XSIAM-Analyst Practice Test 24 — 15 Questions

Question 1

An ASM discovery run identifies a rogue cloud storage bucket publicly exposed to the internet. How does XSIAM's ASM module typically discover this asset without requiring internal cloud credentials?

Accepted Answer

By analyzing Certificate Transparency (CT) logs, DNS brute-forcing, and external port scanning. ASM utilizes external reconnaissance techniques such as certificate transparency log analysis, DNS enumeration, and banner grabbing.

Answer

By intercepting local DNS queries on corporate endpoints

Answer

By scanning internal Active Directory group policies

Answer

By reading netflow data from core internal switches

Question 2

An analyst receives an incident in XSIAM and wants to quickly gather more context about a suspicious file hash without leaving the incident view. Which action should the analyst take?

Accepted Answer

Use the 'Enrich' action on the hash entity. The 'Enrich' action on an entity within the incident view allows analysts to retrieve threat intelligence and other context without leaving the incident. This is the most efficient way to get immediate information about a suspicious hash. Other methods require navigation away or manual steps, which are less efficient.

Answer

Run an XQL query on the hash in the Query Center

Answer

Create a new incident manually for the hash

Answer

Open the Threat Intelligence module and search for the hash

Question 3

An analyst is troubleshooting a correlation rule that is failing to trigger incidents despite matching raw logs. Where can the analyst test and debug the rule logic against historical or sample log data in XSIAM?

Accepted Answer

Correlation Rule Editor test and simulation panel. Rule testing, validation, and dry-run debugging against sample or historical logs are performed within the Analytics or Correlation Rule editor.

Answer

Endpoint isolation diagnostics log

Answer

Playbook task debugger console

Answer

Agent diagnostic package utility

Question 4

A Cortex XSIAM analyst wants to review which external IP addresses and domains belong to the organization's internet-facing footprint after an ASM scan completes, so they can validate that no unexpected assets were discovered. Where does the analyst review the inventory of discovered external assets in XSIAM?

Accepted Answer

The Attack Surface Management asset inventory view. ASM discovered assets are surfaced in the Attack Surface Management asset inventory, which lists external IP addresses, domains, and services with their attributes. This view is where an analyst validates the organization's internet-facing footprint and identifies unexpected exposures after a scan. The indicator store, audit log, and correlation rule pages serve unrelated purposes and do not contain the external asset inventory.

Answer

The Cortex XSIAM audit log

Answer

The threat intelligence indicator store

Answer

The correlation rule management page

Question 5

An XSIAM analyst is reviewing an incident that includes a 'Remote Process Execution' alert. To better understand the parent-child relationship and command-line arguments, the analyst opens the Causality View. Which feature in the Causality View allows the analyst to see the full command line and other process details for a specific process?

Accepted Answer

The Process Details pane, accessible by clicking on the process node.. The Causality View in XSIAM visually maps process ancestry and allows analysts to drill into individual process nodes. Clicking a node reveals the Process Details pane with command line, hash, user, and other forensic data. This is the correct method to inspect remote process execution details without writing queries or leaving the incident context.

Answer

The Action Center, which lists available response actions for the process.

Answer

The Incident Timeline, which shows all events in chronological order.

Answer

The XQL Query Builder, which automatically generates a query for the selected process.

Question 6

An analyst observes that a specific endpoint has stopped generating endpoint telemetry events (such as process execution and file creation logs) into XSIAM, although the endpoint is powered on and connected to the corporate network. Upon checking the agent, the service is running. Which troubleshooting step should the analyst perform next to diagnose endpoint event streaming issues?

Accepted Answer

Inspect the local agent log files on the endpoint to identify communication or buffering errors with the XSIAM backend.. Reviewing local agent log files (such as cyserver.log) on the endpoint or checking broker VM communication logs helps determine if telemetry is blocked or failing to upload.

Answer

Modify the XQL ingestion parser rules for the endpoint asset dataset.

Answer

Purge all historical alerts from the Incident Viewer to free up ingestion buffers.

