XSIAM-Analyst Practice Exam 4 — 20 Questions

Question 1

An analyst wants to classify network events into risk buckets based on the numeric field `bytes_out`: under 1 MB is 'low', 1 MB to 100 MB is 'medium', and above 100 MB is 'high'. The classification should be added as a new field in the pipeline without removing existing fields. Which approach accomplishes this in XQL?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add an `alter` stage using a chained conditional expression such as `alter risk = if(bytes_out < 1000000, "low", if(bytes_out <= 100000000, "medium", "high"))`.. Creating a derived classification field requires a stage that can compute new field values while preserving the event stream, which is what `alter` does. Nesting conditional expressions inside it evaluates thresholds in order and assigns the correct tier. Filtering only excludes events, aggregating collapses rows, and deduplication removes events without any labeling logic.

Answer

Add a `stats` stage that computes `count()` grouped by `bytes_out`.

Answer

Add a `filter` stage with the three threshold comparisons joined by logical OR operators.

Answer

Add a `dedup` stage on `bytes_out` and let XSIAM automatically infer the risk tier from the value.

Question 2

An administrator is planning a staged rollout of a new Cortex XDR agent version across the enterprise. To mitigate risk, the administrator wants to deploy the new version to a test group of endpoints first. How is this staged deployment managed in XSIAM?

Accepted Answer

Assign the new agent version specifically to the test endpoint group's assigned Profile / Settings.. In Cortex XSIAM, agent version deployment is managed through endpoint groups and their assigned profiles/settings. To stage a rollout, you assign the new agent version to a specific test endpoint group's profile, so only endpoints in that group receive the update. Once validated, you can roll it out to other groups.

Answer

Use an XQL playbook to push executables via remote shell.

Answer

Configure a Broker VM distribution schedule for software binaries.

Answer

Manually uninstall the agent on test machines and run the MSI installer with a CLI switch.

Question 3

A threat hunter wants to detect beaconing by finding source-destination pairs whose connection count is unusually high within a one-hour window. The analyst groups events by source IP, destination IP, and a one-hour time bucket, then counts connections. Which XQL feature supports creating that one-hour time bucket for grouping?

Accepted Answer

Use the `bin` function on the timestamp field inside the grouping clause of the `stats` stage to bucket events into fixed one-hour intervals.. Time-bucketed aggregation is achieved by applying a binning function to the timestamp inside the grouping clause of the aggregation stage. That converts continuous timestamps into fixed one-hour intervals so counts can be compared per pair per window. Deduplication, self-joins, and sorting do not create time buckets and cannot yield the required per-hour connection counts.

Answer

Use the `sort` stage on the timestamp field and manually inspect consecutive events that fall within an hour of each other.

Answer

Use the `dedup` stage on the timestamp field to collapse events into hourly representatives before counting.

Answer

Use the `join` stage to merge the dataset with itself on the timestamp field to form hourly groups.

Question 4

An analyst needs to filter the Incident Queue to display only incidents that contain specific high-priority analytic alert types. Which filtering mechanism should the analyst use in the XSIAM Incident view?

Accepted Answer

Use the filter bar in the Incident view to specify 'Alert Type' equals the desired analytic detection.. Incidents can be filtered by alert types, severity, and other attributes directly in the Incident View filter bar.

Answer

Export incidents to CSV and filter using external spreadsheet software.

Answer

Modify the global XSIAM license configuration to hide low-priority alerts.

Answer

Write an automated response playbook to delete unwanted incidents.

Question 5

An XSIAM Analyst is reviewing the Incident Management dashboard and needs to understand why a specific high-severity incident was automatically merged with an existing one. Which XSIAM feature determines this grouping behavior?

Accepted Answer

Incident Stitching and correlation rules. XSIAM uses Incident Stitching and correlation rules to automatically group related alerts into a single incident based on shared indicators of compromise or entities.

Answer

XQL query aggregation limits

Answer

Manual aggregation policies

Answer

Cortex XDR agent policy versioning

Question 6

When reviewing query performance in XSIAM, what does the 'dataset' command do at the beginning of an XQL query?

Accepted Answer

It defines the starting data source or table for the query pipeline.. The 'dataset' command specifies the target table or data source to query from.

Answer

It sets the retention period for the query logs.

Answer

It compiles the query into an XSIAM correlation rule.

Answer

It exports the resulting dataset to an external S3 bucket.

Question 7

You need to format a raw JSON timestamp retrieved from an API call into a readable date string before displaying it in an incident layout. Which XSIAM playbook feature accomplishes this without custom Python code?

Accepted Answer

Transformer functions (e.g., FormatDate). XSIAM playbooks include transformer functions — built-in, no-code utilities like FormatDate — that manipulate data between tasks. To convert a raw JSON timestamp into a readable date string, you apply a transformer such as FormatDate to the field, avoiding custom Python.

