XSIAM-Analyst Incident Handling And Response Practice Test 5 — 15 Questions

Question 1

An XSIAM analyst is investigating a suspected data exfiltration incident. The analyst needs to identify all outbound connections from a specific endpoint to external IP addresses that transferred more than 100 MB of data in the last 24 hours. Which XQL query will achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dataset = xdr_data | filter action_local_ip = "10.0.0.5" and action_remote_ip not in (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) | comp sum(bytes_out) as total_bytes by action_remote_ip | filter total_bytes > 100000000. To detect potential exfiltration, the query must sum outbound bytes to external IPs and apply a threshold in bytes. The correct query filters for the endpoint, excludes private IP ranges to focus on external destinations, aggregates bytes_out per remote IP, and filters for totals exceeding 100 MB. This provides a clear list of external endpoints that received significant data.

Answer

dataset = xdr_data | filter action_local_ip = "10.0.0.5" | comp sum(bytes_in) as total_bytes by action_remote_ip | filter total_bytes > 100000000

Answer

dataset = xdr_data | filter action_local_ip = "10.0.0.5" and action_remote_ip not in (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) | comp count() as conn_count by action_remote_ip | filter conn_count > 100

Answer

dataset = xdr_data | filter action_local_ip = "10.0.0.5" and action_remote_ip not in (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) | comp sum(bytes_out) as total_bytes by action_remote_ip | filter total_bytes > 100

Question 2

An XSIAM analyst is handling a critical ransomware incident. The analyst finishes containment, remediation, and verification, and wants to close the incident with the correct status so that reporting reflects a genuine security event that was resolved. Which incident status should the analyst select?

Accepted Answer

Resolved - True Positive. Closing a verified, remediated ransomware event requires a status that communicates a genuine detection resolved through response. Resolved - True Positive captures both facts: the alert was malicious and the work is done. False positive and duplicate statuses misrepresent the event, while an open status contradicts the completed remediation and distorts lifecycle reporting.

Answer

Resolved - Duplicate

Answer

Resolved - False Positive

Answer

In Progress

Question 3

An XSIAM analyst is investigating an incident where a user's credentials were likely compromised. The analyst wants to gather evidence of potential credential misuse. Which TWO XSIAM data sources or views should the analyst examine? (Choose two.)

Accepted Answer

Authentication logs from identity providers such as Active Directory or Okta. Authentication logs and endpoint process execution history are the most direct sources for evidence of credential misuse. Authentication logs show anomalous logins, while process history reveals actions taken with the compromised account. Other sources may provide context but are not primary evidence of credential misuse.

Answer

Network flow data showing top talkers by bandwidth

Answer

Email gateway logs for spam and phishing messages

Answer

Firewall logs showing blocked outbound connections

Question 4

An analyst is responding to an incident involving a compromised user account in XSIAM. The analyst needs to contain the threat and prevent further unauthorized access. Which TWO actions should the analyst take? (Choose two.)

Accepted Answer

Disable the user account in Active Directory. Disabling the user account and revoking all active sessions are the two most effective immediate containment actions for a compromised account. Disabling prevents new logins, while revoking sessions terminates existing ones. Together, they ensure the attacker loses access. Other actions like password reset or IP blocking are either insufficient or not targeted enough.

Answer

Block the user's IP address at the firewall

Answer

Delete the user account

Answer

Reset the user's password

Question 5

An XSIAM analyst is responding to a confirmed malware incident on an endpoint. The analyst needs to immediately isolate the endpoint from the network to prevent further spread. Which XSIAM action should the analyst take?

Accepted Answer

Run the 'Isolate Endpoint' action from the incident response playbook. Isolating the endpoint via the 'Isolate Endpoint' action is the correct immediate containment step for a malware infection. It severs network communications to prevent spread while allowing remediation. Other actions like disabling accounts or blocking hashes are not sufficient to contain an active infection on the endpoint itself.

