XSIAM-Analyst Practice Test 22 — 15 Questions

Question 1

An enterprise requires continuous monitoring of endpoint security posture. Which TWO metrics or statuses are actively tracked in the XSIAM endpoint asset inventory? (Choose two)

Accepted Answer

Cortex XDR agent version installed on the endpoint. Option B is correct because the XSIAM endpoint asset inventory continuously tracks the Cortex XDR agent version installed on each endpoint, which is essential for verifying agent health, ensuring up-to-date protection, and identifying endpoints needing upgrades. Option C is correct because the inventory also tracks operating system type and patch level details, giving security teams the OS context and vulnerability exposure needed for posture monitoring and risk-based prioritization. Options A, D, and E are incorrect because Wi-Fi router signal strength, printer spooler queue depths, and monitor refresh rate/screen resolution are hardware or peripheral attributes unrelated to endpoint security posture and are not collected as security-relevant metrics in the XSIAM endpoint asset inventory.

Answer

Office Wi-Fi router signal strength

Answer

Local user printer spooler queue depths

Answer

Monitor refresh rate and screen resolution

Question 2

An administrator manages a fleet of Windows endpoints in Cortex XSIAM. The security team wants to prevent end users from stopping the Cortex XDR agent service via the Services console, while still allowing administrators to uninstall the agent with a valid uninstall password. Which agent setting should the administrator enable?

Accepted Answer

Enable 'Agent Self-Protection' to prevent termination of the agent process and its services.. Agent Self-Protection is the built-in Cortex XDR capability that guards the agent service and processes against tampering, including attempts to stop the service from the Services console. Because it operates independently of uninstall authorization, administrators can still uninstall the agent by supplying the configured uninstall password, which precisely matches the stated requirement.

Answer

Deploy a Windows Group Policy Object that sets the Cortex XDR service startup type to Automatic and denies stop permissions to the Users group.

Answer

Enable 'Behavioral Threat Protection' to block service-stopping behavior on endpoints.

Answer

Configure an 'Agent Settings' profile with a password-protected uninstall and disable the agent tray icon.

Question 3

An XSIAM analyst is reviewing an incident that was automatically created by the platform. The incident details show that it was triggered by a correlation rule. The analyst wants to understand exactly which raw log entries matched the rule's criteria. Where can the analyst find this information?

Accepted Answer

In the Incident War Room, under the 'Alerts' tab, by expanding the specific alert and viewing its 'Raw Log' section.. The Incident War Room aggregates all alerts that constitute an incident. Each alert includes a direct reference to the raw log entries that matched the correlation rule. This allows analysts to verify the detection logic and understand the context of the triggering event. The Raw Log section is the definitive source for the exact log data.

Answer

In the Correlation Rules editor, by clicking the 'Test' button and selecting the incident ID.

Answer

In the Threat Intelligence page, by searching for the incident ID in the indicator database.

Answer

In the Data Sources page, by filtering for the source that generated the incident and viewing the ingestion logs.

Question 4

A threat intelligence analyst in Cortex XSIAM notices that a specific indicator from a feed is causing a high number of false positive alerts in correlation rules. The analyst wants to prevent this indicator from triggering any future alerts without removing it from the threat intelligence database, as it may still be useful for historical context. What is the most appropriate action to take?

Accepted Answer

Create an indicator exclusion rule that matches the indicator and set it to 'Exclude from correlation'.. Creating an indicator exclusion rule that excludes the indicator from correlation is the precise method to prevent alerts while retaining the indicator in the database. It allows for centralized management and does not alter the indicator's data or the rules themselves. This is the recommended approach in XSIAM for handling false positive indicators.

Answer

Set the indicator's reputation to 'Benign' to prevent it from triggering alerts.

Answer

Modify the correlation rule that triggers on this indicator to include an exception for the indicator's value.

Answer

Delete the indicator from the threat intelligence database and add it to a watchlist for future monitoring.

Question 5

An analyst is reviewing a Cortex XSIAM threat intelligence indicator for a malicious domain and wants Cortex XSIAM to automatically expire the indicator after 30 days so that stale data does not trigger future correlation rules. The feed is delivered through a TIM-enabled integration that supports indicator expiration. Which setting should the analyst configure to achieve this?

