XSIAM-Analyst Quick Quiz — 10 Questions

Question 1

An analyst has just enabled a new threat intelligence feed in Cortex XSIAM and wants to quickly confirm whether indicators from that feed are actually being stored and are available for investigation, without waiting for a correlation rule to fire. Which action best accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Open the indicator repository and filter by the feed's source, confirming that indicators with recent timestamps are listed.. The indicator repository is the platform location where ingested threat intelligence is stored and can be filtered by source. Filtering for the new feed's source and observing recently timestamped indicators directly verifies that ingestion is working and that the data is ready for investigation, independent of whether any correlation rule has matched.

Answer

Inspect the correlation rule library for a rule named after the feed to confirm the feed registered successfully.

Answer

Run a manual ASM scan against the feed's IP ranges to see whether the indicators resolve to live assets.

Answer

Check the management server's endpoint device inventory for entries matching the feed's indicators.

Question 2

A playbook loops over a list of forty endpoints and runs an isolation command on each. Midway through, the integration returns a rate-limit error on one endpoint. The team wants the playbook to log the failure for that endpoint and continue processing the remaining endpoints rather than aborting the entire run. Which configuration achieves this?

Accepted Answer

Set the isolation task's execution mode to continue on error so the loop proceeds to the next item while recording the failure.. Setting the task to continue on error lets the loop skip past a failed endpoint while capturing the failure in logs, so all remaining endpoints are still processed. This is the standard pattern for bulk operations where individual failures should not halt the workflow. Timeout changes, outer conditionals, and assumed automatic retries do not address per-item failure tolerance inside a loop.

Answer

Wrap the entire loop in a single conditional task that checks whether any endpoint failed before continuing.

Answer

Increase the integration instance's timeout value so the rate-limit error does not occur during the loop.

Answer

Reduce the loop batch size to one and rely on the playbook engine to retry failed iterations automatically.

Question 3

An administrator is preparing to deploy the Cortex XDR agent to a new batch of Windows endpoints. Before installation, the administrator wants to verify that the endpoints meet the minimum supported operating system requirements for the current agent version. Where in the Cortex XSIAM documentation or console should the administrator confirm the supported Windows versions?

Accepted Answer

In the Cortex XSIAM Administrator Guide under the Cortex XDR agent installation requirements section.. The Cortex XSIAM Administrator Guide is the official documentation that lists Cortex XDR agent installation requirements, including supported Windows operating system versions. Administrators should consult it before deployment to confirm compatibility. The other options reference local endpoint data or licensing documents that do not contain the agent's supported OS matrix.

Answer

In the Cortex XSIAM license certificate provided at purchase.

Answer

In the endpoint's Windows Update history on each target machine.

Answer

In the Windows Event Viewer Application log on a previously deployed endpoint.

Question 4

What is the primary function of Attack Surface Management (ASM) within Cortex XSIAM?

Accepted Answer

To continuously discover and map external, internet-facing assets and potential exposures. ASM focuses on discovering unknown or unmanaged internet-facing assets to reduce organizational risk.

Answer

To ingest external threat feeds and correlate them with internal firewall logs

Answer

To monitor internal workstation performance and CPU usage

Answer

To automate the deployment of security patches on cloud servers

Question 5

You notice that an automated playbook is executing multiple duplicate sub-tasks simultaneously because multiple alerts matching the same indicator arrived within seconds. How can you prevent race conditions or duplicate execution?

Accepted Answer

Configure playbook concurrency settings / deduplication keys.. Playbook concurrency settings and deduplication keys are the native XSIAM/Cortex XSOAR mechanisms that prevent the same playbook from spawning parallel duplicate executions when multiple alerts share an indicator. By defining a deduplication key (e.g., based on the indicator value or incident ID) and configuring concurrency limits, the platform ensures only one instance runs or that subsequent triggers are queued/merged rather than executed in parallel. This directly addresses race conditions caused by near-simultaneous matching alerts.

Answer

Reinstall the XSIAM agent on all endpoints.

Answer

Turn off auto-updates for integrations.

Answer

Delete all historical log partitions.

