XSIAM-Analyst Practice Test 21 — 15 Questions

Question 1

An XSIAM analyst is reviewing an incident where a suspicious binary was executed on a critical server. The analyst wants to determine the parent process that spawned the binary and the full command line used. Which XSIAM artifact or view should the analyst consult?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Process causality view. The process causality view is designed to show the sequence of process executions, including parent-child relationships and command-line arguments. It is the correct tool for determining how a suspicious binary was launched. Other artifacts like network logs or registry events do not provide this level of process detail.

Answer

Registry modification events

Answer

Network connection logs

Answer

File integrity monitoring alerts

Question 2

A SOC team wants its Cortex XSIAM playbooks to enrich and respond to incidents automatically without analyst intervention, but only for incidents that meet strict criteria. Which TWO capabilities allow a playbook to be triggered and controlled automatically based on incident attributes? (Choose two.)

Accepted Answer

Using a conditional task at the start of the playbook that evaluates incident fields and routes execution down only the matching branch.. Automatic, criteria-scoped execution in Cortex XSIAM relies on a trigger that fires on incident creation and is constrained by a saved filter over incident fields, plus a conditional task inside the playbook that evaluates those fields at runtime and routes only matching incidents into the response path. Together they ensure automation runs unattended but exclusively for incidents that satisfy the SOC's strict conditions.

Answer

Increasing the playbook's maximum concurrent executions so it can process more incidents at once.

Answer

Enabling the playbook's 'run silently' option so it executes without generating any tasks in the War Room.

Answer

Assigning the playbook to a dedicated incident queue that analysts manually review before execution begins.

Question 3

An XSIAM analyst is investigating a suspected data exfiltration incident. The analyst needs to identify all outbound connections from a specific endpoint to external IP addresses that transferred more than 100 MB of data in the last 24 hours. Which XQL query will achieve this?

Accepted Answer

dataset = xdr_data | filter action_local_ip = "10.0.0.5" and action_remote_ip not in (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) | comp sum(bytes_out) as total_bytes by action_remote_ip | filter total_bytes > 100000000. To detect potential exfiltration, the query must sum outbound bytes to external IPs and apply a threshold in bytes. The correct query filters for the endpoint, excludes private IP ranges to focus on external destinations, aggregates bytes_out per remote IP, and filters for totals exceeding 100 MB. This provides a clear list of external endpoints that received significant data.

Answer

dataset = xdr_data | filter action_local_ip = "10.0.0.5" | comp sum(bytes_in) as total_bytes by action_remote_ip | filter total_bytes > 100000000

Answer

dataset = xdr_data | filter action_local_ip = "10.0.0.5" and action_remote_ip not in (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) | comp count() as conn_count by action_remote_ip | filter conn_count > 100

Answer

dataset = xdr_data | filter action_local_ip = "10.0.0.5" and action_remote_ip not in (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) | comp sum(bytes_out) as total_bytes by action_remote_ip | filter total_bytes > 100

Question 4

An XSIAM analyst notices that a specific analytic alert has been triggering repeatedly for the same endpoint but with different timestamps. The analyst wants to group these related alerts into a single incident to streamline investigation. Which XSIAM feature should the analyst use?

Accepted Answer

Incident Grouping Rules. Incident Grouping Rules are designed to aggregate alerts into incidents based on defined criteria. By using such a rule, the analyst can combine repeated alerts from the same endpoint into one incident, making it easier to investigate the activity as a whole rather than handling each alert separately.

Answer

Alert Exclusion Rules

Answer

Analytic Rule Tuning

Answer

Custom Prioritization Rules

Question 5

An analyst is handling an incident in XSIAM where the same endpoint has generated three separate alerts for suspicious PowerShell activity over the past hour. The analyst wants to consolidate these related alerts into a single investigation view to avoid duplicate effort. Which XSIAM feature should the analyst use?

Accepted Answer

Incident merging. Merging related incidents into a single parent incident is the correct approach when multiple alerts pertain to the same activity on the same endpoint. This reduces duplication, maintains a unified evidence set, and allows the analyst to investigate the full scope efficiently. Other features like deduplication or tagging do not provide a consolidated investigation view.

