XSIAM-Analyst Endpoint Security Management — Timed 20 Questions

Question 1

An enterprise is experiencing high CPU utilization on a subset of developer endpoints running specialized compilation software. The Cortex XDR agent is suspected to be causing file-system scanning overhead. Which specific configuration setting should be adjusted in the Endpoint Security profile to safely reduce resource utilization without entirely disabling threat prevention?

20 minute time limit — choose an answer to begin.

Accepted Answer

Add targeted file path and process exclusions in the Malware Profile scan settings.. Exclusions and scan settings within the Malware Profile allow tuning of paths, processes, and scan frequencies to alleviate resource bottlenecks on specialized systems.

Answer

Switch the agent operating mode from Full to Collector-only.

Answer

Increase the scheduled full-scan frequency from weekly to daily.

Answer

Disable the Anti-Malware module entirely in the profile.

Question 2

An analyst observes that a specific endpoint has stopped generating endpoint telemetry events (such as process execution and file creation logs) into XSIAM, although the endpoint is powered on and connected to the corporate network. Upon checking the agent, the service is running. Which troubleshooting step should the analyst perform next to diagnose endpoint event streaming issues?

Accepted Answer

Inspect the local agent log files on the endpoint to identify communication or buffering errors with the XSIAM backend.. Reviewing local agent log files (such as cyserver.log) on the endpoint or checking broker VM communication logs helps determine if telemetry is blocked or failing to upload.

Answer

Modify the XQL ingestion parser rules for the endpoint asset dataset.

Answer

Purge all historical alerts from the Incident Viewer to free up ingestion buffers.

Answer

Run an immediate software upgrade of the XSIAM tenant license key.

Question 3

A security engineer is configuring a new Exploit Prevention profile in XSIAM. The requirement is to ensure that attempts to inject code into legitimate processes (DLL injection) are blocked and logged. Which section of the profile configuration controls memory protection techniques?

Accepted Answer

Exploit Prevention > Mitigation settings / Process protections. Exploit Prevention profiles contain specific mitigation modules for memory-based attacks such as DLL injection, heap spraying, and buffer overflows.

Answer

Disk Encryption > Policy Rules

Answer

Malware > Behavioral Threat Protection

Answer

Exploit Prevention > Malware Protection Rules

Question 4

An analyst needs to verify which endpoints have out-of-date Cortex XDR agent versions across the organization. Where should the analyst navigate in XSIAM to view a summary dashboard of agent versions and deployment health?

Accepted Answer

Endpoint Security > Dashboards. Endpoint Security > Dashboards or Assets provides overview widgets displaying agent version distribution and compliance status.

Answer

Settings > Infrastructure > Agents

Answer

Marketplace > Content Updates

Answer

XQL Search > Agent Inventory table

Question 5

A security analyst is investigating an endpoint in XSIAM and notices that telemetry is delayed and some security profiles are not applying. Which XSIAM built-in tool or view should the analyst check first to verify the current operational status, connected broker/gateway, and heartbeat connectivity of the Cortex XDR agent?

Accepted Answer

Endpoint Security > Assets > Agent Details. The Agent Details view within Endpoint Security > Assets provides deep visibility into the specific endpoint's operational status, connection health, and applied profiles.

Answer

Incident Viewer > Alerts timeline

Answer

Query Library using dataset xdr_data

Answer

Settings > Agent Settings > Global Status

Question 6

An analyst needs to isolate a compromised workstation immediately from the XSIAM management console to prevent lateral movement. Where is the Network Isolation action executed for an individual asset?

Accepted Answer

Endpoint Security > Assets > Select Asset > Action > Isolate. Network Isolation can be triggered directly from the Asset Details view or Incident response actions in XSIAM.

Answer

Data Collection > Configurations > Network Isolation

Answer

Response > Playbooks > Manual Triggers > Isolate

Answer

Settings > Agent Settings > Containment Rules

Question 7

An administrator has created a new endpoint profile for a subset of point-of-sale (POS) terminals. After saving and assigning the profile, the administrator notices that terminals are not reflecting the updated policy settings. What is the most likely reason for this delay?

