XSIAM-Analyst Multiple Select — 40 Questions

Question 1

Which THREE components or views in XSIAM assist analysts in recognizing and understanding analytic alert types and their context? (Choose three)

Accepted Answer

MITRE ATT&CK tactical coverage display in the alert pane. Alert details, MITRE mappings, and incident graphs help analysts understand alerts.

Answer

License renewal expiration tracker

Answer

Agent BIOS version audit report

Question 2

Which TWO protocols or formats are natively supported for importing threat intelligence feeds into Cortex XSIAM? (Choose two)

Accepted Answer

TAXII 2.0 / 2.1. Cortex XSIAM natively supports ingesting threat intelligence via TAXII 2.0/2.1 (option B), which is the standard OASIS protocol for STIX-formatted threat intel exchange, allowing XSIAM to subscribe to external TAXII servers and pull indicators automatically. It also natively supports CSV file uploads and feeds (option C), enabling analysts to bulk-import custom indicators with mapped columns for fields like indicator type, value, and severity. The remaining options are not threat-intelligence ingestion formats: Bluetooth Low Energy beacon frames (A) are wireless advertising packets, proprietary printer configuration protocols (D) are device-management protocols, and raw binary kernel dump files (E) are memory forensics artifacts — none of these are recognized feed formats for XSIAM's threat intel module.

Answer

Bluetooth Low Energy beacon frames

Answer

Proprietary printer configuration protocols

Answer

Raw binary kernel dump files

Question 3

An XSIAM Analyst is configuring a new custom prioritization rule to ensure that alerts involving the finance department's servers receive a higher severity score. Which TWO elements must be defined within the rule for it to correctly match and score the intended alerts? (Choose two.)

Accepted Answer

A severity adjustment value or new severity level to apply when the condition matches. A custom prioritization rule must have a condition to identify target alerts and an action to adjust severity. Conditions can use asset attributes like hostname or criticality tags to focus on finance servers. The severity adjustment ensures those alerts are scored higher. Other elements like schedules, grouping references, or notification templates are not required for the rule to function.

Answer

A schedule that defines when the rule is active

Answer

A notification template to alert the SOC team

Answer

An incident grouping rule reference to link related alerts

Question 4

An administrator is configuring the Cortex XDR agent's self-protection settings to prevent tampering by malicious actors. The administrator wants to ensure that the agent cannot be stopped or uninstalled without proper authorization. Which TWO measures should the administrator implement? (Choose two.)

Accepted Answer

Enable password protection for agent uninstallation and stopping of the agent service.. Password protection and running as a protected process (PPL) are both direct self-protection mechanisms. Password protection blocks unauthorized uninstallation or service stop, while PPL prevents other processes from terminating or modifying the agent. Together, they significantly harden the agent against tampering attempts, meeting the administrator's requirement.

Answer

Configure the agent to scan for and remove other security tools that might conflict.

Answer

Set the agent to automatically update to the latest version without user intervention.

Answer

Enable detailed logging of all agent actions to a remote syslog server.

Question 5

A Cortex XSIAM analyst is reviewing how threat intelligence indicators flow from an enabled feed into detection. The analyst wants to understand which actions occur when the feed integration polls and new indicators are retrieved. (Choose two.)

Accepted Answer

Indicators can be enriched or matched against telemetry during correlation and used to raise alerts or populate the incident view.. When an enabled feed polls, XSIAM normalizes retrieved indicators into its schema and stores them in the indicator repository with a reputation and expiration, making them available platform-wide. Those indicators are then evaluated during correlation against telemetry and used for enrichment, which can raise alerts or feed incidents. Automatic rule modification, endpoint blocklisting, and mandatory manual approval are not part of the standard ingestion flow.

Answer

Every retrieved indicator is immediately pushed to all managed endpoint agents as a blocklist entry.

Answer

Newly retrieved indicators are automatically written into every enabled correlation rule's indicator filter without analyst action.

Answer

Retrieved indicators are quarantined in a staging area and require manual approval before they become visible to any XSIAM component.

Question 6

Which TWO actions can be performed directly within the Cortex XSIAM Playbook Designer? (Choose two)

Accepted Answer

Configure conditional branches and links between tasks.. Playbook designers allow building visual workflows, configuring task parameters, and linking conditions.

Answer

Write custom XQL queries for data ingestion pipelines.

Answer

Modify global firewall routing tables.

Answer

Install local endpoint security agents.

Question 7

When configuring a new threat intelligence feed integration in Cortex XSIAM, which TWO configuration parameters are typically required for successful API-based ingestion? (Choose two)

Accepted Answer

API Authentication Key, Token, or Credentials. API-based threat intelligence integrations require endpoint URLs and authentication credentials (such as API keys or tokens) to connect and pull data.

