XSIAM-Analyst Practice Test 2 — 30 Questions

Question 1

While troubleshooting a failed custom automation script inside a playbook, you notice that the script returned a non-standard error object. Where should you look first within XSIAM to inspect the raw inputs and outputs passed to the automation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Playbooks > Execution History > Task Details. The Cortex XSIAM War Room or the Automation execution logs store the detailed inputs, outputs, and traceback for troubleshooting script execution.

Answer

Data Hub > Query Service

Answer

Settings > Integrations > Instances logs

Answer

Incidents > Audit Trail

Question 2

When utilizing the 'compact' or 'dedup' commands in an XQL query, an analyst notices that certain fields are missing from the resulting dataset. Why does this behavior occur?

Accepted Answer

The dedup command drops all fields that are not part of the specified grouping key or explicitly retained.. By default, 'dedup' retains only the fields present in the groupby or distinct fields unless specified with specific retain parameters or prior projections.

Answer

XQL automatically normalizes all omitted fields to null values instead of dropping them.

Answer

The schema definition overrides field selection during sorting stages.

Answer

The query engine automatically truncates datasets larger than 1MB.

Question 3

What is the primary purpose of the 'Playbook Debugger' or test run feature when developing a new playbook in XSIAM?

Accepted Answer

To test and validate playbook flow logic and context mapping using sample incidents.. Test runs allow developers to dry-run playbooks against existing test incidents to verify logic and context outputs.

Answer

To debug network firewall rules.

Answer

To analyze log parsing syntax in Data Hub.

Answer

To scan endpoints for malware signatures.

Question 4

An analyst is investigating an incident and needs to isolate an infected endpoint directly from the XSIAM Incident View. Which response action should the analyst execute?

Accepted Answer

Isolate Endpoint. From the Incident View or Endpoint View in XSIAM, analysts can execute the 'Isolate Endpoint' response action to restrict network communication while maintaining management connectivity.

Answer

Kill Process Tree

Answer

Block IP Address

Answer

Quarantine File

Question 5

An analyst needs to retrieve running process information from a specific active endpoint in real time without waiting for scheduled telemetry uploads. Which XSIAM feature should the analyst use?

Accepted Answer

Live Query (osquery). Live Query allows administrators to run osquery-based commands directly against active endpoints to gather real-time system state.

Answer

Asset Inventory export

Answer

Incident Viewer timeline

Answer

XQL historical search

Question 6

While reviewing a complex multi-stage attack in XSIAM, an analyst wants to visualize the sequence of process creation events on an endpoint. Which XSIAM feature provides a graphical representation of parent-child process relationships and associated network connections?

Accepted Answer

Causality Chain. The Causality Chain in XSIAM provides a graphical, tree-like view of process execution history, showing parent-child relationships and associated artifacts.

Answer

MITRE ATT&CK Matrix Dashboard

Answer

Incident Graph Mapping

Answer

BIOC Breakdown View

Question 7

An organization wants to integrate a proprietary threat intelligence feed that uses a non-standard JSON format. What tool or method should be used within XSIAM to ingest and parse this feed correctly?

Accepted Answer

Use the Generic Feed integration with custom JSON path mapping. Custom feeds that do not match out-of-the-box integrations can be parsed using custom feed integrations or mapping transformations.

Answer

Rewrite the core XSIAM ingestion engine in Python

Answer

Manually convert the JSON feed into a Windows Event Log format

Answer

Configure an endpoint agent to scrape the JSON URL locally

Question 8

An analyst is investigating an incident where an internal host communicated with a known malicious domain. To verify when the threat intelligence indicator was first and last seen by XSIAM, where should the analyst look?

Accepted Answer

The indicator's details view within the Threat Intelligence module repository. The Threat Intelligence indicator details page records historical sightings, first seen, and last seen timestamps.

Answer

The local endpoint registry hive on the infected workstation

Answer

The ASM asset discovery log

Answer

The firewall hardware diagnostic logs

Question 9

You are configuring Attack Surface Management in XSIAM to monitor brand infringement and typosquatting domains. Which ASM configuration feature enables this capability?

