XSIAM-Analyst Practice Questions 2 — 50 Questions

Question 1

Which TWO methods can be used to pass data between parent playbooks and sub-playbooks in XSIAM? (Choose two)

Accepted Answer

Playbook inputs and arguments mapping. Sub-playbooks accept inputs via mapped arguments and return outputs back to the parent context.

Answer

Manual USB drive file transfer

Answer

Direct hardware memory pointers

Answer

Hardcoding variables in system environment files

Question 2

During an investigation, an analyst identifies an external IP address communicating with multiple internal hosts. To gather threat intelligence context on this IP address directly within XSIAM, which feature should the analyst inspect?

Accepted Answer

Threat Intelligence indicator details and context view. XSIAM provides built-in Threat Intelligence management where indicators (IPs, domains, hashes) are enriched with threat feeds and can be inspected for context.

Answer

Network interface promiscuous mode switch

Answer

Syslog forwarding status panel

Answer

Cortex XDR Firewall local rulebase

Question 3

An analyst needs to quickly determine which endpoints in the organization are missing critical security content updates that could leave them vulnerable to recently discovered threats. Which XSIAM view should the analyst consult to see agent content version status across the fleet?

Accepted Answer

The Endpoint Management page showing agent version and content version columns. The Endpoint Management page in XSIAM consolidates agent and content version information for every registered endpoint. By sorting or filtering on content version, an analyst can immediately see which systems are behind and need updates. This is the fastest way to assess fleet-wide update status and prioritize remediation for endpoints exposed to new threats.

Answer

The Query Center with a preset for agent installation dates

Answer

The Policy Management page listing applied profiles

Answer

The Incidents page filtered by high severity

Question 4

Which type of analytic alert in XSIAM focuses specifically on identifying unauthorized or anomalous credential usage?

Accepted Answer

Credential Access and User Anomaly analytic alerts. User behavior analytics (UBA) or credential-based analytics focus on credential anomalies.

Answer

Agent Heartbeat Failure alerts

Answer

Network Packet Inspection alerts

Answer

Disk Storage Allocation alerts

Question 5

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

Accepted Answer

XQL Search using dataset xdr_data with filters on actor process and action process. XQL Search is the primary interface for querying normalized endpoint datasets (such as xdr_data) to hunt for specific process relationships.

Answer

Broker VM > Log Viewer > Filter Process

Answer

Incident Viewer > Advanced Filter > Process Spawn

Answer

Endpoint Security > Asset Explorer > Live Query

Question 6

A security manager wants Cortex XSIAM to automatically raise the severity of incidents involving indicators that appear on a specific high-confidence threat intelligence feed, without affecting incidents tied to lower-confidence feeds. Which configuration achieves this requirement?

Accepted Answer

Set the feed's reputation to 'Bad' and assign a high severity value to the feed's indicators in the feed integration configuration.. XSIAM feed integrations let analysts define the reputation and severity applied to indicators from each source. By assigning a high severity to a high-confidence feed, incidents correlated with those indicators inherit elevated severity automatically, while indicators from other feeds keep their own severity values, providing selective, source-aware prioritization without disabling coverage.

Answer

Modify the incident's severity manually each time a matching indicator appears.

Answer

Create a separate tenant dedicated to the high-confidence feed so its indicators are isolated.

Answer

Disable all other feeds so only the high-confidence feed contributes indicators to incidents.

Question 7

An analyst is responding to an incident involving a compromised user account in XSIAM. The analyst needs to contain the threat and prevent further unauthorized access. Which TWO actions should the analyst take? (Choose two.)

Accepted Answer

Disable the user account in Active Directory. Disabling the user account and revoking all active sessions are the two most effective immediate containment actions for a compromised account. Disabling prevents new logins, while revoking sessions terminates existing ones. Together, they ensure the attacker loses access. Other actions like password reset or IP blocking are either insufficient or not targeted enough.

Answer

Block the user's IP address at the firewall

Answer

Delete the user account

Answer

Reset the user's password

Question 8

An XSIAM analyst is reviewing the Alerts table and wants to quickly identify which alerts are associated with a specific incident. Which column or field in the Alerts table should the analyst use to filter for alerts that are part of an incident?

Accepted Answer

Incident ID. The Incident ID column in the Alerts table explicitly shows the incident identifier if the alert is correlated into an incident. Filtering on this field allows analysts to separate incident-bound alerts from standalone ones. This is essential for understanding which alerts are already being investigated as part of a larger incident.