Answer

Endpoint agent installation package version

Answer

Active Directory Domain Controller IP address

Answer

Syslog facility number

Question 8

A threat hunter is analyzing authentication logs in XSIAM using XQL. They want to identify potential brute-force attacks by finding source IP addresses that have more than 10 failed login attempts within a 5-minute window. The logs are in the 'auth_logs' dataset with fields 'src_ip', 'event_time', and 'status' (where 'status' is either 'success' or 'failure'). Which two XQL stages or functions are essential to achieve this? (Choose two.)

Accepted Answer

filter status = "failure". To detect brute-force attacks, the query must first isolate failed login events using a filter on status. Then it must count those failures per source IP within a 5-minute window, which requires an aggregation grouped by source IP and a time bucket. These two steps are the core of the detection. Sorting, deduplication, or external joins are either counterproductive or non-essential for the fundamental count-based logic.

Answer

sort by event_time desc

Answer

join with a threat intelligence dataset on src_ip

Answer

dedup src_ip

Question 9

Which TWO information sources or artifacts can an analyst inspect within an XSIAM incident to understand the scope of an attack? (Choose two)

Accepted Answer

List of affected endpoints and hosts. Option A (List of affected endpoints and hosts) is correct because XSIAM incidents aggregate endpoint and host artifacts from the underlying telemetry and EDR data, allowing the analyst to enumerate which machines were touched by the attacker and thereby gauge the blast radius. Option E (Associated users and account entities involved) is correct because XSIAM correlates identity data into the incident, exposing the user and account entities tied to the activity so the analyst can determine which credentials were compromised or misused. Together, these two artifacts directly answer the scope question by mapping both the systems and the identities affected. Options B, C, and D are unrelated to security telemetry — a cafeteria menu, printer paper inventory, and parking badge records are not XSIAM incident artifacts and provide no insight into attack scope.

Answer

The local cafeteria lunch menu for the day

Answer

Office printer paper inventory levels

Answer

Employee parking garage badge swipe records outside XSIAM

Question 10

Which TWO actions occur when a playbook task hits a conditional split with multiple matching paths? (Choose two)

Accepted Answer

Depending on configuration, matching paths can execute in parallel or sequentially.. Option A is correct because in a playbook conditional split, when several branches match, the engine's configuration governs whether those matching paths run concurrently (in parallel) or one after another (sequentially), so both behaviors are possible depending on how the split is set up. Option D is correct because the conditional split's core function is to evaluate each branch's condition against the task's output/context, and the results of that evaluation determine which downstream tasks are given the execution flow. Options B, C, and E are incorrect because a conditional split only routes execution flow within the playbook; it does not shut down the XSIAM tenant, clear user browser caches, or purge system logs from disk.

Answer

The entire XSIAM tenant automatically shuts down for maintenance.

Answer

The browser cache of every user is cleared.

Answer

All system logs are permanently purged from disk.

Question 11

Which TWO components are fundamental parts of every XQL query structure? (Choose two)

Accepted Answer

The dataset command specifying the source table. Option B is correct because every XQL query must begin by declaring its data source with a dataset command (for example, `dataset = xdr_data`), which tells the query engine which table or dataset to search. Option E is correct because XQL is a pipelined query language in which stages are chained together using the pipe character (|), such as `dataset = xdr_data | filter ... | fields ...`, so the pipeline syntax is fundamental to the query structure. Option A is incorrect because XQL is not SQL and does not use a SQL SELECT statement header; it uses dataset and stage commands instead. Option C is incorrect because playbook triggers belong to automation/playbook configuration, not to the query language itself. Option D is incorrect because XQL queries are plain text and require no XML schema declaration.

Answer

A SQL SELECT statement header

Answer

An automated playbook trigger reference

Answer

A mandatory XML schema declaration

Question 12

Which TWO methods can be used to pass data between parent playbooks and sub-playbooks in XSIAM? (Choose two)

Accepted Answer

Playbook inputs and arguments mapping. Sub-playbooks accept inputs via mapped arguments and return outputs back to the parent context.

Answer

Manual USB drive file transfer

Answer

Direct hardware memory pointers

Answer

Hardcoding variables in system environment files

Question 13

An analyst is responding to an incident involving a compromised user account in XSIAM. The analyst needs to contain the threat and prevent further unauthorized access. Which TWO actions should the analyst take? (Choose two.)

Accepted Answer

Disable the user account in Active Directory. Disabling the user account and revoking all active sessions are the two most effective immediate containment actions for a compromised account. Disabling prevents new logins, while revoking sessions terminates existing ones. Together, they ensure the attacker loses access. Other actions like password reset or IP blocking are either insufficient or not targeted enough.

Answer

Block the user's IP address at the firewall

Answer

Delete the user account

Answer

Reset the user's password

Question 14

Which TWO actions can an analyst perform on a threat intelligence indicator directly from the XSIAM Threat Intelligence workspace? (Choose two)

Accepted Answer

Add the indicator to an exclusion list or whitelist. Option B is correct because the XSIAM Threat Intelligence workspace lets analysts add an indicator to an exclusion list or whitelist so it is no longer treated as malicious and does not trigger detections or response actions. Option C is correct because analysts can manually create and add a custom indicator directly in the workspace, allowing them to track organization-specific IOCs that are not present in the built-in threat intelligence feeds. Option A is incorrect because modifying firewall hardware routing tables is a network-infrastructure administration task, not an action available on an indicator in the Threat Intelligence workspace. Option D is incorrect because reflashing endpoint BIOS firmware is a hardware/firmware remediation operation performed through endpoint management, not from the threat intelligence indicator interface. Option E is incorrect because updating global cloud provider DNS records is an external DNS management action outside the scope of XSIAM's Threat Intelligence workspace.

