XSIAM-Analyst Practice Test 5 — 25 Questions

Question 1

What is the primary function of Attack Surface Management (ASM) within Cortex XSIAM?

Accepted Answer

To continuously discover and map external, internet-facing assets and potential exposures. ASM focuses on discovering unknown or unmanaged internet-facing assets to reduce organizational risk.

Answer

To ingest external threat feeds and correlate them with internal firewall logs

Answer

To monitor internal workstation performance and CPU usage

Answer

To automate the deployment of security patches on cloud servers

Question 2

Which type of indicators can be ingested into XSIAM's Threat Intelligence module?

Accepted Answer

IP addresses, domains, URLs, and file hashes. XSIAM supports multiple indicator types including IP addresses, domains, URLs, and file hashes (MD5, SHA256).

Answer

Only network traffic packet captures (PCAP files)

Answer

Only file hashes (SHA256 and MD5)

Answer

Only internal Active Directory user account names

Question 3

When setting up a threat intelligence feed integration in XSIAM, what is the purpose of the 'Fetch Indicators' toggle?

Accepted Answer

It determines whether the integration actively polls and downloads indicators from the source. The Fetch Indicators setting controls whether the integration actively pulls indicators from the source on a scheduled interval.

Answer

It exports local indicators out to an external TAXII server

Answer

It deletes expired indicators from the local database

Answer

It tests the network connectivity to the XSIAM ingestion server

Question 4

Which TWO methods can an analyst use to investigate matches between internal network telemetry and threat intelligence indicators in XSIAM? (Choose two)

Accepted Answer

Review security incidents generated by Threat Intelligence correlation rules. Analysts can use XQL search queries across telemetry datasets and review incidents generated by threat intelligence correlation rules.

Answer

Update the local Active Directory Group Policy Objects

Answer

Reboot the core XSIAM ingestion server to force log re-indexing

Answer

Run a hardware diagnostic script on network switches

Question 5

When configuring a new threat intelligence feed integration in Cortex XSIAM, which TWO configuration parameters are typically required for successful API-based ingestion? (Choose two)

Accepted Answer

API Authentication Key, Token, or Credentials. API-based threat intelligence integrations require endpoint URLs and authentication credentials (such as API keys or tokens) to connect and pull data.

Answer

Endpoint agent installation package version

Answer

Active Directory Domain Controller IP address

Answer

Syslog facility number

Question 6

An administrator is setting up Attack Surface Management (ASM) discovery scopes in XSIAM. Which THREE types of seed assets can be provided to initiate external discovery? (Choose three)

Accepted Answer

Domain names (e.g., example.com). ASM supports multiple seed types including domain names, IP address ranges, and Autonomous System Numbers (ASNs).

Answer

Local endpoint MAC addresses

Answer

Local Active Directory user security identifiers (SIDs)

Question 7

When reviewing Attack Surface Management (ASM) scan results in XSIAM, an administrator can classify discovered assets using various status designations. Which THREE statuses are standard asset classifications in ASM? (Choose three)

Accepted Answer

Unapproved / Shadow IT. ASM tracks asset lifecycles and validation states using statuses such as Approved, Unapproved/Shadow IT, and Under Investigation.

Answer

Quarantined by Endpoint Agent

Answer

Archived in Syslog Archive

Question 8

An analyst wants to iterate through a list of 50 IP addresses stored in the playbook context and run a enrichment command on each one individually. Which playbook feature should be used?

Accepted Answer

Loop Task. Loop tasks allow iterating over an array of items in the context and executing sub-tasks for each element.

Answer

Conditional Branching

Answer

Data Collection Widget

Answer

Transformer Function

Question 9

When working with array fields in XQL records, which THREE functions or commands can be used to manipulate or inspect arrays? (Choose three)

Accepted Answer

arrayexpand. XQL provides array handling functions such as array_length(), arrayindex(), or expansion commands like 'arrayexpand'.

Answer

array_compile()

Answer

array_destroy()

Question 10

An analyst notices that a specific registry modification performed by a legitimate software installer is triggering a 'Suspicious Registry Modification' alert in XSIAM. The analyst wants to suppress this specific alert across all endpoints without disabling the underlying Behavioral Threat Protection module. What is the correct way to build this exception?

Accepted Answer

Create a Cortex XDR exception rule specifying the initiating process hash and the target registry path.. Alert tuning and exception rules can be created based on alert parameters, file hashes, or specific registry paths to prevent false positives.

Answer

Disable the Windows Registry auditing policy in the domain Group Policy Object.

Answer

Delete the detection rule from the Analytics rule set.

Answer

Lower the endpoint agent's severity threshold to Critical only.

Question 11

Which TWO components are fundamental parts of every XQL query structure? (Choose two)

Accepted Answer

The dataset command specifying the source table. XQL queries always require a dataset declaration and utilize pipeline characters (|) to chain commands.

