XSIAM-Analyst Incident Handling And Response Practice Test 2 — 15 Questions

Question 1

An analyst is investigating an incident in Cortex XSIAM where multiple alerts are related to the same threat actor but are currently separate incidents. The analyst wants to group these incidents into a single case for more efficient management. What should the analyst do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'Merge Incidents' option to combine them into one incident.. Merging incidents is the correct approach to consolidate multiple related incidents into one case, streamlining investigation and response. This feature preserves all alerts, evidence, and history while providing a single incident for management. Other options like tagging, linking, or manual creation do not achieve the same level of consolidation and efficiency.

Answer

Add a common tag to all incidents and create a filtered view.

Answer

Link the incidents using the 'Related Incidents' feature.

Answer

Create a new incident manually and copy all alerts into it.

Question 2

An XSIAM analyst is responding to an incident involving a compromised user account. The analyst needs to perform immediate containment actions directly from the Incident War Room. Which TWO actions can be taken from the War Room to contain the threat? (Choose two.)

Accepted Answer

Isolate the endpoint from the network. The Incident War Room offers built-in containment actions such as disabling user accounts and isolating endpoints. Disabling the account prevents further malicious use of credentials, while endpoint isolation stops the spread of malware or attacker movement. These actions are directly accessible and are designed to be executed rapidly during an incident.

Answer

Delete the user's mailbox from Exchange

Answer

Block the user's email address in the email gateway

Answer

Reset the user's password in Active Directory

Question 3

An XSIAM analyst is handling a high-severity incident involving lateral movement via SMB. The analyst wants to automatically isolate all endpoints that exhibit the same behavior in the future. Which XSIAM feature should the analyst configure to achieve this while minimizing manual effort?

Accepted Answer

Create a new correlation rule that triggers on SMB lateral movement and add an automated response action to isolate the endpoint.. Creating a correlation rule with an embedded automated isolation action is the most direct way to automatically contain future SMB lateral movement. It combines detection and response in a single configuration, ensuring immediate action without manual steps. Other options either lack automation or are not specific to the behavior.

Answer

Use the 'Action Center' to manually isolate endpoints after each alert.

Answer

Modify the existing incident severity scoring to automatically isolate endpoints with high severity.

Answer

Configure a playbook that runs on all incidents and includes a conditional isolation step.

Question 4

An XSIAM analyst receives an incident for a suspicious login from an unrecognized IP address. After verifying with the user that the login was legitimate, the analyst wants to close the incident and ensure that similar future logins from that IP are not treated as threats. What should the analyst do?

Accepted Answer

Create an exception in the correlation rule that generated the incident, specifying the IP address.. Adding an exception to the correlation rule for the specific IP address is the correct approach. It suppresses future incidents for that IP while keeping the rule active for other addresses. This balances security and operational efficiency, avoiding unnecessary alerts without compromising detection.

Answer

Change the incident severity to 'Informational' and close it.

Answer

Disable the correlation rule that triggered the incident.

Answer

Add the IP address to the 'Allowed List' in the Indicators module.

Question 5

During a malware outbreak, an XSIAM analyst needs to quickly identify all endpoints that executed a specific malicious process. The process name is known, but the hash is not. Which XSIAM tool should the analyst use to search for this process across all endpoints in real time?

Accepted Answer

Run an XQL query against the 'Process Execution' dataset to find endpoints with the process name.. Querying the 'Process Execution' dataset with XQL is the correct method to retrospectively search for a process name across all endpoints. XSIAM ingests process execution telemetry, enabling real-time and historical searches. This allows the analyst to quickly scope the outbreak without waiting for future alerts or running invasive actions.

Answer

Use the 'Action Center' to run a 'Process Execution' action on all endpoints to list running processes.

Answer

Use the 'Indicators' module to search for the process name as an indicator.

Answer

Create a correlation rule to alert on future executions of the process name.

Question 6

An XSIAM analyst is investigating a multi-stage attack that involved lateral movement and data exfiltration. The analyst needs to gather additional context to determine the scope of the compromise. Which TWO data sources within XSIAM would provide the most relevant information for identifying affected hosts and user accounts? (Choose two.)

Accepted Answer

Endpoint process execution logs. Endpoint process execution logs and network flow logs are critical for tracing lateral movement and exfiltration. Process logs show execution of tools and commands on hosts, while network flow logs reveal communication between hosts and external entities. Together, they help identify affected hosts and accounts.

