XSIAM-Analyst Endpoint Security Management Practice Test 3 — 15 Questions

Question 1

An enterprise uses Broker VMs to proxy agent traffic from an isolated internal network segment to the XSIAM cloud. Several endpoints have stopped reporting via the Broker VM. Where should the administrator check to verify the health and connectivity between the Broker VM and the internal endpoints?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Settings > Configurations > Broker VM > Agent Status / App Health. The Broker VM management page in XSIAM displays the status of configured apps, connected agents, and communication health.

Answer

Data Lake > Broker VM dataset > Query Status

Answer

Endpoint Security > Broker Logs > Syslog Viewer

Answer

Response > Broker Actions > Test Connection

Question 2

An analyst needs to retrieve running process information from a specific active endpoint in real time without waiting for scheduled telemetry uploads. Which XSIAM feature should the analyst use?

Accepted Answer

Live Query (osquery). Live Query allows administrators to run osquery-based commands directly against active endpoints to gather real-time system state.

Answer

Asset Inventory export

Answer

Incident Viewer timeline

Answer

XQL historical search

Question 3

An administrator is preparing to deploy Cortex XDR agents across a mixed Windows and macOS environment. Which TWO prerequisites must be validated to ensure successful deployment and full functionality of the agent? (Choose two)

Accepted Answer

Ensure local administrative privileges are available for the installation process.. Option A is correct because the Cortex XDR agent installer requires local administrative (root on macOS, local admin on Windows) privileges to install kernel-level components and services needed for full protection. Option B is correct because agents must reach the Cortex XSIAM tenant over outbound HTTPS (TCP 443) to register, download policy/content updates, and upload telemetry; without this connectivity, deployment or full functionality fails. Option C is incorrect because SNMP traps are a monitoring/alerting mechanism and are not a prerequisite for agent deployment or operation. Option D is incorrect because the agent uses its own local storage for event buffering and does not require Microsoft SQL Server on endpoints. Option E is incorrect because inbound TCP 22 (SSH) is not needed by the agent, which initiates outbound connections rather than accepting inbound management traffic.

Answer

Establish a direct SNMP trap listener on the XSIAM management console.

Answer

Install a local Microsoft SQL Server instance on every endpoint for event buffering.

Answer

Configure an inbound TCP port 22 forwarding rule on every workstation firewall.

Question 4

When investigating an endpoint alert in XSIAM, an analyst wants to understand the full scope of potential compromise. Which THREE key data artifacts are typically available within the Causality Analysis View (CAV) for a suspicious process execution? (Choose three)

Accepted Answer

File modifications and registry changes performed by the investigated processes.. The Causality Analysis View (CAV) in XSIAM/Cortex XDR is designed to reconstruct the full chain of activity around a suspicious process, so option A is correct because it surfaces file modifications and registry changes made by the investigated processes, which are core forensic artifacts for scope assessment. Option C is correct because CAV includes network connection details (e.g., remote IP, port, and process responsible) initiated by processes in the causality chain, helping identify C2 or lateral movement. Option D is correct because CAV presents the parent-child process execution tree, showing the sequence of spawned commands and how the suspicious process was launched. Option B is not part of CAV, as Active Directory domain controller replication logs are not endpoint causality artifacts and would come from AD-specific monitoring. Option E is also not part of CAV, since real-time physical RAM dumps are not a standard CAV artifact and would require separate memory acquisition tooling.

Answer

Full Active Directory domain controller database replication logs.

Answer

Real-time physical memory dumps of the endpoint hardware RAM.

Question 5

An administrator is reviewing endpoint agent diagnostic tools available within XSIAM. Which THREE actions can be performed directly from the XSIAM console to troubleshoot or manage an endpoint agent? (Choose three)

Accepted Answer

Trigger a remote restart of the Cortex XDR agent service.. Option B is correct because the XSIAM console provides endpoint management actions that include remotely restarting the Cortex XDR agent service, which is a standard troubleshooting step when an agent is unresponsive or needs to reload its configuration. Option C is correct because XSIAM supports osquery-based Live Queries, allowing administrators to run SQL-like queries against endpoints in real time to inspect processes, files, registry keys, and other telemetry for investigation and diagnostics. Option E is correct because XSIAM can initiate Network Isolation directly from the console, which contains a compromised host by restricting its network communication while preserving the management channel to the agent. Options A and D are not valid because reflashing endpoint BIOS and formatting/reinstalling the OS are out-of-band hardware or imaging operations that XSIAM's agent-based console actions do not perform.

Answer

Reflash the endpoint hardware BIOS remotely.

Answer

Format the primary OS drive and reinstall Windows.

