XSIAM-Analyst Threat Intelligence Management And ASM Practice Test 4 — 15 Questions

Question 1

A Cortex XSIAM analyst is tuning detection logic and needs to reduce noise from a threat intelligence indicator that repeatedly matches benign internal traffic. The analyst wants the indicator to remain available for enrichment but to stop generating detections. Which TWO actions should the analyst take to achieve this goal? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adjust the indicator's reputation or severity so correlation rules that depend on a malicious verdict no longer match it.. Allow listing the indicator removes it from detection while preserving enrichment, and adjusting its reputation or severity prevents reputation-dependent rules from matching. Together these actions stop the benign matches without deleting the indicator or disrupting the feed, which is precisely what the analyst needs.

Answer

Disable the feed integration that delivered the indicator so it stops being refreshed.

Answer

Delete the indicator from the threat intelligence store entirely and re-import it only when needed.

Answer

Create a new correlation rule that explicitly alerts on the indicator and route it to a low-priority queue.

Question 2

An analyst notices that a threat intelligence feed integration in Cortex XSIAM has been running for three days, but the Indicators view shows zero new indicators since the initial sync. The integration's health dashboard shows a green status and no error logs. Which action should the analyst take FIRST to determine why indicators are not appearing?

Accepted Answer

Check the feed's indicator expiration settings and the 'Fetch indicators' configuration in the integration instance.. When an integration is healthy but produces no new indicators after the initial sync, the cause is usually a configuration detail rather than a failure. The 'Fetch indicators' toggle controls whether the integration continues to pull new data on its schedule, and expiration settings determine how long indicators remain visible. Verifying both settings is the fastest, least disruptive diagnostic step.

Answer

Reinstall the threat intelligence content pack to force a schema migration.

Answer

Increase the integration's timeout value because large feeds often silently drop indicators.

Answer

Disable the integration instance and re-enable it to force a full re-fetch of all historical indicators.

Question 3

An analyst is building a Cortex XSIAM correlation rule that uses a threat intelligence indicator set to tag matched events. They need to control how long an ingested indicator remains active before it stops producing matches, so stale indicators from a feed that stopped publishing new data do not keep generating alerts. Which indicator property should the analyst configure on the feed integration to achieve this?

Accepted Answer

Indicator expiration / TTL setting. Configuring an expiration or TTL value on the threat intelligence feed integration ensures each ingested indicator has a defined lifespan. Once that period elapses, XSIAM stops using the indicator for correlation, so indicators from a feed that has stopped publishing do not indefinitely generate alerts against internal telemetry. This directly satisfies the analyst's requirement to control indicator longevity.

Answer

Correlation rule suppression window

Answer

Feed fetch interval in minutes

Answer

Feed reputation score threshold

Question 4

An analyst notices that a high-severity threat intelligence indicator for a malicious domain is present in the XSIAM indicator repository but is not triggering any correlation rule matches against endpoint telemetry, even though several endpoints have resolved that domain. The indicator's expiration date is in the future and the feed that supplied it is enabled. What is the most likely cause?

Accepted Answer

The indicator's reputation was set below the threshold required by the correlation rule, or the indicator type does not map to the field the rule evaluates.. For an indicator in the repository to drive a correlation match, two conditions must hold: the indicator's reputation must meet the rule's threshold, and its type must map to the telemetry field the rule inspects. A live, unexpired indicator from an enabled feed satisfies ingestion, so the failure lies in reputation scoring or type-to-field alignment, which stops the rule from ever producing a match.

Answer

The indicator was ingested with a 'Manual' reputation override, which permanently disables correlation matching for that indicator.

Answer

The indicator lacks a STIX pattern, so XSIAM stores it in the repository but excludes patternless indicators from all correlation rule evaluation.

Answer

The feed's 'Fetch Indicators' toggle is disabled, which prevents the indicator from being correlated even though it appears in the repository.

Question 5

A Cortex XSIAM analyst is preparing to ingest a third-party threat intelligence feed that provides indicators as STIX 2.1 objects. Before enabling the feed, the analyst wants to confirm that the platform can parse the format natively. Which statement best describes Cortex XSIAM's handling of STIX-formatted threat intelligence?

Accepted Answer

Cortex XSIAM supports STIX/TAXII natively, so the analyst can configure the feed without building a custom parser.. Cortex XSIAM provides native STIX and TAXII support, so a STIX 2.1 feed can be configured directly without custom parsing. This lets the analyst enable the third-party feed quickly and rely on the platform to map the objects into its indicator model.

