XSIAM-Analyst Endpoint Security Management Practice Test 2 — 15 Questions

Question 1

An analyst is investigating a suspicious process on a Windows endpoint. The analyst wants to view the process tree, command-line arguments, and loaded modules for a specific process directly from the XSIAM console without logging into the endpoint. Which XSIAM feature should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Endpoint Investigation > Process Explorer. The Process Explorer under Endpoint Investigation is purpose-built to display detailed process information, including the process tree, command-line arguments, and loaded modules. It allows analysts to remotely investigate suspicious processes without direct endpoint access. The other features either require manual command execution, focus on threat intelligence, or provide a timeline rather than a structured process view.

Answer

Threat Intelligence > IOC Analysis

Answer

Forensics > Timeline Analysis

Answer

Incident Response > Live Terminal

Question 2

A security administrator is configuring endpoint security policies in XSIAM. The administrator wants to ensure that when a malware incident is detected on an endpoint, the Cortex XDR agent automatically isolates the endpoint from the network except for communication with the XSIAM management server. Which policy action should the administrator configure to achieve this?

Accepted Answer

Set the malware protection action to 'Block and Isolate'.. The 'Block and Isolate' action in the malware protection policy is designed to automatically isolate an endpoint when malware is detected. This action blocks malicious activity and restricts network communication to only the XSIAM management server, allowing the security team to investigate and remediate. Other options like playbooks or network ACLs are not the native agent policy action and may introduce delays or complexity.

Answer

Enable 'Auto Isolation' in the endpoint's agent configuration profile.

Answer

Configure a playbook in XSIAM to isolate the endpoint upon malware alert.

Answer

Set the endpoint's network access control list to block all traffic except to the XSIAM server.

Question 3

An administrator is reviewing the endpoint security management capabilities in XSIAM. The administrator needs to perform a bulk action on multiple endpoints to apply a new security policy and then verify the policy application status. Which TWO actions can be performed directly from the Endpoints page in the XSIAM console? (Choose two.)

Accepted Answer

Select multiple endpoints and apply a new policy from the action menu.. The XSIAM Endpoints page provides bulk policy assignment through the action menu, allowing administrators to select multiple endpoints and apply a policy. After assignment, the endpoint details pane displays the policy application status, enabling verification. These two actions directly support the administrator's need to apply and confirm policy deployment across multiple endpoints.

Answer

Export a list of endpoints with their current policy status to a CSV file.

Answer

Edit the security policy directly from the Endpoints page without navigating to the Policies section.

Answer

Initiate a remote scan on multiple endpoints simultaneously.

Question 4

An enterprise is experiencing high CPU utilization on a subset of developer endpoints running specialized compilation software. The Cortex XDR agent is suspected to be causing file-system scanning overhead. Which specific configuration setting should be adjusted in the Endpoint Security profile to safely reduce resource utilization without entirely disabling threat prevention?

Accepted Answer

Add targeted file path and process exclusions in the Malware Profile scan settings.. To reduce Cortex XDR agent file-system scanning overhead on developer endpoints without disabling threat prevention, the correct approach is to add targeted file path and process exclusions in the Malware Profile scan settings. Exclusions tell the agent to skip known-good, high-churn paths (such as compiler output directories) and trusted build processes, which lowers CPU usage while keeping malware protection active for everything else. This is the surgical, supported method for balancing performance and security.

Answer

Switch the agent operating mode from Full to Collector-only.

Answer

Increase the scheduled full-scan frequency from weekly to daily.

Answer

Disable the Anti-Malware module entirely in the profile.

Question 5

An analyst observes that a specific endpoint has stopped generating endpoint telemetry events (such as process execution and file creation logs) into XSIAM, although the endpoint is powered on and connected to the corporate network. Upon checking the agent, the service is running. Which troubleshooting step should the analyst perform next to diagnose endpoint event streaming issues?

Accepted Answer

Inspect the local agent log files on the endpoint to identify communication or buffering errors with the XSIAM backend.. Reviewing local agent log files (such as cyserver.log) on the endpoint or checking broker VM communication logs helps determine if telemetry is blocked or failing to upload.

Answer

Modify the XQL ingestion parser rules for the endpoint asset dataset.

Answer

Purge all historical alerts from the Incident Viewer to free up ingestion buffers.

Answer

Run an immediate software upgrade of the XSIAM tenant license key.

Question 6

An administrator has created a new endpoint profile for a subset of point-of-sale (POS) terminals. After saving and assigning the profile, the administrator notices that terminals are not reflecting the updated policy settings. What is the most likely reason for this delay?

Accepted Answer

The endpoints have not yet completed their polling interval to download the updated profile configuration from the XSIAM cloud.. XSIAM endpoint agents periodically poll the cloud for updated profiles and policy configurations rather than receiving instant push updates. After a profile is saved and assigned, there is a delay until each endpoint's next polling interval, during which the terminal continues using the previous configuration. This is the most likely reason for the observed delay.

Answer

The agent must be manually uninstalled and reinstalled with the new profile embedded in the installer.

Answer

Profile changes are only applied during scheduled OS maintenance windows configured in XSIAM.

Answer

POS terminals are locked by XSIAM and cannot accept policy changes without an enterprise root token override.

Question 7

An administrator wants to review all endpoints running an outdated operating system version to plan an upgrade cycle. Which XSIAM feature provides grouped inventory data on operating system distribution?

Accepted Answer

Endpoint Security > Assets filtered by Operating System columns. Endpoint Security asset inventory and filtering capabilities allow sorting and grouping by operating system attributes.

Answer

Response > Asset Discovery Reports

Answer

Data Lake > Parsing Rules > OS Summary

Answer

Settings > Endpoint Management > OS Matrix

Question 8

During a routine audit, an analyst notices that several endpoints have an agent status of 'Unmanaged' or 'Disconnected' for over 30 days. What is the standard behavior of XSIAM regarding endpoints that remain disconnected for extended periods?