Accepted Answer

The endpoints have not yet completed their polling interval to download the updated profile configuration from the XSIAM cloud.. Cortex XDR agents check in periodically based on the heartbeat interval, or configurations require an explicit agent sync/update cycle to take effect immediately.

Answer

The agent must be manually uninstalled and reinstalled with the new profile embedded in the installer.

Answer

Profile changes are only applied during scheduled OS maintenance windows configured in XSIAM.

Answer

POS terminals are locked by XSIAM and cannot accept policy changes without an enterprise root token override.

Question 8

An administrator needs to deploy the Cortex XDR agent to a large fleet of Windows endpoints via Group Policy. Where can the administrator download the latest signed agent installer package and associated transform file from the XSIAM management console?

Accepted Answer

Endpoint Security > Assets > Installers. Agent installers are located under Endpoint Security > Assets > Installers in the XSIAM console, where administrators can select the appropriate operating system and package type.

Answer

Data Collection > Sources > Agents

Answer

Settings > Configurations > Agents > Installers

Answer

Response > Content > Packages

Question 9

An organization requires that all endpoints check in with the XSIAM management console at least every 2 hours. If an endpoint fails to check in within this window, an alert should be generated. Where is this heartbeat threshold and associated notification rule configured?

Accepted Answer

Endpoint Security > Settings > Agent Settings > Heartbeat interval. Agent connectivity settings and offline alerting thresholds are managed within Agent Settings or specific Alert Rules in XSIAM.

Answer

Data Collection > Broker VM > Polling parameters

Answer

Settings > Integrations > Cortex XDR Agent > Sync Timer

Answer

Incidents > Automation > Heartbeat Playbook

Question 10

An administrator wants to review all endpoints running an outdated operating system version to plan an upgrade cycle. Which XSIAM feature provides grouped inventory data on operating system distribution?

Accepted Answer

Endpoint Security > Assets filtered by Operating System columns. Endpoint Security asset inventory and filtering capabilities allow sorting and grouping by operating system attributes.

Answer

Response > Asset Discovery Reports

Answer

Data Lake > Parsing Rules > OS Summary

Answer

Settings > Endpoint Management > OS Matrix

Question 11

During a routine audit, an analyst notices that several endpoints have an agent status of 'Unmanaged' or 'Disconnected' for over 30 days. What is the standard behavior of XSIAM regarding endpoints that remain disconnected for extended periods?

Accepted Answer

The assets remain in the inventory as disconnected, and administrators can manually purge or retain them based on retention policies.. Endpoints that do not communicate within a defined retention or threshold period may be automatically purged or flagged as inactive depending on asset management settings.

Answer

All historical telemetry for those hosts is immediately deleted from the data lake.

Answer

The agent automatically converts the endpoint into a cloud collector proxy.

Answer

XSIAM automatically uninstalls the Cortex XDR agent remotely to reclaim licenses.

Question 12

An administrator is planning a staged rollout of a new Cortex XDR agent version across the enterprise. To mitigate risk, the administrator wants to deploy the new version to a test group of endpoints first. How is this staged deployment managed in XSIAM?

Accepted Answer

Assign the new agent version specifically to the test endpoint group's assigned Profile / Settings.. Agent software versions are managed under Endpoint Security > Assets > Installers or Agent Settings, where different groups can be assigned specific upgrade versions.

Answer

Use an XQL playbook to push executables via remote shell.

Answer

Configure a Broker VM distribution schedule for software binaries.

Answer

Manually uninstall the agent on test machines and run the MSI installer with a CLI switch.

Question 13

An administrator needs to verify whether disk encryption (BitLocker / FileVault) is active and reporting status correctly across managed endpoints in XSIAM. Where can this compliance status be monitored?

Accepted Answer

Endpoint Security > Assets > Disk Encryption column/tab. Disk encryption compliance status is visible within the endpoint asset inventory and security posture dashboards.

