XSIAM-Analyst Incident Handling And Response Practice Test 1 — 15 Questions

Question 1

An analyst creates a custom XQL query to investigate unusual PowerShell execution across endpoints. The query needs to filter out known administrative scripts based on a lookup list stored in XSIAM. Which XQL command is best suited to enrich or filter the event stream using a lookup table?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

lookup. The 'dedup' or 'filter' commands are useful, but enrichment and lookup matching against external lists in XSIAM XQL are performed using the 'lookup' command.

Answer

parse lookup_table

Answer

filter in_list

Answer

join

Question 2

While investigating a potential lateral movement attempt, an analyst wants to review the raw authentication logs associated with the incident in XSIAM. Which XQL dataset should the analyst query to examine Windows logon events?

Accepted Answer

dataset = endpoint_raw. The endpoint_raw dataset in XSIAM contains raw event data collected by Cortex agents, including Windows security event logs for authentication.

Answer

dataset = network_raw

Answer

dataset = cloud_audit_raw

Answer

dataset = xdr_data

Question 3

An analyst is writing an XQL query to search for failed login attempts followed within 5 minutes by a successful login from the same user account. Which XQL function should be used to correlate these sequential events within a timeframe?

Accepted Answer

correlate / seq command. Sequence-based analysis or matching events across time intervals in XQL is efficiently handled using the 'alt' or sequence/stream processing logic or specific commands like 'seq'.

Answer

stream join with time_window parameter

Answer

aggregate windowed_events

Answer

union match operator

Question 4

An XSIAM administrator is configuring a new automated playbook to execute when a high-severity phishing incident is created. Which integration component must be configured to allow the playbook to automatically extract and analyze URLs from incoming emails?

Accepted Answer

Integration instance commands. Playbooks in Cortex XSIAM rely on Integration instances (such as Phishing or Email Security integrations) to perform automated actions like parsing and extracting artifacts.

Answer

XQL forwarding profiles

Answer

Cortex XDR Agent policy rules

Answer

Local parsing rules on endpoints

Question 5

An analyst writes an XQL query to calculate the frequency of failed logins per user over a 24-hour period and wants to filter out users with fewer than 5 failures. Which XQL clause should be used after the aggregation command to filter the aggregated results?

Accepted Answer

filter count > 5. In XQL, after an aggregation command such as 'comp count() by user', you filter the aggregated results using the 'filter' clause, not 'where'. The 'filter' clause operates on the output of the aggregation stage, allowing you to apply conditions like 'filter count > 5' to exclude users with fewer than 5 failures. This is the XQL equivalent of SQL's HAVING clause.

Answer

where frequency_limit >= 5

Answer

having count > 5

Answer

limit 5 records per user

Question 6

An analyst wants to investigate network traffic anomalies by reviewing top talkers by data volume across the enterprise. Which XSIAM tool or query approach should be used?

Accepted Answer

Query Center using XQL with dataset = network_raw, aggregating bytes transferred. Analyzing network traffic data volume and top talkers requires querying network datasets in Query Center using XQL aggregation.

Answer

Endpoint agent installation log

Answer

Playbook execution status dashboard

Answer

Incident severity configuration wizard

Question 7

An analyst is reviewing a cloud security incident in XSIAM involving unauthorized IAM role modifications. Which XSIAM data source provides visibility into these cloud management plane activities?

Accepted Answer

Cloud audit logs (e.g., cloud_audit_raw dataset). Cloud management plane activities, such as API calls and IAM modifications, are ingested into XSIAM through cloud audit logs like AWS CloudTrail or Azure Activity logs.

Answer

Endpoint kernel driver telemetry

Answer

Network firewall packet captures

Answer

Local DNS cache dump files

Question 8

An analyst wants to create a custom XQL query to investigate security events. Which THREE clauses or functions are valid components of an XQL query structure? (Choose three)

Accepted Answer

alt (or alternate stream processing / calculation). In Cortex XQL, a query is built from a pipeline of stages, and the three marked options are all legitimate components. Option C, alt, is a valid XQL function used to compute an alternate value or expression (for example, returning a fallback value when a field is null), so it can appear inside a query's stage expressions. Option D, fields, is a valid XQL stage that selects, renames, or removes fields from the result set, making it a core part of query structure. Option E, filter, is the fundamental XQL stage that applies Boolean conditions to restrict which events or records are returned, and it is one of the most commonly used clauses. By contrast, option A, select_database_table_drop, is not an XQL clause or function at all — it resembles a SQL DDL operation and has no place in XQL syntax. Option B, format_hard_disk, is likewise not an XQL component; it is an unrelated system/disk operation and cannot be used to investigate security events in an XQL query.

Answer

select_database_table_drop

Answer

format_hard_disk

Question 9

An XSIAM analyst is handling an incident involving a compromised user account. The analyst needs to disable the account in Active Directory to prevent further unauthorized access. Which XSIAM feature allows the analyst to perform this action directly from the incident view?

Accepted Answer

Cortex XDR Action Center. The Action Center enables analysts to execute response actions like disabling accounts directly from the incident view, leveraging integrations with systems like Active Directory. This streamlines incident response and reduces manual steps. Other options are either for endpoint commands, automation, or querying, not for direct account management.