Question 6

An administrator needs to manage endpoint security profiles in XSIAM. Which TWO types of prevention profiles can be configured and assigned to endpoints? (Choose two)

Accepted Answer

Malware Protection Profile. In Cortex XSIAM, endpoint security is enforced through prevention profiles that are assigned to endpoint groups, and the two supported profile types are the Malware Protection Profile (A) and the Exploit Prevention Profile (B). The Malware Protection Profile (A) is correct because it defines how the endpoint agent handles malicious files and processes, including actions such as blocking or quarantining malware based on configured security modules and threat signatures. The Exploit Prevention Profile (B) is correct because it controls behavioral protection against exploitation techniques—such as memory corruption, process injection, and other exploit methods—by specifying which exploit-protection modules and actions are enabled. The remaining options do not belong: BGP Routing Profile (C) relates to network routing configuration, DNS Sinkhole Profile (D) is a network/DNS security construct rather than an endpoint prevention profile, and VPN Tunnel Profile (E) pertains to VPN connectivity settings, none of which are assignable endpoint prevention profile types in XSIAM.

Answer

BGP Routing Profile

Answer

DNS Sinkhole Profile

Answer

VPN Tunnel Profile

Question 7

An enterprise requires continuous monitoring of endpoint security posture. Which TWO metrics or statuses are actively tracked in the XSIAM endpoint asset inventory? (Choose two)

Accepted Answer

Cortex XDR agent version installed on the endpoint. Option B is correct because the XSIAM endpoint asset inventory continuously tracks the Cortex XDR agent version installed on each endpoint, which is essential for verifying agent health, ensuring up-to-date protection, and identifying endpoints needing upgrades. Option C is correct because the inventory also tracks operating system type and patch level details, giving security teams the OS context and vulnerability exposure needed for posture monitoring and risk-based prioritization. Options A, D, and E are incorrect because Wi-Fi router signal strength, printer spooler queue depths, and monitor refresh rate/screen resolution are hardware or peripheral attributes unrelated to endpoint security posture and are not collected as security-relevant metrics in the XSIAM endpoint asset inventory.

Answer

Office Wi-Fi router signal strength

Answer

Local user printer spooler queue depths

Answer

Monitor refresh rate and screen resolution

Question 8

An analyst is configuring behavioral threat protection rules and exceptions in XSIAM. Which THREE parameters can typically be used to define a precise exclusion rule for a benign application exhibiting suspicious behavior? (Choose three)

Accepted Answer

Digital certificate signer of the application. Option A is correct because XSIAM behavioral threat protection exceptions can be scoped by the digital certificate signer, allowing trusted vendors' signed binaries to be excluded while still catching unsigned or maliciously signed code. Option B is correct because specifying the exact file path and filename lets the exception apply only to the known benign executable in its known location, avoiding broad exclusions. Option E is correct because the SHA-256 hash uniquely identifies the exact executable version, providing the most precise and tamper-resistant exclusion criterion. Option C is not appropriate because a MAC address identifies a network interface, not an application, so it cannot precisely scope a behavioral rule to a benign program. Option D is likewise irrelevant because a DHCP lease expiration timestamp is a network-address lifetime value and has no bearing on identifying or excluding an application's behavior.

Answer

The MAC address of the endpoint's primary network interface card

Answer

The DHCP lease expiration timestamp

Question 9

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to connect to the XSIAM tenant through a corporate proxy server. Which THREE proxy configuration parameters must be correctly supplied to the agent installation or policy to ensure successful connectivity? (Choose three)

Accepted Answer

Proxy authentication credentials (username and password) if required. Proxy configurations require server address/IP, port, and authentication credentials if the proxy requires them.

Answer

Primary domain controller NetBIOS name

Answer

Local BGP autonomous system number (ASN)

Question 10

An analyst is reviewing endpoint security alerts and needs to filter events by specific threat categories. Which TWO threat categories are commonly associated with Cortex XDR endpoint prevention modules? (Choose two)

Accepted Answer

Exploit and memory-based attack techniques. Option B is correct because Cortex XDR endpoint prevention modules include exploit protection that detects and blocks memory-based attack techniques such as buffer overflows, ROP chains, and other exploitation methods targeting vulnerable processes. Option C is correct because Cortex XDR's malware prevention module identifies and blocks malware execution attempts, including known malicious files, ransomware, and other malicious payloads on endpoints. Options A, D, and E are incorrect because badge reader failures, point-of-sale printer jams, and HVAC temperature anomalies are physical or facilities-related issues, not endpoint threat categories monitored by Cortex XDR prevention modules.