Answer

Run an immediate software upgrade of the XSIAM tenant license key.

Question 7

An analyst is performing forensics on a suspicious process execution in XSIAM. Which THREE artifacts or views are typically available in the Causality Analysis of an alert? (Choose three)

Accepted Answer

File creation, modification, or deletion events. In XSIAM's Causality Analysis view, the goal is to reconstruct the sequence of events that led to an alert, so option C (file creation, modification, or deletion events) is correct because file-system activity is a core causality artifact that shows what the process touched before or during execution. Option D (process parent-child command line arguments) is correct because the causality chain centers on process lineage, and command-line arguments for parent and child processes reveal exactly how the suspicious process was launched and what it spawned. Option E (associated network connection destinations and ports) is correct because network connections tied to the process (destination IPs, ports, and related socket events) are standard causality artifacts that help determine command-and-control or exfiltration behavior. Options A and B are not part of Causality Analysis: physical geographic location of a power supply and local BIOS firmware version history are not process-causality artifacts and are not surfaced in that view.

Answer

Physical geographic location of the endpoint's power supply

Answer

Local BIOS firmware version history of the endpoint

Question 8

A security administrator is configuring the Cortex XDR agent on a group of Windows servers. The organization's policy requires that the agent cannot be uninstalled by local administrators without a password. Which setting should the administrator configure to enforce this requirement?

Accepted Answer

Enable 'Password Protection' for agent uninstallation in the agent configuration profile.. The Cortex XDR agent includes a password protection feature that prevents unauthorized uninstallation. This is configured in the agent configuration profile within XSIAM. When enabled, a password is required to uninstall the agent, ensuring that only authorized personnel can remove it. Other methods like Group Policy or registry changes are not the native or recommended way to enforce this requirement.

Answer

Deploy the agent with a tamper-resistant installation package.

Answer

Configure a Windows Group Policy to restrict uninstallation of the agent.

Answer

Set the agent to run as a protected process in the Windows registry.

Question 9

Which user role is typically required to create, edit, and publish custom playbooks in Cortex XSIAM?

Accepted Answer

Automation / Playbook Administrator or Editor. Playbook authoring requires specific administrative or analyst roles with automation permissions, such as Administrator or Playbook Editor.

Answer

Log Collector Operator

Answer

Viewer Role

Answer

Endpoint Security Agent

Question 10

You are troubleshooting a Cortex XSIAM playbook that unexpectedly stopped executing after a script task returned an error. You want to understand how the playbook engine handles task-level errors so you can design more resilient flows. Which TWO statements accurately describe how task errors and playbook continuation behave in Cortex XSIAM? (Choose two.)

Accepted Answer

Error information from a failed task, such as the error message, is available in the task result and can be referenced by later tasks in the playbook.. Cortex XSIAM lets you define error paths so a failing task can route the playbook to alternate handling instead of stopping, and failed tasks still expose error details in their results for downstream tasks to consume. Automatic fixed retries are not a guaranteed engine default, and immediate total termination is not the only behavior. Together, configurable error paths and accessible error details are what enable resilient playbook design.

Answer

By default, when a task fails, the entire playbook run is immediately terminated and no subsequent tasks execute.

Answer

Once a task fails, the playbook cannot reference any output from that task anywhere later in the run under any configuration.

Answer

A failed task always automatically retries the exact same task a fixed number of times before the playbook moves on.

Question 11

A Cortex XSIAM analyst is preparing to ingest a third-party threat intelligence feed that provides indicators as STIX 2.1 objects. Before enabling the feed, the analyst wants to confirm that the platform can parse the format natively. Which statement best describes Cortex XSIAM's handling of STIX-formatted threat intelligence?

Accepted Answer

Cortex XSIAM supports STIX/TAXII natively, so the analyst can configure the feed without building a custom parser.. Cortex XSIAM provides native STIX and TAXII support, so a STIX 2.1 feed can be configured directly without custom parsing. This lets the analyst enable the third-party feed quickly and rely on the platform to map the objects into its indicator model.

