XSIAM-Analyst Practice Questions 1 — 50 Questions

Question 1

An analyst has just enabled a new threat intelligence feed in Cortex XSIAM and wants to quickly confirm whether indicators from that feed are actually being stored and are available for investigation, without waiting for a correlation rule to fire. Which action best accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Open the indicator repository and filter by the feed's source, confirming that indicators with recent timestamps are listed.. The indicator repository is the platform location where ingested threat intelligence is stored and can be filtered by source. Filtering for the new feed's source and observing recently timestamped indicators directly verifies that ingestion is working and that the data is ready for investigation, independent of whether any correlation rule has matched.

Answer

Inspect the correlation rule library for a rule named after the feed to confirm the feed registered successfully.

Answer

Run a manual ASM scan against the feed's IP ranges to see whether the indicators resolve to live assets.

Answer

Check the management server's endpoint device inventory for entries matching the feed's indicators.

Question 2

A playbook loops over a list of forty endpoints and runs an isolation command on each. Midway through, the integration returns a rate-limit error on one endpoint. The team wants the playbook to log the failure for that endpoint and continue processing the remaining endpoints rather than aborting the entire run. Which configuration achieves this?

Accepted Answer

Set the isolation task's execution mode to continue on error so the loop proceeds to the next item while recording the failure.. Setting the task to continue on error lets the loop skip past a failed endpoint while capturing the failure in logs, so all remaining endpoints are still processed. This is the standard pattern for bulk operations where individual failures should not halt the workflow. Timeout changes, outer conditionals, and assumed automatic retries do not address per-item failure tolerance inside a loop.

Answer

Wrap the entire loop in a single conditional task that checks whether any endpoint failed before continuing.

Answer

Increase the integration instance's timeout value so the rate-limit error does not occur during the loop.

Answer

Reduce the loop batch size to one and rely on the playbook engine to retry failed iterations automatically.

Question 3

An administrator is preparing to deploy the Cortex XDR agent to a new batch of Windows endpoints. Before installation, the administrator wants to verify that the endpoints meet the minimum supported operating system requirements for the current agent version. Where in the Cortex XSIAM documentation or console should the administrator confirm the supported Windows versions?

Accepted Answer

In the Cortex XSIAM Administrator Guide under the Cortex XDR agent installation requirements section.. The Cortex XSIAM Administrator Guide is the official documentation that lists Cortex XDR agent installation requirements, including supported Windows operating system versions. Administrators should consult it before deployment to confirm compatibility. The other options reference local endpoint data or licensing documents that do not contain the agent's supported OS matrix.

Answer

In the Cortex XSIAM license certificate provided at purchase.

Answer

In the endpoint's Windows Update history on each target machine.

Answer

In the Windows Event Viewer Application log on a previously deployed endpoint.

Question 4

What is the primary function of Attack Surface Management (ASM) within Cortex XSIAM?

Accepted Answer

To continuously discover and map external, internet-facing assets and potential exposures. ASM focuses on discovering unknown or unmanaged internet-facing assets to reduce organizational risk.

Answer

To ingest external threat feeds and correlate them with internal firewall logs

Answer

To monitor internal workstation performance and CPU usage

Answer

To automate the deployment of security patches on cloud servers

Question 5

You notice that an automated playbook is executing multiple duplicate sub-tasks simultaneously because multiple alerts matching the same indicator arrived within seconds. How can you prevent race conditions or duplicate execution?

Accepted Answer

Configure playbook concurrency settings / deduplication keys.. Playbook concurrency settings and deduplication keys are the native XSIAM/Cortex XSOAR mechanisms that prevent the same playbook from spawning parallel duplicate executions when multiple alerts share an indicator. By defining a deduplication key (e.g., based on the indicator value or incident ID) and configuring concurrency limits, the platform ensures only one instance runs or that subsequent triggers are queued/merged rather than executed in parallel. This directly addresses race conditions caused by near-simultaneous matching alerts.