Answer

A SQL SELECT statement header

Answer

An automated playbook trigger reference

Answer

A mandatory XML schema declaration

Question 12

An administrator has created a new endpoint profile for a subset of point-of-sale (POS) terminals. After saving and assigning the profile, the administrator notices that terminals are not reflecting the updated policy settings. What is the most likely reason for this delay?

Accepted Answer

The endpoints have not yet completed their polling interval to download the updated profile configuration from the XSIAM cloud.. Cortex XDR agents check in periodically based on the heartbeat interval, or configurations require an explicit agent sync/update cycle to take effect immediately.

Answer

The agent must be manually uninstalled and reinstalled with the new profile embedded in the installer.

Answer

Profile changes are only applied during scheduled OS maintenance windows configured in XSIAM.

Answer

POS terminals are locked by XSIAM and cannot accept policy changes without an enterprise root token override.

Question 13

An XSIAM Analyst is reviewing the Analytics page and needs to understand the difference between standard alerts and incident-bound alerts. Which of the following best describes the role of analytics in XSIAM's alerting process?

Accepted Answer

Analytics automatically evaluate telemetry to generate structured alerts that contribute to security incidents.. XSIAM analytics automatically evaluate ingested telemetry to generate analytic alerts, which are then correlated into broader security incidents based on matching entities and timelines.

Answer

Analytics replace the need for correlation rules by directly closing false positives.

Answer

Analytics are exclusively used for reporting compliance and do not affect the active alert queue.

Answer

Analytics only generate raw logs, requiring manual rule creation to produce alerts.

Question 14

What is the primary benefit of continuous Attack Surface Management (ASM) monitoring compared to periodic external vulnerability scans?

Accepted Answer

It provides real-time visibility into newly exposed assets, shadow IT, and perimeter changes as they occur. Continuous ASM provides ongoing visibility into dynamic changes on the external perimeter, whereas periodic scans leave blind spots between runs.

Answer

It eliminates all network traffic latency

Answer

It automatically patches all vulnerabilities found on external servers

Answer

It replaces the need for internal endpoint security agents entirely

Question 15

When reviewing alert metrics and tuning detection rules in XSIAM, an analyst wants to identify noisy or low-value analytic rules. Which THREE metrics or views in XSIAM assist in evaluating alert rule effectiveness? (Choose three)

Accepted Answer

Correlation rate and incident grouping frequency for specific alerts. Evaluating rule effectiveness relies on monitoring alert volume, false positive rates, closure reasons, and analyst tagging trends.

Answer

Bandwidth consumption of agent log forwarders

Answer

Physical CPU utilization of the query engine nodes

Question 16

You notice that an automated playbook is executing multiple duplicate sub-tasks simultaneously because multiple alerts matching the same indicator arrived within seconds. How can you prevent race conditions or duplicate execution?

Accepted Answer

Configure playbook concurrency settings / deduplication keys.. Playbook concurrency controls or incident deduplication settings prevent overlapping playbook executions for identical alerts.

Answer

Reinstall the XSIAM agent on all endpoints.

Answer

Turn off auto-updates for integrations.

Answer

Delete all historical log partitions.

Question 17

An analyst notices that an analytic alert is repeatedly firing for legitimate administrative activity (a false positive). Aside from custom prioritization, how can an analyst manage this specific alert instance to aid future investigations?

Accepted Answer

Add analyst feedback and tag the alert instance as a false positive within the alert review workflow.. Analysts can add feedback, tags, or suppressions depending on the workflow, but tagging or documenting exclusions is key.

Answer

Delete the raw log from the underlying storage bucket via the UI.

Answer

Disable the Cortex XDR agent on the administrator's workstation.

Answer

Change the XDM mapping of the source log parser to omit the user account.

Question 18

Where in the XSIAM navigation menu can an administrator view the status and health of built-in analytics engines?

Accepted Answer

Settings > Analytics. Analytics status and configuration are found under Settings > Analytics.

Answer

Data Sources > Integrations > Analytics

Answer

XQL Search > Analytic Status

Answer

Incidents > Analytics Queue

Question 19

An XSIAM analyst is investigating an analytic alert triggered by a rare process execution. The analyst wants to see if similar processes have executed across other endpoints in the enterprise over the past 30 days. Which action should the analyst take?

Accepted Answer

Pivot directly from the alert to XQL Search using the pre-populated process hash or name to query historical data.. Pivot to XQL Search from the alert to query historical data across the enterprise.

Answer

Generate a new incident report from the Dashboards menu.

Answer

Restart the analytics engine to force a re-evaluation of historical logs.

Answer

Modify the custom prioritization rule to look back 30 days.

Question 20

An analyst is investigating an incident where an attacker attempted to clear Windows Event Logs to hide malicious activity. Which XSIAM behavioral detection category typically flags this suspicious administrative tampering?

Accepted Answer

Behavioral Indicators of Compromise (BIOCs) / Analytics. Clearing event logs is classified as a Defense Evasion technique and is detected via behavioral analytics and BIOCs targeting log tampering.

Answer

Network port scanning signatures

Answer

Cloud IAM permission boundary checks

Answer

Static file signature matching