XSIAM-Analyst Practice Test 7 — 10 Questions

Question 1

An analyst wants to classify network events into risk buckets based on the numeric field `bytes_out`: under 1 MB is 'low', 1 MB to 100 MB is 'medium', and above 100 MB is 'high'. The classification should be added as a new field in the pipeline without removing existing fields. Which approach accomplishes this in XQL?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add an `alter` stage using a chained conditional expression such as `alter risk = if(bytes_out < 1000000, "low", if(bytes_out <= 100000000, "medium", "high"))`.. Creating a derived classification field requires a stage that can compute new field values while preserving the event stream, which is what `alter` does. Nesting conditional expressions inside it evaluates thresholds in order and assigns the correct tier. Filtering only excludes events, aggregating collapses rows, and deduplication removes events without any labeling logic.

Answer

Add a `stats` stage that computes `count()` grouped by `bytes_out`.

Answer

Add a `filter` stage with the three threshold comparisons joined by logical OR operators.

Answer

Add a `dedup` stage on `bytes_out` and let XSIAM automatically infer the risk tier from the value.

Question 2

An administrator is planning a staged rollout of a new Cortex XDR agent version across the enterprise. To mitigate risk, the administrator wants to deploy the new version to a test group of endpoints first. How is this staged deployment managed in XSIAM?

Accepted Answer

Assign the new agent version specifically to the test endpoint group's assigned Profile / Settings.. In Cortex XSIAM, agent version deployment is managed through endpoint groups and their assigned profiles/settings. To stage a rollout, you assign the new agent version to a specific test endpoint group's profile, so only endpoints in that group receive the update. Once validated, you can roll it out to other groups.

Answer

Use an XQL playbook to push executables via remote shell.

Answer

Configure a Broker VM distribution schedule for software binaries.

Answer

Manually uninstall the agent on test machines and run the MSI installer with a CLI switch.

Question 3

A threat hunter wants to detect beaconing by finding source-destination pairs whose connection count is unusually high within a one-hour window. The analyst groups events by source IP, destination IP, and a one-hour time bucket, then counts connections. Which XQL feature supports creating that one-hour time bucket for grouping?

Accepted Answer

Use the `bin` function on the timestamp field inside the grouping clause of the `stats` stage to bucket events into fixed one-hour intervals.. Time-bucketed aggregation is achieved by applying a binning function to the timestamp inside the grouping clause of the aggregation stage. That converts continuous timestamps into fixed one-hour intervals so counts can be compared per pair per window. Deduplication, self-joins, and sorting do not create time buckets and cannot yield the required per-hour connection counts.

Answer

Use the `sort` stage on the timestamp field and manually inspect consecutive events that fall within an hour of each other.

Answer

Use the `dedup` stage on the timestamp field to collapse events into hourly representatives before counting.

Answer

Use the `join` stage to merge the dataset with itself on the timestamp field to form hourly groups.

Question 4

An analyst needs to filter the Incident Queue to display only incidents that contain specific high-priority analytic alert types. Which filtering mechanism should the analyst use in the XSIAM Incident view?

Accepted Answer

Use the filter bar in the Incident view to specify 'Alert Type' equals the desired analytic detection.. Incidents can be filtered by alert types, severity, and other attributes directly in the Incident View filter bar.

Answer

Export incidents to CSV and filter using external spreadsheet software.

Answer

Modify the global XSIAM license configuration to hide low-priority alerts.

Answer

Write an automated response playbook to delete unwanted incidents.

Question 5

An XSIAM Analyst is reviewing the Incident Management dashboard and needs to understand why a specific high-severity incident was automatically merged with an existing one. Which XSIAM feature determines this grouping behavior?

Accepted Answer

Incident Stitching and correlation rules. XSIAM uses Incident Stitching and correlation rules to automatically group related alerts into a single incident based on shared indicators of compromise or entities.

Answer

XQL query aggregation limits

Answer

Manual aggregation policies

Answer

Cortex XDR agent policy versioning

Question 6

When reviewing query performance in XSIAM, what does the 'dataset' command do at the beginning of an XQL query?

Accepted Answer

It defines the starting data source or table for the query pipeline.. The 'dataset' command specifies the target table or data source to query from.

Answer

It sets the retention period for the query logs.

Answer

It compiles the query into an XSIAM correlation rule.

Answer

It exports the resulting dataset to an external S3 bucket.

Question 7

You need to format a raw JSON timestamp retrieved from an API call into a readable date string before displaying it in an incident layout. Which XSIAM playbook feature accomplishes this without custom Python code?

Accepted Answer

Transformer functions (e.g., FormatDate). XSIAM playbooks include transformer functions — built-in, no-code utilities like FormatDate — that manipulate data between tasks. To convert a raw JSON timestamp into a readable date string, you apply a transformer such as FormatDate to the field, avoiding custom Python.

Answer

Incident Layout Scripts

Answer

Syslog Forwarding Rules

Answer

XQL Aggregate Functions

Question 8

You are troubleshooting an Attack Surface Management (ASM) scan in XSIAM where external IP ranges belonging to a newly acquired subsidiary are not showing up in the asset inventory. What is the most likely reason for this discrepancy?

Accepted Answer

The seed domains or IP ranges for the subsidiary have not been added to the ASM configuration scope. ASM relies on defined organization seed assets and authorized external scopes. If the discovery seed is missing, ASM will not map the assets.

Answer

Threat intelligence feeds have disabled automatic asset correlation by default

Answer

The Log Forwarder agent is not installed on the subsidiary endpoints

Answer

The ingestion service for ASM requires manual CSV asset mapping before discovery runs

Question 9

An analyst needs to extract specific Regex matching patterns from an incoming email body during an automated phishing investigation playbook. Which built-in mechanism should be used?

Accepted Answer

Extraction transformer / script command (e.g., ExtractIndicators). In XSIAM playbooks, the Extraction transformer (or the ExtractIndicators script command) is designed to parse text and extract indicators such as IP addresses, URLs, domains, and other regex patterns. It is a built-in mechanism specifically for extracting data from email bodies during phishing investigations.

Answer

XQL Indexing rule

Answer

Syslog output routing

Answer

Agent Policy assignment

Question 10

An XSIAM Analyst is reviewing the Analytics page and needs to understand the difference between standard alerts and incident-bound alerts. Which of the following best describes the role of analytics in XSIAM's alerting process?

Accepted Answer

Analytics automatically evaluate telemetry to generate structured alerts that contribute to security incidents.. In XSIAM, analytics are the detection engine that continuously evaluates ingested telemetry (endpoint, network, identity, cloud) and produces structured alerts. These alerts are not just informational — they are designed to be incident-bound, meaning they automatically contribute to and enrich security incidents within the incident management workflow. This is the core mechanism by which XSIAM turns raw data into actionable detections without requiring manual rule authoring for every scenario.

Answer

Analytics replace the need for correlation rules by directly closing false positives.

Answer

Analytics are exclusively used for reporting compliance and do not affect the active alert queue.

Answer

Analytics only generate raw logs, requiring manual rule creation to produce alerts.