XSIAM-Analyst Practice Test 7 — 10 Questions

Question 1

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

XQL Search using dataset xdr_data with filters on actor process and action process. XQL Search is the primary interface for querying normalized endpoint datasets (such as xdr_data) to hunt for specific process relationships.

Answer

Broker VM > Log Viewer > Filter Process

Answer

Incident Viewer > Advanced Filter > Process Spawn

Answer

Endpoint Security > Asset Explorer > Live Query

Question 2

An analyst needs to retrieve running process information from a specific active endpoint in real time without waiting for scheduled telemetry uploads. Which XSIAM feature should the analyst use?

Accepted Answer

Live Query (osquery). Live Query allows administrators to run osquery-based commands directly against active endpoints to gather real-time system state.

Answer

Asset Inventory export

Answer

Incident Viewer timeline

Answer

XQL historical search

Question 3

An analyst is investigating an incident where a suspicious file was dropped on a host. To verify if other hosts across the enterprise have seen this exact file hash, which XSIAM search tool should the analyst use?

Accepted Answer

Query Center using XQL to search endpoint datasets for the file hash. Global hash searches across all ingested endpoint telemetry in XSIAM are efficiently executed using Query Center (XQL) searching the endpoint datasets.

Answer

Incident Timeline Rebuilder

Answer

Local Quarantine Explorer

Answer

Agent Upgrade Wizard

Question 4

When configuring incident notification settings in XSIAM, which TWO notification channels are natively supported for alerting analysts about new high-severity incidents? (Choose two)

Accepted Answer

Email notifications. XSIAM supports multiple notification channels, notably email and webhook/chat integrations like Slack or Microsoft Teams, for alerting SOC personnel.

Answer

Automated AM/FM radio broadcast

Answer

Physical office alarm siren activation

Answer

Direct SMS text messaging via cellular gateway without integrations

Question 5

A security engineer is configuring a new Exploit Prevention profile in XSIAM. The requirement is to ensure that attempts to inject code into legitimate processes (DLL injection) are blocked and logged. Which section of the profile configuration controls memory protection techniques?

Accepted Answer

Exploit Prevention > Mitigation settings / Process protections. Exploit Prevention profiles contain specific mitigation modules for memory-based attacks such as DLL injection, heap spraying, and buffer overflows.

Answer

Disk Encryption > Policy Rules

Answer

Malware > Behavioral Threat Protection

Answer

Exploit Prevention > Malware Protection Rules

Question 6

An administrator wants to review all endpoints running an outdated operating system version to plan an upgrade cycle. Which XSIAM feature provides grouped inventory data on operating system distribution?

Accepted Answer

Endpoint Security > Assets filtered by Operating System columns. Endpoint Security asset inventory and filtering capabilities allow sorting and grouping by operating system attributes.

Answer

Response > Asset Discovery Reports

Answer

Data Lake > Parsing Rules > OS Summary

Answer

Settings > Endpoint Management > OS Matrix

Question 7

An administrator is preparing to deploy Cortex XDR agents across a mixed Windows and macOS environment. Which TWO prerequisites must be validated to ensure successful deployment and full functionality of the agent? (Choose two)

Accepted Answer

Ensure local administrative privileges are available for the installation process.. Validating OS compatibility and necessary network/firewall outbound access to the XSIAM tenant are crucial prerequisites for agent deployment.

Answer

Establish a direct SNMP trap listener on the XSIAM management console.

Answer

Install a local Microsoft SQL Server instance on every endpoint for event buffering.

Answer

Configure an inbound TCP port 22 forwarding rule on every workstation firewall.

Question 8

An analyst is configuring behavioral threat protection rules and exceptions in XSIAM. Which THREE parameters can typically be used to define a precise exclusion rule for a benign application exhibiting suspicious behavior? (Choose three)

Accepted Answer

Digital certificate signer of the application. Exclusions can be built using file hashes, digital signatures, and specific path criteria.

Answer

The MAC address of the endpoint's primary network interface card

Answer

The DHCP lease expiration timestamp

Question 9

An analyst needs to assign an unassigned incident to a specific Tier 2 response engineer within the XSIAM incident management interface. Which field must the analyst modify?

Accepted Answer

Assigned To. Assigning ownership of an incident in XSIAM is handled by updating the Assigned To or Owner field of the incident.

Answer

Resolution Status

Answer

Incident Source

Answer

Severity Level

Question 10

An XSIAM administrator is configuring a new automated playbook to execute when a high-severity phishing incident is created. Which integration component must be configured to allow the playbook to automatically extract and analyze URLs from incoming emails?

Accepted Answer

Integration instance commands. Playbooks in Cortex XSIAM rely on Integration instances (such as Phishing or Email Security integrations) to perform automated actions like parsing and extracting artifacts.

Answer

XQL forwarding profiles

Answer

Cortex XDR Agent policy rules

Answer

Local parsing rules on endpoints