Answer

Reinstall the XSIAM agent on all endpoints.

Answer

Turn off auto-updates for integrations.

Answer

Delete all historical log partitions.

Question 6

During an investigation in Cortex XSIAM, an analyst needs to review the local protection settings currently applied to a specific Windows endpoint by its Cortex XDR agent, including whether behavioral threat protection is enabled and whether the agent is running in blocking or report-only mode. Where in the XSIAM console can the analyst view this per-endpoint protection configuration?

Accepted Answer

Endpoint Management > Endpoints > select the endpoint > Protection Status tab. To verify what protections a Cortex XDR agent is actually enforcing on a specific host, the analyst must open the endpoint's detail view and consult the Protection Status tab, which reports the applied policy and each module's state. Incident timelines, policy audit trails, and vulnerability views describe different data sets and do not represent the endpoint's live protection configuration.

Answer

Inventory > Endpoints > select the endpoint > Vulnerabilities tab

Answer

Policies > Prevention > select the policy > Audit Trail tab

Answer

Incidents > select the relevant incident > Timeline tab

Question 7

Which THREE components or views in XSIAM assist analysts in recognizing and understanding analytic alert types and their context? (Choose three)

Accepted Answer

MITRE ATT&CK tactical coverage display in the alert pane. Alert details, MITRE mappings, and incident graphs help analysts understand alerts.

Answer

License renewal expiration tracker

Answer

Agent BIOS version audit report

Question 8

During an incident investigation in Cortex XSIAM, an analyst needs to determine the scope of a credential theft attack. The analyst wants to identify all endpoints where a specific compromised user account was used to log in successfully after the initial compromise. Which XQL query should the analyst run?

Accepted Answer

dataset = xdr_data | filter event_type = ENUM.LOGIN and action_status = "SUCCESS" and user_name = "compromised_user" | fields agent_hostname, user_name, _time. The correct XQL query filters for successful login events (ENUM.LOGIN with action_status "SUCCESS") for the compromised user, returning hostnames and timestamps. This directly identifies all endpoints where the account was used after compromise, enabling the analyst to scope the incident. Other queries focus on process, file, or network events, which do not show successful authentication usage.

Answer

dataset = xdr_data | filter event_type = ENUM.NETWORK and remote_ip = "attacker_ip" | fields agent_hostname, remote_ip

Answer

dataset = xdr_data | filter event_type = ENUM.FILE and file_name = "ntds.dit" | fields agent_hostname, file_name

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and process_name = "lsass.exe" | fields agent_hostname, process_name

Question 9

Which TWO protocols or formats are natively supported for importing threat intelligence feeds into Cortex XSIAM? (Choose two)

Accepted Answer

TAXII 2.0 / 2.1. Cortex XSIAM natively supports ingesting threat intelligence via TAXII 2.0/2.1 (option B), which is the standard OASIS protocol for STIX-formatted threat intel exchange, allowing XSIAM to subscribe to external TAXII servers and pull indicators automatically. It also natively supports CSV file uploads and feeds (option C), enabling analysts to bulk-import custom indicators with mapped columns for fields like indicator type, value, and severity. The remaining options are not threat-intelligence ingestion formats: Bluetooth Low Energy beacon frames (A) are wireless advertising packets, proprietary printer configuration protocols (D) are device-management protocols, and raw binary kernel dump files (E) are memory forensics artifacts — none of these are recognized feed formats for XSIAM's threat intel module.

Answer

Bluetooth Low Energy beacon frames

Answer

Proprietary printer configuration protocols

Answer

Raw binary kernel dump files

Question 10

An XSIAM Analyst is configuring a new custom prioritization rule to ensure that alerts involving the finance department's servers receive a higher severity score. Which TWO elements must be defined within the rule for it to correctly match and score the intended alerts? (Choose two.)

