XSIAM-Analyst Threat Intelligence Management And ASM — All Questions With Answers

Question 1hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

You are writing an XQL query to search for internal network traffic matching threat intelligence indicators that have a reliability rating of 'A' and a minimum severity of 'High'. Which syntax correctly filters the threat intelligence dataset in XSIAM?

Question 2hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An administrator needs to ensure that custom threat intelligence indicators ingested via a CSV file maintain a specific custom severity rating of 'Critical' regardless of external provider scores. How should this be configured in XSIAM?

Question 3mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An XSIAM analyst notices that a high-fidelity threat intelligence indicator is generating low-priority alerts because its default expiration time is set too short. Where can the indicator expiration settings be adjusted?

Question 4mediummultiple choice

Read the full Ansible explanation →

An analyst wants to create an automated playbook action that checks the reputation of a suspicious IP address against all active threat intelligence feeds in XSIAM. Which built-in command should be used in the playbook?

Question 5mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

Which THREE attributes are automatically evaluated and stored for indicators ingested into Cortex XSIAM's Threat Intelligence module? (Choose three)

Question 6mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

When managing threat intelligence feeds in XSIAM, which THREE options are available for configuring feed synchronization intervals? (Choose three)

Question 7hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

When reviewing Attack Surface Management (ASM) scan results in XSIAM, an administrator can classify discovered assets using various status designations. Which THREE statuses are standard asset classifications in ASM? (Choose three)

Question 8hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst is investigating a security incident and wants to enrich the involved IP addresses with threat intelligence from multiple sources. The analyst needs to view, for each IP, the reputation score, associated campaigns, and the last seen date from all configured feeds in a single consolidated view. Which TWO actions in Cortex XSIAM allow the analyst to achieve this? (Choose two.)

Question 9mediummultiple choice

Read the full network assurance explanation →

An analyst is reviewing a Cortex XSIAM threat intelligence feed that has been running for a week. The feed's indicator count keeps growing, but the analyst notices that indicators older than the feed's configured expiration window are still showing up in indicator searches and matching against endpoint telemetry. The feed integration is healthy and no manual overrides exist. What is the most likely explanation for this behavior?

Question 10hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing ASM findings in Cortex XSIAM and notices that a critical external asset is missing from the attack surface inventory even though its IP range is included in a discovery scope and the scan reports success. Other assets in the same range appear correctly. Which action should the analyst take to diagnose the missing asset?

Question 11hardmultiple choice

Review the full subnetting walkthrough →

A security team wants Cortex XSIAM to continuously discover internet-facing assets belonging to a business unit whose public IP ranges were recently reallocated. The team provides the CIDR blocks, but the ASM scan results only show a fraction of the expected hosts, and no authentication issues are reported. Which configuration detail should the analyst verify first?

Question 12mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst is tuning Cortex XSIAM Threat Intelligence enrichment after a noisy week of alerts. Several indicators from an internal research feed are creating high-severity incidents for hosts that are actually part of an authorized penetration-test range. The analyst wants to stop these indicators from generating new incidents without removing the feed, preserving the data for retrospective hunting. Which TWO actions should the analyst take? (Choose two.)

Question 13mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

You are troubleshooting an Attack Surface Management (ASM) scan in XSIAM where external IP ranges belonging to a newly acquired subsidiary are not showing up in the asset inventory. What is the most likely reason for this discrepancy?

Question 14easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

Question 15mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst wants to suppress a specific threat intelligence indicator that has been identified as a false positive across all correlation rules in XSIAM. What is the correct procedure?

Question 16easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

What is the primary function of Attack Surface Management (ASM) within Cortex XSIAM?

Question 17easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is configuring a new threat intelligence feed in XSIAM to ingest Indicators of Compromise (IoCs). Which integration mechanism should be used to pull indicators natively from an external TAXII 2.1 server?

Question 18easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

Which type of indicators can be ingested into XSIAM's Threat Intelligence module?

Question 19easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

What is the purpose of tagging threat intelligence indicators in XSIAM?

Question 20hardmultiple choice

Read the full network assurance explanation →

You are configuring correlation rules in XSIAM to trigger an incident when internal telemetry matches indicators from a high-confidence threat feed. How do you ensure that indicators from low-confidence feeds are filtered out of this specific rule?

Question 21easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

What information does an indicator's 'TLP' (Traffic Light Protocol) designation provide in XSIAM?

Question 22hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

When configuring a Threat Intelligence feed using a custom REST API integration in XSIAM, the API requires a bearer token for authentication that expires every 60 minutes. How should this authentication be managed within the integration instance configuration?

Question 23mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An organization wants to integrate a proprietary threat intelligence feed that uses a non-standard JSON format. What tool or method should be used within XSIAM to ingest and parse this feed correctly?

