XSIAM-Analyst Endpoint Security Management Practice Test 2 — 15 Questions

Question 1

An analyst notices that a custom PowerShell script used by system administrators is repeatedly blocked by the Cortex XDR agent as a suspicious execution. The analyst has verified the script's safety and wants to prevent future blocks without weakening overall script security for other scripts. How should this exception be configured in XSIAM?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a specific exception using the script file hash or signed certificate in the Cortex XDR exception rules.. Creating a script-specific exception using file hash or signer verification within the Agent Settings or Behavioral Threat Protection exclusions avoids blanket profile disabling.

Answer

Change the endpoint agent profile from Prevention to Reporting mode.

Answer

Disable PowerShell execution policy enforcement globally across all endpoint profiles.

Answer

Modify the Windows Defender exclusions via Group Policy.

Question 2

An organization deploys Cortex XDR agents to Linux servers. Certain critical database files residing on custom mount points are experiencing I/O latency due to agent monitoring. How should the administrator configure file integrity monitoring (FIM) or malware scan paths to exclude these specific mount points on Linux endpoints?

Accepted Answer

Configure path exclusions in the Linux Malware / Scan profile pointing to the custom mount directories.. Linux agent settings and Malware profiles allow path-based exclusions tailored to mount points and directories.

Answer

Modify the /etc/fstab file on each server to disable XDR hooks.

Answer

Disable auditd integration in the Data Collection settings.

Answer

Change the agent mode from Advanced to Basic via the Linux kernel module configuration.

Question 3

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

Accepted Answer

XQL Search using dataset xdr_data with filters on actor process and action process. XQL Search is the primary interface for querying normalized endpoint datasets (such as xdr_data) to hunt for specific process relationships.

Answer

Broker VM > Log Viewer > Filter Process

Answer

Incident Viewer > Advanced Filter > Process Spawn

Answer

Endpoint Security > Asset Explorer > Live Query

Question 4

An enterprise uses Broker VMs to proxy agent traffic from an isolated internal network segment to the XSIAM cloud. Several endpoints have stopped reporting via the Broker VM. Where should the administrator check to verify the health and connectivity between the Broker VM and the internal endpoints?

Accepted Answer

Settings > Configurations > Broker VM > Agent Status / App Health. The Broker VM management page in XSIAM displays the status of configured apps, connected agents, and communication health.

Answer

Data Lake > Broker VM dataset > Query Status

Answer

Endpoint Security > Broker Logs > Syslog Viewer

Answer

Response > Broker Actions > Test Connection

Question 5

An analyst needs to retrieve running process information from a specific active endpoint in real time without waiting for scheduled telemetry uploads. Which XSIAM feature should the analyst use?

Accepted Answer

Live Query (osquery). Live Query allows administrators to run osquery-based commands directly against active endpoints to gather real-time system state.

Answer

Asset Inventory export

Answer

Incident Viewer timeline

Answer

XQL historical search

Question 6

An endpoint has been compromised and cleaned, and the analyst wants to restore network connectivity for the host which was previously isolated. How should the analyst lift the network isolation in XSIAM?

Accepted Answer

Endpoint Security > Assets > Select Asset > Action > Lift Isolation. Network isolation can be reversed via the asset management actions menu in XSIAM.

Answer

Settings > Network > Firewall > Unblock Host

Answer

Response > Playbooks > Restart Agent

Answer

Data Collection > Endpoints > Reconnect

Question 7

An administrator is configuring password protection for the Cortex XDR agent on endpoints to prevent unauthorized users or malware from stopping the agent service or modifying its configuration locally. Where is this agent uninstallation/tamper protection password configured in XSIAM?

Accepted Answer

Endpoint Security > Profiles/Settings > Agent Settings > Tamper Protection. Tamper protection and agent password settings are managed within Agent Settings profiles in XSIAM.