Accepted Answer

Set the Time to Live (TTL) value on the indicator or feed so Cortex XSIAM expires it after the specified number of days.. Indicator expiration in Cortex XSIAM is managed through the Time to Live (TTL) setting, which defines how long an indicator stays active before automatic removal. Configuring a 30-day TTL on the indicator or its parent feed directly satisfies the requirement to prevent stale malicious domains from continuing to trigger correlation rules.

Answer

Apply a reputation override of 'Good' to the domain so it stops matching correlation rules after 30 days.

Answer

Create a correlation rule exclusion that references the indicator and schedule it to run every 30 days.

Answer

Enable the 'Fetch Indicators' toggle and set the feed's refresh interval to 30 days.

Question 6

An XSIAM analyst notices that a high-severity analytic alert was generated for a suspicious PowerShell command on a finance workstation, but no incident was created. The alert appears on the Analytics page with a status of 'New'. The analyst wants to ensure that future similar alerts automatically become incidents so they appear on the Incidents page for triage. Which configuration in XSIAM controls whether an analytic alert is promoted to an incident?

Accepted Answer

The incident creation rule configured in the XSIAM incident settings. Incident creation in XSIAM is controlled by incident creation rules, which define the conditions for promoting an analytic alert to an incident. These rules are separate from severity, lifecycle status, and prioritization. To ensure future similar alerts become incidents, the analyst must configure or adjust an incident creation rule to match the alert's attributes. This allows the SOC to triage the activity on the Incidents page.

Answer

The alert's lifecycle status on the Analytics page

Answer

The alert's severity level in the Analytics page

Answer

The custom prioritization rule applied to the alert

Question 7

When reviewing security events in the XSIAM Incident View, an analyst notices that an event has a 'BIOC' tag. What does BIOC stand for in the context of XSIAM and Cortex XDR?

Accepted Answer

Behavioral Indicator of Compromise. BIOC stands for Behavioral Indicator of Compromise, which detects suspicious sequences of events or behaviors without relying solely on known file hashes.

Answer

Basic Incident Operations Center

Answer

Blocklist Indicator of Cyberattack

Answer

Binary Indicator of Code

Question 8

A Cortex XSIAM analyst is tuning detection logic and needs to reduce noise from a threat intelligence indicator that repeatedly matches benign internal traffic. The analyst wants the indicator to remain available for enrichment but to stop generating detections. Which TWO actions should the analyst take to achieve this goal? (Choose two.)

Accepted Answer

Adjust the indicator's reputation or severity so correlation rules that depend on a malicious verdict no longer match it.. Allow listing the indicator removes it from detection while preserving enrichment, and adjusting its reputation or severity prevents reputation-dependent rules from matching. Together these actions stop the benign matches without deleting the indicator or disrupting the feed, which is precisely what the analyst needs.

Answer

Disable the feed integration that delivered the indicator so it stops being refreshed.

Answer

Delete the indicator from the threat intelligence store entirely and re-import it only when needed.

Answer

Create a new correlation rule that explicitly alerts on the indicator and route it to a low-priority queue.

Question 9

An XSIAM analyst is investigating a series of alerts related to a potential data exfiltration attempt. The analyst notices that the same alert, 'Suspicious Outbound Connection', has fired multiple times over the past hour from the same source IP but with different destination IPs. The analyst wants to reduce noise while ensuring that a true exfiltration event is not missed. What is the most appropriate action according to XSIAM best practices?

Accepted Answer

Correlate the multiple alerts into a single incident to analyze the pattern and determine if it represents a coordinated attack.. Correlating related alerts into an incident allows the analyst to see the bigger picture, such as multiple outbound connections from the same source to different destinations, which could indicate data exfiltration. XSIAM's correlation engine automatically groups alerts based on shared attributes, reducing alert fatigue while maintaining detection fidelity. This approach aligns with best practices for investigating potential threats.

Answer

Create a custom prioritization rule to lower the severity of the alert when the source IP matches the internal asset.

Answer

Modify the analytic rule to exclude the source IP from triggering the alert in the future.

Answer

Use the 'Suppress' action on the alert to prevent future occurrences from generating new alerts.