Answer

Status

Answer

Source

Answer

Severity

Question 9

While triaging an incoming security incident in XSIAM, an analyst observes multiple analytic alerts grouped together under a single incident container. What is the primary mechanism XSIAM uses to group these alerts?

Accepted Answer

Automated correlation based on shared entities, timelines, and attack chains.. XSIAM's core value proposition is its ability to automatically correlate alerts into incidents using machine learning and the Cortex Data Model (XDM). It groups alerts that share entities (IPs, users, hosts), occur within related timelines, and form part of the same attack chain, dramatically reducing analyst alert fatigue. This automated correlation is what transforms thousands of raw alerts into a manageable set of incidents.

Answer

Pre-configured firewall policy matches only.

Answer

Random assignment by the system load balancer.

Answer

Manual aggregation performed by the ingestion service.

Question 10

An XSIAM analyst is responding to a confirmed malware incident on an endpoint. The analyst needs to immediately isolate the endpoint from the network to prevent further spread. Which XSIAM action should the analyst take?

Accepted Answer

Run the 'Isolate Endpoint' action from the incident response playbook. Isolating the endpoint via the 'Isolate Endpoint' action is the correct immediate containment step for a malware infection. It severs network communications to prevent spread while allowing remediation. Other actions like disabling accounts or blocking hashes are not sufficient to contain an active infection on the endpoint itself.

Answer

Block the malware's hash in the endpoint protection policy

Answer

Disable the user account associated with the endpoint

Answer

Create a new incident for the endpoint and assign it to the security team

Question 11

An analyst wants to classify network events into risk buckets based on the numeric field `bytes_out`: under 1 MB is 'low', 1 MB to 100 MB is 'medium', and above 100 MB is 'high'. The classification should be added as a new field in the pipeline without removing existing fields. Which approach accomplishes this in XQL?

Accepted Answer

Add an `alter` stage using a chained conditional expression such as `alter risk = if(bytes_out < 1000000, "low", if(bytes_out <= 100000000, "medium", "high"))`.. Creating a derived classification field requires a stage that can compute new field values while preserving the event stream, which is what `alter` does. Nesting conditional expressions inside it evaluates thresholds in order and assigns the correct tier. Filtering only excludes events, aggregating collapses rows, and deduplication removes events without any labeling logic.

Answer

Add a `stats` stage that computes `count()` grouped by `bytes_out`.

Answer

Add a `filter` stage with the three threshold comparisons joined by logical OR operators.

Answer

Add a `dedup` stage on `bytes_out` and let XSIAM automatically infer the risk tier from the value.

Question 12

An administrator is planning a staged rollout of a new Cortex XDR agent version across the enterprise. To mitigate risk, the administrator wants to deploy the new version to a test group of endpoints first. How is this staged deployment managed in XSIAM?

Accepted Answer

Assign the new agent version specifically to the test endpoint group's assigned Profile / Settings.. In Cortex XSIAM, agent version deployment is managed through endpoint groups and their assigned profiles/settings. To stage a rollout, you assign the new agent version to a specific test endpoint group's profile, so only endpoints in that group receive the update. Once validated, you can roll it out to other groups.

Answer

Use an XQL playbook to push executables via remote shell.

Answer

Configure a Broker VM distribution schedule for software binaries.

Answer

Manually uninstall the agent on test machines and run the MSI installer with a CLI switch.

Question 13

A threat hunter wants to detect beaconing by finding source-destination pairs whose connection count is unusually high within a one-hour window. The analyst groups events by source IP, destination IP, and a one-hour time bucket, then counts connections. Which XQL feature supports creating that one-hour time bucket for grouping?

Accepted Answer

Use the `bin` function on the timestamp field inside the grouping clause of the `stats` stage to bucket events into fixed one-hour intervals.. Time-bucketed aggregation is achieved by applying a binning function to the timestamp inside the grouping clause of the aggregation stage. That converts continuous timestamps into fixed one-hour intervals so counts can be compared per pair per window. Deduplication, self-joins, and sorting do not create time buckets and cannot yield the required per-hour connection counts.

Answer

Use the `sort` stage on the timestamp field and manually inspect consecutive events that fall within an hour of each other.

Answer

Use the `dedup` stage on the timestamp field to collapse events into hourly representatives before counting.

