XSIAM-Analyst Practice Exam 3 — 20 Questions

Question 1

Which type of indicators can be ingested into XSIAM's Threat Intelligence module?

Accepted Answer

IP addresses, domains, URLs, and file hashes. XSIAM supports multiple indicator types including IP addresses, domains, URLs, and file hashes (MD5, SHA256).

Answer

Only network traffic packet captures (PCAP files)

Answer

Only file hashes (SHA256 and MD5)

Answer

Only internal Active Directory user account names

Question 2

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

Accepted Answer

Attack Surface Management > Assets. Attack Surface Management features have a dedicated workspace within the XSIAM navigation menu.

Answer

Incident Response > ASM Incidents

Answer

Dashboards > Threat Intelligence > ASM

Answer

Settings > Integrations > ASM Scanner

Question 3

Which TWO information sources or artifacts can an analyst inspect within an XSIAM incident to understand the scope of an attack? (Choose two)

Accepted Answer

List of affected endpoints and hosts. Option A (List of affected endpoints and hosts) is correct because XSIAM incidents aggregate endpoint and host artifacts from the underlying telemetry and EDR data, allowing the analyst to enumerate which machines were touched by the attacker and thereby gauge the blast radius. Option E (Associated users and account entities involved) is correct because XSIAM correlates identity data into the incident, exposing the user and account entities tied to the activity so the analyst can determine which credentials were compromised or misused. Together, these two artifacts directly answer the scope question by mapping both the systems and the identities affected. Options B, C, and D are unrelated to security telemetry — a cafeteria menu, printer paper inventory, and parking badge records are not XSIAM incident artifacts and provide no insight into attack scope.

Answer

The local cafeteria lunch menu for the day

Answer

Office printer paper inventory levels

Answer

Employee parking garage badge swipe records outside XSIAM

Question 4

Which TWO actions occur when a playbook task hits a conditional split with multiple matching paths? (Choose two)

Accepted Answer

Depending on configuration, matching paths can execute in parallel or sequentially.. Option A is correct because in a playbook conditional split, when several branches match, the engine's configuration governs whether those matching paths run concurrently (in parallel) or one after another (sequentially), so both behaviors are possible depending on how the split is set up. Option D is correct because the conditional split's core function is to evaluate each branch's condition against the task's output/context, and the results of that evaluation determine which downstream tasks are given the execution flow. Options B, C, and E are incorrect because a conditional split only routes execution flow within the playbook; it does not shut down the XSIAM tenant, clear user browser caches, or purge system logs from disk.

Answer

The entire XSIAM tenant automatically shuts down for maintenance.

Answer

The browser cache of every user is cleared.

Answer

All system logs are permanently purged from disk.

Question 5

Which TWO components are fundamental parts of every XQL query structure? (Choose two)

Accepted Answer

The dataset command specifying the source table. Option B is correct because every XQL query must begin by declaring its data source with a dataset command (for example, `dataset = xdr_data`), which tells the query engine which table or dataset to search. Option E is correct because XQL is a pipelined query language in which stages are chained together using the pipe character (|), such as `dataset = xdr_data | filter ... | fields ...`, so the pipeline syntax is fundamental to the query structure. Option A is incorrect because XQL is not SQL and does not use a SQL SELECT statement header; it uses dataset and stage commands instead. Option C is incorrect because playbook triggers belong to automation/playbook configuration, not to the query language itself. Option D is incorrect because XQL queries are plain text and require no XML schema declaration.

Answer

A SQL SELECT statement header

Answer

An automated playbook trigger reference

Answer

A mandatory XML schema declaration

Question 6

An analyst investigates a suspected lateral-movement burst and needs to identify source hosts that connected to more than 15 distinct destination IPs within a single hour. The relevant authentication events are already filtered into the pipeline. Which XQL construction produces one row per source host per hour with the distinct destination count?

Accepted Answer

bin timestamp span = 1h as hour | comp count_distinct(dst_ip) as dest_count by src_host, hour | filter dest_count > 15. Detecting a lateral-movement burst requires counting unique destinations rather than raw events, because repeated contacts to one host are not lateral movement. Bucketing the stream into one-hour windows with bin, then applying comp count_distinct(dst_ip) grouped by source host and bucket, produces exactly one row per host per hour, and the filter enforces the 15-destination threshold.

