception?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Cortex XDR exception rule specifying the initiating process hash and the target registry path.. Cortex XSIAM (built on Cortex XDR) allows analysts to create exception rules that suppress specific alerts by matching attributes like the initiating process hash and the target registry path. This suppresses the false-positive alert across all endpoints while leaving the Behavioral Threat Protection (BTP) module fully enabled, so other malicious behaviors are still detected.

Answer

Disable the Windows Registry auditing policy in the domain Group Policy Object.

Answer

Delete the detection rule from the Analytics rule set.

Answer

Lower the endpoint agent's severity threshold to Critical only.

Question 2

While building a playbook in Cortex XSIAM, you need a task that waits for an analyst to approve a high-risk containment action before the playbook continues. The analyst may take several hours to respond. Which task type should you add to the playbook to satisfy this requirement?

Accepted Answer

A manual task that pauses the playbook until an analyst marks it complete. The requirement is a human-in-the-loop approval gate that can remain open indefinitely. A manual task is the only Cortex XSIAM playbook task type that suspends execution and waits for an analyst to complete it, optionally capturing their input. Conditional, data collection, and automation tasks all execute automatically and continue the playbook without waiting for a person.

Answer

An automation task that runs a script to send an email notification to the SOC

Answer

A data collection task that gathers endpoint telemetry from the involved host

Answer

A conditional task that evaluates a decision tree against the incident severity

Question 3

An analyst is reviewing an ASM finding in Cortex XSIAM that flags an external server as exposing an outdated TLS version. The analyst wants to confirm the exact endpoint, port, and certificate details associated with the finding before escalating to the infrastructure team. Where in Cortex XSIAM should the analyst look to view the detailed evidence for this specific ASM finding?

Accepted Answer

The Attack Surface Management findings view, opened on the specific asset and issue. ASM findings in Cortex XSIAM are stored and presented within the Attack Surface Management findings view. Each finding is tied to a discovered asset and a specific issue, and opening it reveals scan-collected evidence such as endpoint, port, TLS version, and certificate details. Other interfaces like threat intelligence, audit logs, and correlation alerts do not hold this scan evidence.

Answer

The Cortex XSIAM audit log filtered by the scan's execution time

Answer

The Threat Intelligence Indicators page filtered by the server's IP address

Answer

The correlation rules engine's alert details for the matching detection rule

Question 4

An enterprise is experiencing high CPU utilization on a subset of developer endpoints running specialized compilation software. The Cortex XDR agent is suspected to be causing file-system scanning overhead. Which specific configuration setting should be adjusted in the Endpoint Security profile to safely reduce resource utilization without entirely disabling threat prevention?

Accepted Answer

Add targeted file path and process exclusions in the Malware Profile scan settings.. To reduce Cortex XDR agent file-system scanning overhead on developer endpoints without disabling threat prevention, the correct approach is to add targeted file path and process exclusions in the Malware Profile scan settings. Exclusions tell the agent to skip known-good, high-churn paths (such as compiler output directories) and trusted build processes, which lowers CPU usage while keeping malware protection active for everything else. This is the surgical, supported method for balancing performance and security.

Answer

Switch the agent operating mode from Full to Collector-only.

Answer

Increase the scheduled full-scan frequency from weekly to daily.

Answer

Disable the Anti-Malware module entirely in the profile.

Question 5

When reviewing alert metrics and tuning detection rules in XSIAM, an analyst wants to identify noisy or low-value analytic rules. Which THREE metrics or views in XSIAM assist in evaluating alert rule effectiveness? (Choose three)

Accepted Answer

Correlation rate and incident grouping frequency for specific alerts. Option A is correct because the correlation rate and incident grouping frequency show how often a given alert gets correlated into incidents, which directly indicates whether a rule produces meaningful, actionable groupings or just noise. Option D is correct because alert closure reasons and false-positive disposition rates reveal the analyst-validated quality of each rule's output, exposing rules that consistently generate false positives or get closed as benign. Option E is correct because total alert volume per analytic rule over time identifies high-volume, low-value rules that flood the queue and are prime candidates for tuning or disabling. Options B and C are incorrect because bandwidth consumption of log forwarders and CPU utilization of query engine nodes are infrastructure/performance metrics, not measures of analytic rule effectiveness or alert value.