Answer

Data Collection > Agent Deployment > Security Passwords

Answer

Settings > Access Management > Endpoint Users

Answer

Response > Containment > Agent Passwords

Question 8

An administrator is preparing to deploy Cortex XDR agents across a mixed Windows and macOS environment. Which TWO prerequisites must be validated to ensure successful deployment and full functionality of the agent? (Choose two)

Accepted Answer

Ensure local administrative privileges are available for the installation process.. Validating OS compatibility and necessary network/firewall outbound access to the XSIAM tenant are crucial prerequisites for agent deployment.

Answer

Establish a direct SNMP trap listener on the XSIAM management console.

Answer

Install a local Microsoft SQL Server instance on every endpoint for event buffering.

Answer

Configure an inbound TCP port 22 forwarding rule on every workstation firewall.

Question 9

When investigating an endpoint alert in XSIAM, an analyst wants to understand the full scope of potential compromise. Which THREE key data artifacts are typically available within the Causality Analysis View (CAV) for a suspicious process execution? (Choose three)

Accepted Answer

File modifications and registry changes performed by the investigated processes.. The Causality Analysis View provides details on parent-child process chains, associated network connections, and file/registry modifications tied to the causal chain.

Answer

Full Active Directory domain controller database replication logs.

Answer

Real-time physical memory dumps of the endpoint hardware RAM.

Question 10

An administrator is reviewing endpoint agent diagnostic tools available within XSIAM. Which THREE actions can be performed directly from the XSIAM console to troubleshoot or manage an endpoint agent? (Choose three)

Accepted Answer

Trigger a remote restart of the Cortex XDR agent service.. Administrators can initiate actions such as agent restarts, running live queries, and isolating endpoints directly from the console.

Answer

Reflash the endpoint hardware BIOS remotely.

Answer

Format the primary OS drive and reinstall Windows.

Question 11

An administrator needs to manage endpoint security profiles in XSIAM. Which TWO types of prevention profiles can be configured and assigned to endpoints? (Choose two)

Accepted Answer

Malware Protection Profile. XSIAM endpoint management includes specialized profiles such as Malware Protection and Exploit Prevention.

Answer

BGP Routing Profile

Answer

DNS Sinkhole Profile

Answer

VPN Tunnel Profile

Question 12

An enterprise requires continuous monitoring of endpoint security posture. Which TWO metrics or statuses are actively tracked in the XSIAM endpoint asset inventory? (Choose two)

Accepted Answer

Cortex XDR agent version installed on the endpoint. Asset inventory tracks details such as agent version, operational status, IP addresses, and operating systems.

Answer

Office Wi-Fi router signal strength

Answer

Local user printer spooler queue depths

Answer

Monitor refresh rate and screen resolution

Question 13

An analyst is configuring behavioral threat protection rules and exceptions in XSIAM. Which THREE parameters can typically be used to define a precise exclusion rule for a benign application exhibiting suspicious behavior? (Choose three)

Accepted Answer

Digital certificate signer of the application. Exclusions can be built using file hashes, digital signatures, and specific path criteria.

Answer

The MAC address of the endpoint's primary network interface card

Answer

The DHCP lease expiration timestamp

Question 14

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to connect to the XSIAM tenant through a corporate proxy server. Which THREE proxy configuration parameters must be correctly supplied to the agent installation or policy to ensure successful connectivity? (Choose three)

Accepted Answer

Proxy authentication credentials (username and password) if required. Proxy configurations require server address/IP, port, and authentication credentials if the proxy requires them.

Answer

Primary domain controller NetBIOS name

Answer

Local BGP autonomous system number (ASN)

Question 15

An administrator wants to ensure high availability and load distribution for endpoint agent reporting within a segmented enterprise network. Which TWO architectural components or features can be utilized in XSIAM to achieve this? (Choose two)

Accepted Answer

Configuring multiple gateway addresses within agent deployment settings for failover.. Broker VMs and multi-gateway configurations support agent load balancing and regional proxying.

Answer

Enabling spanning tree protocol across all endpoint network interface cards.

Answer

Replacing all endpoint agents with manual syslog forwarding rules via UDP port 514.

Answer

Converting every Windows workstation into an active cluster node controller.