Question 24mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An ASM scan in XSIAM flags an external web server as having an outdated SSL/TLS certificate. Where can an analyst view the detailed finding context and remediation recommendations for this exposed asset?

Question 25hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An ASM discovery run identifies a rogue cloud storage bucket publicly exposed to the internet. How does XSIAM's ASM module typically discover this asset without requiring internal cloud credentials?

Question 26mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is investigating an incident where an internal host communicated with a known malicious domain. To verify when the threat intelligence indicator was first and last seen by XSIAM, where should the analyst look?

Question 27hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

You are configuring Attack Surface Management in XSIAM to monitor brand infringement and typosquatting domains. Which ASM configuration feature enables this capability?

Question 28easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

When setting up a threat intelligence feed integration in XSIAM, what is the purpose of the 'Fetch Indicators' toggle?

Question 29hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An organization's security policy requires that any threat intelligence indicator originating from an untrusted open-source feed must not automatically generate high-severity blocking alerts. How can this policy be enforced in XSIAM?

Question 30mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

When configuring a new threat intelligence feed integration in Cortex XSIAM, which TWO configuration parameters are typically required for successful API-based ingestion? (Choose two)

Question 31mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing threat intelligence indicators and notices a specific file hash is marked as 'Expired'. What does this status indicate in XSIAM?

Question 32easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

What is the primary benefit of continuous Attack Surface Management (ASM) monitoring compared to periodic external vulnerability scans?

Question 33hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An administrator is setting up Attack Surface Management (ASM) discovery scopes in XSIAM. Which THREE types of seed assets can be provided to initiate external discovery? (Choose three)

Question 34easymulti select

Read the full Threat Intelligence Management And ASM explanation →

Which TWO actions can an analyst perform on a threat intelligence indicator directly from the XSIAM Threat Intelligence workspace? (Choose two)

Question 35hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst is investigating an ASM finding regarding an exposed service on an external asset. Which THREE details are typically provided within the ASM finding record in XSIAM? (Choose three)

Question 36hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An organization wants to configure custom threat intelligence scoring in XSIAM. Which THREE factors can influence the composite threat score of an indicator within the platform? (Choose three)

Question 37easymulti select

Read the full Threat Intelligence Management And ASM explanation →

Which TWO protocols or formats are natively supported for importing threat intelligence feeds into Cortex XSIAM? (Choose two)

Question 38mediummulti select

Read the full network assurance explanation →

Which TWO methods can an analyst use to investigate matches between internal network telemetry and threat intelligence indicators in XSIAM? (Choose two)

Question 39hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst needs to assess the external attack surface of a newly acquired subsidiary whose primary domain is registered under a different parent organization. The analyst plans to configure an Attack Surface Management (ASM) scan in Cortex XSIAM. Which TWO configuration elements must be defined so that ASM can discover external assets associated with this subsidiary? (Choose two.)

Question 40mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing an ASM finding in Cortex XSIAM that flags an external server as exposing an outdated TLS version. The analyst wants to confirm the exact endpoint, port, and certificate details associated with the finding before escalating to the infrastructure team. Where in Cortex XSIAM should the analyst look to view the detailed evidence for this specific ASM finding?

Question 41easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A security analyst in Cortex XSIAM wants to enrich incoming alerts with context from an external threat intelligence source. The analyst needs the platform to automatically query the source and attach reputation and related indicators to matching alerts. Which Cortex XSIAM capability should the analyst configure to achieve this enrichment?

Question 42mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing a Cortex XSIAM threat intelligence indicator for a malicious domain and wants Cortex XSIAM to automatically expire the indicator after 30 days so that stale data does not trigger future correlation rules. The feed is delivered through a TIM-enabled integration that supports indicator expiration. Which setting should the analyst configure to achieve this?

Question 43mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst discovers that a threat intelligence feed is ingesting indicators with expiration dates far in the future, causing stale indicators to remain active. The analyst wants to enforce a maximum indicator lifespan of 30 days from the feed's own 'last_seen' field, regardless of what the source provides. Which setting in the Cortex XSIAM threat intelligence feed integration should be configured to achieve this?

Question 44hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is investigating an external-facing asset discovered by Attack Surface Management (ASM). The asset appears in the inventory but has no associated service, certificate, or technology details, and the analyst needs to understand what ASM actually observed. Which action should the analyst take to review the raw discovery evidence for this asset?

Question 45mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is validating an incoming TAXII 2.1 threat intelligence feed that keeps returning a 401 Unauthorized error during the 'Test' step of the feed configuration. The feed URL, collection ID, and API root are correct, and the same credentials work in a browser. What should the analyst verify first to resolve the failure?

