XSIAM-Analyst Threat Intelligence Management And ASM Practice Test 3 — 15 Questions

Question 1

An analyst is reviewing threat intelligence indicators and notices a specific file hash is marked as 'Expired'. What does this status indicate in XSIAM?

Accepted Answer

The indicator has exceeded its configured time-to-live (TTL) or retention period without being refreshed by a feed. Indicators reach an expired status when they exceed their time-to-live (TTL) or retention period without being updated by a feed.

Answer

The indicator matched an internal whitelist entry

Answer

The threat feed source has revoked its SSL certificate

Answer

The file hash has been successfully quarantined on all endpoints

Question 2

What is the primary benefit of continuous Attack Surface Management (ASM) monitoring compared to periodic external vulnerability scans?

Accepted Answer

It provides real-time visibility into newly exposed assets, shadow IT, and perimeter changes as they occur. Continuous ASM monitoring provides real-time visibility into newly exposed assets, shadow IT, and perimeter changes as they occur. Unlike periodic scans that only capture a point-in-time snapshot, continuous monitoring detects changes immediately, allowing faster response to new exposures. This is the primary benefit over periodic external vulnerability scans.

Answer

It eliminates all network traffic latency

Answer

It automatically patches all vulnerabilities found on external servers

Answer

It replaces the need for internal endpoint security agents entirely

Question 3

An administrator is setting up Attack Surface Management (ASM) discovery scopes in XSIAM. Which THREE types of seed assets can be provided to initiate external discovery? (Choose three)

Accepted Answer

Domain names (e.g., example.com). In XSIAM Attack Surface Management, external discovery is seeded with internet-facing identifiers that the discovery engine can enumerate and scan. Option A (Domain names such as example.com) is correct because domains are a primary seed type: ASM resolves them to subdomains, IPs, and exposed services. Option C (Autonomous System Numbers, ASNs) is correct because an ASN seed lets ASM enumerate all IP prefixes and netblocks announced by that organization, expanding discovery to owned internet ranges. Option E (CIDR IP address ranges such as 192.0.2.0/24) is correct because CIDR blocks are directly scanned and mapped to hosts and open services. Option B (local endpoint MAC addresses) is not valid because MAC addresses are layer-2 identifiers that are not routable or discoverable on the public internet. Option D (Active Directory user SIDs) is not valid because SIDs are internal identity objects, not externally resolvable assets, and belong to identity/AD rather than external ASM seeding.

Answer

Local endpoint MAC addresses

Answer

Local Active Directory user security identifiers (SIDs)

Question 4

Which TWO actions can an analyst perform on a threat intelligence indicator directly from the XSIAM Threat Intelligence workspace? (Choose two)

Accepted Answer

Add the indicator to an exclusion list or whitelist. Option B is correct because the XSIAM Threat Intelligence workspace lets analysts add an indicator to an exclusion list or whitelist so it is no longer treated as malicious and does not trigger detections or response actions. Option C is correct because analysts can manually create and add a custom indicator directly in the workspace, allowing them to track organization-specific IOCs that are not present in the built-in threat intelligence feeds. Option A is incorrect because modifying firewall hardware routing tables is a network-infrastructure administration task, not an action available on an indicator in the Threat Intelligence workspace. Option D is incorrect because reflashing endpoint BIOS firmware is a hardware/firmware remediation operation performed through endpoint management, not from the threat intelligence indicator interface. Option E is incorrect because updating global cloud provider DNS records is an external DNS management action outside the scope of XSIAM's Threat Intelligence workspace.

Answer

Modify firewall hardware routing tables

Answer

Reflash the BIOS firmware of endpoints matching the indicator

Answer

Directly update global cloud provider DNS records

Question 5

An analyst is investigating an ASM finding regarding an exposed service on an external asset. Which THREE details are typically provided within the ASM finding record in XSIAM? (Choose three)

Accepted Answer

Associated vulnerability references (CVEs). Option B is correct because ASM findings in XSIAM typically include associated vulnerability references such as CVE IDs, which let analysts correlate the exposed service with known exploits and prioritize remediation. Option C is correct because the finding record identifies the exposed port and protocol (for example, TCP/443 or TCP/22), which is essential for understanding the attack surface and validating the exposure. Option E is correct because ASM findings commonly capture service banners and application version details, enabling analysts to fingerprint the service and determine whether it is outdated or vulnerable. Options A and D are not part of ASM finding records: internal employee home Wi-Fi SSID names are unrelated to external attack surface data, and local workstation password hashes are endpoint credential material that would never be included in an ASM exposure finding.