Answer

Incident Layout Scripts

Answer

Syslog Forwarding Rules

Answer

XQL Aggregate Functions

Question 8

You are troubleshooting an Attack Surface Management (ASM) scan in XSIAM where external IP ranges belonging to a newly acquired subsidiary are not showing up in the asset inventory. What is the most likely reason for this discrepancy?

Accepted Answer

The seed domains or IP ranges for the subsidiary have not been added to the ASM configuration scope. ASM relies on defined organization seed assets and authorized external scopes. If the discovery seed is missing, ASM will not map the assets.

Answer

Threat intelligence feeds have disabled automatic asset correlation by default

Answer

The Log Forwarder agent is not installed on the subsidiary endpoints

Answer

The ingestion service for ASM requires manual CSV asset mapping before discovery runs

Question 9

An analyst needs to extract specific Regex matching patterns from an incoming email body during an automated phishing investigation playbook. Which built-in mechanism should be used?

Accepted Answer

Extraction transformer / script command (e.g., ExtractIndicators). In XSIAM playbooks, the Extraction transformer (or the ExtractIndicators script command) is designed to parse text and extract indicators such as IP addresses, URLs, domains, and other regex patterns. It is a built-in mechanism specifically for extracting data from email bodies during phishing investigations.

Answer

XQL Indexing rule

Answer

Syslog output routing

Answer

Agent Policy assignment

Question 10

An XSIAM Analyst is reviewing the Analytics page and needs to understand the difference between standard alerts and incident-bound alerts. Which of the following best describes the role of analytics in XSIAM's alerting process?

Accepted Answer

Analytics automatically evaluate telemetry to generate structured alerts that contribute to security incidents.. In XSIAM, analytics are the detection engine that continuously evaluates ingested telemetry (endpoint, network, identity, cloud) and produces structured alerts. These alerts are not just informational — they are designed to be incident-bound, meaning they automatically contribute to and enrich security incidents within the incident management workflow. This is the core mechanism by which XSIAM turns raw data into actionable detections without requiring manual rule authoring for every scenario.

Answer

Analytics replace the need for correlation rules by directly closing false positives.

Answer

Analytics are exclusively used for reporting compliance and do not affect the active alert queue.

Answer

Analytics only generate raw logs, requiring manual rule creation to produce alerts.

Question 11

An analyst is building a Cortex XSIAM playbook that must run an enrichment task only when the incident's severity is 'Critical' AND the source IP is external. The playbook already has a task that retrieves severity and IP classification. Which playbook construct should the analyst use to evaluate both conditions before proceeding?

Accepted Answer

A conditional task with an AND condition combining the two criteria. The requirement is a single decision that depends on two facts already available in the incident. A conditional task with an AND condition evaluates both criteria together and routes execution only when severity is Critical and the IP is external, which is exactly the gating behavior described. Sequential tasks, human prompts, and data-mutating scripts do not provide that combined automatic check.

Answer

A task that runs a script to set the incident severity to Critical

Answer

A data collection task that asks the analyst to confirm both conditions

Answer

Two sequential conditional tasks, each checking one criterion

Question 12

An XSIAM analyst is investigating an analytic alert triggered by a rare process execution. The analyst wants to see if similar processes have executed across other endpoints in the enterprise over the past 30 days. Which action should the analyst take?

Accepted Answer

Pivot directly from the alert to XQL Search using the pre-populated process hash or name to query historical data.. XSIAM's alert view supports pivoting directly into XQL Search with the alert's key fields (process hash, name, endpoint) pre-populated, letting the analyst query historical telemetry across the enterprise for the past 30 days. This is the intended hunting workflow for scoping a rare process execution.

Answer

Generate a new incident report from the Dashboards menu.

Answer

Restart the analytics engine to force a re-evaluation of historical logs.

Answer

Modify the custom prioritization rule to look back 30 days.

Question 13

An automated playbook task fails intermittently due to a temporary network timeout when contacting an external asset management database. What is the most resilient way to handle this inside the playbook configuration?

Accepted Answer

Configure task-level retries and retry intervals.. Configuring task-level retries with a backoff delay handles transient network glitches automatically.

Answer

Convert the playbook into a manual-only workflow.

Answer

Permanently disable the integration instance.

Answer

Increase the database server's hardware CPU cores.

Question 14

An analyst is building a query to detect abnormal process behavior. They want to calculate the ratio of network connections to process executions for each process name, but only for processes that have at least 5 executions. The relevant events are in the 'xdr_data' dataset with an 'event_type' field indicating 'process' or 'network'. Which XQL query correctly computes this ratio?

Accepted Answer

filter event_type in ("process", "network") | stats count() as cnt by process_name, event_type | stats sum(if(event_type="process", cnt, 0)) as exec_count, sum(if(event_type="network", cnt, 0)) as net_count by process_name | filter exec_count >= 5 | alter ratio = net_count / exec_count. To compute the ratio of network connections to process executions, the query must separately count network and process events per process name, then filter for processes with at least 5 executions, and finally divide network count by execution count. The correct query uses conditional sums in a second 'stats' to derive these counts before calculating the ratio.

