XSIAM-Analyst Practice Test 8 — 10 Questions

Question 1

An analyst is building a Cortex XSIAM playbook that must run an enrichment task only when the incident's severity is 'Critical' AND the source IP is external. The playbook already has a task that retrieves severity and IP classification. Which playbook construct should the analyst use to evaluate both conditions before proceeding?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A conditional task with an AND condition combining the two criteria. The requirement is a single decision that depends on two facts already available in the incident. A conditional task with an AND condition evaluates both criteria together and routes execution only when severity is Critical and the IP is external, which is exactly the gating behavior described. Sequential tasks, human prompts, and data-mutating scripts do not provide that combined automatic check.

Answer

A task that runs a script to set the incident severity to Critical

Answer

A data collection task that asks the analyst to confirm both conditions

Answer

Two sequential conditional tasks, each checking one criterion

Question 2

An XSIAM analyst is investigating an analytic alert triggered by a rare process execution. The analyst wants to see if similar processes have executed across other endpoints in the enterprise over the past 30 days. Which action should the analyst take?

Accepted Answer

Pivot directly from the alert to XQL Search using the pre-populated process hash or name to query historical data.. XSIAM's alert view supports pivoting directly into XQL Search with the alert's key fields (process hash, name, endpoint) pre-populated, letting the analyst query historical telemetry across the enterprise for the past 30 days. This is the intended hunting workflow for scoping a rare process execution.

Answer

Generate a new incident report from the Dashboards menu.

Answer

Restart the analytics engine to force a re-evaluation of historical logs.

Answer

Modify the custom prioritization rule to look back 30 days.

Question 3

An automated playbook task fails intermittently due to a temporary network timeout when contacting an external asset management database. What is the most resilient way to handle this inside the playbook configuration?

Accepted Answer

Configure task-level retries and retry intervals.. Configuring task-level retries with a backoff delay handles transient network glitches automatically.

Answer

Convert the playbook into a manual-only workflow.

Answer

Permanently disable the integration instance.

Answer

Increase the database server's hardware CPU cores.

Question 4

An analyst is building a query to detect abnormal process behavior. They want to calculate the ratio of network connections to process executions for each process name, but only for processes that have at least 5 executions. The relevant events are in the 'xdr_data' dataset with an 'event_type' field indicating 'process' or 'network'. Which XQL query correctly computes this ratio?

Accepted Answer

filter event_type in ("process", "network") | stats count() as cnt by process_name, event_type | stats sum(if(event_type="process", cnt, 0)) as exec_count, sum(if(event_type="network", cnt, 0)) as net_count by process_name | filter exec_count >= 5 | alter ratio = net_count / exec_count. To compute the ratio of network connections to process executions, the query must separately count network and process events per process name, then filter for processes with at least 5 executions, and finally divide network count by execution count. The correct query uses conditional sums in a second 'stats' to derive these counts before calculating the ratio.

Answer

filter event_type in ("process", "network") | stats count() as cnt by process_name, event_type | filter cnt >= 5 | stats sum(cnt) as total by process_name | alter ratio = total / cnt

Answer

filter event_type in ("process", "network") | stats count() as cnt by process_name | filter cnt >= 5 | alter ratio = count(event_type="network") / count(event_type="process")

Answer

filter event_type in ("process", "network") | stats count() as total by process_name, event_type | stats sum(total) as total_count, sum(if(event_type="network", total, 0)) as net_count by process_name | filter total_count >= 5 | alter ratio = net_count / total_count

Question 5

An enterprise uses Broker VMs to proxy agent traffic from an isolated internal network segment to the XSIAM cloud. Several endpoints have stopped reporting via the Broker VM. Where should the administrator check to verify the health and connectivity between the Broker VM and the internal endpoints?

Accepted Answer

Settings > Configurations > Broker VM > Agent Status / App Health. The Broker VM management page in XSIAM displays the status of configured apps, connected agents, and communication health.