Question 46mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is tuning detection logic and needs to reduce noise from a threat intelligence indicator that repeatedly matches benign internal traffic. The analyst wants the indicator to remain available for enrichment but to stop generating detections. Which TWO actions should the analyst take to achieve this goal? (Choose two.)

Question 47mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst notices that a threat intelligence feed integration in Cortex XSIAM has been running for three days, but the Indicators view shows zero new indicators since the initial sync. The integration's health dashboard shows a green status and no error logs. Which action should the analyst take FIRST to determine why indicators are not appearing?

Question 48mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is building a Cortex XSIAM correlation rule that uses a threat intelligence indicator set to tag matched events. They need to control how long an ingested indicator remains active before it stops producing matches, so stale indicators from a feed that stopped publishing new data do not keep generating alerts. Which indicator property should the analyst configure on the feed integration to achieve this?

Question 49hardmultiple choice

Read the full network assurance explanation →

An analyst notices that a high-severity threat intelligence indicator for a malicious domain is present in the XSIAM indicator repository but is not triggering any correlation rule matches against endpoint telemetry, even though several endpoints have resolved that domain. The indicator's expiration date is in the future and the feed that supplied it is enabled. What is the most likely cause?

Question 50easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is preparing to ingest a third-party threat intelligence feed that provides indicators as STIX 2.1 objects. Before enabling the feed, the analyst wants to confirm that the platform can parse the format natively. Which statement best describes Cortex XSIAM's handling of STIX-formatted threat intelligence?

Question 51hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

During an Attack Surface Management (ASM) review in Cortex XSIAM, an analyst sees an external-facing asset classified as 'Unregistered' even though the asset's IP address appears in a configured discovery scope. The analyst confirms the IP is reachable and the scan completed successfully. What is the MOST likely explanation for the classification?

Question 52mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing an Attack Surface Management scan that enumerated an external-facing host. The host is flagged with an unauthenticated remote code execution exposure tied to a specific product build, but the analyst needs to prioritize remediation based on whether the exposure is actively being exploited in the wild. Which XSIAM feature should the analyst consult to determine real-world exploitation status for this exposure?

Question 53hardmultiple choice

Review the full routing breakdown →

A Cortex XSIAM Attack Surface Management scan has discovered an internet-facing server, but its hostname and open ports are recorded while the owning business unit and criticality are blank. The analyst wants subsequent ASM findings on this asset to be routed to the correct team and prioritized correctly. What should the analyst do to enrich the asset with ownership and criticality context?

Question 54mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

During an incident investigation, an analyst opens the Cortex XSIAM Threat Intelligence module and searches for an external IP address observed in the alert. The indicator detail view shows a 'Verdict' of 'Unknown' and no associated sources, even though several feed integrations are enabled and healthy. The analyst confirms the IP appears in logs but not in any indicator store. What is the most likely explanation for the missing verdict and sources?

Question 55easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A security analyst is configuring a new external attack surface scan in Cortex XSIAM. The analyst wants to ensure that the scan only targets IP addresses and domains that are explicitly owned by the organization, avoiding any third-party assets. Which configuration step should the analyst take to define the scope of the scan?

Question 56hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is configuring an Attack Surface Management (ASM) discovery scope for a subsidiary and wants to ensure that only externally reachable assets are included in the inventory, excluding internal-only hosts. Which configuration should the analyst apply to the scope?

Question 57mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

During an Attack Surface Management (ASM) review, an analyst needs to confirm which external-facing assets belonging to the organization have a specific known-vulnerable service version exposed. Where in Cortex XSIAM should the analyst look to see the discovered assets, their open ports, and detected service versions for the configured external IP ranges?

Question 58mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst wants to enrich an incident in Cortex XSIAM by correlating its associated IP addresses against the organization's active threat intelligence feeds. Which TWO actions will produce a list of matching indicators for those IPs? (Choose two.)

Question 59mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst notices that a threat intelligence feed integration shows a status of 'Disconnected' and no new indicators have appeared in the indicator store for several hours. The feed uses an API key that the vendor recently rotated. What is the most likely cause and the appropriate first action?

Question 60hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst is tuning Cortex XSIAM Attack Surface Management (ASM) after a scan generated a large volume of findings, many of which are expected and low risk. The analyst wants to reduce noise so future scans surface only meaningful exposure. Which TWO actions are appropriate for this goal? (Choose two.)

Question 61hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A threat intelligence administrator has ingested a feed of domain indicators into Cortex XSIAM. Several of those domains are legitimate business partners, and the administrator wants future correlation and detection logic to ignore them without deleting the indicators or disabling the entire feed. Which XSIAM mechanism should the administrator use?