Answer

Bandwidth consumption of agent log forwarders

Answer

Physical CPU utilization of the query engine nodes

Question 6

An analyst notices that a high-severity threat intelligence indicator for a malicious domain is present in the XSIAM indicator repository but is not triggering any correlation rule matches against endpoint telemetry, even though several endpoints have resolved that domain. The indicator's expiration date is in the future and the feed that supplied it is enabled. What is the most likely cause?

Accepted Answer

The indicator's reputation was set below the threshold required by the correlation rule, or the indicator type does not map to the field the rule evaluates.. For an indicator in the repository to drive a correlation match, two conditions must hold: the indicator's reputation must meet the rule's threshold, and its type must map to the telemetry field the rule inspects. A live, unexpired indicator from an enabled feed satisfies ingestion, so the failure lies in reputation scoring or type-to-field alignment, which stops the rule from ever producing a match.

Answer

The indicator was ingested with a 'Manual' reputation override, which permanently disables correlation matching for that indicator.

Answer

The indicator lacks a STIX pattern, so XSIAM stores it in the repository but excludes patternless indicators from all correlation rule evaluation.

Answer

The feed's 'Fetch Indicators' toggle is disabled, which prevents the indicator from being correlated even though it appears in the repository.

Question 7

When investigating an endpoint alert in XSIAM, an analyst wants to understand the full scope of potential compromise. Which THREE key data artifacts are typically available within the Causality Analysis View (CAV) for a suspicious process execution? (Choose three)

Accepted Answer

File modifications and registry changes performed by the investigated processes.. The Causality Analysis View (CAV) in XSIAM/Cortex XDR is designed to reconstruct the full chain of activity around a suspicious process, so option A is correct because it surfaces file modifications and registry changes made by the investigated processes, which are core forensic artifacts for scope assessment. Option C is correct because CAV includes network connection details (e.g., remote IP, port, and process responsible) initiated by processes in the causality chain, helping identify C2 or lateral movement. Option D is correct because CAV presents the parent-child process execution tree, showing the sequence of spawned commands and how the suspicious process was launched. Option B is not part of CAV, as Active Directory domain controller replication logs are not endpoint causality artifacts and would come from AD-specific monitoring. Option E is also not part of CAV, since real-time physical RAM dumps are not a standard CAV artifact and would require separate memory acquisition tooling.

Answer

Full Active Directory domain controller database replication logs.

Answer

Real-time physical memory dumps of the endpoint hardware RAM.

Question 8

An analyst is building a Cortex XSIAM correlation rule that uses a threat intelligence indicator set to tag matched events. They need to control how long an ingested indicator remains active before it stops producing matches, so stale indicators from a feed that stopped publishing new data do not keep generating alerts. Which indicator property should the analyst configure on the feed integration to achieve this?

Accepted Answer

Indicator expiration / TTL setting. Configuring an expiration or TTL value on the threat intelligence feed integration ensures each ingested indicator has a defined lifespan. Once that period elapses, XSIAM stops using the indicator for correlation, so indicators from a feed that has stopped publishing do not indefinitely generate alerts against internal telemetry. This directly satisfies the analyst's requirement to control indicator longevity.

Answer

Correlation rule suppression window

Answer

Feed fetch interval in minutes

Answer

Feed reputation score threshold

Question 9

A Cortex XSIAM analyst wants to create a playbook that automatically runs whenever a new high-severity incident is created. The analyst needs to select the appropriate trigger. Which trigger type should the analyst configure?

Accepted Answer

Incident trigger. An incident trigger is designed to start a playbook when an incident is created or updated and can filter by severity. Alert, scheduled, and manual triggers fire at different times or require human action, so they cannot automatically run the playbook on new high-severity incidents.

Answer

Manual trigger

Answer

Scheduled trigger

Answer

Alert trigger

Question 10

When reviewing an incident in the XSIAM Incident View, which TWO pieces of high-level summary information are immediately visible to an analyst? (Choose two)

Accepted Answer

Incident Severity and Status. In the XSIAM Incident View, the incident header/war room immediately surfaces the incident's Severity and Status (B), which are core triage fields used to prioritize and track the investigation, and the Assigned Analyst / Owner (C), which shows accountability and who is handling the case. These two fields are part of the standard high-level incident summary metadata presented to the analyst without needing to drill into raw logs or endpoint data. Options A, D, and E are not part of XSIAM incident summary information: a Wi-Fi SSID password in plaintext (A) is sensitive credential data that would not be displayed as incident metadata, an employee's annual performance review score (D) is HR data unrelated to security incident triage, and the personal home address of the endpoint user (E) is PII not shown as high-level incident summary information.

