XSIAM-Analyst Practice Test 6 — 10 Questions

Question 1

Which TWO methods can be used to pass data between parent playbooks and sub-playbooks in XSIAM? (Choose two)

Accepted Answer

Playbook inputs and arguments mapping. Sub-playbooks accept inputs via mapped arguments and return outputs back to the parent context.

Answer

Manual USB drive file transfer

Answer

Direct hardware memory pointers

Answer

Hardcoding variables in system environment files

Question 2

During an investigation, an analyst identifies an external IP address communicating with multiple internal hosts. To gather threat intelligence context on this IP address directly within XSIAM, which feature should the analyst inspect?

Accepted Answer

Threat Intelligence indicator details and context view. XSIAM provides built-in Threat Intelligence management where indicators (IPs, domains, hashes) are enriched with threat feeds and can be inspected for context.

Answer

Network interface promiscuous mode switch

Answer

Syslog forwarding status panel

Answer

Cortex XDR Firewall local rulebase

Question 3

An analyst needs to quickly determine which endpoints in the organization are missing critical security content updates that could leave them vulnerable to recently discovered threats. Which XSIAM view should the analyst consult to see agent content version status across the fleet?

Accepted Answer

The Endpoint Management page showing agent version and content version columns. The Endpoint Management page in XSIAM consolidates agent and content version information for every registered endpoint. By sorting or filtering on content version, an analyst can immediately see which systems are behind and need updates. This is the fastest way to assess fleet-wide update status and prioritize remediation for endpoints exposed to new threats.

Answer

The Query Center with a preset for agent installation dates

Answer

The Policy Management page listing applied profiles

Answer

The Incidents page filtered by high severity

Question 4

Which type of analytic alert in XSIAM focuses specifically on identifying unauthorized or anomalous credential usage?

Accepted Answer

Credential Access and User Anomaly analytic alerts. User behavior analytics (UBA) or credential-based analytics focus on credential anomalies.

Answer

Agent Heartbeat Failure alerts

Answer

Network Packet Inspection alerts

Answer

Disk Storage Allocation alerts

Question 5

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

Accepted Answer

XQL Search using dataset xdr_data with filters on actor process and action process. XQL Search is the primary interface for querying normalized endpoint datasets (such as xdr_data) to hunt for specific process relationships.

Answer

Broker VM > Log Viewer > Filter Process

Answer

Incident Viewer > Advanced Filter > Process Spawn

Answer

Endpoint Security > Asset Explorer > Live Query

Question 6

A security manager wants Cortex XSIAM to automatically raise the severity of incidents involving indicators that appear on a specific high-confidence threat intelligence feed, without affecting incidents tied to lower-confidence feeds. Which configuration achieves this requirement?

Accepted Answer

Set the feed's reputation to 'Bad' and assign a high severity value to the feed's indicators in the feed integration configuration.. XSIAM feed integrations let analysts define the reputation and severity applied to indicators from each source. By assigning a high severity to a high-confidence feed, incidents correlated with those indicators inherit elevated severity automatically, while indicators from other feeds keep their own severity values, providing selective, source-aware prioritization without disabling coverage.

Answer

Modify the incident's severity manually each time a matching indicator appears.

Answer

Create a separate tenant dedicated to the high-confidence feed so its indicators are isolated.

Answer

Disable all other feeds so only the high-confidence feed contributes indicators to incidents.

Question 7

An analyst is responding to an incident involving a compromised user account in XSIAM. The analyst needs to contain the threat and prevent further unauthorized access. Which TWO actions should the analyst take? (Choose two.)

Accepted Answer

Disable the user account in Active Directory. Disabling the user account and revoking all active sessions are the two most effective immediate containment actions for a compromised account. Disabling prevents new logins, while revoking sessions terminates existing ones. Together, they ensure the attacker loses access. Other actions like password reset or IP blocking are either insufficient or not targeted enough.

Answer

Block the user's IP address at the firewall

Answer

Delete the user account

Answer

Reset the user's password

Question 8

An XSIAM analyst is reviewing the Alerts table and wants to quickly identify which alerts are associated with a specific incident. Which column or field in the Alerts table should the analyst use to filter for alerts that are part of an incident?

Accepted Answer

Incident ID. The Incident ID column in the Alerts table explicitly shows the incident identifier if the alert is correlated into an incident. Filtering on this field allows analysts to separate incident-bound alerts from standalone ones. This is essential for understanding which alerts are already being investigated as part of a larger incident.

Answer

Status

Answer

Source

Answer

Severity

Question 9

While triaging an incoming security incident in XSIAM, an analyst observes multiple analytic alerts grouped together under a single incident container. What is the primary mechanism XSIAM uses to group these alerts?

Accepted Answer

Automated correlation based on shared entities, timelines, and attack chains.. XSIAM's core value proposition is its ability to automatically correlate alerts into incidents using machine learning and the Cortex Data Model (XDM). It groups alerts that share entities (IPs, users, hosts), occur within related timelines, and form part of the same attack chain, dramatically reducing analyst alert fatigue. This automated correlation is what transforms thousands of raw alerts into a manageable set of incidents.

Answer

Pre-configured firewall policy matches only.

Answer

Random assignment by the system load balancer.

Answer

Manual aggregation performed by the ingestion service.

Question 10

An XSIAM analyst is responding to a confirmed malware incident on an endpoint. The analyst needs to immediately isolate the endpoint from the network to prevent further spread. Which XSIAM action should the analyst take?

Accepted Answer

Run the 'Isolate Endpoint' action from the incident response playbook. Isolating the endpoint via the 'Isolate Endpoint' action is the correct immediate containment step for a malware infection. It severs network communications to prevent spread while allowing remediation. Other actions like disabling accounts or blocking hashes are not sufficient to contain an active infection on the endpoint itself.

Answer

Block the malware's hash in the endpoint protection policy

Answer

Disable the user account associated with the endpoint

Answer

Create a new incident for the endpoint and assign it to the security team