Question 62hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A threat intelligence analyst in Cortex XSIAM notices that a specific indicator from a feed is causing a high number of false positive alerts in correlation rules. The analyst wants to prevent this indicator from triggering any future alerts without removing it from the threat intelligence database, as it may still be useful for historical context. What is the most appropriate action to take?

Question 63hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is reviewing how threat intelligence indicators flow from an enabled feed into detection. The analyst wants to understand which actions occur when the feed integration polls and new indicators are retrieved. (Choose two.)

Question 64easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A security manager wants Cortex XSIAM to automatically raise the severity of incidents involving indicators that appear on a specific high-confidence threat intelligence feed, without affecting incidents tied to lower-confidence feeds. Which configuration achieves this requirement?

Question 65hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is reviewing external attack surface findings and wants to reduce noise from ASM by focusing only on genuinely risky exposures. The analyst plans to use ASM finding attributes to filter and triage. Which TWO attributes are most useful for identifying externally exposed services that represent elevated risk and warrant immediate investigation? (Choose two.)

Question 66easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A security operations team wants Cortex XSIAM to continuously discover internet-facing assets belonging to their organization without manually supplying individual hostnames each time a new subsidiary is onboarded. Which ASM capability should they configure to achieve ongoing discovery from a broad organizational identifier?

Question 67easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A security manager asks an analyst to explain how Cortex XSIAM uses the Threat Intelligence module during alert triage. The analyst wants to describe the primary operational benefit correctly. Which statement best describes its role?

Question 68mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing the results of an Attack Surface Management scan in Cortex XSIAM and sees a finding for an exposed service on a non-standard port. The analyst wants to understand the potential risk and remediation steps. Where can the analyst find detailed information about this finding, including the service banner and recommended actions?

Question 69easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst has just enabled a new threat intelligence feed in Cortex XSIAM and wants to quickly confirm whether indicators from that feed are actually being stored and are available for investigation, without waiting for a correlation rule to fire. Which action best accomplishes this?

Question 70easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst wants to review which external IP addresses and domains belong to the organization's internet-facing footprint after an ASM scan completes, so they can validate that no unexpected assets were discovered. Where does the analyst review the inventory of discovered external assets in XSIAM?

Question 71mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst is triaging an alert in Cortex XSIAM where an internal host contacted an external IP address that appears in multiple threat intelligence feeds. The analyst wants to determine, within the platform, why the indicator is considered malicious and how it relates to known campaigns. Which TWO actions help the analyst understand the indicator's context and provenance? (Choose two.)

Question 72hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst needs to ingest a commercial threat intelligence feed into Cortex XSIAM. The feed publishes indicators in a proprietary XML schema that no built-in integration supports, and the vendor provides only a REST endpoint returning that XML. What is the correct approach to make these indicators available in XSIAM?

Question 73mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst investigating a phishing alert wants to confirm whether a domain seen in the email headers is associated with known malicious activity. The domain does not appear in any enabled feed. Which Cortex XSIAM capability allows the analyst to check the domain's reputation and enrich the investigation without leaving the platform?

Question 74hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM administrator notices that an ASM scan completed successfully but a known external web application was not listed in the results. The application is reachable from the internet and is owned by the organization. Which troubleshooting step is most appropriate to determine why the asset was missed?

Question 75easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst wants to enrich Cortex XSIAM incidents with context from an external threat intelligence provider so that severity and indicator reputation appear directly on the incident. The provider exposes a REST API keyed by indicator value. Which Cortex XSIAM capability should the analyst use to bring this context into incidents?

Question 76mediummulti select

Read the full network assurance explanation →

An analyst is validating that Cortex XSIAM threat intelligence is being applied correctly to internal telemetry. The analyst wants to confirm which internal data sources are being matched against ingested indicators. Which TWO capabilities should the analyst use to verify indicator matches against internal telemetry? (Choose two.)

Question 77hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is onboarding a new threat intelligence provider that publishes indicators at a very high rate. Shortly after enabling the feed, the analyst notices that indicator searches are slow and that several other feeds appear to have stopped updating. The platform's resource utilization is elevated. Which action best addresses the root cause while preserving intelligence coverage?

Question 78hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is reviewing ASM findings for an external asset that exposes an outdated web framework. The asset is owned by a subsidiary that was acquired last quarter and is not listed in any existing discovery scope. The analyst wants ASM to start monitoring this subsidiary's domains and IP ranges automatically in future scans. What should the analyst do first?

Question 79easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst receives a threat intelligence indicator for a domain that is used by a business partner. The indicator is marked as malicious by an open-source feed, but the partner confirms the domain is legitimate. The analyst wants to ensure the domain does not trigger future incidents while keeping the feed enabled for other indicators. What should the analyst do?