Answer

comp count(dst_ip) as dest_count by src_host | filter dest_count > 15

Answer

stats max(dst_ip) as dest_count by src_host | filter dest_count > 15

Answer

dedup dst_ip by src_host | comp count() as dest_count by src_host | filter dest_count > 15

Question 7

An analyst is handling an incident in XSIAM where the attacker moved laterally from a compromised workstation to a server. The analyst wants to identify all affected endpoints and their current containment status from a single view. Which XSIAM feature should the analyst use?

Accepted Answer

Incident Investigation. The Incident Investigation view is designed to give analysts a comprehensive picture of an incident, including all affected endpoints and their containment status. It consolidates data from various sources, enabling quick assessment and response. The other options serve different purposes: War Room for collaboration, Endpoint Management for configuration, and Threat Intelligence for context.

Answer

Threat Intelligence

Answer

Incident War Room

Answer

Endpoint Management

Question 8

An organization wants to reduce noise from a known vulnerability scanner that triggers high-severity analytics alerts every weekend. The SOC decides to suppress these specific alerts during scanning windows. How should the analyst configure this in XSIAM?

Accepted Answer

Create an Exclusion or Suppression rule in the Incident and Alert Settings with time-based criteria.. Alert suppression rules can be configured with specific time schedules and filter criteria to mute known benign scanner activity.

Answer

Modify the firewall security policy to block the scanner IP.

Answer

Configure a global severity override to change the scanner alerts to 'Informational' permanently.

Answer

Delete the underlying log source parser during the scanner execution window.

Question 9

An organization deploys Cortex XDR agents to Linux servers. Certain critical database files residing on custom mount points are experiencing I/O latency due to agent monitoring. How should the administrator configure file integrity monitoring (FIM) or malware scan paths to exclude these specific mount points on Linux endpoints?

Accepted Answer

Configure path exclusions in the Linux Malware / Scan profile pointing to the custom mount directories.. Linux agent settings and Malware profiles allow path-based exclusions tailored to mount points and directories.

Answer

Modify the /etc/fstab file on each server to disable XDR hooks.

Answer

Disable auditd integration in the Data Collection settings.

Answer

Change the agent mode from Advanced to Basic via the Linux kernel module configuration.

Question 10

What is the purpose of tagging threat intelligence indicators in XSIAM?

Accepted Answer

To categorize and group indicators for targeted hunting and filtering in investigations. Tags allow analysts to categorize, organize, and filter indicators for custom hunting queries and incident investigations.

Answer

To increase the processing speed of the ingestion engine

Answer

To automatically block network traffic without creating alerts

Answer

To encrypt sensitive indicators stored in the database

Question 11

Which TWO methods can be used to pass data between parent playbooks and sub-playbooks in XSIAM? (Choose two)

Accepted Answer

Playbook inputs and arguments mapping. Sub-playbooks accept inputs via mapped arguments and return outputs back to the parent context.

Answer

Manual USB drive file transfer

Answer

Direct hardware memory pointers

Answer

Hardcoding variables in system environment files

Question 12

During an investigation, an analyst identifies an external IP address communicating with multiple internal hosts. To gather threat intelligence context on this IP address directly within XSIAM, which feature should the analyst inspect?

Accepted Answer

Threat Intelligence indicator details and context view. XSIAM provides built-in Threat Intelligence management where indicators (IPs, domains, hashes) are enriched with threat feeds and can be inspected for context.

Answer

Network interface promiscuous mode switch

Answer

Syslog forwarding status panel

Answer

Cortex XDR Firewall local rulebase

Question 13

An analyst needs to quickly determine which endpoints in the organization are missing critical security content updates that could leave them vulnerable to recently discovered threats. Which XSIAM view should the analyst consult to see agent content version status across the fleet?

Accepted Answer

The Endpoint Management page showing agent version and content version columns. The Endpoint Management page in XSIAM consolidates agent and content version information for every registered endpoint. By sorting or filtering on content version, an analyst can immediately see which systems are behind and need updates. This is the fastest way to assess fleet-wide update status and prioritize remediation for endpoints exposed to new threats.

Answer

The Query Center with a preset for agent installation dates

Answer

The Policy Management page listing applied profiles

Answer

The Incidents page filtered by high severity

Question 14

Which type of analytic alert in XSIAM focuses specifically on identifying unauthorized or anomalous credential usage?

