XSIAM-Analyst Incident Handling And Response Practice Test 4 — 15 Questions

Question 1

An incident responder is investigating a ransomware outbreak. Which THREE immediate containment or remediation actions can be executed directly from XSIAM to mitigate the threat? (Choose three)

Accepted Answer

Quarantine the malicious ransomware binaries across hosts. Option A is correct because XSIAM's endpoint protection and response capabilities allow the analyst to quarantine malicious ransomware binaries across affected hosts directly from the console, preventing further execution and spread. Option C is correct because XSIAM can issue network isolation commands to infected endpoints, cutting off command-and-control traffic and lateral movement while preserving the agent for investigation. Option D is correct because XSIAM enables termination of malicious running process trees on endpoints, stopping active encryption routines and child processes spawned by the ransomware. Option B is incorrect because physical door lock systems are not managed by XSIAM, which is a security operations platform focused on endpoint, network, and cloud telemetry. Option E is incorrect because hardware replacement is a physical maintenance task outside XSIAM's software-based containment and remediation scope.

Answer

Reconfigure physical office door security locks

Answer

Physically replace damaged motherboard hardware on endpoints

Question 2

Which TWO information sources or artifacts can an analyst inspect within an XSIAM incident to understand the scope of an attack? (Choose two)

Accepted Answer

List of affected endpoints and hosts. Option A (List of affected endpoints and hosts) is correct because XSIAM incidents aggregate endpoint and host artifacts from the underlying telemetry and EDR data, allowing the analyst to enumerate which machines were touched by the attacker and thereby gauge the blast radius. Option E (Associated users and account entities involved) is correct because XSIAM correlates identity data into the incident, exposing the user and account entities tied to the activity so the analyst can determine which credentials were compromised or misused. Together, these two artifacts directly answer the scope question by mapping both the systems and the identities affected. Options B, C, and D are unrelated to security telemetry — a cafeteria menu, printer paper inventory, and parking badge records are not XSIAM incident artifacts and provide no insight into attack scope.

Answer

The local cafeteria lunch menu for the day

Answer

Office printer paper inventory levels

Answer

Employee parking garage badge swipe records outside XSIAM

Question 3

An XSIAM analyst is investigating a malware incident where the endpoint has been isolated from the network. The analyst needs to retrieve a copy of a suspicious executable from the endpoint for further analysis in a sandbox. Which XSIAM capability should the analyst use to obtain the file?

Accepted Answer

Cortex XDR File Retrieval. Cortex XDR File Retrieval is designed specifically to extract files from endpoints, including isolated ones, for further analysis. It ensures secure transfer and maintains forensic integrity. Other options either provide command execution, query capabilities, or orchestration but not direct file extraction, making File Retrieval the correct tool for this scenario.

Answer

XSIAM Action Center

Answer

Cortex XDR Live Terminal

Answer

XSIAM Query Builder

Question 4

An XSIAM analyst is reviewing an incident that includes a 'Remote Process Execution' alert. To better understand the parent-child relationship and command-line arguments, the analyst opens the Causality View. Which feature in the Causality View allows the analyst to see the full command line and other process details for a specific process?

Accepted Answer

The Process Details pane, accessible by clicking on the process node.. The Causality View in XSIAM visually maps process ancestry and allows analysts to drill into individual process nodes. Clicking a node reveals the Process Details pane with command line, hash, user, and other forensic data. This is the correct method to inspect remote process execution details without writing queries or leaving the incident context.

Answer

The Action Center, which lists available response actions for the process.

Answer

The Incident Timeline, which shows all events in chronological order.

Answer

The XQL Query Builder, which automatically generates a query for the selected process.

Question 5

An analyst is handling an incident in XSIAM where the attacker moved laterally from a compromised workstation to a server. The analyst wants to identify all affected endpoints and their current containment status from a single view. Which XSIAM feature should the analyst use?