Question 1hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

You are writing an XQL query to search for internal network traffic matching threat intelligence indicators that have a reliability rating of 'A' and a minimum severity of 'High'. Which syntax correctly filters the threat intelligence dataset in XSIAM?

Question 2hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An administrator needs to ensure that custom threat intelligence indicators ingested via a CSV file maintain a specific custom severity rating of 'Critical' regardless of external provider scores. How should this be configured in XSIAM?

Question 3mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An XSIAM analyst notices that a high-fidelity threat intelligence indicator is generating low-priority alerts because its default expiration time is set too short. Where can the indicator expiration settings be adjusted?

Question 4mediummultiple choice

Read the full Ansible explanation →

An analyst wants to create an automated playbook action that checks the reputation of a suspicious IP address against all active threat intelligence feeds in XSIAM. Which built-in command should be used in the playbook?

Question 5mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

Which THREE attributes are automatically evaluated and stored for indicators ingested into Cortex XSIAM's Threat Intelligence module? (Choose three)

Question 6mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

When managing threat intelligence feeds in XSIAM, which THREE options are available for configuring feed synchronization intervals? (Choose three)

Question 7hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

When reviewing Attack Surface Management (ASM) scan results in XSIAM, an administrator can classify discovered assets using various status designations. Which THREE statuses are standard asset classifications in ASM? (Choose three)

Question 8hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst is investigating a security incident and wants to enrich the involved IP addresses with threat intelligence from multiple sources. The analyst needs to view, for each IP, the reputation score, associated campaigns, and the last seen date from all configured feeds in a single consolidated view. Which TWO actions in Cortex XSIAM allow the analyst to achieve this? (Choose two.)

Question 9mediummultiple choice

Read the full network assurance explanation →

An analyst is reviewing a Cortex XSIAM threat intelligence feed that has been running for a week. The feed's indicator count keeps growing, but the analyst notices that indicators older than the feed's configured expiration window are still showing up in indicator searches and matching against endpoint telemetry. The feed integration is healthy and no manual overrides exist. What is the most likely explanation for this behavior?

Question 10hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing ASM findings in Cortex XSIAM and notices that a critical external asset is missing from the attack surface inventory even though its IP range is included in a discovery scope and the scan reports success. Other assets in the same range appear correctly. Which action should the analyst take to diagnose the missing asset?

Question 11hardmultiple choice

Review the full subnetting walkthrough →

A security team wants Cortex XSIAM to continuously discover internet-facing assets belonging to a business unit whose public IP ranges were recently reallocated. The team provides the CIDR blocks, but the ASM scan results only show a fraction of the expected hosts, and no authentication issues are reported. Which configuration detail should the analyst verify first?

Question 12mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst is tuning Cortex XSIAM Threat Intelligence enrichment after a noisy week of alerts. Several indicators from an internal research feed are creating high-severity incidents for hosts that are actually part of an authorized penetration-test range. The analyst wants to stop these indicators from generating new incidents without removing the feed, preserving the data for retrospective hunting. Which TWO actions should the analyst take? (Choose two.)

Question 13mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

You are troubleshooting an Attack Surface Management (ASM) scan in XSIAM where external IP ranges belonging to a newly acquired subsidiary are not showing up in the asset inventory. What is the most likely reason for this discrepancy?

Question 14easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

Question 15mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst wants to suppress a specific threat intelligence indicator that has been identified as a false positive across all correlation rules in XSIAM. What is the correct procedure?

Question 16easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

What is the primary function of Attack Surface Management (ASM) within Cortex XSIAM?

Question 17easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is configuring a new threat intelligence feed in XSIAM to ingest Indicators of Compromise (IoCs). Which integration mechanism should be used to pull indicators natively from an external TAXII 2.1 server?

Question 18easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

Which type of indicators can be ingested into XSIAM's Threat Intelligence module?

Question 19easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

What is the purpose of tagging threat intelligence indicators in XSIAM?

Question 20hardmultiple choice

Read the full network assurance explanation →

You are configuring correlation rules in XSIAM to trigger an incident when internal telemetry matches indicators from a high-confidence threat feed. How do you ensure that indicators from low-confidence feeds are filtered out of this specific rule?

Question 21easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

What information does an indicator's 'TLP' (Traffic Light Protocol) designation provide in XSIAM?

Question 22hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

When configuring a Threat Intelligence feed using a custom REST API integration in XSIAM, the API requires a bearer token for authentication that expires every 60 minutes. How should this authentication be managed within the integration instance configuration?

Question 23mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An organization wants to integrate a proprietary threat intelligence feed that uses a non-standard JSON format. What tool or method should be used within XSIAM to ingest and parse this feed correctly?

Question 24mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An ASM scan in XSIAM flags an external web server as having an outdated SSL/TLS certificate. Where can an analyst view the detailed finding context and remediation recommendations for this exposed asset?

