XSIAM-Analyst Practice Test 5 — 25 Questions

Question 1

When reviewing an incident in XSIAM, an analyst sees multiple related alerts grouped together. What is the term used in XSIAM for an individual security detection that contributes to an incident?

Accepted Answer

Alert. In XSIAM terminology, individual detections or alerts are grouped together to form an incident.

Answer

Log Stream

Answer

Policy Enforcement Object

Answer

Artifact Container

Question 2

An analyst needs to share specific indicator of compromise (IOC) details discovered during an incident with an external ISAC. Which mechanism in XSIAM allows exporting or sharing threat indicators?

Accepted Answer

Threat Intelligence indicators export / sharing integration. XSIAM provides a Threat Intelligence indicators export and sharing integration that allows analysts to export or share specific IOC details with external parties such as an ISAC. This mechanism is designed for sharing threat intelligence in standard formats (e.g., STIX, CSV) and can be configured to share only selected indicators. It is the appropriate feature for this requirement.

Answer

Raw log CSV export via incident dashboard

Answer

Agent policy package compilation

Answer

XQL query schedule export to email

Question 3

An organization utilizes custom asset criticality tags in XSIAM. How does XSIAM incorporate asset criticality into the overall incident scoring process?

Accepted Answer

It acts as a weight multiplier that scales up the severity score of alerts associated with high-criticality assets.. XSIAM factors asset criticality as a multiplier or modifier when calculating the final severity and priority score of alerts impacting that asset.

Answer

It replaces the MITRE ATT&CK framework mapping with asset-specific naming conventions.

Answer

It converts all analytic alerts into raw syslog messages for external SIEM consumption.

Answer

It completely suppresses all alerts on low-criticality assets automatically.

Question 4

When configuring incident notification settings in XSIAM, which TWO notification channels are natively supported for alerting analysts about new high-severity incidents? (Choose two)

Accepted Answer

Email notifications. Option B (Email notifications) is correct because XSIAM natively supports email as a notification channel, allowing administrators to configure recipients and have high-severity incident alerts delivered directly to analysts' inboxes without additional third-party tooling. Option E (Webhook integrations such as Slack and Microsoft Teams) is correct because XSIAM provides native webhook-based notification support, enabling incident alerts to be pushed to collaboration platforms like Slack or Microsoft Teams through configured webhook endpoints. The remaining options are not natively supported: A (AM/FM radio broadcast) and C (physical office alarm siren activation) are not notification channels XSIAM can drive, and D (direct SMS via cellular gateway without integrations) is excluded because SMS delivery in XSIAM requires an external integration or gateway rather than being a built-in channel.

Answer

Automated AM/FM radio broadcast

Answer

Physical office alarm siren activation

Answer

Direct SMS text messaging via cellular gateway without integrations

Question 5

An incident responder is investigating a ransomware outbreak. Which THREE immediate containment or remediation actions can be executed directly from XSIAM to mitigate the threat? (Choose three)

Accepted Answer

Quarantine the malicious ransomware binaries across hosts. Option A is correct because XSIAM's endpoint protection and response capabilities allow the analyst to quarantine malicious ransomware binaries across affected hosts directly from the console, preventing further execution and spread. Option C is correct because XSIAM can issue network isolation commands to infected endpoints, cutting off command-and-control traffic and lateral movement while preserving the agent for investigation. Option D is correct because XSIAM enables termination of malicious running process trees on endpoints, stopping active encryption routines and child processes spawned by the ransomware. Option B is incorrect because physical door lock systems are not managed by XSIAM, which is a security operations platform focused on endpoint, network, and cloud telemetry. Option E is incorrect because hardware replacement is a physical maintenance task outside XSIAM's software-based containment and remediation scope.

Answer

Reconfigure physical office door security locks

Answer

Physically replace damaged motherboard hardware on endpoints

Question 6

An administrator is preparing a Cortex XDR agent upgrade for a group of Windows endpoints that must never lose malware protection during the update. The administrator wants the new agent package to be installed exactly once per endpoint without requiring a reboot, and wants the old agent removed only after the new agent is functioning. Which deployment method should the administrator use?