Accepted Answer

External Domain Monitoring and Typosquatting detection rules based on seed keywords. ASM includes domain monitoring capabilities such as typosquatting and brand exposure detection based on seed organization names.

Answer

Endpoint firewall rule generators

Answer

Active Directory domain trust relationship settings

Answer

XQL threat hunting regex patterns on proxy logs

Question 10

A threat hunter is analyzing authentication logs in XSIAM using XQL. They want to identify potential brute-force attacks by finding source IP addresses that have more than 10 failed login attempts within a 5-minute window. The logs are in the 'auth_logs' dataset with fields 'src_ip', 'event_time', and 'status' (where 'status' is either 'success' or 'failure'). Which two XQL stages or functions are essential to achieve this? (Choose two.)

Accepted Answer

filter status = "failure". To detect brute-force attacks, the query must first isolate failed login events using a filter on status. Then it must count those failures per source IP within a 5-minute window, which requires an aggregation grouped by source IP and a time bucket. These two steps are the core of the detection. Sorting, deduplication, or external joins are either counterproductive or non-essential for the fundamental count-based logic.

Answer

sort by event_time desc

Answer

join with a threat intelligence dataset on src_ip

Answer

dedup src_ip

Question 11

Which type of indicators can be ingested into XSIAM's Threat Intelligence module?

Accepted Answer

IP addresses, domains, URLs, and file hashes. XSIAM supports multiple indicator types including IP addresses, domains, URLs, and file hashes (MD5, SHA256).

Answer

Only network traffic packet captures (PCAP files)

Answer

Only file hashes (SHA256 and MD5)

Answer

Only internal Active Directory user account names

Question 12

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

Accepted Answer

Attack Surface Management > Assets. Attack Surface Management features have a dedicated workspace within the XSIAM navigation menu.

Answer

Incident Response > ASM Incidents

Answer

Dashboards > Threat Intelligence > ASM

Answer

Settings > Integrations > ASM Scanner

Question 13

Which TWO information sources or artifacts can an analyst inspect within an XSIAM incident to understand the scope of an attack? (Choose two)

Accepted Answer

List of affected endpoints and hosts. Option A (List of affected endpoints and hosts) is correct because XSIAM incidents aggregate endpoint and host artifacts from the underlying telemetry and EDR data, allowing the analyst to enumerate which machines were touched by the attacker and thereby gauge the blast radius. Option E (Associated users and account entities involved) is correct because XSIAM correlates identity data into the incident, exposing the user and account entities tied to the activity so the analyst can determine which credentials were compromised or misused. Together, these two artifacts directly answer the scope question by mapping both the systems and the identities affected. Options B, C, and D are unrelated to security telemetry — a cafeteria menu, printer paper inventory, and parking badge records are not XSIAM incident artifacts and provide no insight into attack scope.

Answer

The local cafeteria lunch menu for the day

Answer

Office printer paper inventory levels

Answer

Employee parking garage badge swipe records outside XSIAM

Question 14

Which TWO actions occur when a playbook task hits a conditional split with multiple matching paths? (Choose two)

Accepted Answer

Depending on configuration, matching paths can execute in parallel or sequentially.. Option A is correct because in a playbook conditional split, when several branches match, the engine's configuration governs whether those matching paths run concurrently (in parallel) or one after another (sequentially), so both behaviors are possible depending on how the split is set up. Option D is correct because the conditional split's core function is to evaluate each branch's condition against the task's output/context, and the results of that evaluation determine which downstream tasks are given the execution flow. Options B, C, and E are incorrect because a conditional split only routes execution flow within the playbook; it does not shut down the XSIAM tenant, clear user browser caches, or purge system logs from disk.

Answer

The entire XSIAM tenant automatically shuts down for maintenance.

Answer

The browser cache of every user is cleared.

Answer

All system logs are permanently purged from disk.

