XSIAM-Analyst Practice Test 25 — 15 Questions

Question 1

A security manager asks an analyst to explain how Cortex XSIAM uses the Threat Intelligence module during alert triage. The analyst wants to describe the primary operational benefit correctly. Which statement best describes its role?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It enriches observed artifacts with external reputation and context so analysts can judge whether activity is likely malicious.. Threat intelligence enrichment adds external reputation and context to artifacts observed in alerts, letting analysts judge likelihood of maliciousness during triage. It complements internal telemetry rather than replacing it, and it does not automatically enforce blocking. Understanding this distinction sets correct expectations about what the module contributes to investigations and what still requires explicit response actions.

Answer

It replaces the need for internal telemetry by providing a complete record of all activity on the network.

Answer

It stores raw packet captures from all monitored network segments for forensic replay.

Answer

It automatically blocks all traffic to any IP address that appears in any enabled threat intelligence feed.

Question 2

An XSIAM analyst is investigating a potential data exfiltration incident. The analyst wants to identify all endpoints that communicated with a specific suspicious external IP address (203.0.113.45) over the past 7 days. Which XQL query should the analyst use to retrieve this information from the network data?

Accepted Answer

dataset = xdr_data | filter remote_ip = "203.0.113.45" and event_type = NETWORK | fields agent_hostname, remote_ip, event_timestamp. In XSIAM network data, the remote IP address is stored in the remote_ip field. To find all endpoints that communicated with a specific external IP, the analyst must filter on remote_ip and event_type = NETWORK. The correct query uses these fields and returns the hostname and timestamp, enabling identification of affected endpoints.

Answer

dataset = xdr_data | filter local_ip = "203.0.113.45" and event_type = NETWORK | fields agent_hostname, local_ip, event_timestamp

Answer

dataset = xdr_data | filter action_remote_ip = "203.0.113.45" and event_type = NETWORK | fields agent_hostname, action_remote_ip, event_timestamp

Answer

dataset = xdr_data | filter action_local_ip = "203.0.113.45" and event_type = NETWORK | fields agent_hostname, action_local_ip, event_timestamp

Question 3

A Cortex XSIAM playbook invokes a sub-playbook to perform malware analysis on an uploaded file. The sub-playbook can return a verdict of malicious, suspicious, or benign, and the parent playbook must take different response actions for each. How should the parent playbook consume the sub-playbook's result to drive those branching actions?

Accepted Answer

Read the sub-playbook's returned output and evaluate it in conditional tasks that route to each response path.. When a parent playbook invokes a sub-playbook, the sub-playbook returns outputs that the parent can reference. Evaluating the returned verdict in conditional tasks lets the parent route to distinct malicious, suspicious, or benign response paths. Manual inspection, global context keys, and error signaling are all unsuitable because they either break automation, risk cross-incident leakage, or conflate valid verdicts with failures.

Answer

Set the sub-playbook to raise an error for any verdict other than benign so the parent's error handler runs.

Answer

Configure the sub-playbook to write the verdict into the parent's global context key.

Answer

Inspect the sub-playbook's War Room entries manually and then run the parent playbook again.

Question 4

A Cortex XSIAM playbook calls an external ticketing integration that returns HTTP 429 when the request rate exceeds the vendor's limit. The task currently fails and stops the playbook. The analyst wants the playbook to retry the call up to three times with increasing delay before marking the task as failed. Which configuration should the analyst apply to the task?

Accepted Answer

Configure the task's retry settings with a maximum of three retries, a delay, and a backoff multiplier.. XSIAM tasks support built-in retry parameters, including maximum retries, delay, and backoff multiplier. Configuring these values lets the playbook tolerate transient HTTP 429 responses by retrying with progressively longer waits, then failing cleanly after three attempts. This avoids duplicate task copies and keeps the retry behavior declarative and visible in the task settings.

Answer

Add a sleep task before the integration call and duplicate the integration task three times.

Answer

Set the task's polling interval to 30 seconds and enable the 'continue on error' flag.

Answer

Change the integration instance's proxy settings to route traffic through a different network path.

Question 5

You are configuring correlation rules in XSIAM to trigger an incident when internal telemetry matches indicators from a high-confidence threat feed. How do you ensure that indicators from low-confidence feeds are filtered out of this specific rule?

Accepted Answer

Add a condition in the correlation rule logic requiring indicator source reliability or confidence to meet a specific threshold. In XSIAM correlation rules, you can incorporate conditions based on indicator attributes such as source reliability or confidence score. By adding a condition that requires the indicator's source reliability or confidence to meet a specific threshold, the rule will only trigger on high-confidence indicators, effectively filtering out low-confidence feeds. This is the intended way to scope a rule to specific indicator quality without affecting other rules or the entire correlation engine.