Accepted Answer

Push an agent upgrade from the XSIAM management console using the Upgrade Agent action on the selected endpoints.. The correct answer is the XSIAM management console Upgrade Agent action. This built-in action performs an in-place, rebootless upgrade that replaces the agent binary while keeping the endpoint protected and preserving its configuration. It automatically handles the removal of the old agent only after the new agent is operational, satisfying the requirement that malware protection never lapse.

Answer

Create a new installation package with the same distribution ID and deploy it with a Group Policy startup script.

Answer

Manually uninstall the Cortex XDR agent on each endpoint, reboot, and then install the new agent version from the endpoint console.

Answer

Deploy the new agent MSI to endpoints using Microsoft Intune and configure a post-installation script that deletes the old agent folder.

Question 7

When evaluating alert prioritization in XSIAM, what does a higher alert score typically signify?

Accepted Answer

Higher potential risk and urgency requiring immediate analyst attention.. Higher scores represent higher risk and urgency based on confidence, severity, and asset criticality.

Answer

A larger file size associated with the raw log event.

Answer

The requirement for manual schema parsing adjustments.

Answer

A higher frequency of occurrence across other unrelated tenants.

Question 8

Which THREE characteristics describe XSIAM analytic alerts versus standard log queries? (Choose three)

Accepted Answer

They automatically participate in the incident stitching and aggregation pipeline.. Analytic alerts are generated by machine learning/behavioral engines, include scoring, and feed incident stitching.

Answer

They require the analyst to manually write an XQL query every time an alert fires.

Answer

They can only be viewed by users with Master Administrator roles.

Question 9

When configuring a Threat Intelligence feed using a custom REST API integration in XSIAM, the API requires a bearer token for authentication that expires every 60 minutes. How should this authentication be managed within the integration instance configuration?

Accepted Answer

Configure the integration instance authentication parameters to support automated OAuth2 token generation and refresh. The integration instance authentication parameters should be configured to support automated OAuth2 token generation and refresh, which handles the 60-minute expiry seamlessly. XSIAM's integration framework supports OAuth2 with refresh tokens, allowing the integration to obtain new bearer tokens automatically without manual intervention. This is the standard, secure method for expiring tokens.

Answer

Configure the endpoint collector to proxy the authentication header

Answer

Write an external cron job to push a new token via syslog

Answer

Hardcode the static bearer token in the integration field and update it manually hourly

Question 10

What is the primary benefit of continuous Attack Surface Management (ASM) monitoring compared to periodic external vulnerability scans?

Accepted Answer

It provides real-time visibility into newly exposed assets, shadow IT, and perimeter changes as they occur. Continuous ASM monitoring provides real-time visibility into newly exposed assets, shadow IT, and perimeter changes as they occur. Unlike periodic scans that only capture a point-in-time snapshot, continuous monitoring detects changes immediately, allowing faster response to new exposures. This is the primary benefit over periodic external vulnerability scans.

Answer

It eliminates all network traffic latency

Answer

It automatically patches all vulnerabilities found on external servers

Answer

It replaces the need for internal endpoint security agents entirely

Question 11

An analyst in the Cortex XSIAM console sees an endpoint in the 'Endpoints' inventory with a status of 'Disconnected'. The endpoint manager reports the Cortex XDR agent service is running, but the analyst wants to verify whether the agent is actually communicating with the tenant. Which action should the analyst take to confirm the agent's last communication time and connection state directly from the XSIAM console?

Accepted Answer

Open the endpoint's detail view and review the Agent Status and Last Seen fields in the endpoint information panel.. The Endpoints inventory in Cortex XSIAM displays each agent's connection state and Last Seen timestamp in the endpoint detail view. Reviewing these fields confirms whether the agent is actively communicating with the tenant, which is the fastest and most authoritative check from the console. The other options either rely on local data that does not prove tenant connectivity or point to views that do not expose per-endpoint agent status.

Answer

Run the 'cytool status' command on the endpoint and compare the output to the XSIAM tenant's license expiration date.