Answer

Local Wi-Fi router SSID password in plaintext

Answer

The employee's annual performance review score

Answer

The personal home address of the endpoint user

Question 11

During an Attack Surface Management (ASM) review, an analyst needs to confirm which external-facing assets belonging to the organization have a specific known-vulnerable service version exposed. Where in Cortex XSIAM should the analyst look to see the discovered assets, their open ports, and detected service versions for the configured external IP ranges?

Accepted Answer

The Attack Surface Management view under the inventory, where discovered external assets and their observed attributes such as ports and service versions are listed for the configured scan ranges.. Attack Surface Management discovery results are surfaced in the ASM inventory view, which lists external-facing assets and their observed attributes including open ports and detected service versions. To find assets exposing a specific vulnerable service version, the analyst reviews this inventory for the configured external IP ranges rather than looking at threat intelligence, correlation rules, or endpoint inventory.

Answer

The Threat Intelligence indicator repository, filtered by the 'ASM' source tag, where discovered services are stored as indicators.

Answer

The correlation rule library, by searching for rules that reference the vulnerable service version.

Answer

The endpoint device inventory on the management server, since ASM discoveries are merged into the endpoint asset list.

Question 12

An XSIAM analyst is investigating a suspected credential dumping attack (e.g., LSASS memory dumping). Which THREE types of evidence or indicators should the analyst look for in XSIAM endpoint telemetry? (Choose three)

Accepted Answer

Suspicious command-line parameters associated with memory export. Option B is correct because credential dumping tools such as ProcDump or comsvcs.dll MiniDump rely on distinctive command-line arguments (for example, -ma lsass.exe or rundll32 comsvcs.dll MiniDump), so XSIAM should flag suspicious memory-export parameters in process command lines. Option C is correct because LSASS memory dumping requires opening the lsass.exe process with memory-read rights such as PROCESS_VM_READ (0x0010) via OpenProcess, and unusual handle access requests to LSASS memory space are a strong behavioral indicator of credential theft. Option D is correct because execution of known credential dumping utility names or patterns (e.g., mimikatz, procdump, lazagne, pwdump, or renamed variants matching those signatures) directly signals the attack technique. Option A is not relevant because endpoint monitor refresh rate is a display setting unrelated to credential access, and Option E is not relevant because desktop wallpaper modification is a cosmetic change with no bearing on LSASS memory dumping.

Answer

Changes to the endpoint monitor refresh rate

Answer

Modification of desktop wallpaper image files

Question 13

When managing the incident lifecycle in XSIAM, an analyst determines that a triggered alert is a false positive and wants to prevent similar alerts from generating incidents in the future. What is the recommended action?

Accepted Answer

Change the incident status to Closed and tune the correlation rule or add an exception.. Analysts can resolve an incident and tune or suppress the underlying alert rule to prevent future occurrences of the same false positive.

Answer

Export the incident to CSV and purge local cache.

Answer

Delete the alert from the backend database using an administrative XQL delete command.

Answer

Disable the Cortex XDR agent on the affected endpoint.

Question 14

A playbook contains a script task that outputs a large JSON payload exceeding standard context size limits, causing performance degradation. What is the best practice to optimize context storage?

Accepted Answer

Store the raw payload in the XSIAM File Store / Vault and keep only summary metadata in the context.. Storing large payloads in the file store or extracting only required fields prevents bloating the incident context.

Answer

Increase the browser zoom level.

Answer

Run all tasks synchronously in a single monolithic script.

Answer

Disable all logging across the entire XSIAM tenant.

Question 15

An analyst is reviewing the incident scoring for a newly created incident in XSIAM. The incident contains multiple alerts, including a high-severity alert and several low-severity alerts. The analyst notices that the incident score is higher than the score of the high-severity alert alone. What is the most likely explanation for this behavior?

Accepted Answer

XSIAM aggregates alert scores using a weighted sum, where higher severity alerts contribute more, but multiple low-severity alerts can cumulatively increase the incident score.. XSIAM aggregates alert scores to compute an incident score, often using a weighted sum. Multiple low-severity alerts can cumulatively raise the incident score above that of a single high-severity alert. This reflects the combined risk of all associated alerts, rather than just taking the maximum or applying a count-based bonus.

Answer

The incident score is always set to the maximum score among its alerts, so the score should equal the high-severity alert's score.

Answer

The incident score includes a bonus factor for the number of alerts, regardless of their severity.

Answer

The incident score is manually set by the analyst during triage, overriding the alert scores.