Accepted Answer

The assets remain in the inventory as disconnected, and administrators can manually purge or retain them based on retention policies.. XSIAM retains disconnected or unmanaged endpoints in the asset inventory rather than deleting them automatically. Historical telemetry remains subject to configured retention policies, and administrators can manually purge or retain assets based on those policies. This preserves forensic and audit data while giving organizations control over data lifecycle.

Answer

All historical telemetry for those hosts is immediately deleted from the data lake.

Answer

The agent automatically converts the endpoint into a cloud collector proxy.

Answer

XSIAM automatically uninstalls the Cortex XDR agent remotely to reclaim licenses.

Question 9

An administrator is planning a staged rollout of a new Cortex XDR agent version across the enterprise. To mitigate risk, the administrator wants to deploy the new version to a test group of endpoints first. How is this staged deployment managed in XSIAM?

Accepted Answer

Assign the new agent version specifically to the test endpoint group's assigned Profile / Settings.. In Cortex XSIAM, agent version deployment is managed through endpoint groups and their assigned profiles/settings. To stage a rollout, you assign the new agent version to a specific test endpoint group's profile, so only endpoints in that group receive the update. Once validated, you can roll it out to other groups.

Answer

Use an XQL playbook to push executables via remote shell.

Answer

Configure a Broker VM distribution schedule for software binaries.

Answer

Manually uninstall the agent on test machines and run the MSI installer with a CLI switch.

Question 10

An administrator needs to verify whether disk encryption (BitLocker / FileVault) is active and reporting status correctly across managed endpoints in XSIAM. Where can this compliance status be monitored?

Accepted Answer

Endpoint Security > Assets > Disk Encryption column/tab. In Cortex XSIAM, endpoint compliance data such as disk encryption status (BitLocker on Windows, FileVault on macOS) is surfaced in the Endpoint Security > Assets view, where each endpoint record includes a Disk Encryption column/tab showing whether encryption is active and reporting correctly. This is the centralized place to monitor compliance across managed endpoints.

Answer

Settings > Compliance > BitLocker Management

Answer

Data Collection > Endpoints > Encryption Logs

Answer

Response > Actions > Encryption Status

Question 11

An analyst wants to check the details of a specific security alert triggered on an endpoint, including the process tree and causality chain. Which XSIAM module contains the Causality Analysis View (CAV)?

Accepted Answer

Incident Viewer > Alert Details > Causality Analysis. The Causality Analysis View (CAV) in XSIAM is accessed through the Incident Viewer by opening an alert's details and selecting the Causality Analysis tab. This view visualizes the process tree and causality chain — showing which process spawned which, the originating user, and the sequence of events — enabling analysts to trace an alert back to its root cause.

Answer

Endpoint Security > Asset Management > Process Explorer

Answer

Data Lake > Query Explorer > Causality View

Answer

Settings > Threat Intelligence > CAV

Question 12

An analyst notices that a specific registry modification performed by a legitimate software installer is triggering a 'Suspicious Registry Modification' alert in XSIAM. The analyst wants to suppress this specific alert across all endpoints without disabling the underlying Behavioral Threat Protection module. What is the correct way to build this exception?

Accepted Answer

Create a Cortex XDR exception rule specifying the initiating process hash and the target registry path.. Cortex XSIAM (built on Cortex XDR) allows analysts to create exception rules that suppress specific alerts by matching attributes like the initiating process hash and the target registry path. This suppresses the false-positive alert across all endpoints while leaving the Behavioral Threat Protection (BTP) module fully enabled, so other malicious behaviors are still detected.

Answer

Disable the Windows Registry auditing policy in the domain Group Policy Object.

Answer

Delete the detection rule from the Analytics rule set.

Answer

Lower the endpoint agent's severity threshold to Critical only.

Question 13

An analyst notices that a custom PowerShell script used by system administrators is repeatedly blocked by the Cortex XDR agent as a suspicious execution. The analyst has verified the script's safety and wants to prevent future blocks without weakening overall script security for other scripts. How should this exception be configured in XSIAM?

Accepted Answer

Add a specific exception using the script file hash or signed certificate in the Cortex XDR exception rules.. Creating a script-specific exception using file hash or signer verification within the Agent Settings or Behavioral Threat Protection exclusions avoids blanket profile disabling.

Answer

Change the endpoint agent profile from Prevention to Reporting mode.

Answer

Disable PowerShell execution policy enforcement globally across all endpoint profiles.

Answer

Modify the Windows Defender exclusions via Group Policy.

Question 14

An organization deploys Cortex XDR agents to Linux servers. Certain critical database files residing on custom mount points are experiencing I/O latency due to agent monitoring. How should the administrator configure file integrity monitoring (FIM) or malware scan paths to exclude these specific mount points on Linux endpoints?

Accepted Answer

Configure path exclusions in the Linux Malware / Scan profile pointing to the custom mount directories.. Linux agent settings and Malware profiles allow path-based exclusions tailored to mount points and directories.

Answer

Modify the /etc/fstab file on each server to disable XDR hooks.

Answer

Disable auditd integration in the Data Collection settings.

Answer

Change the agent mode from Advanced to Basic via the Linux kernel module configuration.

Question 15

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

Accepted Answer

XQL Search using dataset xdr_data with filters on actor process and action process. XQL Search is the primary interface for querying normalized endpoint datasets (such as xdr_data) to hunt for specific process relationships.

Answer

Broker VM > Log Viewer > Filter Process

Answer

Incident Viewer > Advanced Filter > Process Spawn

Answer

Endpoint Security > Asset Explorer > Live Query