XSIAM-Analyst Practice Test 4 — 25 Questions

Question 1

An ASM scan in XSIAM flags an external web server as having an outdated SSL/TLS certificate. Where can an analyst view the detailed finding context and remediation recommendations for this exposed asset?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Click on the specific asset within the Attack Surface Management asset inventory to open its risk and finding details pane. ASM asset findings provide detailed context and risk information directly within the asset's detail pane.

Answer

Export all raw asset logs to an external SIEM for inspection

Answer

Check the Endpoint Security alert queue

Answer

Review the firewall traffic logs associated with port 443

Question 2

When setting up a threat intelligence feed integration in XSIAM, what is the purpose of the 'Fetch Indicators' toggle?

Accepted Answer

It determines whether the integration actively polls and downloads indicators from the source. The Fetch Indicators setting controls whether the integration actively pulls indicators from the source on a scheduled interval.

Answer

It exports local indicators out to an external TAXII server

Answer

It deletes expired indicators from the local database

Answer

It tests the network connectivity to the XSIAM ingestion server

Question 3

A Cortex XSIAM analyst is investigating a ransomware incident. The analyst needs to isolate an infected endpoint from the network to prevent lateral movement. Which action should the analyst take within the XSIAM incident response console?

Accepted Answer

Run the 'isolate endpoint' response action from the incident's Action Center.. The Action Center's 'isolate endpoint' response action is the correct method to immediately contain an infected endpoint by blocking all network traffic except management communication. This prevents lateral movement and further damage. Other options either do not fully isolate the endpoint, require manual steps, or address only a specific file rather than the entire host.

Answer

Create a firewall rule on the network perimeter to block the endpoint's IP address.

Answer

Use the 'Quarantine File' action to quarantine the malicious executable.

Answer

Manually disable the network adapter on the endpoint via remote PowerShell.

Question 4

Which TWO actions can an analyst perform on a threat intelligence indicator directly from the XSIAM Threat Intelligence workspace? (Choose two)

Accepted Answer

Add the indicator to an exclusion list or whitelist. Option B is correct because the XSIAM Threat Intelligence workspace lets analysts add an indicator to an exclusion list or whitelist so it is no longer treated as malicious and does not trigger detections or response actions. Option C is correct because analysts can manually create and add a custom indicator directly in the workspace, allowing them to track organization-specific IOCs that are not present in the built-in threat intelligence feeds. Option A is incorrect because modifying firewall hardware routing tables is a network-infrastructure administration task, not an action available on an indicator in the Threat Intelligence workspace. Option D is incorrect because reflashing endpoint BIOS firmware is a hardware/firmware remediation operation performed through endpoint management, not from the threat intelligence indicator interface. Option E is incorrect because updating global cloud provider DNS records is an external DNS management action outside the scope of XSIAM's Threat Intelligence workspace.

Answer

Modify firewall hardware routing tables

Answer

Reflash the BIOS firmware of endpoints matching the indicator

Answer

Directly update global cloud provider DNS records

Question 5

A Cortex XSIAM playbook is triggered by a correlation rule that fires multiple times for the same incident within a short window. The playbook's first task creates a ticket in an external ITSM system, and duplicate tickets are being created. The analyst confirms that the correlation rule is correctly firing for distinct events but the playbook is running more than once per incident. Which setting should the analyst verify first to prevent duplicate playbook executions for the same incident?

Accepted Answer

The playbook's trigger configuration to ensure it runs only once per incident.. Duplicate playbook executions for the same incident usually stem from a trigger that fires on every matching event rather than once per incident. The analyst should first verify the trigger configuration and ensure it is set to run the playbook only once per incident. Task timeout, concurrency limits, and ITSM deduplication are secondary or unrelated controls that do not prevent the playbook from being invoked multiple times.

Answer

The playbook's maximum concurrent executions setting.

Answer

The playbook's task timeout value.

Answer

The ITSM integration's deduplication settings.

Question 6

An administrator is deploying Cortex XDR agents to a set of Linux servers that run a custom application writing large log files to a non-standard mount point. The security team reports that the agent is generating excessive file scanning activity on those log files, impacting application performance. Which action should the administrator take?

Accepted Answer

Add the custom mount point to the malware profile's scan exclusion list for the affected endpoint group.. A path-based scan exclusion in the malware profile is the correct control because it stops the agent from reading the high-churn log directory during real-time and scheduled scans. This removes the I/O contention affecting the custom application while keeping malware protection active everywhere else on the endpoint group.