Accepted Answer

A severity adjustment value or new severity level to apply when the condition matches. A custom prioritization rule must have a condition to identify target alerts and an action to adjust severity. Conditions can use asset attributes like hostname or criticality tags to focus on finance servers. The severity adjustment ensures those alerts are scored higher. Other elements like schedules, grouping references, or notification templates are not required for the rule to function.

Answer

A schedule that defines when the rule is active

Answer

A notification template to alert the SOC team

Answer

An incident grouping rule reference to link related alerts

Question 11

A junior analyst is reviewing XQL query results and notices that the 'event_id' field is present in some rows but missing in others. They need to filter the results to only include rows where 'event_id' is not null. Which XQL filter condition should they use?

Accepted Answer

filter event_id is not null. To filter for rows where a field is not null, XQL provides the 'is not null' operator. This explicitly checks that the field contains a value, correctly excluding rows where the field is missing or null. Other approaches like comparing to null or empty string do not accurately handle null semantics and can lead to incorrect results.

Answer

filter event_id != null

Answer

filter event_id exists

Answer

filter event_id <> ""

Question 12

An analyst is reviewing an endpoint that has been flagged for suspicious behavior. The analyst wants to retrieve the agent's diagnostic logs directly from the XSIAM console to investigate why certain events were not detected. Which action should the analyst take?

Accepted Answer

Use the 'Retrieve Agent Logs' action on the endpoint details page. The 'Retrieve Agent Logs' action on the endpoint details page is designed to collect and deliver the agent's diagnostic logs to the XSIAM console. This enables analysts to troubleshoot detection gaps, service issues, or configuration problems without remote shell access. It is the most direct and supported method for obtaining agent logs for investigation.

Answer

Run a Live Terminal session and execute a log collection script

Answer

Export the endpoint's alert history to a CSV file

Answer

Configure a new policy that enables verbose logging and wait for logs to appear in the console

Question 13

A Cortex XSIAM administrator notices that an ASM scan completed successfully but a known external web application was not listed in the results. The application is reachable from the internet and is owned by the organization. Which troubleshooting step is most appropriate to determine why the asset was missed?

Accepted Answer

Verify that the asset's hostname or address falls within the configured discovery seeds and that the relevant ports are included in the scan scope. A reachable asset that does not appear in ASM results is usually outside the configured seed set or listening on a port that is not scanned. Verifying seed coverage and port scope directly addresses the discovery boundary. Re-running discovery, tuning request rates, or manually adding the asset all skip the diagnostic step and leave the coverage gap in place.

Answer

Re-run the entire discovery configuration from scratch to force a fresh enumeration of all seeds

Answer

Add the web application to the asset inventory manually so it appears in ASM reports going forward

Answer

Increase the scan's request rate to ensure the web application responds before the scan times out

Question 14

An administrator is configuring the Cortex XDR agent's self-protection settings to prevent tampering by malicious actors. The administrator wants to ensure that the agent cannot be stopped or uninstalled without proper authorization. Which TWO measures should the administrator implement? (Choose two.)

Accepted Answer

Enable password protection for agent uninstallation and stopping of the agent service.. Password protection and running as a protected process (PPL) are both direct self-protection mechanisms. Password protection blocks unauthorized uninstallation or service stop, while PPL prevents other processes from terminating or modifying the agent. Together, they significantly harden the agent against tampering attempts, meeting the administrator's requirement.

Answer

Configure the agent to scan for and remove other security tools that might conflict.

Answer

Set the agent to automatically update to the latest version without user intervention.

Answer

Enable detailed logging of all agent actions to a remote syslog server.

Question 15

An incident response team wants to customize the incident severity scoring in XSIAM to better reflect organizational risk. Where are incident risk scoring and severity mapping configurations managed?

Accepted Answer

Incident Configuration settings. Incident severity and scoring rules, which determine how alerts roll up into incidents and their resulting priority, are configured under Incident Configuration settings in XSIAM.