Answer

Use the `join` stage to merge the dataset with itself on the timestamp field to form hourly groups.

Question 14

An analyst needs to filter the Incident Queue to display only incidents that contain specific high-priority analytic alert types. Which filtering mechanism should the analyst use in the XSIAM Incident view?

Accepted Answer

Use the filter bar in the Incident view to specify 'Alert Type' equals the desired analytic detection.. Incidents can be filtered by alert types, severity, and other attributes directly in the Incident View filter bar.

Answer

Export incidents to CSV and filter using external spreadsheet software.

Answer

Modify the global XSIAM license configuration to hide low-priority alerts.

Answer

Write an automated response playbook to delete unwanted incidents.

Question 15

An XSIAM Analyst is reviewing the Incident Management dashboard and needs to understand why a specific high-severity incident was automatically merged with an existing one. Which XSIAM feature determines this grouping behavior?

Accepted Answer

Incident Stitching and correlation rules. XSIAM uses Incident Stitching and correlation rules to automatically group related alerts into a single incident based on shared indicators of compromise or entities.

Answer

XQL query aggregation limits

Answer

Manual aggregation policies

Answer

Cortex XDR agent policy versioning

Question 16

When reviewing query performance in XSIAM, what does the 'dataset' command do at the beginning of an XQL query?

Accepted Answer

It defines the starting data source or table for the query pipeline.. The 'dataset' command specifies the target table or data source to query from.

Answer

It sets the retention period for the query logs.

Answer

It compiles the query into an XSIAM correlation rule.

Answer

It exports the resulting dataset to an external S3 bucket.

Question 17

You need to format a raw JSON timestamp retrieved from an API call into a readable date string before displaying it in an incident layout. Which XSIAM playbook feature accomplishes this without custom Python code?

Accepted Answer

Transformer functions (e.g., FormatDate). XSIAM playbooks include transformer functions — built-in, no-code utilities like FormatDate — that manipulate data between tasks. To convert a raw JSON timestamp into a readable date string, you apply a transformer such as FormatDate to the field, avoiding custom Python.

Answer

Incident Layout Scripts

Answer

Syslog Forwarding Rules

Answer

XQL Aggregate Functions

Question 18

You are troubleshooting an Attack Surface Management (ASM) scan in XSIAM where external IP ranges belonging to a newly acquired subsidiary are not showing up in the asset inventory. What is the most likely reason for this discrepancy?

Accepted Answer

The seed domains or IP ranges for the subsidiary have not been added to the ASM configuration scope. ASM relies on defined organization seed assets and authorized external scopes. If the discovery seed is missing, ASM will not map the assets.

Answer

Threat intelligence feeds have disabled automatic asset correlation by default

Answer

The Log Forwarder agent is not installed on the subsidiary endpoints

Answer

The ingestion service for ASM requires manual CSV asset mapping before discovery runs

Question 19

An analyst needs to extract specific Regex matching patterns from an incoming email body during an automated phishing investigation playbook. Which built-in mechanism should be used?

Accepted Answer

Extraction transformer / script command (e.g., ExtractIndicators). In XSIAM playbooks, the Extraction transformer (or the ExtractIndicators script command) is designed to parse text and extract indicators such as IP addresses, URLs, domains, and other regex patterns. It is a built-in mechanism specifically for extracting data from email bodies during phishing investigations.

Answer

XQL Indexing rule

Answer

Syslog output routing

Answer

Agent Policy assignment

Question 20

An XSIAM Analyst is reviewing the Analytics page and needs to understand the difference between standard alerts and incident-bound alerts. Which of the following best describes the role of analytics in XSIAM's alerting process?

Accepted Answer

Analytics automatically evaluate telemetry to generate structured alerts that contribute to security incidents.. In XSIAM, analytics are the detection engine that continuously evaluates ingested telemetry (endpoint, network, identity, cloud) and produces structured alerts. These alerts are not just informational — they are designed to be incident-bound, meaning they automatically contribute to and enrich security incidents within the incident management workflow. This is the core mechanism by which XSIAM turns raw data into actionable detections without requiring manual rule authoring for every scenario.

Answer

Analytics replace the need for correlation rules by directly closing false positives.

Answer

Analytics are exclusively used for reporting compliance and do not affect the active alert queue.

Answer

Analytics only generate raw logs, requiring manual rule creation to produce alerts.