Answer

Switch the endpoint group's malware profile action from Block to Report to reduce scanning overhead.

Answer

Lower the agent's CPU priority using the 'Agent Resource Management' setting in the endpoint policy.

Answer

Disable the agent's real-time file protection on the Linux servers entirely.

Question 7

Which TWO methods can be used to test a custom automation script before deploying it in a production playbook? (Choose two)

Accepted Answer

Executing the script within a test incident War Room. Option C is correct because executing the script within a test incident War Room lets you validate the automation against a simulated incident in a safe, non-production environment, exercising the same incident context and integrations the playbook will use. Option E is correct because running the script interactively in the Playground / CLI interface allows step-by-step execution, immediate inspection of inputs/outputs, and rapid debugging before the script is embedded in a production playbook. Option A is not appropriate since compiling to a native Windows .exe is unrelated to testing a custom automation script in a playbook context. Option B is not appropriate because broadcasting over local radio frequencies has no bearing on script validation. Option D is not appropriate because printing the script for manual peer review is a documentation/review activity, not a functional test of the script's execution.

Answer

Compiling the script into a native Windows executable (.exe) on a local laptop

Answer

Broadcasting the script over local radio frequencies

Answer

Printing the script on paper for manual peer review

Question 8

Which operator is used in XQL filter statements to check if a field value matches any item in a provided list?

Accepted Answer

IN. The 'IN' operator is used to check if a field value matches any element within a specified list or array.

Answer

EQUALS_ANY

Answer

MATCHES

Answer

CONTAINS

Question 9

A security operations team wants Cortex XSIAM to continuously discover internet-facing assets belonging to their organization without manually supplying individual hostnames each time a new subsidiary is onboarded. Which ASM capability should they configure to achieve ongoing discovery from a broad organizational identifier?

Accepted Answer

An ASM discovery configuration seeded with the organization's registered domain names and related identifiers. Continuous external discovery requires seeds that the platform can expand on its own. Seeding ASM with the organization's registered domains and related identifiers lets Cortex XSIAM enumerate subdomains and external services as the footprint changes, removing manual per-host entry. Static CSVs, fixed-range schedules, and endpoint agents all fail to deliver automatic expansion of external coverage.

Answer

Manually importing a CSV of external IP addresses for each subsidiary

Answer

An endpoint agent deployment policy pushed to all subsidiary workstations

Answer

A recurring ASM scan schedule applied to a fixed list of seed IP ranges

Question 10

An XSIAM analyst notices that a specific analytic alert, generated by a built-in analytics rule, has been automatically assigned a high severity score that seems inconsistent with the raw event data. The analyst wants to understand what factors could have contributed to this elevated severity. Which of the following is the most likely explanation for the elevated severity score?

Accepted Answer

XSIAM applied a custom prioritization rule that boosts severity based on the asset's criticality tag.. XSIAM's custom prioritization rules can automatically adjust alert severity based on asset criticality, user identity, or other contextual factors. When an asset is tagged as high criticality, such rules can elevate the severity of any alert involving that asset, even if the raw event appears benign. This ensures that alerts on critical systems are prioritized appropriately.

Answer

The severity was inherited from the original event's source system, such as an endpoint protection platform.

Answer

The alert's severity was manually overridden by another analyst using the Alert Details page.

Answer

The alert is part of a correlated incident that aggregates multiple low-severity alerts into a higher-severity incident.

Question 11

Which feature enables playbooks to automatically execute on a recurring schedule (e.g., every morning at 2 AM) rather than reacting to an incident?

Accepted Answer

Scheduled / Timer Triggers. Timer triggers or scheduled playbooks allow time-based execution.

Answer

Syslog Listener

Answer

Parser Parsing Schedule

Answer

Endpoint Quarantine Schedule

Question 12

An analyst observes that two distinct analytic alerts—one for 'Suspicious Process' and one for 'Outbound Connection'—are generated 10 minutes apart on the same host. In XSIAM, how are these related alerts typically presented to the analyst?

Accepted Answer

Stitched together into a single unified incident based on shared entities and temporal proximity.. XSIAM stitches related alerts occurring within a specific timeframe on the same entity into a single incident.

Answer

Forwarded immediately to external ticketing systems as individual tickets.