Answer

Authentication logs

Answer

Email gateway logs

Answer

DNS query logs

Question 7

While reviewing a complex multi-stage attack in XSIAM, an analyst wants to visualize the sequence of process creation events on an endpoint. Which XSIAM feature provides a graphical representation of parent-child process relationships and associated network connections?

Accepted Answer

Causality Chain. The Causality Chain in XSIAM provides a graphical, tree-like view of process execution history, showing parent-child relationships and associated artifacts.

Answer

MITRE ATT&CK Matrix Dashboard

Answer

Incident Graph Mapping

Answer

BIOC Breakdown View

Question 8

An analyst needs to assign an unassigned incident to a specific Tier 2 response engineer within the XSIAM incident management interface. Which field must the analyst modify?

Accepted Answer

Assigned To. Assigning ownership of an incident in XSIAM is handled by updating the Assigned To or Owner field of the incident.

Answer

Resolution Status

Answer

Incident Source

Answer

Severity Level

Question 9

An analyst is investigating an incident and needs to isolate an infected endpoint directly from the XSIAM Incident View. Which response action should the analyst execute?

Accepted Answer

Isolate Endpoint. From the Incident View or Endpoint View in XSIAM, analysts can execute the 'Isolate Endpoint' response action to restrict network communication while maintaining management connectivity.

Answer

Kill Process Tree

Answer

Block IP Address

Answer

Quarantine File

Question 10

When managing the incident lifecycle in XSIAM, an analyst determines that a triggered alert is a false positive and wants to prevent similar alerts from generating incidents in the future. What is the recommended action?

Accepted Answer

Change the incident status to Closed and tune the correlation rule or add an exception.. Analysts can resolve an incident and tune or suppress the underlying alert rule to prevent future occurrences of the same false positive.

Answer

Export the incident to CSV and purge local cache.

Answer

Delete the alert from the backend database using an administrative XQL delete command.

Answer

Disable the Cortex XDR agent on the affected endpoint.

Question 11

An XSIAM Analyst is reviewing the Incident Management dashboard and needs to understand why a specific high-severity incident was automatically merged with an existing one. Which XSIAM feature determines this grouping behavior?

Accepted Answer

Incident Stitching and correlation rules. XSIAM uses Incident Stitching and correlation rules to automatically group related alerts into a single incident based on shared indicators of compromise or entities.

Answer

XQL query aggregation limits

Answer

Manual aggregation policies

Answer

Cortex XDR agent policy versioning

Question 12

When reviewing security events in the XSIAM Incident View, an analyst notices that an event has a 'BIOC' tag. What does BIOC stand for in the context of XSIAM and Cortex XDR?

Accepted Answer

Behavioral Indicator of Compromise. BIOC stands for Behavioral Indicator of Compromise, which detects suspicious sequences of events or behaviors without relying solely on known file hashes.

Answer

Basic Incident Operations Center

Answer

Blocklist Indicator of Cyberattack

Answer

Binary Indicator of Code

Question 13

An incident response team wants to customize the incident severity scoring in XSIAM to better reflect organizational risk. Where are incident risk scoring and severity mapping configurations managed?

Accepted Answer

Incident Configuration settings. Incident severity and scoring rules, which determine how alerts roll up into incidents and their resulting priority, are configured under Incident Configuration settings in XSIAM.

Answer

Agent Installation Settings

Answer

Role-Based Access Control (RBAC) definitions

Answer

Data Stitching Schema Builder

Question 14

An analyst is investigating an incident where a suspicious file was dropped on a host. To verify if other hosts across the enterprise have seen this exact file hash, which XSIAM search tool should the analyst use?

Accepted Answer

Query Center using XQL to search endpoint datasets for the file hash. Global hash searches across all ingested endpoint telemetry in XSIAM are efficiently executed using Query Center (XQL) searching the endpoint datasets.

Answer

Incident Timeline Rebuilder

Answer

Local Quarantine Explorer

Answer

Agent Upgrade Wizard

Question 15

During an investigation, an analyst identifies an external IP address communicating with multiple internal hosts. To gather threat intelligence context on this IP address directly within XSIAM, which feature should the analyst inspect?

Accepted Answer

Threat Intelligence indicator details and context view. XSIAM provides built-in Threat Intelligence management where indicators (IPs, domains, hashes) are enriched with threat feeds and can be inspected for context.

Answer

Network interface promiscuous mode switch

Answer

Syslog forwarding status panel

Answer

Cortex XDR Firewall local rulebase