XSIAM-Analyst Practice Test 5 — 10 Questions

Question 1

Which type of indicators can be ingested into XSIAM's Threat Intelligence module?

Accepted Answer

IP addresses, domains, URLs, and file hashes. XSIAM supports multiple indicator types including IP addresses, domains, URLs, and file hashes (MD5, SHA256).

Answer

Only network traffic packet captures (PCAP files)

Answer

Only file hashes (SHA256 and MD5)

Answer

Only internal Active Directory user account names

Question 2

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

Accepted Answer

Attack Surface Management > Assets. Attack Surface Management features have a dedicated workspace within the XSIAM navigation menu.

Answer

Incident Response > ASM Incidents

Answer

Dashboards > Threat Intelligence > ASM

Answer

Settings > Integrations > ASM Scanner

Question 3

Which TWO information sources or artifacts can an analyst inspect within an XSIAM incident to understand the scope of an attack? (Choose two)

Accepted Answer

List of affected endpoints and hosts. Option A (List of affected endpoints and hosts) is correct because XSIAM incidents aggregate endpoint and host artifacts from the underlying telemetry and EDR data, allowing the analyst to enumerate which machines were touched by the attacker and thereby gauge the blast radius. Option E (Associated users and account entities involved) is correct because XSIAM correlates identity data into the incident, exposing the user and account entities tied to the activity so the analyst can determine which credentials were compromised or misused. Together, these two artifacts directly answer the scope question by mapping both the systems and the identities affected. Options B, C, and D are unrelated to security telemetry — a cafeteria menu, printer paper inventory, and parking badge records are not XSIAM incident artifacts and provide no insight into attack scope.

Answer

The local cafeteria lunch menu for the day

Answer

Office printer paper inventory levels

Answer

Employee parking garage badge swipe records outside XSIAM

Question 4

Which TWO actions occur when a playbook task hits a conditional split with multiple matching paths? (Choose two)

Accepted Answer

Depending on configuration, matching paths can execute in parallel or sequentially.. Option A is correct because in a playbook conditional split, when several branches match, the engine's configuration governs whether those matching paths run concurrently (in parallel) or one after another (sequentially), so both behaviors are possible depending on how the split is set up. Option D is correct because the conditional split's core function is to evaluate each branch's condition against the task's output/context, and the results of that evaluation determine which downstream tasks are given the execution flow. Options B, C, and E are incorrect because a conditional split only routes execution flow within the playbook; it does not shut down the XSIAM tenant, clear user browser caches, or purge system logs from disk.

Answer

The entire XSIAM tenant automatically shuts down for maintenance.

Answer

The browser cache of every user is cleared.

Answer

All system logs are permanently purged from disk.

Question 5

Which TWO components are fundamental parts of every XQL query structure? (Choose two)

Accepted Answer

The dataset command specifying the source table. Option B is correct because every XQL query must begin by declaring its data source with a dataset command (for example, `dataset = xdr_data`), which tells the query engine which table or dataset to search. Option E is correct because XQL is a pipelined query language in which stages are chained together using the pipe character (|), such as `dataset = xdr_data | filter ... | fields ...`, so the pipeline syntax is fundamental to the query structure. Option A is incorrect because XQL is not SQL and does not use a SQL SELECT statement header; it uses dataset and stage commands instead. Option C is incorrect because playbook triggers belong to automation/playbook configuration, not to the query language itself. Option D is incorrect because XQL queries are plain text and require no XML schema declaration.

Answer

A SQL SELECT statement header

Answer

An automated playbook trigger reference

Answer

A mandatory XML schema declaration

Question 6

An analyst investigates a suspected lateral-movement burst and needs to identify source hosts that connected to more than 15 distinct destination IPs within a single hour. The relevant authentication events are already filtered into the pipeline. Which XQL construction produces one row per source host per hour with the distinct destination count?

Accepted Answer

bin timestamp span = 1h as hour | comp count_distinct(dst_ip) as dest_count by src_host, hour | filter dest_count > 15. Detecting a lateral-movement burst requires counting unique destinations rather than raw events, because repeated contacts to one host are not lateral movement. Bucketing the stream into one-hour windows with bin, then applying comp count_distinct(dst_ip) grouped by source host and bucket, produces exactly one row per host per hour, and the filter enforces the 15-destination threshold.

Answer

comp count(dst_ip) as dest_count by src_host | filter dest_count > 15

Answer

stats max(dst_ip) as dest_count by src_host | filter dest_count > 15

Answer

dedup dst_ip by src_host | comp count() as dest_count by src_host | filter dest_count > 15

Question 7

An analyst is handling an incident in XSIAM where the attacker moved laterally from a compromised workstation to a server. The analyst wants to identify all affected endpoints and their current containment status from a single view. Which XSIAM feature should the analyst use?

Accepted Answer

Incident Investigation. The Incident Investigation view is designed to give analysts a comprehensive picture of an incident, including all affected endpoints and their containment status. It consolidates data from various sources, enabling quick assessment and response. The other options serve different purposes: War Room for collaboration, Endpoint Management for configuration, and Threat Intelligence for context.

Answer

Threat Intelligence

Answer

Incident War Room

Answer

Endpoint Management

Question 8

An organization wants to reduce noise from a known vulnerability scanner that triggers high-severity analytics alerts every weekend. The SOC decides to suppress these specific alerts during scanning windows. How should the analyst configure this in XSIAM?

Accepted Answer

Create an Exclusion or Suppression rule in the Incident and Alert Settings with time-based criteria.. Alert suppression rules can be configured with specific time schedules and filter criteria to mute known benign scanner activity.

Answer

Modify the firewall security policy to block the scanner IP.

Answer

Configure a global severity override to change the scanner alerts to 'Informational' permanently.

Answer

Delete the underlying log source parser during the scanner execution window.

Question 9

An organization deploys Cortex XDR agents to Linux servers. Certain critical database files residing on custom mount points are experiencing I/O latency due to agent monitoring. How should the administrator configure file integrity monitoring (FIM) or malware scan paths to exclude these specific mount points on Linux endpoints?

Accepted Answer

Configure path exclusions in the Linux Malware / Scan profile pointing to the custom mount directories.. Linux agent settings and Malware profiles allow path-based exclusions tailored to mount points and directories.

Answer

Modify the /etc/fstab file on each server to disable XDR hooks.

Answer

Disable auditd integration in the Data Collection settings.

Answer

Change the agent mode from Advanced to Basic via the Linux kernel module configuration.

Question 10

What is the purpose of tagging threat intelligence indicators in XSIAM?

Accepted Answer

To categorize and group indicators for targeted hunting and filtering in investigations. Tags allow analysts to categorize, organize, and filter indicators for custom hunting queries and incident investigations.

Answer

To increase the processing speed of the ingestion engine

Answer

To automatically block network traffic without creating alerts

Answer

To encrypt sensitive indicators stored in the database