XSIAM-Analyst Practice Exam 2 — 20 Questions

Question 1

An administrator needs to prevent end users from stopping the Cortex XDR agent service on their Windows workstations. The administrator plans to enable password protection for the agent. Which statement correctly describes how password protection affects agent operations in Cortex XSIAM?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Password protection requires a password to uninstall or tamper with the agent, and the password is set in the agent configuration profile applied to the endpoint.. Cortex XSIAM agent password protection is configured in the agent profile and requires a password for uninstall or tamper operations, preventing users from stopping or removing the agent. It is not an OS-level encryption or Group Policy feature, and it applies to Windows agents. The other options misdescribe the mechanism or incorrectly limit its platform support.

Answer

Password protection encrypts the agent's local database and requires a password each time the endpoint boots.

Answer

Password protection is enforced by the Windows operating system's Group Policy and is unrelated to the Cortex XDR agent configuration.

Answer

Password protection only applies to macOS and Linux agents; Windows agents rely solely on Windows service permissions.

Question 2

A threat intelligence administrator has ingested a feed of domain indicators into Cortex XSIAM. Several of those domains are legitimate business partners, and the administrator wants future correlation and detection logic to ignore them without deleting the indicators or disabling the entire feed. Which XSIAM mechanism should the administrator use?

Accepted Answer

Create an allow list entry for the partner domains so they are treated as known-good. The administrator needs indicators to remain stored while being excluded from correlation and detection. Allow listing marks the partner domains as known-good inside Cortex XSIAM, so detections skip them while the indicators stay visible and auditable. Ingestion exclusions delete them from the store, confidence thresholds affect unrelated indicators, and retention changes degrade the whole feed.

Answer

Add the partner domains to the feed's exclusion list so they are dropped at ingestion

Answer

Lower the feed's confidence score threshold so low-confidence indicators are not correlated

Answer

Set the feed to expire indicators after a short retention window so stale entries stop matching

Question 3

Which TWO actions can be performed directly within the Cortex XSIAM Playbook Designer? (Choose two)

Accepted Answer

Configure conditional branches and links between tasks.. Playbook designers allow building visual workflows, configuring task parameters, and linking conditions.

Answer

Write custom XQL queries for data ingestion pipelines.

Answer

Modify global firewall routing tables.

Answer

Install local endpoint security agents.

Question 4

When designing a playbook, you want to assign an incident to a specific Tier 2 analyst group only if the alert severity is marked as 'High'. Which playbook element should you place before the assignment task?

Accepted Answer

Condition Task. A condition task evaluates the incident severity and directs flow accordingly.

Answer

Notification Task

Answer

Data Parsing Task

Answer

Enrichment Task

Question 5

An analyst reviews an analytic alert and notices its severity is classified as 'Medium', but wants to understand which specific sub-techniques triggered the detection. Where should the analyst look within the XSIAM interface?

Accepted Answer

The MITRE ATT&CK section within the Alert Details view.. MITRE ATT&CK tactics and techniques associated with an analytic alert are visible in the alert details and MITRE coverage views.

Answer

Settings > Analytics > MITRE Mapping Table.

Answer

The Incident Graph timeline nodes.

Answer

Dashboards > Threat Intelligence widgets.

Question 6

What is the primary purpose of the Cortex Data Model (CDM) in XSIAM?

Accepted Answer

To normalize disparate log sources into a standardized schema for consistent querying.. The Cortex Data Model normalizes disparate log sources into standardized schemas and fields for uniform querying.

Answer

To encrypt telemetry data before it leaves the endpoint agent.

Answer

To automatically remediate incidents without analyst intervention.

Answer

To compress log storage sizes on disk by removing redundant headers.

Question 7

When configuring a new threat intelligence feed integration in Cortex XSIAM, which TWO configuration parameters are typically required for successful API-based ingestion? (Choose two)

Accepted Answer

API Authentication Key, Token, or Credentials. API-based threat intelligence integrations require endpoint URLs and authentication credentials (such as API keys or tokens) to connect and pull data.

Answer

Endpoint agent installation package version

Answer

Active Directory Domain Controller IP address

Answer

Syslog facility number

Question 8

Which XSIAM construct allows you to package a reusable set of playbook tasks into a modular component that can be invoked by multiple parent playbooks?

Accepted Answer

Sub-playbook. Sub-playbooks provide modular, reusable playbook logic that can be called from main playbooks.

Answer

Integration Instance

Answer

Custom Layout

Answer

XQL Alert Rule

Question 9

A playbook designer needs to reference a specific value extracted from a previous task's output within Cortex XSIAM. Which syntax must be used to access this context data?

Accepted Answer

${Path.To.Data}. Context data in Cortex XSIAM playbooks is referenced using the ${Path.To.Data} syntax to dynamically pull information from previous task outputs.

Answer

#{Path.To.Data}

Answer

Answer

[[Path.To.Data]]

Question 10

An analyst needs to create a custom analytic rule in XSIAM using XQL (XSIAM Query Language) to detect unusual PowerShell activity. Which section of the XSIAM platform should the analyst navigate to build and test this rule?

Accepted Answer

Analytics > Detection Rules > Add Rule > XQL Rule. Custom analytics rules based on XQL are created and managed within the Analytics rule builder under the Detection rules section.