Answer

Building badge reader access failures

Answer

Cafeteria point-of-sale receipt printer paper jams

Answer

Physical datacenter HVAC temperature anomalies

Question 11

An analyst is investigating an incident where an endpoint downloaded a suspicious file. Which TWO XSIAM tools or views can the analyst use to inspect the file's characteristics, hash, and reputation across the tenant? (Choose two)

Accepted Answer

XQL Search querying file execution and hash datasets. Option A is correct because XQL Search lets the analyst query XSIAM datasets such as file execution and file hash events, returning the file's hash values, execution context, and related telemetry across the tenant. Option E is correct because the Global Context / Hash Lookup view in XSIAM provides reputation and prevalence information for a file hash, aggregating intelligence and tenant-wide sightings to assess whether the file is malicious. Option B is incorrect because Active Directory Group Policy Management Editor manages AD policy objects, not file characteristics or reputation. Option C is incorrect because the Printer Spooler Activity Dashboard monitors print spooler behavior and has no file hash or reputation inspection capability. Option D is incorrect because a Network DHCP Lease Viewer only maps IP addresses to MAC addresses and leases, which is unrelated to file inspection.

Answer

Active Directory Group Policy Management Editor

Answer

Printer Spooler Activity Dashboard

Answer

Network DHCP Lease Viewer

Question 12

An analyst needs to quickly determine which endpoints in the organization are missing critical security content updates that could leave them vulnerable to recently discovered threats. Which XSIAM view should the analyst consult to see agent content version status across the fleet?

Accepted Answer

The Endpoint Management page showing agent version and content version columns. The Endpoint Management page in XSIAM consolidates agent and content version information for every registered endpoint. By sorting or filtering on content version, an analyst can immediately see which systems are behind and need updates. This is the fastest way to assess fleet-wide update status and prioritize remediation for endpoints exposed to new threats.

Answer

The Query Center with a preset for agent installation dates

Answer

The Policy Management page listing applied profiles

Answer

The Incidents page filtered by high severity

Question 13

An administrator is preparing a Cortex XDR agent upgrade for a group of Windows endpoints that must never lose malware protection during the update. The administrator wants the new agent package to be installed exactly once per endpoint without requiring a reboot, and wants the old agent removed only after the new agent is functioning. Which deployment method should the administrator use?

Accepted Answer

Push an agent upgrade from the XSIAM management console using the Upgrade Agent action on the selected endpoints.. The correct answer is the XSIAM management console Upgrade Agent action. This built-in action performs an in-place, rebootless upgrade that replaces the agent binary while keeping the endpoint protected and preserving its configuration. It automatically handles the removal of the old agent only after the new agent is operational, satisfying the requirement that malware protection never lapse.

Answer

Create a new installation package with the same distribution ID and deploy it with a Group Policy startup script.

Answer

Manually uninstall the Cortex XDR agent on each endpoint, reboot, and then install the new agent version from the endpoint console.

Answer

Deploy the new agent MSI to endpoints using Microsoft Intune and configure a post-installation script that deletes the old agent folder.

Question 14

An analyst is reviewing an endpoint that has been flagged for suspicious behavior. The analyst wants to retrieve the agent's diagnostic logs directly from the XSIAM console to investigate why certain events were not detected. Which action should the analyst take?

Accepted Answer

Use the 'Retrieve Agent Logs' action on the endpoint details page. The 'Retrieve Agent Logs' action on the endpoint details page is designed to collect and deliver the agent's diagnostic logs to the XSIAM console. This enables analysts to troubleshoot detection gaps, service issues, or configuration problems without remote shell access. It is the most direct and supported method for obtaining agent logs for investigation.

Answer

Run a Live Terminal session and execute a log collection script

Answer

Export the endpoint's alert history to a CSV file

Answer

Configure a new policy that enables verbose logging and wait for logs to appear in the console

Question 15

An analyst in the Cortex XSIAM console sees an endpoint in the 'Endpoints' inventory with a status of 'Disconnected'. The endpoint manager reports the Cortex XDR agent service is running, but the analyst wants to verify whether the agent is actually communicating with the tenant. Which action should the analyst take to confirm the agent's last communication time and connection state directly from the XSIAM console?

Accepted Answer

Open the endpoint's detail view and review the Agent Status and Last Seen fields in the endpoint information panel.. The Endpoints inventory in Cortex XSIAM displays each agent's connection state and Last Seen timestamp in the endpoint detail view. Reviewing these fields confirms whether the agent is actively communicating with the tenant, which is the fastest and most authoritative check from the console. The other options either rely on local data that does not prove tenant connectivity or point to views that do not expose per-endpoint agent status.

Answer

Run the 'cytool status' command on the endpoint and compare the output to the XSIAM tenant's license expiration date.

Answer

Open the Cortex XDR agent installation directory on the endpoint and inspect the most recent .log file for a timestamp.

Answer

Navigate to the Incident Response view and check the 'Agent Connectivity' widget on the default dashboard.