Answer

Block the malware's hash in the endpoint protection policy

Answer

Disable the user account associated with the endpoint

Answer

Create a new incident for the endpoint and assign it to the security team

Question 6

An XSIAM analyst is reviewing an incident where a user's credentials were used to access a sensitive server from an unusual geographic location. The analyst suspects the credentials were compromised. Which XSIAM feature should the analyst use to quickly determine if the user account has been involved in any other suspicious activities across the environment?

Accepted Answer

User Entity Page. The User Entity Page aggregates all relevant data for a user, including incidents, alerts, and risk indicators, enabling a holistic view of their activity. This helps analysts quickly identify other suspicious behaviors linked to the compromised account. Other options are either too narrow or not focused on user activity.

Answer

Threat Intelligence Platform

Answer

XQL Query Builder

Answer

Incident Timeline

Question 7

An XSIAM analyst is investigating an incident and wants to add a note documenting the containment steps taken, so that other responders and auditors can see the actions in the incident timeline. Where should the analyst record this information?

Accepted Answer

In the incident's War Room as a new note entry. Incident documentation belongs in the incident's War Room, where notes are timestamped and visible to all responders. This creates a shared timeline for handoffs and post-incident review. Query comments, data source settings, and saved search descriptions are unrelated to incident records and would not surface the containment steps to the team or auditors.

Answer

In the XQL query editor as a comment above the investigation query

Answer

In the data source configuration page for the affected endpoint

Answer

In the global search bar as a saved search description

Question 8

An XSIAM analyst is investigating a phishing incident where a user clicked a malicious link and downloaded a payload. The analyst needs to determine the scope of the compromise by identifying all endpoints that communicated with the malicious domain. Which TWO XSIAM capabilities should the analyst use to efficiently identify affected endpoints? (Choose two.)

Accepted Answer

Use XQL to query network logs for the malicious domain and extract endpoint identifiers.. Using XQL to query network logs and the Indicators module to search for the malicious domain both enable efficient identification of endpoints that communicated with the threat. XQL provides flexible querying across data sources, while the Indicators module offers a curated view of threat intelligence matches. Together, they allow rapid scoping without disrupting endpoints.

Answer

Create a correlation rule to alert on future connections to the malicious domain.

Answer

Initiate a 'Collect Endpoint Evidence' action on all endpoints to capture network connections.

Answer

Run a 'File Search' action on all endpoints to find the downloaded payload by hash.

Question 9

An XSIAM analyst is reviewing an incident and wants to see the chronological sequence of events that led to the alert. Which XSIAM feature provides a timeline view of the incident's related activities?

Accepted Answer

Incident Timeline. The Incident Timeline provides a chronological view of events and alerts associated with an incident, enabling analysts to reconstruct the attack sequence. Query Builder, Threat Intelligence Management, and Endpoint Device Control serve different purposes and do not offer this timeline visualization.

Answer

Query Builder

Answer

Threat Intelligence Management

Answer

Endpoint Device Control

Question 10

An XSIAM analyst is reviewing an incident where a suspicious binary was executed on a critical server. The analyst wants to determine the parent process that spawned the binary and the full command line used. Which XSIAM artifact or view should the analyst consult?

Accepted Answer

Process causality view. The process causality view is designed to show the sequence of process executions, including parent-child relationships and command-line arguments. It is the correct tool for determining how a suspicious binary was launched. Other artifacts like network logs or registry events do not provide this level of process detail.

Answer

Registry modification events

Answer

Network connection logs

Answer

File integrity monitoring alerts

Question 11

An XSIAM analyst is responding to an incident where an attacker moved laterally using remote service creation. The analyst wants to identify all endpoints where the attacker created a service with a specific suspicious binary path during the last 48 hours. Which approach best accomplishes this?