Accepted Answer

Incident Investigation. The Incident Investigation view is designed to give analysts a comprehensive picture of an incident, including all affected endpoints and their containment status. It consolidates data from various sources, enabling quick assessment and response. The other options serve different purposes: War Room for collaboration, Endpoint Management for configuration, and Threat Intelligence for context.

Answer

Threat Intelligence

Answer

Incident War Room

Answer

Endpoint Management

Question 6

An XSIAM analyst is investigating a potential data exfiltration incident. The analyst wants to identify all endpoints that communicated with a specific suspicious external IP address (203.0.113.45) over the past 7 days. Which XQL query should the analyst use to retrieve this information from the network data?

Accepted Answer

dataset = xdr_data | filter remote_ip = "203.0.113.45" and event_type = NETWORK | fields agent_hostname, remote_ip, event_timestamp. In XSIAM network data, the remote IP address is stored in the remote_ip field. To find all endpoints that communicated with a specific external IP, the analyst must filter on remote_ip and event_type = NETWORK. The correct query uses these fields and returns the hostname and timestamp, enabling identification of affected endpoints.

Answer

dataset = xdr_data | filter local_ip = "203.0.113.45" and event_type = NETWORK | fields agent_hostname, local_ip, event_timestamp

Answer

dataset = xdr_data | filter action_remote_ip = "203.0.113.45" and event_type = NETWORK | fields agent_hostname, action_remote_ip, event_timestamp

Answer

dataset = xdr_data | filter action_local_ip = "203.0.113.45" and event_type = NETWORK | fields agent_hostname, action_local_ip, event_timestamp

Question 7

An XSIAM analyst is leading the response to a confirmed ransomware outbreak. The incident was created automatically by the platform. The analyst needs to locate all affected endpoints and initiate remote live terminal sessions to contain the threat. Which area of the XSIAM console should the analyst use?

Accepted Answer

The Incident War Room. The Incident War Room is the primary interface for incident response in XSIAM. It aggregates all relevant artifacts, including affected endpoints and users, and provides one-click actions for containment and investigation. Remote live terminal sessions are initiated directly from the War Room, allowing analysts to quickly respond to threats like ransomware without switching tools.

Answer

The Data Sources configuration page

Answer

The Threat Intelligence management page

Answer

The Correlation Rules engine

Question 8

An analyst receives an incident in XSIAM and wants to quickly gather more context about a suspicious file hash without leaving the incident view. Which action should the analyst take?

Accepted Answer

Use the 'Enrich' action on the hash entity. The 'Enrich' action on an entity within the incident view allows analysts to retrieve threat intelligence and other context without leaving the incident. This is the most efficient way to get immediate information about a suspicious hash. Other methods require navigation away or manual steps, which are less efficient.

Answer

Run an XQL query on the hash in the Query Center

Answer

Create a new incident manually for the hash

Answer

Open the Threat Intelligence module and search for the hash

Question 9

During an incident investigation in XSIAM, an analyst needs to determine the root cause of a suspicious process execution. The analyst has the process GUID and wants to see the full command line, parent process, and user context. Which XSIAM capability provides this information?

Accepted Answer

Endpoint Process Timeline. The Endpoint Process Timeline is specifically designed to provide detailed process execution data, including command lines, parent-child relationships, and user context. It is the correct tool for investigating a suspicious process using its GUID. Other options provide different types of data that do not address the requirement.

Answer

Authentication Logs

Answer

Registry Change Events

Answer

Network Connection Logs

Question 10

An analyst is handling an incident in XSIAM where the same endpoint has generated three separate alerts for suspicious PowerShell activity over the past hour. The analyst wants to consolidate these related alerts into a single investigation view to avoid duplicate effort. Which XSIAM feature should the analyst use?

Accepted Answer

Incident merging. Merging related incidents into a single parent incident is the correct approach when multiple alerts pertain to the same activity on the same endpoint. This reduces duplication, maintains a unified evidence set, and allows the analyst to investigate the full scope efficiently. Other features like deduplication or tagging do not provide a consolidated investigation view.