Question 10

Which TWO types of triggers can initiate a Cortex XSIAM playbook execution? (Choose two)

Accepted Answer

Manual triggering by an analyst from an incident view. Option A is correct because Cortex XSIAM allows analysts to manually run a playbook directly from an incident view, giving them on-demand response and investigation capabilities. Option E is correct because XSIAM supports automatic playbook triggering through incident configuration rules, where the incident type and creation/update conditions determine when the playbook executes. Options B, C, and D are incorrect because local printer error codes, webcam motion detection, and physical keyboard shortcuts on agent keyboards are not supported trigger mechanisms for Cortex XSIAM playbook execution.

Answer

Automatic execution via local printer error codes

Answer

Webcam motion detection

Answer

Physical keyboard shortcut combinations on agent keyboards

Question 11

When configuring notification tasks within an XSIAM playbook, which THREE delivery methods or communication channels can be integrated natively? (Choose three)

Accepted Answer

Email notifications via SMTP integration. Option B is correct because XSIAM playbooks can natively send email notifications through an SMTP integration, allowing analysts to configure mail servers and recipients directly in the notification task. Option C is correct because XSIAM provides a built-in Microsoft Teams integration that enables collaboration messaging, so playbooks can post alerts or updates to Teams channels. Option E is correct because XSIAM also natively supports Slack integration for ChatOps notifications, letting playbooks push messages to Slack channels or users. Options A and D are not valid because smoke signal generation APIs and carrier pigeon dispatch protocols are fictional and not supported native delivery methods in XSIAM.

Answer

Smoke signal generation API

Answer

Carrier Pigeon dispatch protocol

Question 12

An analyst is configuring a new threat intelligence feed in XSIAM to ingest Indicators of Compromise (IoCs). Which integration mechanism should be used to pull indicators natively from an external TAXII 2.1 server?

Accepted Answer

Use the native TAXII 2.1 feed integration instance within Cortex XSIAM Settings. Cortex XSIAM includes a native TAXII 2.1 feed integration that can be configured as an instance under Settings > Threat Intelligence / Integrations, allowing analysts to point at a TAXII server URL, provide credentials, and select collections to pull STIX/TAXII indicators on a schedule. This is the supported, native mechanism for consuming TAXII feeds without custom parsing. It automatically normalizes STIX objects into XSIAM's indicator schema.

Answer

Upload a static CSV file export from the TAXII server on a scheduled basis

Answer

Deploy an external syslog collector to forward TAXII feeds to the XSIAM ingestion endpoint

Answer

Configure a custom Script Runner playbook to parse the TAXII JSON payload

Question 13

You need to ensure that a specific playbook task executes only if the preceding task successfully found more than zero malicious hashes in the context. How should you configure the task condition?

Accepted Answer

Configure a conditional link evaluating ${File.MD5} length or existence.. Task conditions in XSIAM playbooks use expression builders to evaluate context paths, such as checking if the length of an array is greater than zero.

Answer

Set the task execution timeout to zero.

Answer

Write an external Python script inside an integration.

Answer

Use a Loop task to iterate through every hash.

Question 14

An XSIAM analyst is investigating an incident that was created from a 'Brute Force' analytic alert. The analyst notices that the incident's severity is 'High', but the individual alert's severity is 'Medium'. The analyst wants to understand why the incident severity is higher than the alert severity. Which XSIAM mechanism is responsible for this discrepancy?

Accepted Answer

Incident Scoring Rules. Incident severity in XSIAM is not simply the maximum alert severity; it is computed by Incident Scoring Rules that aggregate alert severities and incorporate contextual factors like asset criticality and user role. Therefore, an incident can have a higher severity than its constituent alerts due to these additional considerations.

Answer

Data Source Enrichment

Answer

Alert Severity Override

Answer

Analytic Rule Configuration

Question 15

What information does the MITRE ATT&CK matrix integration provide within XSIAM analytic alerts?

Accepted Answer

Mapping of alert behaviors to standardized attacker tactics, techniques, and sub-techniques.. It maps detected behaviors to standard attacker tactics and techniques.

Answer

Real-time vulnerability patching recommendations for cloud servers.

Answer

Network bandwidth utilization metrics for infected hosts.

Answer

Geographical location of the external IP address.