Answer

Settings > Compliance > BitLocker Management

Answer

Data Collection > Endpoints > Encryption Logs

Answer

Response > Actions > Encryption Status

Question 14

An analyst wants to check the details of a specific security alert triggered on an endpoint, including the process tree and causality chain. Which XSIAM module contains the Causality Analysis View (CAV)?

Accepted Answer

Incident Viewer > Alert Details > Causality Analysis. The Causality Analysis View is accessed via the Incident Viewer when investigating alerts related to endpoint activity.

Answer

Endpoint Security > Asset Management > Process Explorer

Answer

Data Lake > Query Explorer > Causality View

Answer

Settings > Threat Intelligence > CAV

Question 15

An analyst notices that a specific registry modification performed by a legitimate software installer is triggering a 'Suspicious Registry Modification' alert in XSIAM. The analyst wants to suppress this specific alert across all endpoints without disabling the underlying Behavioral Threat Protection module. What is the correct way to build this exception?

Accepted Answer

Create a Cortex XDR exception rule specifying the initiating process hash and the target registry path.. Alert tuning and exception rules can be created based on alert parameters, file hashes, or specific registry paths to prevent false positives.

Answer

Disable the Windows Registry auditing policy in the domain Group Policy Object.

Answer

Delete the detection rule from the Analytics rule set.

Answer

Lower the endpoint agent's severity threshold to Critical only.

Question 16

An analyst notices that a custom PowerShell script used by system administrators is repeatedly blocked by the Cortex XDR agent as a suspicious execution. The analyst has verified the script's safety and wants to prevent future blocks without weakening overall script security for other scripts. How should this exception be configured in XSIAM?

Accepted Answer

Add a specific exception using the script file hash or signed certificate in the Cortex XDR exception rules.. Creating a script-specific exception using file hash or signer verification within the Agent Settings or Behavioral Threat Protection exclusions avoids blanket profile disabling.

Answer

Change the endpoint agent profile from Prevention to Reporting mode.

Answer

Disable PowerShell execution policy enforcement globally across all endpoint profiles.

Answer

Modify the Windows Defender exclusions via Group Policy.

Question 17

An organization deploys Cortex XDR agents to Linux servers. Certain critical database files residing on custom mount points are experiencing I/O latency due to agent monitoring. How should the administrator configure file integrity monitoring (FIM) or malware scan paths to exclude these specific mount points on Linux endpoints?

Accepted Answer

Configure path exclusions in the Linux Malware / Scan profile pointing to the custom mount directories.. Linux agent settings and Malware profiles allow path-based exclusions tailored to mount points and directories.

Answer

Modify the /etc/fstab file on each server to disable XDR hooks.

Answer

Disable auditd integration in the Data Collection settings.

Answer

Change the agent mode from Advanced to Basic via the Linux kernel module configuration.

Question 18

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

Accepted Answer

XQL Search using dataset xdr_data with filters on actor process and action process. XQL Search is the primary interface for querying normalized endpoint datasets (such as xdr_data) to hunt for specific process relationships.

Answer

Broker VM > Log Viewer > Filter Process

Answer

Incident Viewer > Advanced Filter > Process Spawn

Answer

Endpoint Security > Asset Explorer > Live Query

Question 19

An enterprise uses Broker VMs to proxy agent traffic from an isolated internal network segment to the XSIAM cloud. Several endpoints have stopped reporting via the Broker VM. Where should the administrator check to verify the health and connectivity between the Broker VM and the internal endpoints?

Accepted Answer

Settings > Configurations > Broker VM > Agent Status / App Health. The Broker VM management page in XSIAM displays the status of configured apps, connected agents, and communication health.

Answer

Data Lake > Broker VM dataset > Query Status

Answer

Endpoint Security > Broker Logs > Syslog Viewer

Answer

Response > Broker Actions > Test Connection

Question 20

An analyst needs to retrieve running process information from a specific active endpoint in real time without waiting for scheduled telemetry uploads. Which XSIAM feature should the analyst use?

Accepted Answer

Live Query (osquery). Live Query allows administrators to run osquery-based commands directly against active endpoints to gather real-time system state.

Answer

Asset Inventory export

Answer

Incident Viewer timeline

Answer

XQL historical search