Answer

Settings > Automation > Playbooks > New Rule

Answer

Frames > Dashboards > Query Builder

Answer

Investigation > XQL Search > Save as Incident

Question 11

While troubleshooting a failed custom automation script inside a playbook, you notice that the script returned a non-standard error object. Where should you look first within XSIAM to inspect the raw inputs and outputs passed to the automation?

Accepted Answer

Playbooks > Execution History > Task Details. The Cortex XSIAM War Room or the Automation execution logs store the detailed inputs, outputs, and traceback for troubleshooting script execution.

Answer

Data Hub > Query Service

Answer

Settings > Integrations > Instances logs

Answer

Incidents > Audit Trail

Question 12

When utilizing the 'compact' or 'dedup' commands in an XQL query, an analyst notices that certain fields are missing from the resulting dataset. Why does this behavior occur?

Accepted Answer

The dedup command drops all fields that are not part of the specified grouping key or explicitly retained.. By default, 'dedup' retains only the fields present in the groupby or distinct fields unless specified with specific retain parameters or prior projections.

Answer

XQL automatically normalizes all omitted fields to null values instead of dropping them.

Answer

The schema definition overrides field selection during sorting stages.

Answer

The query engine automatically truncates datasets larger than 1MB.

Question 13

What is the primary purpose of the 'Playbook Debugger' or test run feature when developing a new playbook in XSIAM?

Accepted Answer

To test and validate playbook flow logic and context mapping using sample incidents.. Test runs allow developers to dry-run playbooks against existing test incidents to verify logic and context outputs.

Answer

To debug network firewall rules.

Answer

To analyze log parsing syntax in Data Hub.

Answer

To scan endpoints for malware signatures.

Question 14

An analyst is investigating an incident and needs to isolate an infected endpoint directly from the XSIAM Incident View. Which response action should the analyst execute?

Accepted Answer

Isolate Endpoint. From the Incident View or Endpoint View in XSIAM, analysts can execute the 'Isolate Endpoint' response action to restrict network communication while maintaining management connectivity.

Answer

Kill Process Tree

Answer

Block IP Address

Answer

Quarantine File

Question 15

An analyst needs to retrieve running process information from a specific active endpoint in real time without waiting for scheduled telemetry uploads. Which XSIAM feature should the analyst use?

Accepted Answer

Live Query (osquery). Live Query allows administrators to run osquery-based commands directly against active endpoints to gather real-time system state.

Answer

Asset Inventory export

Answer

Incident Viewer timeline

Answer

XQL historical search

Question 16

While reviewing a complex multi-stage attack in XSIAM, an analyst wants to visualize the sequence of process creation events on an endpoint. Which XSIAM feature provides a graphical representation of parent-child process relationships and associated network connections?

Accepted Answer

Causality Chain. The Causality Chain in XSIAM provides a graphical, tree-like view of process execution history, showing parent-child relationships and associated artifacts.

Answer

MITRE ATT&CK Matrix Dashboard

Answer

Incident Graph Mapping

Answer

BIOC Breakdown View

Question 17

An organization wants to integrate a proprietary threat intelligence feed that uses a non-standard JSON format. What tool or method should be used within XSIAM to ingest and parse this feed correctly?

Accepted Answer

Use the Generic Feed integration with custom JSON path mapping. Custom feeds that do not match out-of-the-box integrations can be parsed using custom feed integrations or mapping transformations.

Answer

Rewrite the core XSIAM ingestion engine in Python

Answer

Manually convert the JSON feed into a Windows Event Log format

Answer

Configure an endpoint agent to scrape the JSON URL locally

Question 18

An analyst is investigating an incident where an internal host communicated with a known malicious domain. To verify when the threat intelligence indicator was first and last seen by XSIAM, where should the analyst look?

Accepted Answer

The indicator's details view within the Threat Intelligence module repository. The Threat Intelligence indicator details page records historical sightings, first seen, and last seen timestamps.

Answer

The local endpoint registry hive on the infected workstation

Answer

The ASM asset discovery log

Answer

The firewall hardware diagnostic logs

Question 19

You are configuring Attack Surface Management in XSIAM to monitor brand infringement and typosquatting domains. Which ASM configuration feature enables this capability?

Accepted Answer

External Domain Monitoring and Typosquatting detection rules based on seed keywords. ASM includes domain monitoring capabilities such as typosquatting and brand exposure detection based on seed organization names.

Answer

Endpoint firewall rule generators

Answer

Active Directory domain trust relationship settings

Answer

XQL threat hunting regex patterns on proxy logs

Question 20

A threat hunter is analyzing authentication logs in XSIAM using XQL. They want to identify potential brute-force attacks by finding source IP addresses that have more than 10 failed login attempts within a 5-minute window. The logs are in the 'auth_logs' dataset with fields 'src_ip', 'event_time', and 'status' (where 'status' is either 'success' or 'failure'). Which two XQL stages or functions are essential to achieve this? (Choose two.)

Accepted Answer

filter status = "failure". To detect brute-force attacks, the query must first isolate failed login events using a filter on status. Then it must count those failures per source IP within a 5-minute window, which requires an aggregation grouped by source IP and a time bucket. These two steps are the core of the detection. Sorting, deduplication, or external joins are either counterproductive or non-essential for the fundamental count-based logic.

Answer

sort by event_time desc

Answer

join with a threat intelligence dataset on src_ip

Answer

dedup src_ip