Question 25hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An ASM discovery run identifies a rogue cloud storage bucket publicly exposed to the internet. How does XSIAM's ASM module typically discover this asset without requiring internal cloud credentials?

Question 26mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is investigating an incident where an internal host communicated with a known malicious domain. To verify when the threat intelligence indicator was first and last seen by XSIAM, where should the analyst look?

Question 27hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

You are configuring Attack Surface Management in XSIAM to monitor brand infringement and typosquatting domains. Which ASM configuration feature enables this capability?

Question 28easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

When setting up a threat intelligence feed integration in XSIAM, what is the purpose of the 'Fetch Indicators' toggle?

Question 29hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An organization's security policy requires that any threat intelligence indicator originating from an untrusted open-source feed must not automatically generate high-severity blocking alerts. How can this policy be enforced in XSIAM?

Question 30mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

When configuring a new threat intelligence feed integration in Cortex XSIAM, which TWO configuration parameters are typically required for successful API-based ingestion? (Choose two)

Question 31mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing threat intelligence indicators and notices a specific file hash is marked as 'Expired'. What does this status indicate in XSIAM?

Question 32easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

What is the primary benefit of continuous Attack Surface Management (ASM) monitoring compared to periodic external vulnerability scans?

Question 33hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An administrator is setting up Attack Surface Management (ASM) discovery scopes in XSIAM. Which THREE types of seed assets can be provided to initiate external discovery? (Choose three)

Question 34easymulti select

Read the full Threat Intelligence Management And ASM explanation →

Which TWO actions can an analyst perform on a threat intelligence indicator directly from the XSIAM Threat Intelligence workspace? (Choose two)

Question 35hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst is investigating an ASM finding regarding an exposed service on an external asset. Which THREE details are typically provided within the ASM finding record in XSIAM? (Choose three)

Question 36hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An organization wants to configure custom threat intelligence scoring in XSIAM. Which THREE factors can influence the composite threat score of an indicator within the platform? (Choose three)

Question 37easymulti select

Read the full Threat Intelligence Management And ASM explanation →

Which TWO protocols or formats are natively supported for importing threat intelligence feeds into Cortex XSIAM? (Choose two)

Question 38mediummulti select

Read the full network assurance explanation →

Which TWO methods can an analyst use to investigate matches between internal network telemetry and threat intelligence indicators in XSIAM? (Choose two)

Question 39hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst needs to assess the external attack surface of a newly acquired subsidiary whose primary domain is registered under a different parent organization. The analyst plans to configure an Attack Surface Management (ASM) scan in Cortex XSIAM. Which TWO configuration elements must be defined so that ASM can discover external assets associated with this subsidiary? (Choose two.)

Question 40mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing an ASM finding in Cortex XSIAM that flags an external server as exposing an outdated TLS version. The analyst wants to confirm the exact endpoint, port, and certificate details associated with the finding before escalating to the infrastructure team. Where in Cortex XSIAM should the analyst look to view the detailed evidence for this specific ASM finding?

Question 41easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A security analyst in Cortex XSIAM wants to enrich incoming alerts with context from an external threat intelligence source. The analyst needs the platform to automatically query the source and attach reputation and related indicators to matching alerts. Which Cortex XSIAM capability should the analyst configure to achieve this enrichment?

Question 42mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing a Cortex XSIAM threat intelligence indicator for a malicious domain and wants Cortex XSIAM to automatically expire the indicator after 30 days so that stale data does not trigger future correlation rules. The feed is delivered through a TIM-enabled integration that supports indicator expiration. Which setting should the analyst configure to achieve this?

Question 43mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst discovers that a threat intelligence feed is ingesting indicators with expiration dates far in the future, causing stale indicators to remain active. The analyst wants to enforce a maximum indicator lifespan of 30 days from the feed's own 'last_seen' field, regardless of what the source provides. Which setting in the Cortex XSIAM threat intelligence feed integration should be configured to achieve this?

Question 44hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is investigating an external-facing asset discovered by Attack Surface Management (ASM). The asset appears in the inventory but has no associated service, certificate, or technology details, and the analyst needs to understand what ASM actually observed. Which action should the analyst take to review the raw discovery evidence for this asset?

Question 45mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is validating an incoming TAXII 2.1 threat intelligence feed that keeps returning a 401 Unauthorized error during the 'Test' step of the feed configuration. The feed URL, collection ID, and API root are correct, and the same credentials work in a browser. What should the analyst verify first to resolve the failure?

Question 46mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is tuning detection logic and needs to reduce noise from a threat intelligence indicator that repeatedly matches benign internal traffic. The analyst wants the indicator to remain available for enrichment but to stop generating detections. Which TWO actions should the analyst take to achieve this goal? (Choose two.)