Answer

Playbook execution

Answer

Alert deduplication

Answer

Incident tagging

Question 6

An analyst is building a playbook that must conditionally send an email notification only when the incident's severity is 'High' and the affected asset is marked as 'Production' in the CMDB. The CMDB lookup returns a JSON object. Which TWO approaches correctly implement this conditional logic within the Cortex XSIAM playbook? (Choose two.)

Accepted Answer

Use a condition task that evaluates two separate expressions joined by an AND operator.. The requirement is an AND of two conditions: severity equals High and asset classification equals Production. Cortex XSIAM condition tasks can evaluate multiple expressions with logical operators, and sequential condition tasks can also express AND logic by gating the second check behind the first. Both approaches ensure the email notification runs only when both conditions are true, while the other options either rely on unsupported task-level filtering or shift the decision to a human.

Answer

Use a single condition task that evaluates the severity expression only, then rely on the email task's built-in filter to check the asset classification.

Answer

Use a data collection task to prompt the analyst, and let the analyst decide whether to send the email.

Answer

Use a JavaScript automation task that returns a boolean, and configure the playbook to branch based on that task's output.

Question 7

An analyst is building an XQL query that pulls from a dataset with millions of events and must reduce the volume of data returned to the console while still preserving counts for reporting. Which TWO statements about XQL pipeline behavior are accurate in this scenario? (Choose two.)

Accepted Answer

Using `stats` with a grouping field collapses matching events into aggregated rows, so the returned row count is typically far smaller than the input event count.. Early filtering minimizes the event set before costly stages run, and grouped aggregation collapses many events into few rows while retaining counts, so both directly serve the goal of reducing returned volume without losing reporting fidelity. Truncating early destroys data, deduplication does not count, and column narrowing does have a performance benefit.

Answer

Field selection stages do not affect performance because XSIAM always materializes every field from storage regardless of the query.

Answer

Adding a `limit` stage at the very start of the pipeline guarantees the aggregation still sees every original event.

Answer

The `dedup` stage preserves every duplicate event while adding a count column for each repeated value.

Question 8

A Cortex XSIAM analyst needs a playbook to pause and wait for a human reviewer to approve blocking a suspicious domain before the block task executes. The reviewer may also need to provide a justification note. Which TWO configurations are required to implement this human-in-the-loop step? (Choose two.)

Accepted Answer

A conditional task that evaluates the reviewer's response before the block task runs. Human-in-the-loop approval requires two things: a way to ask the reviewer and capture the answer, and a way to act on that answer. A data collection task provides the prompt and stores the response in context, while a conditional task reads that response and routes execution so the block only happens on approval. Timer, file-write, and auto-close tasks do not collect or evaluate the decision.

Answer

A timer task that delays execution for a fixed number of minutes

Answer

A task that automatically closes the incident if no response is received within one hour

Answer

A script task that writes the domain to a blocklist file on the XSIAM server

Question 9

An organization's security policy requires that any threat intelligence indicator originating from an untrusted open-source feed must not automatically generate high-severity blocking alerts. How can this policy be enforced in XSIAM?

Accepted Answer

Configure the feed's default reliability rating to 'Low' or adjust the correlation rule criteria to ignore feeds with low reliability. XSIAM enforces feed trust through reliability ratings and correlation rule criteria. Setting an untrusted open-source feed's default reliability to 'Low' (or configuring the correlation rule to exclude low-reliability feeds) prevents indicators from that feed from generating high-severity blocking alerts, satisfying the policy without disabling detection entirely.

Answer

Disable all incident generation globally

Answer

Set the endpoint agent operational mode to 'Disabled'

Answer

Delete the integration instance every evening

Question 10

An administrator has created a new endpoint profile for a subset of point-of-sale (POS) terminals. After saving and assigning the profile, the administrator notices that terminals are not reflecting the updated policy settings. What is the most likely reason for this delay?

Accepted Answer

The endpoints have not yet completed their polling interval to download the updated profile configuration from the XSIAM cloud.. XSIAM endpoint agents periodically poll the cloud for updated profiles and policy configurations rather than receiving instant push updates. After a profile is saved and assigned, there is a delay until each endpoint's next polling interval, during which the terminal continues using the previous configuration. This is the most likely reason for the observed delay.

Answer

The agent must be manually uninstalled and reinstalled with the new profile embedded in the installer.