Answer

Internal employee home Wi-Fi SSID names

Answer

Local workstation user password hashes

Question 6

An organization wants to configure custom threat intelligence scoring in XSIAM. Which THREE factors can influence the composite threat score of an indicator within the platform? (Choose three)

Accepted Answer

Custom severity mapping overrides. In XSIAM, the composite threat score of an indicator is derived from multiple weighted attributes, and custom severity mapping overrides (B) are correct because they let analysts redefine how a given severity level contributes to the score, directly changing the resulting composite value. Source reliability rating (C) is correct because the trustworthiness of the intelligence source is a scoring input, so indicators from highly reliable feeds score differently than those from questionable sources. Indicator confidence score (D) is also correct because confidence reflects how certain the source is that the indicator is malicious, and it is factored into the composite score calculation. The physical location of the XSIAM cloud data center (A) does not affect indicator scoring, and the brand of the firewall generating internal traffic logs (E) is irrelevant to the threat intelligence scoring algorithm.

Answer

The physical geographic location of the XSIAM cloud data center

Answer

The brand of the firewall generating internal traffic logs

Question 7

Which TWO protocols or formats are natively supported for importing threat intelligence feeds into Cortex XSIAM? (Choose two)

Accepted Answer

TAXII 2.0 / 2.1. Cortex XSIAM natively supports ingesting threat intelligence via TAXII 2.0/2.1 (option B), which is the standard OASIS protocol for STIX-formatted threat intel exchange, allowing XSIAM to subscribe to external TAXII servers and pull indicators automatically. It also natively supports CSV file uploads and feeds (option C), enabling analysts to bulk-import custom indicators with mapped columns for fields like indicator type, value, and severity. The remaining options are not threat-intelligence ingestion formats: Bluetooth Low Energy beacon frames (A) are wireless advertising packets, proprietary printer configuration protocols (D) are device-management protocols, and raw binary kernel dump files (E) are memory forensics artifacts — none of these are recognized feed formats for XSIAM's threat intel module.

Answer

Bluetooth Low Energy beacon frames

Answer

Proprietary printer configuration protocols

Answer

Raw binary kernel dump files

Question 8

Which TWO methods can an analyst use to investigate matches between internal network telemetry and threat intelligence indicators in XSIAM? (Choose two)

Accepted Answer

Review security incidents generated by Threat Intelligence correlation rules. Option C is correct because XSIAM's Threat Intelligence correlation rules automatically generate security incidents when internal network telemetry matches known threat intelligence indicators, giving the analyst a curated starting point for investigation. Option D is correct because analysts can write dedicated XQL (XSIAM Query Language) queries against the threat intelligence and network event datasets to hunt for and correlate matches manually, providing flexible, ad-hoc investigation beyond prebuilt rules. Option A is incorrect because modifying Active Directory Group Policy Objects is a Windows configuration task unrelated to threat intelligence matching or telemetry investigation. Option B is incorrect because rebooting the ingestion server does not re-index logs and would disrupt data collection rather than help investigate indicator matches. Option E is incorrect because hardware diagnostics on network switches address physical device health, not correlation of telemetry with threat intelligence indicators.

Answer

Update the local Active Directory Group Policy Objects

Answer

Reboot the core XSIAM ingestion server to force log re-indexing

Answer

Run a hardware diagnostic script on network switches

Question 9

An analyst needs to assess the external attack surface of a newly acquired subsidiary whose primary domain is registered under a different parent organization. The analyst plans to configure an Attack Surface Management (ASM) scan in Cortex XSIAM. Which TWO configuration elements must be defined so that ASM can discover external assets associated with this subsidiary? (Choose two.)

Accepted Answer

A discovery scope that includes the subsidiary's root domain and any known subdomains. ASM discovery is driven by explicit scope definitions. To find external assets for a subsidiary whose registration sits under a different parent, the analyst must supply the subsidiary's domains and subdomains and its known external IP ranges or CIDR blocks. Feeds, schedules, and detection allowlists do not expand the discovery target set, so they cannot surface the subsidiary's external footprint.

Answer

An ASM scan schedule configured with a recurrence that matches the subsidiary's change window

Answer

An allowlist rule in the correlation rules engine that permits traffic from the subsidiary's IP space

Answer

A Cortex XSIAM threat intelligence feed subscribed to a commercial IP reputation provider

Question 10

An analyst is reviewing an ASM finding in Cortex XSIAM that flags an external server as exposing an outdated TLS version. The analyst wants to confirm the exact endpoint, port, and certificate details associated with the finding before escalating to the infrastructure team. Where in Cortex XSIAM should the analyst look to view the detailed evidence for this specific ASM finding?

Accepted Answer

The Attack Surface Management findings view, opened on the specific asset and issue. ASM findings in Cortex XSIAM are stored and presented within the Attack Surface Management findings view. Each finding is tied to a discovered asset and a specific issue, and opening it reveals scan-collected evidence such as endpoint, port, TLS version, and certificate details. Other interfaces like threat intelligence, audit logs, and correlation alerts do not hold this scan evidence.

Answer

The Cortex XSIAM audit log filtered by the scan's execution time

Answer

The Threat Intelligence Indicators page filtered by the server's IP address

Answer

The correlation rules engine's alert details for the matching detection rule

Question 11

A security analyst in Cortex XSIAM wants to enrich incoming alerts with context from an external threat intelligence source. The analyst needs the platform to automatically query the source and attach reputation and related indicators to matching alerts. Which Cortex XSIAM capability should the analyst configure to achieve this enrichment?