Answer

filter event_type in ("process", "network") | stats count() as cnt by process_name, event_type | filter cnt >= 5 | stats sum(cnt) as total by process_name | alter ratio = total / cnt

Answer

filter event_type in ("process", "network") | stats count() as cnt by process_name | filter cnt >= 5 | alter ratio = count(event_type="network") / count(event_type="process")

Answer

filter event_type in ("process", "network") | stats count() as total by process_name, event_type | stats sum(total) as total_count, sum(if(event_type="network", total, 0)) as net_count by process_name | filter total_count >= 5 | alter ratio = net_count / total_count

Question 15

An enterprise uses Broker VMs to proxy agent traffic from an isolated internal network segment to the XSIAM cloud. Several endpoints have stopped reporting via the Broker VM. Where should the administrator check to verify the health and connectivity between the Broker VM and the internal endpoints?

Accepted Answer

Settings > Configurations > Broker VM > Agent Status / App Health. The Broker VM management page in XSIAM displays the status of configured apps, connected agents, and communication health.

Answer

Data Lake > Broker VM dataset > Query Status

Answer

Endpoint Security > Broker Logs > Syslog Viewer

Answer

Response > Broker Actions > Test Connection

Question 16

An ASM scan in XSIAM flags an external web server as having an outdated SSL/TLS certificate. Where can an analyst view the detailed finding context and remediation recommendations for this exposed asset?

Accepted Answer

Click on the specific asset within the Attack Surface Management asset inventory to open its risk and finding details pane. ASM asset findings provide detailed context and risk information directly within the asset's detail pane.

Answer

Export all raw asset logs to an external SIEM for inspection

Answer

Check the Endpoint Security alert queue

Answer

Review the firewall traffic logs associated with port 443

Question 17

When setting up a threat intelligence feed integration in XSIAM, what is the purpose of the 'Fetch Indicators' toggle?

Accepted Answer

It determines whether the integration actively polls and downloads indicators from the source. The Fetch Indicators setting controls whether the integration actively pulls indicators from the source on a scheduled interval.

Answer

It exports local indicators out to an external TAXII server

Answer

It deletes expired indicators from the local database

Answer

It tests the network connectivity to the XSIAM ingestion server

Question 18

A Cortex XSIAM analyst is investigating a ransomware incident. The analyst needs to isolate an infected endpoint from the network to prevent lateral movement. Which action should the analyst take within the XSIAM incident response console?

Accepted Answer

Run the 'isolate endpoint' response action from the incident's Action Center.. The Action Center's 'isolate endpoint' response action is the correct method to immediately contain an infected endpoint by blocking all network traffic except management communication. This prevents lateral movement and further damage. Other options either do not fully isolate the endpoint, require manual steps, or address only a specific file rather than the entire host.

Answer

Create a firewall rule on the network perimeter to block the endpoint's IP address.

Answer

Use the 'Quarantine File' action to quarantine the malicious executable.

Answer

Manually disable the network adapter on the endpoint via remote PowerShell.

Question 19

Which TWO actions can an analyst perform on a threat intelligence indicator directly from the XSIAM Threat Intelligence workspace? (Choose two)

Accepted Answer

Add the indicator to an exclusion list or whitelist. Option B is correct because the XSIAM Threat Intelligence workspace lets analysts add an indicator to an exclusion list or whitelist so it is no longer treated as malicious and does not trigger detections or response actions. Option C is correct because analysts can manually create and add a custom indicator directly in the workspace, allowing them to track organization-specific IOCs that are not present in the built-in threat intelligence feeds. Option A is incorrect because modifying firewall hardware routing tables is a network-infrastructure administration task, not an action available on an indicator in the Threat Intelligence workspace. Option D is incorrect because reflashing endpoint BIOS firmware is a hardware/firmware remediation operation performed through endpoint management, not from the threat intelligence indicator interface. Option E is incorrect because updating global cloud provider DNS records is an external DNS management action outside the scope of XSIAM's Threat Intelligence workspace.

Answer

Modify firewall hardware routing tables

Answer

Reflash the BIOS firmware of endpoints matching the indicator

Answer

Directly update global cloud provider DNS records

Question 20

A Cortex XSIAM playbook is triggered by a correlation rule that fires multiple times for the same incident within a short window. The playbook's first task creates a ticket in an external ITSM system, and duplicate tickets are being created. The analyst confirms that the correlation rule is correctly firing for distinct events but the playbook is running more than once per incident. Which setting should the analyst verify first to prevent duplicate playbook executions for the same incident?

Accepted Answer

The playbook's trigger configuration to ensure it runs only once per incident.. Duplicate playbook executions for the same incident usually stem from a trigger that fires on every matching event rather than once per incident. The analyst should first verify the trigger configuration and ensure it is set to run the playbook only once per incident. Task timeout, concurrency limits, and ITSM deduplication are secondary or unrelated controls that do not prevent the playbook from being invoked multiple times.

Answer

The playbook's maximum concurrent executions setting.

Answer

The playbook's task timeout value.

Answer

The ITSM integration's deduplication settings.