Answer

Profile changes are only applied during scheduled OS maintenance windows configured in XSIAM.

Answer

POS terminals are locked by XSIAM and cannot accept policy changes without an enterprise root token override.

Question 11

A Cortex XSIAM analyst needs a playbook to pause for a fixed period before checking whether an endpoint isolation command has completed, because the endpoint agent reports status asynchronously. Which playbook task should the analyst insert to introduce that fixed wait?

Accepted Answer

A sleep task configured with the desired wait duration.. Introducing a fixed wait in a Cortex XSIAM playbook is the job of the sleep task, which halts execution for a configured duration. Placing it before the isolation status check allows the asynchronous endpoint agent report to arrive. Conditional tasks only branch, and data collection or manual tasks introduce human dependencies rather than a deterministic timed pause.

Answer

A conditional task that evaluates the isolation status field.

Answer

A data collection task that prompts the analyst for the isolation result.

Answer

A manual task assigned to the endpoint administrator.

Question 12

Which TWO actions can an analyst take within XSIAM to manage or respond to analytic alerts effectively? (Choose two)

Accepted Answer

Review alert details including MITRE ATT&CK mapping and scoring context. Analysts can investigate alert details, assign status, add feedback, or pivot to XQL search.

Answer

Directly flash the BIOS of the alerting endpoint from the alert menu

Answer

Format the hard drive of the XSIAM management server

Answer

Manually recompile the underlying C++ source code of the analytic engine

Question 13

A SOC manager wants to ensure that all alerts with a severity of 'Critical' are automatically assigned to the on-call analyst and that an incident is created immediately. The manager creates a custom prioritization rule that sets the severity to 'Critical' and assigns the incident to the on-call analyst. However, after testing, they notice that incidents are not being created for these alerts. What is the most likely cause of this issue?

Accepted Answer

The custom prioritization rule does not have the 'Create Incident' action enabled.. Custom prioritization rules in XSIAM can perform multiple actions, including setting severity, assigning owners, and creating incidents. To automatically create an incident, the rule must have the 'Create Incident' action enabled. Without this action, the rule will only modify alert properties and will not generate an incident. The other options are less likely because they either do not prevent incident creation or introduce unsupported assumptions.

Answer

The rule is not applied because the alert severity is already set to 'Critical' by the analytics.

Answer

The on-call analyst does not have the necessary permissions to be assigned incidents.

Answer

The rule's priority is lower than the default incident creation rule, so it is overridden.

Question 14

An XSIAM analyst is reviewing a new high-severity incident and wants to see all the raw alerts, entities, and evidence that XSIAM automatically grouped together for this incident. Which part of the incident view should the analyst examine?

Accepted Answer

The incident's Issues and Evidence sections, which show the grouped alerts and supporting artifacts. XSIAM automatically correlates related alerts and artifacts into a single incident. The Issues and Evidence sections in the incident view present those grouped items, giving the analyst the raw alerts, entities, and supporting evidence needed to begin triage. The playbook library, schema browser, and audit log serve different purposes and do not display incident contents.

Answer

The playbook library, which lists all available automated response playbooks

Answer

The system audit log, which records configuration changes made by administrators

Answer

The data model schema browser, which documents normalized field mappings

Question 15

An analyst needs to ingest a commercial threat intelligence feed into Cortex XSIAM. The feed publishes indicators in a proprietary XML schema that no built-in integration supports, and the vendor provides only a REST endpoint returning that XML. What is the correct approach to make these indicators available in XSIAM?

Accepted Answer

Build a custom feed integration or parser that fetches the REST endpoint, transforms the proprietary XML into the expected indicator format, and ingests it.. Proprietary schemas are handled through custom integrations or parsers that fetch from the available endpoint, transform the data into XSIAM's expected indicator format, and ingest it into the store. This keeps enrichment automated and current. Manual uploads, direct live querying, and forcing vendor reformatting all fail to deliver reliable, automated ingestion for a non-standard commercial feed.

Answer

Request that the vendor reformat its feed to the STIX/TAXII standard before any ingestion can occur.

Answer

Point the XSIAM indicator store directly at the vendor's XML endpoint so it parses the schema natively at query time.

Answer

Manually copy the indicators from the vendor portal into a text file and upload it once as a static indicator list.