Question 15

Which TWO components are fundamental parts of every XQL query structure? (Choose two)

Accepted Answer

The dataset command specifying the source table. Option B is correct because every XQL query must begin by declaring its data source with a dataset command (for example, `dataset = xdr_data`), which tells the query engine which table or dataset to search. Option E is correct because XQL is a pipelined query language in which stages are chained together using the pipe character (|), such as `dataset = xdr_data | filter ... | fields ...`, so the pipeline syntax is fundamental to the query structure. Option A is incorrect because XQL is not SQL and does not use a SQL SELECT statement header; it uses dataset and stage commands instead. Option C is incorrect because playbook triggers belong to automation/playbook configuration, not to the query language itself. Option D is incorrect because XQL queries are plain text and require no XML schema declaration.

Answer

A SQL SELECT statement header

Answer

An automated playbook trigger reference

Answer

A mandatory XML schema declaration

Question 16

An analyst investigates a suspected lateral-movement burst and needs to identify source hosts that connected to more than 15 distinct destination IPs within a single hour. The relevant authentication events are already filtered into the pipeline. Which XQL construction produces one row per source host per hour with the distinct destination count?

Accepted Answer

bin timestamp span = 1h as hour | comp count_distinct(dst_ip) as dest_count by src_host, hour | filter dest_count > 15. Detecting a lateral-movement burst requires counting unique destinations rather than raw events, because repeated contacts to one host are not lateral movement. Bucketing the stream into one-hour windows with bin, then applying comp count_distinct(dst_ip) grouped by source host and bucket, produces exactly one row per host per hour, and the filter enforces the 15-destination threshold.

Answer

comp count(dst_ip) as dest_count by src_host | filter dest_count > 15

Answer

stats max(dst_ip) as dest_count by src_host | filter dest_count > 15

Answer

dedup dst_ip by src_host | comp count() as dest_count by src_host | filter dest_count > 15

Question 17

An analyst is handling an incident in XSIAM where the attacker moved laterally from a compromised workstation to a server. The analyst wants to identify all affected endpoints and their current containment status from a single view. Which XSIAM feature should the analyst use?

Accepted Answer

Incident Investigation. The Incident Investigation view is designed to give analysts a comprehensive picture of an incident, including all affected endpoints and their containment status. It consolidates data from various sources, enabling quick assessment and response. The other options serve different purposes: War Room for collaboration, Endpoint Management for configuration, and Threat Intelligence for context.

Answer

Threat Intelligence

Answer

Incident War Room

Answer

Endpoint Management

Question 18

An organization wants to reduce noise from a known vulnerability scanner that triggers high-severity analytics alerts every weekend. The SOC decides to suppress these specific alerts during scanning windows. How should the analyst configure this in XSIAM?

Accepted Answer

Create an Exclusion or Suppression rule in the Incident and Alert Settings with time-based criteria.. Alert suppression rules can be configured with specific time schedules and filter criteria to mute known benign scanner activity.

Answer

Modify the firewall security policy to block the scanner IP.

Answer

Configure a global severity override to change the scanner alerts to 'Informational' permanently.

Answer

Delete the underlying log source parser during the scanner execution window.

Question 19

An organization deploys Cortex XDR agents to Linux servers. Certain critical database files residing on custom mount points are experiencing I/O latency due to agent monitoring. How should the administrator configure file integrity monitoring (FIM) or malware scan paths to exclude these specific mount points on Linux endpoints?

Accepted Answer

Configure path exclusions in the Linux Malware / Scan profile pointing to the custom mount directories.. Linux agent settings and Malware profiles allow path-based exclusions tailored to mount points and directories.

Answer

Modify the /etc/fstab file on each server to disable XDR hooks.

Answer

Disable auditd integration in the Data Collection settings.

Answer

Change the agent mode from Advanced to Basic via the Linux kernel module configuration.

Question 20

What is the purpose of tagging threat intelligence indicators in XSIAM?

Accepted Answer

To categorize and group indicators for targeted hunting and filtering in investigations. Tags allow analysts to categorize, organize, and filter indicators for custom hunting queries and incident investigations.

Answer

To increase the processing speed of the ingestion engine

Answer

To automatically block network traffic without creating alerts

Answer

To encrypt sensitive indicators stored in the database