Answer

Open the Cortex XDR agent installation directory on the endpoint and inspect the most recent .log file for a timestamp.

Answer

Navigate to the Incident Response view and check the 'Agent Connectivity' widget on the default dashboard.

Question 12

A security team wants to enforce endpoint security policy compliance across a fleet of Windows servers managed by Cortex XSIAM. The administrator plans to use policy rules that target endpoints based on specific attributes. Which TWO endpoint attributes can be used directly in a Cortex XSIAM endpoint policy rule to scope which endpoints receive the policy? (Choose two.)

Accepted Answer

Endpoint tag or endpoint group assignment.. Cortex XSIAM endpoint policy rules scope endpoints using supported attributes such as operating system platform, endpoint tags, and endpoint groups. Targeting the Windows Server platform and assigning servers to a specific tag or group both directly and reliably limit the policy to the intended fleet. The other options reference values that are either not exposed for policy scoping or are dynamic metrics unsuitable for stable policy assignment.

Answer

The endpoint's physical location as reported by the BIOS asset tag.

Answer

The endpoint's local administrator account password complexity.

Answer

The endpoint's current CPU utilization percentage.

Question 13

An administrator is preparing to enable the Cortex XDR agent's malware protection module on a set of Windows engineering workstations that run custom compiled binaries not seen elsewhere in the organization. The administrator wants to avoid disrupting legitimate builds while still catching malicious executables. Which approach best balances protection and operational continuity?

Accepted Answer

Enable the malware protection module in blocking mode and add a hash-based allowlist for the known legitimate custom binaries.. Hash-based allowlisting of known legitimate custom binaries allows malware protection to remain in blocking mode for all other content, catching malicious executables while preventing false positives on approved builds. Report-only mode, disabling the module, and directory wildcard exclusions each weaken protection more than necessary for this scenario.

Answer

Enable the malware protection module in report-only mode for the entire workstation group.

Answer

Enable blocking mode and create a wildcard path exclusion for the directory where the custom binaries are compiled.

Answer

Leave the malware protection module disabled and rely solely on behavioral threat protection.

Question 14

An analyst is investigating a Windows endpoint that has a Cortex XDR agent installed. The endpoint's security team reports that the agent is still running and reporting to XSIAM, but endpoint protection features such as malware prevention and exploit protection are not blocking malicious activity. The analyst checks the endpoint status in the XSIAM console and sees that the agent is in a 'Disabled' state. Which action should the analyst take to re-enable the agent's protection features?

Accepted Answer

From the Endpoints page in XSIAM, select the endpoint and choose 'Enable Agent' from the action menu.. The agent is in a disabled state, which means its protection features are not active. The XSIAM console provides a direct action to enable the agent on the endpoint. This sends a command to the agent to resume normal operation and apply its security policy. Restarting the service, reinstalling, or changing the policy to monitor-only would not resolve the disabled state and could introduce additional issues.

Answer

Restart the Cortex XDR agent service on the endpoint using the Services console.

Answer

Uninstall and reinstall the Cortex XDR agent on the endpoint.

Answer

Modify the endpoint's security policy to allow the agent to run in monitor-only mode.

Question 15

A Cortex XSIAM analyst is automating the triage of an alert that includes an IP address. The playbook must determine whether that IP is internal or external. The analyst wants to add a task that evaluates the IP and routes the playbook down the correct branch. Which task type in the Playbook Designer should the analyst use to evaluate the IP and produce a true or false result?

Accepted Answer

Conditional task. The conditional task is the XSIAM Playbook Designer construct that evaluates an expression or prior task output and returns true or false, allowing the playbook to follow the matching branch. Manual, data collection, and timer tasks serve different purposes and cannot automatically evaluate the IP and route execution based on the result.

Answer

Data collection task

Answer

Manual task

Answer

Timer task

Question 16

An analyst is reviewing endpoint alerts in Cortex XSIAM and notices repeated 'Local Analysis' verdicts on a custom in-house application executable. The application is business-critical and the analyst wants to prevent future false-positive blocks without disabling malware protection globally. What is the most appropriate action?