Question 47mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst notices that a threat intelligence feed integration in Cortex XSIAM has been running for three days, but the Indicators view shows zero new indicators since the initial sync. The integration's health dashboard shows a green status and no error logs. Which action should the analyst take FIRST to determine why indicators are not appearing?

Question 48mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is building a Cortex XSIAM correlation rule that uses a threat intelligence indicator set to tag matched events. They need to control how long an ingested indicator remains active before it stops producing matches, so stale indicators from a feed that stopped publishing new data do not keep generating alerts. Which indicator property should the analyst configure on the feed integration to achieve this?

Question 49hardmultiple choice

Read the full network assurance explanation →

An analyst notices that a high-severity threat intelligence indicator for a malicious domain is present in the XSIAM indicator repository but is not triggering any correlation rule matches against endpoint telemetry, even though several endpoints have resolved that domain. The indicator's expiration date is in the future and the feed that supplied it is enabled. What is the most likely cause?

Question 50easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is preparing to ingest a third-party threat intelligence feed that provides indicators as STIX 2.1 objects. Before enabling the feed, the analyst wants to confirm that the platform can parse the format natively. Which statement best describes Cortex XSIAM's handling of STIX-formatted threat intelligence?

Question 51hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

During an Attack Surface Management (ASM) review in Cortex XSIAM, an analyst sees an external-facing asset classified as 'Unregistered' even though the asset's IP address appears in a configured discovery scope. The analyst confirms the IP is reachable and the scan completed successfully. What is the MOST likely explanation for the classification?

Question 52mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing an Attack Surface Management scan that enumerated an external-facing host. The host is flagged with an unauthenticated remote code execution exposure tied to a specific product build, but the analyst needs to prioritize remediation based on whether the exposure is actively being exploited in the wild. Which XSIAM feature should the analyst consult to determine real-world exploitation status for this exposure?

Question 53hardmultiple choice

Review the full routing breakdown →

A Cortex XSIAM Attack Surface Management scan has discovered an internet-facing server, but its hostname and open ports are recorded while the owning business unit and criticality are blank. The analyst wants subsequent ASM findings on this asset to be routed to the correct team and prioritized correctly. What should the analyst do to enrich the asset with ownership and criticality context?

Question 54mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

During an incident investigation, an analyst opens the Cortex XSIAM Threat Intelligence module and searches for an external IP address observed in the alert. The indicator detail view shows a 'Verdict' of 'Unknown' and no associated sources, even though several feed integrations are enabled and healthy. The analyst confirms the IP appears in logs but not in any indicator store. What is the most likely explanation for the missing verdict and sources?

Question 55easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A security analyst is configuring a new external attack surface scan in Cortex XSIAM. The analyst wants to ensure that the scan only targets IP addresses and domains that are explicitly owned by the organization, avoiding any third-party assets. Which configuration step should the analyst take to define the scope of the scan?

Question 56hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is configuring an Attack Surface Management (ASM) discovery scope for a subsidiary and wants to ensure that only externally reachable assets are included in the inventory, excluding internal-only hosts. Which configuration should the analyst apply to the scope?

Question 57mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

During an Attack Surface Management (ASM) review, an analyst needs to confirm which external-facing assets belonging to the organization have a specific known-vulnerable service version exposed. Where in Cortex XSIAM should the analyst look to see the discovered assets, their open ports, and detected service versions for the configured external IP ranges?

Question 58mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst wants to enrich an incident in Cortex XSIAM by correlating its associated IP addresses against the organization's active threat intelligence feeds. Which TWO actions will produce a list of matching indicators for those IPs? (Choose two.)

Question 59mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst notices that a threat intelligence feed integration shows a status of 'Disconnected' and no new indicators have appeared in the indicator store for several hours. The feed uses an API key that the vendor recently rotated. What is the most likely cause and the appropriate first action?

Question 60hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst is tuning Cortex XSIAM Attack Surface Management (ASM) after a scan generated a large volume of findings, many of which are expected and low risk. The analyst wants to reduce noise so future scans surface only meaningful exposure. Which TWO actions are appropriate for this goal? (Choose two.)

Question 61hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A threat intelligence administrator has ingested a feed of domain indicators into Cortex XSIAM. Several of those domains are legitimate business partners, and the administrator wants future correlation and detection logic to ignore them without deleting the indicators or disabling the entire feed. Which XSIAM mechanism should the administrator use?

Question 62hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A threat intelligence analyst in Cortex XSIAM notices that a specific indicator from a feed is causing a high number of false positive alerts in correlation rules. The analyst wants to prevent this indicator from triggering any future alerts without removing it from the threat intelligence database, as it may still be useful for historical context. What is the most appropriate action to take?

