XSIAM-Analyst Threat Intelligence Management And ASM Practice Test 2 — 15 Questions

Question 1

What is the primary function of Attack Surface Management (ASM) within Cortex XSIAM?

Accepted Answer

To continuously discover and map external, internet-facing assets and potential exposures. ASM focuses on discovering unknown or unmanaged internet-facing assets to reduce organizational risk.

Answer

To ingest external threat feeds and correlate them with internal firewall logs

Answer

To monitor internal workstation performance and CPU usage

Answer

To automate the deployment of security patches on cloud servers

Question 2

An analyst is configuring a new threat intelligence feed in XSIAM to ingest Indicators of Compromise (IoCs). Which integration mechanism should be used to pull indicators natively from an external TAXII 2.1 server?

Accepted Answer

Use the native TAXII 2.1 feed integration instance within Cortex XSIAM Settings. Cortex XSIAM includes a native TAXII 2.1 feed integration that can be configured as an instance under Settings > Threat Intelligence / Integrations, allowing analysts to point at a TAXII server URL, provide credentials, and select collections to pull STIX/TAXII indicators on a schedule. This is the supported, native mechanism for consuming TAXII feeds without custom parsing. It automatically normalizes STIX objects into XSIAM's indicator schema.

Answer

Upload a static CSV file export from the TAXII server on a scheduled basis

Answer

Deploy an external syslog collector to forward TAXII feeds to the XSIAM ingestion endpoint

Answer

Configure a custom Script Runner playbook to parse the TAXII JSON payload

Question 3

Which type of indicators can be ingested into XSIAM's Threat Intelligence module?

Accepted Answer

IP addresses, domains, URLs, and file hashes. XSIAM supports multiple indicator types including IP addresses, domains, URLs, and file hashes (MD5, SHA256).

Answer

Only network traffic packet captures (PCAP files)

Answer

Only file hashes (SHA256 and MD5)

Answer

Only internal Active Directory user account names

Question 4

What is the purpose of tagging threat intelligence indicators in XSIAM?

Accepted Answer

To categorize and group indicators for targeted hunting and filtering in investigations. Tags allow analysts to categorize, organize, and filter indicators for custom hunting queries and incident investigations.

Answer

To increase the processing speed of the ingestion engine

Answer

To automatically block network traffic without creating alerts

Answer

To encrypt sensitive indicators stored in the database

Question 5

You are configuring correlation rules in XSIAM to trigger an incident when internal telemetry matches indicators from a high-confidence threat feed. How do you ensure that indicators from low-confidence feeds are filtered out of this specific rule?

Accepted Answer

Add a condition in the correlation rule logic requiring indicator source reliability or confidence to meet a specific threshold. In XSIAM correlation rules, you can incorporate conditions based on indicator attributes such as source reliability or confidence score. By adding a condition that requires the indicator's source reliability or confidence to meet a specific threshold, the rule will only trigger on high-confidence indicators, effectively filtering out low-confidence feeds. This is the intended way to scope a rule to specific indicator quality without affecting other rules or the entire correlation engine.

Answer

Disable the correlation engine when low-confidence feeds are syncing

Answer

Configure the firewall to drop low-confidence indicators automatically

Answer

Delete all low-confidence indicators from the database daily via XQL delete commands

Question 6

What information does an indicator's 'TLP' (Traffic Light Protocol) designation provide in XSIAM?

Accepted Answer

The sharing and distribution boundaries for the threat intelligence data. TLP defines sharing boundaries and restrictions for sensitive information and threat intelligence.

Answer

The technical severity level of the indicator (Low, Medium, High, Critical)

Answer

The network protocol associated with the indicator (TCP, UDP, HTTP)

Answer

The speed at which the feed is polled by the XSIAM ingestion engine

Question 7

When configuring a Threat Intelligence feed using a custom REST API integration in XSIAM, the API requires a bearer token for authentication that expires every 60 minutes. How should this authentication be managed within the integration instance configuration?

Accepted Answer

Configure the integration instance authentication parameters to support automated OAuth2 token generation and refresh. The integration instance authentication parameters should be configured to support automated OAuth2 token generation and refresh, which handles the 60-minute expiry seamlessly. XSIAM's integration framework supports OAuth2 with refresh tokens, allowing the integration to obtain new bearer tokens automatically without manual intervention. This is the standard, secure method for expiring tokens.