Accepted Answer

Create an allowlist exception for the file hash in the malware profile applied to the affected endpoint group.. A hash-based allowlist exception in the malware profile is the precise, minimally invasive control: it stops the false positives on the known-good in-house binary while preserving local analysis and blocking for all other files. This keeps the endpoint group's security posture intact and follows XSIAM's exception model for trusted applications.

Answer

Add the application's parent folder path to the 'Behavioral Threat Protection' exception list.

Answer

Disable 'Local Analysis' on the endpoint group so the agent stops generating verdicts for unknown files.

Answer

Set the endpoint's malware profile action to 'Report' instead of 'Block' for all files.

Question 17

An administrator needs to verify that the Cortex XDR agent is installed and running on a specific Windows endpoint. The administrator has access to the XSIAM management console. Which section of the console should the administrator use to check the agent's status and version?

Accepted Answer

Endpoints > Endpoint Management. The Endpoint Management section under the Endpoints menu is specifically designed to list all endpoints with the Cortex XDR agent, showing status, version, and other details. It allows administrators to search for a specific endpoint and verify that the agent is installed and running. The other sections focus on incidents, policies, or global settings, not endpoint-specific agent status.

Answer

Incidents > Incident Management

Answer

Policies > Policy Management

Answer

Settings > Agent Configuration

Question 18

An analyst is investigating a Linux server where the Cortex XDR agent is installed but has not reported any events for several hours. The analyst confirms the agent process is running and the server has network connectivity. Which XSIAM feature should the analyst use first to verify whether the agent is properly registered and communicating with the tenant?

Accepted Answer

Endpoint Management page, filtering by the endpoint's hostname to view its status and last check-in time.. The Endpoint Management page is the central location for monitoring agent health, including registration status and last check-in time. When an agent is silent, this page quickly reveals whether the endpoint is still communicating. If the last check-in is recent, the issue may be event forwarding; if stale, the agent-server connection is likely broken, guiding further troubleshooting.

Answer

Agent Installations page, verifying the installation package used for this server.

Answer

Incident Response view, searching for the endpoint's IP address to see if any alerts were generated.

Answer

Threat Intelligence module, checking for any indicators associated with the server.

Question 19

An analyst is reviewing an endpoint's status in the XSIAM Endpoints page and sees that the Cortex XDR agent's status is 'Disconnected' while the endpoint itself is online and reachable over the network. The analyst confirms the endpoint has network connectivity to the XSIAM tenant. Which action should the analyst take FIRST to determine why the agent is not reporting?

Accepted Answer

Check the agent diagnostic logs and service status on the endpoint to identify why the agent cannot reach the tenant.. An online endpoint whose agent reports Disconnected points to a communication or service problem on the endpoint itself, not a network outage. Inspecting the agent's diagnostic logs and confirming the service is running surfaces the specific failure, such as proxy, DNS, or certificate issues, so the analyst can remediate the true cause rather than applying disruptive containment or unnecessary reinstallation.

Answer

Immediately isolate the endpoint from the network to prevent potential lateral movement while investigating.

Answer

Reinstall the Cortex XDR agent on the endpoint to restore communications with the tenant.

Answer

Create a new agent installation package and redistribute it to the endpoint through the deployment console.

Question 20

A security administrator wants to prevent end users from disabling the Cortex XDR agent through the endpoint's system tray or command line. Which setting should the administrator configure in the XSIAM agent policy?

Accepted Answer

Enable password protection for the agent and set a strong uninstall password.. Password protection is the agent policy control designed specifically to gate stop, uninstall, and configuration changes behind a credential. Enabling it with a strong password ensures only authorized administrators can disable protection, which directly addresses the requirement that end users cannot turn the agent off from the tray or command line.

Answer

Set the agent to run in report-only mode so it cannot be uninstalled by users.

Answer

Configure a behavioral threat protection rule that blocks attempts to stop security services.

Answer

Apply a malware exception for the agent's own binaries so they are never flagged.