Answer

Automatically discarded as duplicate noise by the alert deduplication engine.

Answer

Kept as completely separate incidents requiring manual merging by the analyst every time.

Question 13

An analyst is reviewing threat intelligence indicators and notices a specific file hash is marked as 'Expired'. What does this status indicate in XSIAM?

Accepted Answer

The indicator has exceeded its configured time-to-live (TTL) or retention period without being refreshed by a feed. Indicators reach an expired status when they exceed their time-to-live (TTL) or retention period without being updated by a feed.

Answer

The indicator matched an internal whitelist entry

Answer

The threat feed source has revoked its SSL certificate

Answer

The file hash has been successfully quarantined on all endpoints

Question 14

When an analyst reviews an analytic alert in XSIAM, which THREE pieces of contextual information are typically available to assist in prioritization and triage? (Choose three)

Accepted Answer

Score calculation breakdown and contributing factors. Context includes affected assets, MITRE ATT&CK details, and score breakdown.

Answer

Local printer driver version installed on the analyst's laptop

Answer

Cafeteria menu schedule for the security operations center

Question 15

An analyst wants to iterate through a list of 50 IP addresses stored in the playbook context and run a enrichment command on each one individually. Which playbook feature should be used?

Accepted Answer

Loop Task. A Loop Task in Cortex XSIAM playbooks iterates over a list (such as 50 IPs stored in context) and executes a specified command or sub-playbook for each item individually. This is the standard playbook construct for repeating an action across a collection of values. It supports both list iteration and key-value iteration, making it ideal for enrichment of multiple indicators.

Answer

Conditional Branching

Answer

Data Collection Widget

Answer

Transformer Function

Question 16

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to connect to the XSIAM tenant through a corporate proxy server. Which THREE proxy configuration parameters must be correctly supplied to the agent installation or policy to ensure successful connectivity? (Choose three)

Accepted Answer

Proxy authentication credentials (username and password) if required. Proxy configurations require server address/IP, port, and authentication credentials if the proxy requires them.

Answer

Primary domain controller NetBIOS name

Answer

Local BGP autonomous system number (ASN)

Question 17

When writing a custom Python automation script to be executed as a Cortex XSIAM playbook task, which built-in library function is used to output results directly into the incident context?

Accepted Answer

demisto.results() or CommandResults. In Cortex XSIAM (and the underlying Demisto/Cortex XSOAR engine), automation scripts return data to the playbook and incident context via demisto.results() for legacy scripts or the CommandResults object for modern Python integrations. These APIs serialize the output into the war room and write entries into the incident context under the specified key.

Answer

sys.stdout.write()

Answer

print()

Answer

requests.post()

Question 18

An analyst is examining an alert timeline in XSIAM. What does the timestamp on a security event represent?

Accepted Answer

The exact time the event occurred on the source or was ingested and processed by XSIAM. In XSIAM, the timestamp on a security event represents the time the event occurred at the source (the endpoint, log source, or sensor) or, if the source time is unavailable, the time it was ingested and processed by XSIAM. This timestamp is the anchor for timeline reconstruction and correlation across data sources.

Answer

The time the analyst opened the incident investigation view

Answer

The expiration time of the Cortex XDR agent license

Answer

The scheduled time for the next playbook execution

Question 19

An analyst needs to export a detailed report of all closed incidents over the last 30 days for an executive summary. Where can this report generation be initiated within XSIAM?

Accepted Answer

Reporting module. In XSIAM, the Reporting module is where you can generate, schedule, and export detailed reports, including incident summaries over a specified time range. To create an executive summary of closed incidents over the last 30 days, you would use the Reporting module to build a report with the appropriate filters and export it.

Answer

Content Hub

Answer

XQL Schema Viewer

Answer

Agent Health Monitoring view

Question 20

An analyst is investigating an incident where an attacker attempted to clear Windows Event Logs to hide malicious activity. Which XSIAM behavioral detection category typically flags this suspicious administrative tampering?

Accepted Answer

Behavioral Indicators of Compromise (BIOCs) / Analytics. Clearing Windows Event Logs is a classic behavioral indicator of attacker defense evasion, and XSIAM's BIOCs/Analytics category detects such suspicious administrative tampering by correlating process, command-line, and audit-log events. This category is designed for behaviors rather than static signatures.

Answer

Network port scanning signatures

Answer

Cloud IAM permission boundary checks

Answer

Static file signature matching