Answer

Modify firewall hardware routing tables

Answer

Reflash the BIOS firmware of endpoints matching the indicator

Answer

Directly update global cloud provider DNS records

Question 15

Which TWO methods can be used to test a custom automation script before deploying it in a production playbook? (Choose two)

Accepted Answer

Executing the script within a test incident War Room. Option C is correct because executing the script within a test incident War Room lets you validate the automation against a simulated incident in a safe, non-production environment, exercising the same incident context and integrations the playbook will use. Option E is correct because running the script interactively in the Playground / CLI interface allows step-by-step execution, immediate inspection of inputs/outputs, and rapid debugging before the script is embedded in a production playbook. Option A is not appropriate since compiling to a native Windows .exe is unrelated to testing a custom automation script in a playbook context. Option B is not appropriate because broadcasting over local radio frequencies has no bearing on script validation. Option D is not appropriate because printing the script for manual peer review is a documentation/review activity, not a functional test of the script's execution.

Answer

Compiling the script into a native Windows executable (.exe) on a local laptop

Answer

Broadcasting the script over local radio frequencies

Answer

Printing the script on paper for manual peer review

Question 16

When an analyst reviews an analytic alert in XSIAM, which THREE pieces of contextual information are typically available to assist in prioritization and triage? (Choose three)

Accepted Answer

Score calculation breakdown and contributing factors. Context includes affected assets, MITRE ATT&CK details, and score breakdown.

Answer

Local printer driver version installed on the analyst's laptop

Answer

Cafeteria menu schedule for the security operations center

Question 17

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to connect to the XSIAM tenant through a corporate proxy server. Which THREE proxy configuration parameters must be correctly supplied to the agent installation or policy to ensure successful connectivity? (Choose three)

Accepted Answer

Proxy authentication credentials (username and password) if required. Proxy configurations require server address/IP, port, and authentication credentials if the proxy requires them.

Answer

Primary domain controller NetBIOS name

Answer

Local BGP autonomous system number (ASN)

Question 18

When analyzing security events in XSIAM, what are THREE key benefits of data normalization? (Choose three)

Accepted Answer

Facilitates cross-vendor correlation rules and analytics. Normalization standardizes disparate log formats into a common schema, facilitating consistent querying, correlation, and threat hunting across different vendors.

Answer

Increases local storage capacity on the log collector

Answer

Automatically encrypts hard drives on all endpoints

Question 19

When configuring incident notification settings in XSIAM, which TWO notification channels are natively supported for alerting analysts about new high-severity incidents? (Choose two)

Accepted Answer

Email notifications. Option B (Email notifications) is correct because XSIAM natively supports email as a notification channel, allowing administrators to configure recipients and have high-severity incident alerts delivered directly to analysts' inboxes without additional third-party tooling. Option E (Webhook integrations such as Slack and Microsoft Teams) is correct because XSIAM provides native webhook-based notification support, enabling incident alerts to be pushed to collaboration platforms like Slack or Microsoft Teams through configured webhook endpoints. The remaining options are not natively supported: A (AM/FM radio broadcast) and C (physical office alarm siren activation) are not notification channels XSIAM can drive, and D (direct SMS via cellular gateway without integrations) is excluded because SMS delivery in XSIAM requires an external integration or gateway rather than being a built-in channel.

Answer

Automated AM/FM radio broadcast

Answer

Physical office alarm siren activation

Answer

Direct SMS text messaging via cellular gateway without integrations

Question 20

An incident responder is investigating a ransomware outbreak. Which THREE immediate containment or remediation actions can be executed directly from XSIAM to mitigate the threat? (Choose three)

Accepted Answer

Quarantine the malicious ransomware binaries across hosts. Option A is correct because XSIAM's endpoint protection and response capabilities allow the analyst to quarantine malicious ransomware binaries across affected hosts directly from the console, preventing further execution and spread. Option C is correct because XSIAM can issue network isolation commands to infected endpoints, cutting off command-and-control traffic and lateral movement while preserving the agent for investigation. Option D is correct because XSIAM enables termination of malicious running process trees on endpoints, stopping active encryption routines and child processes spawned by the ransomware. Option B is incorrect because physical door lock systems are not managed by XSIAM, which is a security operations platform focused on endpoint, network, and cloud telemetry. Option E is incorrect because hardware replacement is a physical maintenance task outside XSIAM's software-based containment and remediation scope.

Answer

Reconfigure physical office door security locks

Answer

Physically replace damaged motherboard hardware on endpoints