Answer

Configure the endpoint collector to proxy the authentication header

Answer

Write an external cron job to push a new token via syslog

Answer

Hardcode the static bearer token in the integration field and update it manually hourly

Question 8

An organization wants to integrate a proprietary threat intelligence feed that uses a non-standard JSON format. What tool or method should be used within XSIAM to ingest and parse this feed correctly?

Accepted Answer

Use the Generic Feed integration with custom JSON path mapping. Custom feeds that do not match out-of-the-box integrations can be parsed using custom feed integrations or mapping transformations.

Answer

Rewrite the core XSIAM ingestion engine in Python

Answer

Manually convert the JSON feed into a Windows Event Log format

Answer

Configure an endpoint agent to scrape the JSON URL locally

Question 9

An ASM scan in XSIAM flags an external web server as having an outdated SSL/TLS certificate. Where can an analyst view the detailed finding context and remediation recommendations for this exposed asset?

Accepted Answer

Click on the specific asset within the Attack Surface Management asset inventory to open its risk and finding details pane. ASM asset findings provide detailed context and risk information directly within the asset's detail pane.

Answer

Export all raw asset logs to an external SIEM for inspection

Answer

Check the Endpoint Security alert queue

Answer

Review the firewall traffic logs associated with port 443

Question 10

An ASM discovery run identifies a rogue cloud storage bucket publicly exposed to the internet. How does XSIAM's ASM module typically discover this asset without requiring internal cloud credentials?

Accepted Answer

By analyzing Certificate Transparency (CT) logs, DNS brute-forcing, and external port scanning. ASM utilizes external reconnaissance techniques such as certificate transparency log analysis, DNS enumeration, and banner grabbing.

Answer

By intercepting local DNS queries on corporate endpoints

Answer

By scanning internal Active Directory group policies

Answer

By reading netflow data from core internal switches

Question 11

An analyst is investigating an incident where an internal host communicated with a known malicious domain. To verify when the threat intelligence indicator was first and last seen by XSIAM, where should the analyst look?

Accepted Answer

The indicator's details view within the Threat Intelligence module repository. The Threat Intelligence indicator details page records historical sightings, first seen, and last seen timestamps.

Answer

The local endpoint registry hive on the infected workstation

Answer

The ASM asset discovery log

Answer

The firewall hardware diagnostic logs

Question 12

You are configuring Attack Surface Management in XSIAM to monitor brand infringement and typosquatting domains. Which ASM configuration feature enables this capability?

Accepted Answer

External Domain Monitoring and Typosquatting detection rules based on seed keywords. ASM includes domain monitoring capabilities such as typosquatting and brand exposure detection based on seed organization names.

Answer

Endpoint firewall rule generators

Answer

Active Directory domain trust relationship settings

Answer

XQL threat hunting regex patterns on proxy logs

Question 13

When setting up a threat intelligence feed integration in XSIAM, what is the purpose of the 'Fetch Indicators' toggle?

Accepted Answer

It determines whether the integration actively polls and downloads indicators from the source. The Fetch Indicators setting controls whether the integration actively pulls indicators from the source on a scheduled interval.

Answer

It exports local indicators out to an external TAXII server

Answer

It deletes expired indicators from the local database

Answer

It tests the network connectivity to the XSIAM ingestion server

Question 14

An organization's security policy requires that any threat intelligence indicator originating from an untrusted open-source feed must not automatically generate high-severity blocking alerts. How can this policy be enforced in XSIAM?

Accepted Answer

Configure the feed's default reliability rating to 'Low' or adjust the correlation rule criteria to ignore feeds with low reliability. XSIAM enforces feed trust through reliability ratings and correlation rule criteria. Setting an untrusted open-source feed's default reliability to 'Low' (or configuring the correlation rule to exclude low-reliability feeds) prevents indicators from that feed from generating high-severity blocking alerts, satisfying the policy without disabling detection entirely.

Answer

Disable all incident generation globally

Answer

Set the endpoint agent operational mode to 'Disabled'

Answer

Delete the integration instance every evening

Question 15

When configuring a new threat intelligence feed integration in Cortex XSIAM, which TWO configuration parameters are typically required for successful API-based ingestion? (Choose two)

Accepted Answer

API Authentication Key, Token, or Credentials. API-based threat intelligence integrations require endpoint URLs and authentication credentials (such as API keys or tokens) to connect and pull data.

Answer

Endpoint agent installation package version

Answer

Active Directory Domain Controller IP address

Answer

Syslog facility number