XSIAM-Analyst Practice Test 9 — 10 Questions

Question 1

An incident response team wants to customize the incident severity scoring in XSIAM to better reflect organizational risk. Where are incident risk scoring and severity mapping configurations managed?

Accepted Answer

Incident Configuration settings. Incident severity and scoring rules, which determine how alerts roll up into incidents and their resulting priority, are configured under Incident Configuration settings in XSIAM.

Answer

Agent Installation Settings

Answer

Role-Based Access Control (RBAC) definitions

Answer

Data Stitching Schema Builder

Question 2

When managing the incident lifecycle in XSIAM, an analyst determines that a triggered alert is a false positive and wants to prevent similar alerts from generating incidents in the future. What is the recommended action?

Accepted Answer

Change the incident status to Closed and tune the correlation rule or add an exception.. Analysts can resolve an incident and tune or suppress the underlying alert rule to prevent future occurrences of the same false positive.

Answer

Export the incident to CSV and purge local cache.

Answer

Delete the alert from the backend database using an administrative XQL delete command.

Answer

Disable the Cortex XDR agent on the affected endpoint.

Question 3

What information does an indicator's 'TLP' (Traffic Light Protocol) designation provide in XSIAM?

Accepted Answer

The sharing and distribution boundaries for the threat intelligence data. TLP defines sharing boundaries and restrictions for sensitive information and threat intelligence.

Answer

The technical severity level of the indicator (Low, Medium, High, Critical)

Answer

The network protocol associated with the indicator (TCP, UDP, HTTP)

Answer

The speed at which the feed is polled by the XSIAM ingestion engine

Question 4

An analyst is reviewing threat intelligence indicators and notices a specific file hash is marked as 'Expired'. What does this status indicate in XSIAM?

Accepted Answer

The indicator has exceeded its configured time-to-live (TTL) or retention period without being refreshed by a feed. Indicators reach an expired status when they exceed their time-to-live (TTL) or retention period without being updated by a feed.

Answer

The indicator matched an internal whitelist entry

Answer

The threat feed source has revoked its SSL certificate

Answer

The file hash has been successfully quarantined on all endpoints

Question 5

An administrator is designing a data ingestion pipeline in XSIAM. Which THREE data source categories can be ingested and normalized into XSIAM for security analytics? (Choose three)

Accepted Answer

Network firewall and traffic logs. XSIAM ingests diverse telemetry including endpoint logs, network traffic data, and cloud audit/activity logs.

Answer

Personal social media direct message archives

Answer

Local consumer smartphone app notification history

Question 6

An organization wants to integrate a proprietary threat intelligence feed that uses a non-standard JSON format. What tool or method should be used within XSIAM to ingest and parse this feed correctly?

Accepted Answer

Use the Generic Feed integration with custom JSON path mapping. Custom feeds that do not match out-of-the-box integrations can be parsed using custom feed integrations or mapping transformations.

Answer

Rewrite the core XSIAM ingestion engine in Python

Answer

Manually convert the JSON feed into a Windows Event Log format

Answer

Configure an endpoint agent to scrape the JSON URL locally

Question 7

An analyst is investigating an ASM finding regarding an exposed service on an external asset. Which THREE details are typically provided within the ASM finding record in XSIAM? (Choose three)

Accepted Answer

Associated vulnerability references (CVEs). ASM finding records provide service banners, port information, associated CVEs, and protocol details for exposed assets.

Answer

Internal employee home Wi-Fi SSID names

Answer

Local workstation user password hashes

Question 8

An analyst concludes an incident investigation and determines that the alert was a true positive, remediation actions have been completed, and no further steps are needed. What is the correct final state to assign to the incident in XSIAM?

Accepted Answer

Resolved / Closed. When an incident has been fully investigated and remediated, its status should be set to Resolved (or Closed) with the appropriate resolution reason.

Answer

Isolated State

Answer

Quarantined Status

Answer

Pending Further Review (Active)

Question 9

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

Accepted Answer

Attack Surface Management > Assets. Attack Surface Management features have a dedicated workspace within the XSIAM navigation menu.

Answer

Incident Response > ASM Incidents

Answer

Dashboards > Threat Intelligence > ASM

Answer

Settings > Integrations > ASM Scanner

Question 10

Which TWO protocols or formats are natively supported for importing threat intelligence feeds into Cortex XSIAM? (Choose two)

Accepted Answer

TAXII 2.0 / 2.1. XSIAM supports standard threat intelligence ingestion formats including TAXII and CSV/JSON via generic feeds.

Answer

Bluetooth Low Energy beacon frames

Answer

Proprietary printer configuration protocols

Answer

Raw binary kernel dump files