Question 6

During an investigation in Cortex XSIAM, an analyst needs to review the local protection settings currently applied to a specific Windows endpoint by its Cortex XDR agent, including whether behavioral threat protection is enabled and whether the agent is running in blocking or report-only mode. Where in the XSIAM console can the analyst view this per-endpoint protection configuration?

Accepted Answer

Endpoint Management > Endpoints > select the endpoint > Protection Status tab. To verify what protections a Cortex XDR agent is actually enforcing on a specific host, the analyst must open the endpoint's detail view and consult the Protection Status tab, which reports the applied policy and each module's state. Incident timelines, policy audit trails, and vulnerability views describe different data sets and do not represent the endpoint's live protection configuration.

Answer

Inventory > Endpoints > select the endpoint > Vulnerabilities tab

Answer

Policies > Prevention > select the policy > Audit Trail tab

Answer

Incidents > select the relevant incident > Timeline tab

Question 7

Which THREE components or views in XSIAM assist analysts in recognizing and understanding analytic alert types and their context? (Choose three)

Accepted Answer

MITRE ATT&CK tactical coverage display in the alert pane. Alert details, MITRE mappings, and incident graphs help analysts understand alerts.

Answer

License renewal expiration tracker

Answer

Agent BIOS version audit report

Question 8

During an incident investigation in Cortex XSIAM, an analyst needs to determine the scope of a credential theft attack. The analyst wants to identify all endpoints where a specific compromised user account was used to log in successfully after the initial compromise. Which XQL query should the analyst run?

Accepted Answer

dataset = xdr_data | filter event_type = ENUM.LOGIN and action_status = "SUCCESS" and user_name = "compromised_user" | fields agent_hostname, user_name, _time. The correct XQL query filters for successful login events (ENUM.LOGIN with action_status "SUCCESS") for the compromised user, returning hostnames and timestamps. This directly identifies all endpoints where the account was used after compromise, enabling the analyst to scope the incident. Other queries focus on process, file, or network events, which do not show successful authentication usage.

Answer

dataset = xdr_data | filter event_type = ENUM.NETWORK and remote_ip = "attacker_ip" | fields agent_hostname, remote_ip

Answer

dataset = xdr_data | filter event_type = ENUM.FILE and file_name = "ntds.dit" | fields agent_hostname, file_name

Answer

dataset = xdr_data | filter event_type = ENUM.PROCESS and process_name = "lsass.exe" | fields agent_hostname, process_name

Question 9

Which TWO protocols or formats are natively supported for importing threat intelligence feeds into Cortex XSIAM? (Choose two)

Accepted Answer

TAXII 2.0 / 2.1. Cortex XSIAM natively supports ingesting threat intelligence via TAXII 2.0/2.1 (option B), which is the standard OASIS protocol for STIX-formatted threat intel exchange, allowing XSIAM to subscribe to external TAXII servers and pull indicators automatically. It also natively supports CSV file uploads and feeds (option C), enabling analysts to bulk-import custom indicators with mapped columns for fields like indicator type, value, and severity. The remaining options are not threat-intelligence ingestion formats: Bluetooth Low Energy beacon frames (A) are wireless advertising packets, proprietary printer configuration protocols (D) are device-management protocols, and raw binary kernel dump files (E) are memory forensics artifacts — none of these are recognized feed formats for XSIAM's threat intel module.

Answer

Bluetooth Low Energy beacon frames

Answer

Proprietary printer configuration protocols

Answer

Raw binary kernel dump files

Question 10

An XSIAM Analyst is configuring a new custom prioritization rule to ensure that alerts involving the finance department's servers receive a higher severity score. Which TWO elements must be defined within the rule for it to correctly match and score the intended alerts? (Choose two.)

Accepted Answer

A severity adjustment value or new severity level to apply when the condition matches. A custom prioritization rule must have a condition to identify target alerts and an action to adjust severity. Conditions can use asset attributes like hostname or criticality tags to focus on finance servers. The severity adjustment ensures those alerts are scored higher. Other elements like schedules, grouping references, or notification templates are not required for the rule to function.

Answer

A schedule that defines when the rule is active

Answer

A notification template to alert the SOC team

Answer

An incident grouping rule reference to link related alerts