Accepted Answer

Run an XQL query over the relevant dataset filtering on service creation events and the suspicious binary path within the 48-hour window. Scoping a lateral movement incident requires querying historical telemetry across all endpoints, not just reviewing existing alerts or inspecting hosts manually. XQL over the relevant service creation dataset with a binary path filter and a 48-hour window returns every affected endpoint. This is both comprehensive and repeatable, and the query can be converted into a detection for ongoing monitoring.

Answer

Export the full raw log archive to a spreadsheet and manually search for the binary path

Answer

Review the incident's alert list and rely on the existing correlated alerts to enumerate affected endpoints

Answer

Open each endpoint's process list in the endpoint management console and sort by service name

Question 12

An XSIAM analyst is handling an incident that requires immediate containment of a malicious file hash across all endpoints. The analyst wants to automate this response for future similar incidents. Which XSIAM capability should the analyst use?

Accepted Answer

Create a playbook that triggers on the incident type and adds the file hash to a blocklist. Creating a playbook that triggers on the incident type and adds the file hash to a blocklist automates containment across all endpoints and ensures future incidents are handled consistently. Manual actions, correlation rules, and threat intelligence updates do not provide automated, enterprise-wide blocking.

Answer

Manually add the file hash to the blocklist on each endpoint

Answer

Add the file hash to the threat intelligence database as an indicator

Answer

Configure a correlation rule to alert on the file hash

Question 13

During an incident investigation in Cortex XSIAM, an analyst needs to determine the scope of a credential theft attack. The analyst wants to identify all endpoints where a specific compromised user account was used to log in successfully after the initial compromise. Which XQL query should the analyst run?

Accepted Answer

dataset = xdr_data | filter event_type = ENUM.LOGIN and action_status = "SUCCESS" and user_name = "compromised_user" | fields agent_hostname, user_name, _time. The correct XQL query filters for successful login events (ENUM.LOGIN with action_status "SUCCESS") for the compromised user, returning hostnames and timestamps. This directly identifies all endpoints where the account was used after compromise, enabling the analyst to scope the incident. Other queries focus on process, file, or network events, which do not show successful authentication usage.

Answer

dataset = xdr_data | filter event_type = ENUM.NETWORK and remote_ip = "attacker_ip" | fields agent_hostname, remote_ip

Answer

dataset = xdr_data | filter event_type = ENUM.FILE and file_name = "ntds.dit" | fields agent_hostname, file_name

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and process_name = "lsass.exe" | fields agent_hostname, process_name

Question 14

An XSIAM analyst is reviewing a new high-severity incident and wants to see all the raw alerts, entities, and evidence that XSIAM automatically grouped together for this incident. Which part of the incident view should the analyst examine?

Accepted Answer

The incident's Issues and Evidence sections, which show the grouped alerts and supporting artifacts. XSIAM automatically correlates related alerts and artifacts into a single incident. The Issues and Evidence sections in the incident view present those grouped items, giving the analyst the raw alerts, entities, and supporting evidence needed to begin triage. The playbook library, schema browser, and audit log serve different purposes and do not display incident contents.

Answer

The playbook library, which lists all available automated response playbooks

Answer

The system audit log, which records configuration changes made by administrators

Answer

The data model schema browser, which documents normalized field mappings

Question 15

An XSIAM analyst is handling an incident where an endpoint has been confirmed infected with ransomware. The analyst has already collected the ransom note and process execution logs as evidence. According to standard incident response procedures within XSIAM, what is the next appropriate action to prevent further encryption and lateral movement?

Accepted Answer

Isolate the endpoint from the network using the Cortex XDR isolate endpoint action.. After evidence collection, containment is critical to stop the spread of ransomware. Isolating the endpoint through Cortex XDR prevents further encryption and lateral movement while preserving the ability to investigate. Other actions like deleting files or scanning are either premature or insufficient for immediate containment.

Answer

Initiate a full antivirus scan on the endpoint to remove the ransomware.

Answer

Delete the ransomware executable and any associated files from the endpoint.

Answer

Disable the user account associated with the endpoint.