Answer

Disable the correlation engine when low-confidence feeds are syncing

Answer

Configure the firewall to drop low-confidence indicators automatically

Answer

Delete all low-confidence indicators from the database daily via XQL delete commands

Question 6

When developing custom Python automation scripts for Cortex XSIAM, which THREE best practices should be followed for maintainability and performance? (Choose three)

Accepted Answer

Properly handle exceptions and return meaningful error messages using CommandResults or demisto.results.. Option A is correct because robust exception handling with meaningful errors returned through CommandResults (or the legacy demisto.results) lets XSIAM surface actionable failure context to analysts and prevents silent script failures, which is essential for maintainable automation. Option C is correct because automation scripts must avoid infinite loops by defining clear termination conditions and enforcing pagination limits (e.g., max pages or max results) so API polling and data retrieval terminate predictably and don't exhaust execution time or resources. Option D is correct because using demisto.executeCommand to invoke built-in integration commands leverages supported, authenticated connectors and their error handling, whereas raw unauthorized socket calls bypass integration logic, credentials management, and proxy handling, hurting both maintainability and security. Option B is not correct because a single 50,000-line monolithic file with no modular functions is the opposite of maintainable design. Option E is not correct because storing unencrypted passwords as plain-text global variables is a serious security violation and never a best practice.

Answer

Write all application code inside a single 50,000-line monolithic file without modular functions.

Answer

Store all unencrypted user passwords as plain text global variables.

Question 7

An analyst is investigating a Windows endpoint that was recently compromised. The attacker used a legitimate signed driver to disable the Cortex XDR agent's kernel-mode protection. The analyst wants to prevent this technique from succeeding on other endpoints without blocking the legitimate business application that relies on the driver. Which XSIAM endpoint security capability should the analyst configure?

Accepted Answer

Configure a Kernel Control Module (KCM) policy to block the vulnerable driver from loading on all endpoints.. Kernel Control Module (KCM) is specifically designed to enforce kernel-level driver load policies on Windows endpoints. It allows or denies driver loading based on configured rules, effectively preventing vulnerable or malicious drivers from disabling the Cortex XDR agent's kernel protection. Other endpoint security features like Exploit Protection, Behavioral Threat, and Device Control operate at different layers and cannot block a signed driver from loading.

Answer

Enable Device Control to block the driver file from being written to disk.

Answer

Create a Behavioral Threat rule that terminates any process attempting to load the driver.

Answer

Enable Exploit Protection with a custom mitigation that blocks the specific driver from loading.

Question 8

A Cortex XSIAM analyst is reviewing ASM findings for an external asset that exposes an outdated web framework. The asset is owned by a subsidiary that was acquired last quarter and is not listed in any existing discovery scope. The analyst wants ASM to start monitoring this subsidiary's domains and IP ranges automatically in future scans. What should the analyst do first?

Accepted Answer

Add the subsidiary's root domains and CIDR ranges as seed assets in a new or existing ASM discovery scope.. ASM expands coverage from seed assets configured in discovery scopes. Adding the subsidiary's root domains and CIDR ranges as seeds is the only action that makes ASM discover and monitor the subsidiary automatically in future scans. Manual imports, threat intelligence correlation, and one-time scans do not change the discovery scope and therefore cannot provide ongoing coverage for the acquired subsidiary.

Answer

Run an on-demand ASM scan against the subsidiary's public website and then add the results to a watchlist.

Answer

Create a new asset group in the Asset Inventory and manually import the subsidiary's known external IP addresses.

Answer

Enable the subsidiary's domains in the Threat Intelligence module so they are correlated during ASM scans.

Question 9

An analyst is building a Cortex XSIAM playbook that must query a threat intelligence platform for each of several indicators. The query task sometimes fails with a transient network timeout, but succeeds when retried a few seconds later. The analyst wants the playbook to automatically retry the task up to three times before continuing to the next task. Which playbook task configuration should the analyst use?

Accepted Answer

Set the task's retry count to 3 and the retry interval to 5 seconds in the task settings.. Cortex XSIAM playbook tasks support a retry count and retry interval that let a task re-execute automatically after a failure. For a transient network timeout, setting the retry count to three with a short interval gives the external service time to recover while keeping the playbook moving. Loops, conditional error-string checks, and concurrency limits do not provide the same controlled retry behavior.

Answer

Configure the integration instance's maximum concurrent requests to 3 so the query is repeated automatically.

Answer

Add a conditional task that runs the query again only when the previous task's error message contains 'timeout'.

Answer

Wrap the query task in a loop that iterates three times and continues on error.

Question 10

An XSIAM analyst is reviewing a newly created incident that contains multiple alerts from the same endpoint. The analyst wants to determine which two conditions would cause the incident's severity to be recalculated automatically after a new alert is added. (Choose two.)

Accepted Answer

The new alert has a higher severity than the current incident severity.. Incident severity in XSIAM is dynamically recalculated when a new alert with a higher severity is linked, or when a custom prioritization rule that modifies the incident score is triggered. These mechanisms ensure that incidents are prioritized based on the most critical evidence or organizational risk policies. Other factors like data source diversity, lower-severity alerts, or manual assignment do not inherently cause severity recalculation.