Answer

Data Lake > Broker VM dataset > Query Status

Answer

Endpoint Security > Broker Logs > Syslog Viewer

Answer

Response > Broker Actions > Test Connection

Question 6

An ASM scan in XSIAM flags an external web server as having an outdated SSL/TLS certificate. Where can an analyst view the detailed finding context and remediation recommendations for this exposed asset?

Accepted Answer

Click on the specific asset within the Attack Surface Management asset inventory to open its risk and finding details pane. ASM asset findings provide detailed context and risk information directly within the asset's detail pane.

Answer

Export all raw asset logs to an external SIEM for inspection

Answer

Check the Endpoint Security alert queue

Answer

Review the firewall traffic logs associated with port 443

Question 7

When setting up a threat intelligence feed integration in XSIAM, what is the purpose of the 'Fetch Indicators' toggle?

Accepted Answer

It determines whether the integration actively polls and downloads indicators from the source. The Fetch Indicators setting controls whether the integration actively pulls indicators from the source on a scheduled interval.

Answer

It exports local indicators out to an external TAXII server

Answer

It deletes expired indicators from the local database

Answer

It tests the network connectivity to the XSIAM ingestion server

Question 8

A Cortex XSIAM analyst is investigating a ransomware incident. The analyst needs to isolate an infected endpoint from the network to prevent lateral movement. Which action should the analyst take within the XSIAM incident response console?

Accepted Answer

Run the 'isolate endpoint' response action from the incident's Action Center.. The Action Center's 'isolate endpoint' response action is the correct method to immediately contain an infected endpoint by blocking all network traffic except management communication. This prevents lateral movement and further damage. Other options either do not fully isolate the endpoint, require manual steps, or address only a specific file rather than the entire host.

Answer

Create a firewall rule on the network perimeter to block the endpoint's IP address.

Answer

Use the 'Quarantine File' action to quarantine the malicious executable.

Answer

Manually disable the network adapter on the endpoint via remote PowerShell.

Question 9

Which TWO actions can an analyst perform on a threat intelligence indicator directly from the XSIAM Threat Intelligence workspace? (Choose two)

Accepted Answer

Add the indicator to an exclusion list or whitelist. Option B is correct because the XSIAM Threat Intelligence workspace lets analysts add an indicator to an exclusion list or whitelist so it is no longer treated as malicious and does not trigger detections or response actions. Option C is correct because analysts can manually create and add a custom indicator directly in the workspace, allowing them to track organization-specific IOCs that are not present in the built-in threat intelligence feeds. Option A is incorrect because modifying firewall hardware routing tables is a network-infrastructure administration task, not an action available on an indicator in the Threat Intelligence workspace. Option D is incorrect because reflashing endpoint BIOS firmware is a hardware/firmware remediation operation performed through endpoint management, not from the threat intelligence indicator interface. Option E is incorrect because updating global cloud provider DNS records is an external DNS management action outside the scope of XSIAM's Threat Intelligence workspace.

Answer

Modify firewall hardware routing tables

Answer

Reflash the BIOS firmware of endpoints matching the indicator

Answer

Directly update global cloud provider DNS records

Question 10

A Cortex XSIAM playbook is triggered by a correlation rule that fires multiple times for the same incident within a short window. The playbook's first task creates a ticket in an external ITSM system, and duplicate tickets are being created. The analyst confirms that the correlation rule is correctly firing for distinct events but the playbook is running more than once per incident. Which setting should the analyst verify first to prevent duplicate playbook executions for the same incident?

Accepted Answer

The playbook's trigger configuration to ensure it runs only once per incident.. Duplicate playbook executions for the same incident usually stem from a trigger that fires on every matching event rather than once per incident. The analyst should first verify the trigger configuration and ensure it is set to run the playbook only once per incident. Task timeout, concurrency limits, and ITSM deduplication are secondary or unrelated controls that do not prevent the playbook from being invoked multiple times.

Answer

The playbook's maximum concurrent executions setting.

Answer

The playbook's task timeout value.

Answer

The ITSM integration's deduplication settings.