Accepted Answer

Credential Access and User Anomaly analytic alerts. User behavior analytics (UBA) or credential-based analytics focus on credential anomalies.

Answer

Agent Heartbeat Failure alerts

Answer

Network Packet Inspection alerts

Answer

Disk Storage Allocation alerts

Question 15

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

Accepted Answer

XQL Search using dataset xdr_data with filters on actor process and action process. XQL Search is the primary interface for querying normalized endpoint datasets (such as xdr_data) to hunt for specific process relationships.

Answer

Broker VM > Log Viewer > Filter Process

Answer

Incident Viewer > Advanced Filter > Process Spawn

Answer

Endpoint Security > Asset Explorer > Live Query

Question 16

A security manager wants Cortex XSIAM to automatically raise the severity of incidents involving indicators that appear on a specific high-confidence threat intelligence feed, without affecting incidents tied to lower-confidence feeds. Which configuration achieves this requirement?

Accepted Answer

Set the feed's reputation to 'Bad' and assign a high severity value to the feed's indicators in the feed integration configuration.. XSIAM feed integrations let analysts define the reputation and severity applied to indicators from each source. By assigning a high severity to a high-confidence feed, incidents correlated with those indicators inherit elevated severity automatically, while indicators from other feeds keep their own severity values, providing selective, source-aware prioritization without disabling coverage.

Answer

Modify the incident's severity manually each time a matching indicator appears.

Answer

Create a separate tenant dedicated to the high-confidence feed so its indicators are isolated.

Answer

Disable all other feeds so only the high-confidence feed contributes indicators to incidents.

Question 17

An analyst is responding to an incident involving a compromised user account in XSIAM. The analyst needs to contain the threat and prevent further unauthorized access. Which TWO actions should the analyst take? (Choose two.)

Accepted Answer

Disable the user account in Active Directory. Disabling the user account and revoking all active sessions are the two most effective immediate containment actions for a compromised account. Disabling prevents new logins, while revoking sessions terminates existing ones. Together, they ensure the attacker loses access. Other actions like password reset or IP blocking are either insufficient or not targeted enough.

Answer

Block the user's IP address at the firewall

Answer

Delete the user account

Answer

Reset the user's password

Question 18

An XSIAM analyst is reviewing the Alerts table and wants to quickly identify which alerts are associated with a specific incident. Which column or field in the Alerts table should the analyst use to filter for alerts that are part of an incident?

Accepted Answer

Incident ID. The Incident ID column in the Alerts table explicitly shows the incident identifier if the alert is correlated into an incident. Filtering on this field allows analysts to separate incident-bound alerts from standalone ones. This is essential for understanding which alerts are already being investigated as part of a larger incident.

Answer

Status

Answer

Source

Answer

Severity

Question 19

While triaging an incoming security incident in XSIAM, an analyst observes multiple analytic alerts grouped together under a single incident container. What is the primary mechanism XSIAM uses to group these alerts?

Accepted Answer

Automated correlation based on shared entities, timelines, and attack chains.. XSIAM's core value proposition is its ability to automatically correlate alerts into incidents using machine learning and the Cortex Data Model (XDM). It groups alerts that share entities (IPs, users, hosts), occur within related timelines, and form part of the same attack chain, dramatically reducing analyst alert fatigue. This automated correlation is what transforms thousands of raw alerts into a manageable set of incidents.

Answer

Pre-configured firewall policy matches only.

Answer

Random assignment by the system load balancer.

Answer

Manual aggregation performed by the ingestion service.

Question 20

An XSIAM analyst is responding to a confirmed malware incident on an endpoint. The analyst needs to immediately isolate the endpoint from the network to prevent further spread. Which XSIAM action should the analyst take?

Accepted Answer

Run the 'Isolate Endpoint' action from the incident response playbook. Isolating the endpoint via the 'Isolate Endpoint' action is the correct immediate containment step for a malware infection. It severs network communications to prevent spread while allowing remediation. Other actions like disabling accounts or blocking hashes are not sufficient to contain an active infection on the endpoint itself.

Answer

Block the malware's hash in the endpoint protection policy

Answer

Disable the user account associated with the endpoint

Answer

Create a new incident for the endpoint and assign it to the security team