Answer

The new alert is from a different data source than the existing alerts.

Answer

The incident is manually assigned to an analyst.

Answer

The new alert has a lower severity than the current incident severity.

Question 11

An analyst is investigating a phishing campaign and needs to filter XQL results in the `xdr_data` dataset by a specific set of SHA256 hashes. The hashes are stored in the field `action_file_sha256`. Which XQL filter expression correctly returns only events where the hash matches any value in the provided array?

Accepted Answer

| filter action_file_sha256 in ("a1b2c3...", "d4e5f6...", "7890ab..."). The `in` operator in XQL is specifically designed to test whether a field value matches any element in a provided list, making it the correct choice for filtering events by multiple SHA256 hashes. It is concise, readable, and avoids the pitfalls of substring or regex matching. The other operators either expect a single scalar, perform substring matching, or use regex syntax, none of which correctly implement set membership.

Answer

| filter action_file_sha256 contains ("a1b2c3...", "d4e5f6...", "7890ab...")

Answer

| filter action_file_sha256 ~ ("a1b2c3...", "d4e5f6...", "7890ab...")

Answer

| filter action_file_sha256 = ("a1b2c3...", "d4e5f6...", "7890ab...")

Question 12

A Cortex XSIAM analyst receives a threat intelligence indicator for a domain that is used by a business partner. The indicator is marked as malicious by an open-source feed, but the partner confirms the domain is legitimate. The analyst wants to ensure the domain does not trigger future incidents while keeping the feed enabled for other indicators. What should the analyst do?

Accepted Answer

Add the domain to an allow list in the Threat Intelligence module.. A confirmed false-positive domain should be suppressed with a targeted control that keeps the feed active. Adding the domain to an allow list in the Threat Intelligence module prevents it from being treated as malicious during enrichment and correlation, so it will not trigger future incidents. Deleting the indicator, disabling the feed, or lowering severity either fails to prevent recurrence or removes coverage for other indicators.

Answer

Disable the open-source feed that provided the domain indicator.

Answer

Lower the severity of incidents generated by the open-source feed to Informational.

Answer

Delete the indicator from the Threat Intelligence module and block the feed from re-adding it.

Question 13

A security team is using XSIAM to manage endpoint security across a mixed fleet of Windows and macOS devices. They need to ensure that the Cortex XDR agent enforces malware prevention and that endpoints can be isolated from the network if a threat is detected. Which two actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Enable the Endpoint Isolation capability in the agent configuration and assign it to the relevant endpoint groups.. To enforce malware prevention, a Malware Prevention profile with real-time scanning and Block action is necessary. To enable network isolation, the Endpoint Isolation capability must be enabled and assigned to endpoint groups. These two actions directly satisfy the requirements. Host Firewall, Device Control, and Behavioral Threat rules address different aspects of endpoint security and do not provide the required malware prevention and dynamic isolation.

Answer

Configure a Behavioral Threat rule that automatically terminates malicious processes and quarantines files.

Answer

Create a Device Control rule to block USB storage devices on all endpoints.

Answer

Deploy a Host Firewall policy that blocks all inbound and outbound traffic except for the XSIAM management channel.

Question 14

An XSIAM analyst is investigating a series of alerts related to a suspicious PowerShell execution on multiple endpoints. The analyst wants to quickly identify all related alerts that share the same command-line argument across different incidents. Which XSIAM feature should the analyst use to achieve this?

Accepted Answer

XQL query with a filter on the command-line field.. XQL is the primary tool for ad-hoc searching and correlation across alerts and events in XSIAM. By querying the command-line field for the specific argument, the analyst can find all related alerts regardless of incident boundaries. Other features like grouping rules, TIP integration, or the Analytics page do not offer this level of investigative flexibility for internal telemetry.

Answer

Analytics page with a filter on alert severity.

Answer

Incident grouping rules based on alert name.

Answer

Threat intelligence platform (TIP) integration.

Question 15

A Cortex XSIAM playbook includes a task that sends an HTTP request to an external enrichment service. The analyst wants to prevent the playbook from exposing the API key in the task inputs and wants the key to be managed centrally so it can be rotated without editing the playbook. Which two actions should the analyst take? (Choose two.)

Accepted Answer

Store the API key as a credential in the Cortex XSIAM credential store and reference it from the task.. To avoid exposing an API key in playbook inputs and to manage it centrally, the analyst should use the Cortex XSIAM credential store or configure the key on the integration instance. Both methods keep the secret out of the playbook definition and allow rotation in one place. Encoding, manual prompts, and plaintext files do not provide secure, centralized secret management.

Answer

Write the API key into a text file on the Cortex XSIAM server and have the task read the file at runtime.

Answer

Create a playbook input that prompts the analyst to type the API key each time the playbook runs.

Answer

Base64-encode the API key and paste the encoded value directly into the task's request headers.