XSIAM-Analyst Practice Test 9 — 10 Questions

Question 1

An administrator is deploying Cortex XDR agents to a set of Linux servers that run a custom application writing large log files to a non-standard mount point. The security team reports that the agent is generating excessive file scanning activity on those log files, impacting application performance. Which action should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the custom mount point to the malware profile's scan exclusion list for the affected endpoint group.. A path-based scan exclusion in the malware profile is the correct control because it stops the agent from reading the high-churn log directory during real-time and scheduled scans. This removes the I/O contention affecting the custom application while keeping malware protection active everywhere else on the endpoint group.

Answer

Switch the endpoint group's malware profile action from Block to Report to reduce scanning overhead.

Answer

Lower the agent's CPU priority using the 'Agent Resource Management' setting in the endpoint policy.

Answer

Disable the agent's real-time file protection on the Linux servers entirely.

Question 2

Which TWO methods can be used to test a custom automation script before deploying it in a production playbook? (Choose two)

Accepted Answer

Executing the script within a test incident War Room. Option C is correct because executing the script within a test incident War Room lets you validate the automation against a simulated incident in a safe, non-production environment, exercising the same incident context and integrations the playbook will use. Option E is correct because running the script interactively in the Playground / CLI interface allows step-by-step execution, immediate inspection of inputs/outputs, and rapid debugging before the script is embedded in a production playbook. Option A is not appropriate since compiling to a native Windows .exe is unrelated to testing a custom automation script in a playbook context. Option B is not appropriate because broadcasting over local radio frequencies has no bearing on script validation. Option D is not appropriate because printing the script for manual peer review is a documentation/review activity, not a functional test of the script's execution.

Answer

Compiling the script into a native Windows executable (.exe) on a local laptop

Answer

Broadcasting the script over local radio frequencies

Answer

Printing the script on paper for manual peer review

Question 3

Which operator is used in XQL filter statements to check if a field value matches any item in a provided list?

Accepted Answer

IN. The 'IN' operator is used to check if a field value matches any element within a specified list or array.

Answer

EQUALS_ANY

Answer

MATCHES

Answer

CONTAINS

Question 4

A security operations team wants Cortex XSIAM to continuously discover internet-facing assets belonging to their organization without manually supplying individual hostnames each time a new subsidiary is onboarded. Which ASM capability should they configure to achieve ongoing discovery from a broad organizational identifier?

Accepted Answer

An ASM discovery configuration seeded with the organization's registered domain names and related identifiers. Continuous external discovery requires seeds that the platform can expand on its own. Seeding ASM with the organization's registered domains and related identifiers lets Cortex XSIAM enumerate subdomains and external services as the footprint changes, removing manual per-host entry. Static CSVs, fixed-range schedules, and endpoint agents all fail to deliver automatic expansion of external coverage.

Answer

Manually importing a CSV of external IP addresses for each subsidiary

Answer

An endpoint agent deployment policy pushed to all subsidiary workstations

Answer

A recurring ASM scan schedule applied to a fixed list of seed IP ranges

Question 5

An XSIAM analyst notices that a specific analytic alert, generated by a built-in analytics rule, has been automatically assigned a high severity score that seems inconsistent with the raw event data. The analyst wants to understand what factors could have contributed to this elevated severity. Which of the following is the most likely explanation for the elevated severity score?

Accepted Answer

XSIAM applied a custom prioritization rule that boosts severity based on the asset's criticality tag.. XSIAM's custom prioritization rules can automatically adjust alert severity based on asset criticality, user identity, or other contextual factors. When an asset is tagged as high criticality, such rules can elevate the severity of any alert involving that asset, even if the raw event appears benign. This ensures that alerts on critical systems are prioritized appropriately.

Answer

The severity was inherited from the original event's source system, such as an endpoint protection platform.

Answer

The alert's severity was manually overridden by another analyst using the Alert Details page.

Answer

The alert is part of a correlated incident that aggregates multiple low-severity alerts into a higher-severity incident.

Question 6

Which feature enables playbooks to automatically execute on a recurring schedule (e.g., every morning at 2 AM) rather than reacting to an incident?

Accepted Answer

Scheduled / Timer Triggers. Timer triggers or scheduled playbooks allow time-based execution.

Answer

Syslog Listener

Answer

Parser Parsing Schedule

Answer

Endpoint Quarantine Schedule

Question 7

An analyst observes that two distinct analytic alerts—one for 'Suspicious Process' and one for 'Outbound Connection'—are generated 10 minutes apart on the same host. In XSIAM, how are these related alerts typically presented to the analyst?

Accepted Answer

Stitched together into a single unified incident based on shared entities and temporal proximity.. XSIAM stitches related alerts occurring within a specific timeframe on the same entity into a single incident.

Answer

Forwarded immediately to external ticketing systems as individual tickets.

Answer

Automatically discarded as duplicate noise by the alert deduplication engine.

Answer

Kept as completely separate incidents requiring manual merging by the analyst every time.

Question 8

An analyst is reviewing threat intelligence indicators and notices a specific file hash is marked as 'Expired'. What does this status indicate in XSIAM?

Accepted Answer

The indicator has exceeded its configured time-to-live (TTL) or retention period without being refreshed by a feed. Indicators reach an expired status when they exceed their time-to-live (TTL) or retention period without being updated by a feed.

Answer

The indicator matched an internal whitelist entry

Answer

The threat feed source has revoked its SSL certificate

Answer

The file hash has been successfully quarantined on all endpoints

Question 9

When an analyst reviews an analytic alert in XSIAM, which THREE pieces of contextual information are typically available to assist in prioritization and triage? (Choose three)

Accepted Answer

Score calculation breakdown and contributing factors. Context includes affected assets, MITRE ATT&CK details, and score breakdown.

Answer

Local printer driver version installed on the analyst's laptop

Answer

Cafeteria menu schedule for the security operations center

Question 10

An analyst wants to iterate through a list of 50 IP addresses stored in the playbook context and run a enrichment command on each one individually. Which playbook feature should be used?

Accepted Answer

Loop Task. A Loop Task in Cortex XSIAM playbooks iterates over a list (such as 50 IPs stored in context) and executes a specified command or sub-playbook for each item individually. This is the standard playbook construct for repeating an action across a collection of values. It supports both list iteration and key-value iteration, making it ideal for enrichment of multiple indicators.

Answer

Conditional Branching

Answer

Data Collection Widget

Answer

Transformer Function