Answer

Cortex XSIAM accepts STIX only when delivered over email as an attachment.

Answer

Cortex XSIAM requires STIX feeds to be converted to CSV before ingestion.

Answer

Cortex XSIAM can only ingest STIX indicators after they are mapped through a custom Python integration.

Question 12

An administrator is reviewing endpoint agent diagnostic tools available within XSIAM. Which THREE actions can be performed directly from the XSIAM console to troubleshoot or manage an endpoint agent? (Choose three)

Accepted Answer

Trigger a remote restart of the Cortex XDR agent service.. Option B is correct because the XSIAM console provides endpoint management actions that include remotely restarting the Cortex XDR agent service, which is a standard troubleshooting step when an agent is unresponsive or needs to reload its configuration. Option C is correct because XSIAM supports osquery-based Live Queries, allowing administrators to run SQL-like queries against endpoints in real time to inspect processes, files, registry keys, and other telemetry for investigation and diagnostics. Option E is correct because XSIAM can initiate Network Isolation directly from the console, which contains a compromised host by restricting its network communication while preserving the management channel to the agent. Options A and D are not valid because reflashing endpoint BIOS and formatting/reinstalling the OS are out-of-band hardware or imaging operations that XSIAM's agent-based console actions do not perform.

Answer

Reflash the endpoint hardware BIOS remotely.

Answer

Format the primary OS drive and reinstall Windows.

Question 13

An analyst is writing a Cortex XSIAM playbook in which a task's output must be passed to a later task that sits on a different branch of the workflow. The later task cannot see the value because it is not a direct descendant of the producing task. What should the analyst do to make the value available where it is needed?

Accepted Answer

Write the value into the incident context so the downstream task can reference the shared key. Playbook task outputs are scoped to the producing task's branch and its descendants, so a task on an unrelated branch cannot resolve them directly. Writing the value into incident context removes that scoping restriction because context is shared across the entire playbook run, letting any task on any branch reference the stored key. This is the supported way to pass data across divergent workflow paths.

Answer

Move the downstream task into the same branch as the producing task and rerun the playbook

Answer

Increase the task's execution timeout so its output has time to propagate to other branches

Answer

Convert the producing task into a manual task so its output persists across branches

Question 14

An analyst wants to enrich an incident in Cortex XSIAM by correlating its associated IP addresses against the organization's active threat intelligence feeds. Which TWO actions will produce a list of matching indicators for those IPs? (Choose two.)

Accepted Answer

Use the built-in threat intelligence enrichment command on the incident's IP entity to retrieve associated indicators.. Correlating an incident's IP against threat intelligence in XSIAM is best done through native lookup mechanisms. Searching the Indicators view by indicator value returns all stored matches across enabled feeds, while the enrichment action on an incident entity queries configured sources and returns matches with source and verdict context. Both are direct, on-demand, and preserve source attribution.

Answer

Disable all feeds except one, then re-enable them one at a time to isolate which feed contains the IP.

Answer

Create a new correlation rule that matches the IP against all feeds and wait for the next scheduled evaluation.

Answer

Export the raw incident JSON and manually grep for the IP in the threat intelligence database dump.

Question 15

An XSIAM Analyst is reviewing the Alerts table after a phishing campaign. Several alerts reference the same host and user and share a common causality chain. The analyst wants to ensure these are treated as a single high-priority incident for the SOC team. Which XSIAM feature should the analyst rely on to automatically group these related analytic alerts into one incident?

Accepted Answer

Alert grouping via the Incident Grouping Rules engine. XSIAM's Incident Grouping Rules automatically merge analytic alerts that share a causality chain, host, or user into one incident. This is the native mechanism for consolidating related alerts, ensuring the SOC receives a single high-priority incident instead of multiple disconnected alerts. Manual creation, prioritization, and exclusion do not provide automatic grouping.

Answer

Custom Prioritization rules that assign severity scores

Answer

Analytic exclusion filters that suppress duplicate alerts

Answer

Manual incident creation from the Alerts page