Answer

Agent Installation Settings

Answer

Role-Based Access Control (RBAC) definitions

Answer

Data Stitching Schema Builder

Question 16

An XSIAM Analyst is investigating an analytic alert that has an unusually high priority score. The analyst wants to audit how the final score was calculated, specifically looking at the base score versus modifier weights. Where can the analyst inspect the score breakdown for an alert?

Accepted Answer

Alert Details slide-out panel > Score Breakdown / Scoring Factors tab. The alert details pane in XSIAM provides an analytical breakdown showing the base severity and any applied custom prioritization modifiers.

Answer

Reports > Audit Logs > System Activities

Answer

Investigation > Graph View > Edge Weights

Answer

Settings > Incident Settings > Scoring Matrix

Question 17

A Cortex XSIAM analyst is reviewing how threat intelligence indicators flow from an enabled feed into detection. The analyst wants to understand which actions occur when the feed integration polls and new indicators are retrieved. (Choose two.)

Accepted Answer

Indicators can be enriched or matched against telemetry during correlation and used to raise alerts or populate the incident view.. When an enabled feed polls, XSIAM normalizes retrieved indicators into its schema and stores them in the indicator repository with a reputation and expiration, making them available platform-wide. Those indicators are then evaluated during correlation against telemetry and used for enrichment, which can raise alerts or feed incidents. Automatic rule modification, endpoint blocklisting, and mandatory manual approval are not part of the standard ingestion flow.

Answer

Every retrieved indicator is immediately pushed to all managed endpoint agents as a blocklist entry.

Answer

Newly retrieved indicators are automatically written into every enabled correlation rule's indicator filter without analyst action.

Answer

Retrieved indicators are quarantined in a staging area and require manual approval before they become visible to any XSIAM component.

Question 18

A Cortex XSIAM analyst is building a playbook that must pause and wait for an analyst to review a quarantined file before deciding whether to restore or delete it. The playbook should resume automatically once the analyst completes the review task. Which task type should the analyst use to implement this pause and resume behavior?

Accepted Answer

Manual task. A manual task is the XSIAM construct that pauses a playbook, presents an action to an analyst, and resumes automatically when the action is completed. Conditional, data collection, and timer tasks do not provide an interactive review step that captures a restore-or-delete decision.

Answer

Timer task

Answer

Data collection task

Answer

Conditional task

Question 19

A Cortex XSIAM analyst is configuring an Attack Surface Management (ASM) discovery scope for a subsidiary and wants to ensure that only externally reachable assets are included in the inventory, excluding internal-only hosts. Which configuration should the analyst apply to the scope?

Accepted Answer

Define the scope using external seed assets such as public domain names and public IP ranges so ASM discovers only internet-facing assets.. ASM discovery is driven by the seeds defined in the scope. Providing public domain names and public IP ranges as seeds naturally limits discovery to internet-facing assets, which is the intended way to exclude internal-only hosts from the inventory.

Answer

Enable the 'internal only' option in the ASM scope settings and then manually tag external assets for removal.

Answer

Add internal RFC 1918 address ranges as seeds and enable a filter that removes private IPs from the inventory after discovery.

Answer

Create the scope with no seeds and rely on passive DNS and certificate transparency data to populate the inventory.

Question 20

An automation script requires secure storage of an API token used to query an external threat intel feed. Where should this token be stored within Cortex XSIAM?

Accepted Answer

Integration Instance Configuration Parameters (marked as Encrypted/Password). Integration Instance Configuration Parameters marked as Encrypted/Password are the designated secure store for credentials such as API tokens in Cortex XSIAM. When a parameter is flagged as encrypted, the value is stored in the tenant's credential vault and masked in the UI, so playbooks and integrations reference it without ever exposing the plaintext secret. This is the platform-supported pattern for secrets used by external threat intel feed queries.

Answer

Within unencrypted XQL lookup CSV files.

Answer

Hardcoded directly inside the playbook JSON file.

Answer

Inside public dashboard notes.