Accepted Answer

A threat intelligence feed integration instance that fetches indicators and enables enrichment. Automatic alert enrichment with external reputation and related indicators is achieved through a threat intelligence feed integration instance configured with enrichment enabled. ASM scopes, correlation suppression rules, and report templates serve different purposes and do not query external sources to attach context to alerts.

Answer

An ASM discovery scope that includes the organization's external IP ranges

Answer

A report template that includes indicator fields for scheduled distribution

Answer

A correlation rule that suppresses alerts matching known benign indicators

Question 12

An analyst is reviewing a Cortex XSIAM threat intelligence indicator for a malicious domain and wants Cortex XSIAM to automatically expire the indicator after 30 days so that stale data does not trigger future correlation rules. The feed is delivered through a TIM-enabled integration that supports indicator expiration. Which setting should the analyst configure to achieve this?

Accepted Answer

Set the Time to Live (TTL) value on the indicator or feed so Cortex XSIAM expires it after the specified number of days.. Indicator expiration in Cortex XSIAM is managed through the Time to Live (TTL) setting, which defines how long an indicator stays active before automatic removal. Configuring a 30-day TTL on the indicator or its parent feed directly satisfies the requirement to prevent stale malicious domains from continuing to trigger correlation rules.

Answer

Apply a reputation override of 'Good' to the domain so it stops matching correlation rules after 30 days.

Answer

Create a correlation rule exclusion that references the indicator and schedule it to run every 30 days.

Answer

Enable the 'Fetch Indicators' toggle and set the feed's refresh interval to 30 days.

Question 13

An analyst discovers that a threat intelligence feed is ingesting indicators with expiration dates far in the future, causing stale indicators to remain active. The analyst wants to enforce a maximum indicator lifespan of 30 days from the feed's own 'last_seen' field, regardless of what the source provides. Which setting in the Cortex XSIAM threat intelligence feed integration should be configured to achieve this?

Accepted Answer

Set the 'Indicator Expiration Method' to 'Expire indicators based on the feed's last_seen field' and configure the 'Indicator Expiration Interval' to 30 days.. The correct setting is the indicator expiration method that uses the feed's last_seen field with a 30-day interval. This allows XSIAM to automatically expire indicators based on their activity, ensuring stale data is removed. Other options either do not control expiration or rely on manual intervention, which is inefficient and not scalable.

Answer

Configure the 'Feed Fetch Interval' to 30 days to ensure indicators are refreshed only every 30 days, implicitly expiring older ones.

Answer

Enable the 'Reputation Calculation' option and set the 'Reputation Threshold' to expire indicators with a reputation score below 30.

Answer

Use the 'Indicator Exclusion List' to manually add indicators older than 30 days, preventing them from being ingested.

Question 14

A Cortex XSIAM analyst is investigating an external-facing asset discovered by Attack Surface Management (ASM). The asset appears in the inventory but has no associated service, certificate, or technology details, and the analyst needs to understand what ASM actually observed. Which action should the analyst take to review the raw discovery evidence for this asset?

Accepted Answer

Open the asset's details page and review the associated findings and evidence collected during the discovery scan.. ASM stores discovery evidence at the asset level, and the asset details page surfaces the observed services, certificates, technologies, and findings. When the inventory summary appears incomplete, the details page is the authoritative place to review what the scan actually collected, making it the correct action for this investigation.

Answer

Run a new ASM scan with a broader port range and wait for the next inventory refresh.

Answer

Export the ASM inventory to CSV and inspect the row for the asset to find its service details.

Answer

Query the threat intelligence indicator store for the asset's IP address to infer its services.

Question 15

A Cortex XSIAM analyst is validating an incoming TAXII 2.1 threat intelligence feed that keeps returning a 401 Unauthorized error during the 'Test' step of the feed configuration. The feed URL, collection ID, and API root are correct, and the same credentials work in a browser. What should the analyst verify first to resolve the failure?

Accepted Answer

That the TAXII 2.1 feed is configured with the correct username and API key (or Basic/Bearer credential) in the integration instance, since TAXII handshakes authenticate per request and a mismatched auth header returns 401.. A 401 Unauthorized from a TAXII 2.1 server indicates that the credential presented in the request was rejected. Because XSIAM sends the credential stored in the integration instance on every request, the analyst must confirm that the instance's username/API key or Bearer token matches what the server expects. The URL, collection ID, and API root are independent of authentication and were already verified as correct.

Answer

That the feed's indicator type mapping includes 'STIX Pattern' entries, because unmapped STIX patterns cause the server to return 401.

Answer

That the reputation calculation method is set to 'Manual' instead of 'Automatic', since manual reputation blocks the initial TAXII handshake.

Answer

That the indicator expiration policy is set to a value longer than the feed's polling interval, because expired indicators can cause the server to reject the request.