Question 63hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is reviewing how threat intelligence indicators flow from an enabled feed into detection. The analyst wants to understand which actions occur when the feed integration polls and new indicators are retrieved. (Choose two.)

Question 64easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A security manager wants Cortex XSIAM to automatically raise the severity of incidents involving indicators that appear on a specific high-confidence threat intelligence feed, without affecting incidents tied to lower-confidence feeds. Which configuration achieves this requirement?

Question 65hardmulti select

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is reviewing external attack surface findings and wants to reduce noise from ASM by focusing only on genuinely risky exposures. The analyst plans to use ASM finding attributes to filter and triage. Which TWO attributes are most useful for identifying externally exposed services that represent elevated risk and warrant immediate investigation? (Choose two.)

Question 66easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A security operations team wants Cortex XSIAM to continuously discover internet-facing assets belonging to their organization without manually supplying individual hostnames each time a new subsidiary is onboarded. Which ASM capability should they configure to achieve ongoing discovery from a broad organizational identifier?

Question 67easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A security manager asks an analyst to explain how Cortex XSIAM uses the Threat Intelligence module during alert triage. The analyst wants to describe the primary operational benefit correctly. Which statement best describes its role?

Question 68mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst is reviewing the results of an Attack Surface Management scan in Cortex XSIAM and sees a finding for an exposed service on a non-standard port. The analyst wants to understand the potential risk and remediation steps. Where can the analyst find detailed information about this finding, including the service banner and recommended actions?

Question 69easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst has just enabled a new threat intelligence feed in Cortex XSIAM and wants to quickly confirm whether indicators from that feed are actually being stored and are available for investigation, without waiting for a correlation rule to fire. Which action best accomplishes this?

Question 70easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst wants to review which external IP addresses and domains belong to the organization's internet-facing footprint after an ASM scan completes, so they can validate that no unexpected assets were discovered. Where does the analyst review the inventory of discovered external assets in XSIAM?

Question 71mediummulti select

Read the full Threat Intelligence Management And ASM explanation →

An analyst is triaging an alert in Cortex XSIAM where an internal host contacted an external IP address that appears in multiple threat intelligence feeds. The analyst wants to determine, within the platform, why the indicator is considered malicious and how it relates to known campaigns. Which TWO actions help the analyst understand the indicator's context and provenance? (Choose two.)

Question 72hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst needs to ingest a commercial threat intelligence feed into Cortex XSIAM. The feed publishes indicators in a proprietary XML schema that no built-in integration supports, and the vendor provides only a REST endpoint returning that XML. What is the correct approach to make these indicators available in XSIAM?

Question 73mediummultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst investigating a phishing alert wants to confirm whether a domain seen in the email headers is associated with known malicious activity. The domain does not appear in any enabled feed. Which Cortex XSIAM capability allows the analyst to check the domain's reputation and enrich the investigation without leaving the platform?

Question 74hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM administrator notices that an ASM scan completed successfully but a known external web application was not listed in the results. The application is reachable from the internet and is owned by the organization. Which troubleshooting step is most appropriate to determine why the asset was missed?

Question 75easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

An analyst wants to enrich Cortex XSIAM incidents with context from an external threat intelligence provider so that severity and indicator reputation appear directly on the incident. The provider exposes a REST API keyed by indicator value. Which Cortex XSIAM capability should the analyst use to bring this context into incidents?

Question 76mediummulti select

Read the full network assurance explanation →

An analyst is validating that Cortex XSIAM threat intelligence is being applied correctly to internal telemetry. The analyst wants to confirm which internal data sources are being matched against ingested indicators. Which TWO capabilities should the analyst use to verify indicator matches against internal telemetry? (Choose two.)

Question 77hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is onboarding a new threat intelligence provider that publishes indicators at a very high rate. Shortly after enabling the feed, the analyst notices that indicator searches are slow and that several other feeds appear to have stopped updating. The platform's resource utilization is elevated. Which action best addresses the root cause while preserving intelligence coverage?

Question 78hardmultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst is reviewing ASM findings for an external asset that exposes an outdated web framework. The asset is owned by a subsidiary that was acquired last quarter and is not listed in any existing discovery scope. The analyst wants ASM to start monitoring this subsidiary's domains and IP ranges automatically in future scans. What should the analyst do first?

Question 79easymultiple choice

Read the full Threat Intelligence Management And ASM explanation →

A Cortex XSIAM analyst receives a threat intelligence indicator for a domain that is used by a business partner. The indicator is marked as malicious by an open-source feed, but the partner confirms the domain is legitimate. The analyst wants to ensure the domain does not trigger future incidents while keeping the feed enabled for other indicators. What should the analyst do?