Answer

XSIAM Playbook

Answer

XSIAM Query Builder

Answer

Cortex XDR Live Terminal

Question 10

An XSIAM analyst is investigating a series of alerts related to a suspicious scheduled task created on multiple endpoints. The analyst wants to determine if the task is malicious and needs to see the full command line and parent process of the task creation event. Which XSIAM data source should the analyst query to obtain this information?

Accepted Answer

XSIAM Scheduled Task Telemetry. XSIAM ingests detailed scheduled task telemetry that includes command lines and parent process relationships, enabling deep forensic analysis. This telemetry is specifically designed to capture task creation and modification events with rich context. Other sources may lack the full command line or parent process, making them insufficient for the investigation.

Answer

Cortex XDR Analytics

Answer

XDR Agent Event Logs

Answer

Windows Event Logs (Security)

Question 11

An XSIAM analyst is investigating a multi-stage attack that involved lateral movement via SMB and subsequent credential theft. The analyst wants to identify all unique destination IP addresses that the source host communicated with over SMB (port 445) during the last 48 hours. Which XQL query will produce this result?

Accepted Answer

dataset = xdr_data | filter action_remote_port = 445 | comp count() as conn_count by action_local_ip, action_remote_ip. To identify unique destination IPs contacted by a specific source host over SMB, the query must filter for the remote port 445 and group by both local and remote IP addresses. The comp stage with count by action_local_ip and action_remote_ip provides the necessary aggregation. This approach isolates the source host's outbound SMB connections and lists the distinct destinations.

Answer

dataset = xdr_data | filter action_local_port = 445 or action_remote_port = 445 | dedup action_remote_ip

Answer

dataset = xdr_data | filter action_local_port = 445 | comp count() as conn_count by action_local_ip, action_remote_ip

Answer

dataset = xdr_data | filter action_remote_port = 445 | comp count() as conn_count by action_remote_ip

Question 12

An analyst is reviewing an incident in XSIAM and notices that the incident severity is set to 'High', but the organization's policy dictates that any incident involving a domain controller should be 'Critical'. The analyst wants to ensure future incidents automatically reflect this policy. What should the analyst do?

Accepted Answer

Modify the incident severity scoring configuration to include domain controller as a critical asset. Incident severity scoring in XSIAM can be customized to reflect organizational risk policies. By configuring domain controllers as critical assets, the scoring algorithm will automatically assign higher severity to incidents involving them. This is the proactive and scalable solution, unlike manual changes or reactive playbooks.

Answer

Use a playbook to change the severity of incidents after they are created

Answer

Create a new correlation rule that sets severity to 'Critical' when a domain controller is involved

Answer

Manually change the severity of the current incident to 'Critical'

Question 13

An XSIAM analyst is investigating a suspected lateral movement attack using PsExec. The analyst needs to identify which TWO types of evidence in XSIAM would most directly confirm the use of PsExec on a remote endpoint. (Choose two.)

Accepted Answer

Windows Event ID 4624 logon type 3 (network logon) from the source host. The two most direct evidence types for confirming PsExec lateral movement are process creation of PSEXESVC.exe (Event ID 4688) and network logon type 3 (Event ID 4624). These together show the service execution and the network authentication from the source host. Other events like service installation or share access are supporting but less definitive on their own.

Answer

Windows Event ID 5140 showing network share access to ADMIN$

Answer

Windows Event ID 7045 showing service installation of PSEXESVC

Answer

Sysmon Event ID 1 showing process creation with parent process services.exe

Question 14

An XSIAM analyst is responding to an incident involving a compromised endpoint that is communicating with a known command-and-control (C2) server. The analyst needs to perform containment and remediation actions. Which TWO actions can the analyst perform directly from the XSIAM incident view? (Choose two.)

Accepted Answer

Isolate the endpoint from the network. XSIAM provides direct endpoint response actions such as isolating the endpoint and terminating malicious processes from the incident view. These actions are immediately available and do not require additional integrations. Blocking IPs at the firewall and deleting user accounts are not direct actions from the incident view, and file quarantine, while possible, is less direct than the two correct actions.

Answer

Block the C2 IP address at the firewall

Answer

Delete the user account associated with the incident

Answer

Quarantine the malicious file

Question 15

An XSIAM analyst is responding to a ransomware incident on a Windows endpoint. After isolating the endpoint using the Cortex XDR agent, the analyst needs to collect volatile evidence before remediation. Which built-in XSIAM action should the analyst use to capture running processes and network connections from the live endpoint?

Accepted Answer

Use the 'Collect Endpoint Evidence' action to gather volatile data including processes and network connections.. The 'Collect Endpoint Evidence' action is the correct choice because it is purpose-built for gathering volatile forensic data from live endpoints in a forensically sound manner. It captures processes, network connections, and other runtime artifacts, and integrates with the incident for streamlined analysis. Other options either lack the necessary scope or are not designed for evidence collection.

Answer

Initiate a 'Process Execution' action to list all running processes and their network connections.

Answer

Run a live terminal session on the endpoint and execute built-in Windows commands to capture process and network data.

Answer

Use the 'Retrieve File' action to pull a memory dump of the endpoint.