Answer

Playbook execution

Answer

Alert deduplication

Answer

Incident tagging

Question 11

An XSIAM analyst is triaging a new high-severity incident. During investigation, the analyst determines that the activity is benign and wants to close the incident while ensuring that similar alerts are not re-triggered for this known-good activity. Which incident resolution action should the analyst take?

Accepted Answer

Mark the incident as a false positive and add an exception in the relevant detection rule. When an analyst confirms benign activity, the correct resolution is to mark the incident as a false positive and tune the detection rule with an exception. This closes the incident accurately and prevents future identical alerts, reducing noise while preserving audit trails. Other actions either delete evidence, delay closure, or fail to suppress recurrence.

Answer

Lower the severity of the incident to informational and leave it open for monitoring

Answer

Close the incident as resolved and delete the associated alert from the database

Answer

Reassign the incident to a different analyst for a second opinion before closure

Question 12

A security analyst is handling a new incident in Cortex XSIAM. The incident contains a high-severity alert for 'Suspicious PowerShell Execution' on host FIN-PC-07. The analyst wants to quickly determine the parent process of the PowerShell instance to understand how it was launched. Which XSIAM feature should the analyst use?

Accepted Answer

Causality View. Causality View is the correct tool because it visually maps the process execution chain, allowing the analyst to immediately see the parent process of the suspicious PowerShell instance. This helps determine the initial infection vector, such as a malicious document or script. Other options either require manual querying or provide different types of information not focused on process ancestry.

Answer

Incident Timeline

Answer

Threat Intelligence Platform

Answer

XQL Query Builder

Question 13

An XSIAM analyst is reviewing an incident that was automatically created by the platform. The incident details show that it was triggered by a correlation rule. The analyst wants to understand exactly which raw log entries matched the rule's criteria. Where can the analyst find this information?

Accepted Answer

In the Incident War Room, under the 'Alerts' tab, by expanding the specific alert and viewing its 'Raw Log' section.. The Incident War Room aggregates all alerts that constitute an incident. Each alert includes a direct reference to the raw log entries that matched the correlation rule. This allows analysts to verify the detection logic and understand the context of the triggering event. The Raw Log section is the definitive source for the exact log data.

Answer

In the Correlation Rules editor, by clicking the 'Test' button and selecting the incident ID.

Answer

In the Threat Intelligence page, by searching for the incident ID in the indicator database.

Answer

In the Data Sources page, by filtering for the source that generated the incident and viewing the ingestion logs.

Question 14

An XSIAM analyst is responding to an incident involving a compromised endpoint. The analyst needs to isolate the endpoint from the network while preserving the ability to remotely investigate it. Which XSIAM action should the analyst perform?

Accepted Answer

Initiate a network isolation action on the endpoint via the incident response playbook. Network isolation via the incident response playbook is the correct action because it contains the endpoint by restricting network traffic while preserving a management channel for remote investigation. This aligns with XSIAM's endpoint response capabilities. Other options either fail to contain the threat, destroy evidence, or do not enable remote analysis.

Answer

Run a full antivirus scan on the endpoint using the XSIAM agent

Answer

Disable the endpoint's user account in Active Directory

Answer

Shut down the endpoint to prevent further damage

Question 15

A Cortex XSIAM analyst is investigating a ransomware incident. The analyst needs to isolate an infected endpoint from the network to prevent lateral movement. Which action should the analyst take within the XSIAM incident response console?

Accepted Answer

Run the 'isolate endpoint' response action from the incident's Action Center.. The Action Center's 'isolate endpoint' response action is the correct method to immediately contain an infected endpoint by blocking all network traffic except management communication. This prevents lateral movement and further damage. Other options either do not fully isolate the endpoint, require manual steps, or address only a specific file rather than the entire host.

Answer

Create a firewall rule on the network perimeter to block the endpoint's IP address.

Answer

Use the 'Quarantine File' action to quarantine the malicious executable.

Answer

Manually disable the network adapter on the endpoint via remote PowerShell.