Answer

Cortex XSIAM accepts STIX only when delivered over email as an attachment.

Answer

Cortex XSIAM requires STIX feeds to be converted to CSV before ingestion.

Answer

Cortex XSIAM can only ingest STIX indicators after they are mapped through a custom Python integration.

Question 6

During an Attack Surface Management (ASM) review in Cortex XSIAM, an analyst sees an external-facing asset classified as 'Unregistered' even though the asset's IP address appears in a configured discovery scope. The analyst confirms the IP is reachable and the scan completed successfully. What is the MOST likely explanation for the classification?

Accepted Answer

The asset's domain or certificate does not match any registered organization attribute in the ASM configuration.. ASM registration status reflects whether a discovered asset can be attributed to the organization based on configured ownership attributes such as domains, certificates, and WHOIS records. An IP address within a discovery scope can still be unregistered if the associated domain or certificate does not match any organization attribute, which is common with shared hosting, acquired subsidiaries, or third-party infrastructure.

Answer

The scan scope only allows CIDR notation and silently rejects individual IP entries.

Answer

The asset was discovered by an external scanner instead of the internal ASM scanner.

Answer

The asset lacks an open port that ASM requires for registration verification.

Question 7

An analyst is reviewing an Attack Surface Management scan that enumerated an external-facing host. The host is flagged with an unauthenticated remote code execution exposure tied to a specific product build, but the analyst needs to prioritize remediation based on whether the exposure is actively being exploited in the wild. Which XSIAM feature should the analyst consult to determine real-world exploitation status for this exposure?

Accepted Answer

The ASM finding's associated CVE entry enriched with Cortex XSIAM Threat Intelligence exploitation signals. Determining whether an exposure is actively exploited requires threat intelligence enrichment rather than static vulnerability data. Cortex XSIAM correlates ASM findings with threat intelligence that tracks exploitation and trending activity, so the analyst can see real-world abuse signals. Asset criticality, scan history, and scan policy all provide useful context but none of them describe whether attackers are currently exploiting the vulnerability.

Answer

The ASM scan policy definition that controls which ports and services are probed for the asset

Answer

The asset inventory record's business criticality and owner assignment fields

Answer

The asset's historical vulnerability scan diff report showing when the exposure first appeared

Question 8

A Cortex XSIAM Attack Surface Management scan has discovered an internet-facing server, but its hostname and open ports are recorded while the owning business unit and criticality are blank. The analyst wants subsequent ASM findings on this asset to be routed to the correct team and prioritized correctly. What should the analyst do to enrich the asset with ownership and criticality context?

Accepted Answer

Assign the asset to a classification or tag that maps to an owner and criticality in ASM asset management. ASM asset management supports applying classifications or tags to discovered assets, and those classifications can encode ownership and criticality. When the internet-facing server is classified correctly, subsequent ASM findings on that asset inherit the owner and priority, so alerts route to the responsible team and are prioritized according to business impact rather than appearing as unowned, low-context findings.

Answer

Re-run the ASM discovery scan with a broader IP range to capture more context

Answer

Create a correlation rule that matches the server's hostname and sets severity to high

Answer

Add the server's IP address to a threat intelligence blocklist feed

Question 9

During an incident investigation, an analyst opens the Cortex XSIAM Threat Intelligence module and searches for an external IP address observed in the alert. The indicator detail view shows a 'Verdict' of 'Unknown' and no associated sources, even though several feed integrations are enabled and healthy. The analyst confirms the IP appears in logs but not in any indicator store. What is the most likely explanation for the missing verdict and sources?

Accepted Answer

The IP address was never ingested by any enabled feed, so no reputation data exists and the indicator remains unenriched.. The indicator detail view reflects what exists in the indicator store. When no feed has ingested a given IP, XSIAM has nothing to match against, so the verdict stays Unknown and the sources list is empty. Healthy integrations do not guarantee coverage of every possible address, so the analyst must treat this as an intelligence gap and pivot to internal evidence.

Answer

The threat intelligence feed integrations have exceeded their daily API quota and enrichment silently failed for all indicators.

Answer

The analyst's role lacks the Threat Intelligence permission needed to view verdicts and source attribution.

Answer

The indicator was ingested but automatically expired because its time-to-live elapsed, leaving an empty verdict.

Question 10

A security analyst is configuring a new external attack surface scan in Cortex XSIAM. The analyst wants to ensure that the scan only targets IP addresses and domains that are explicitly owned by the organization, avoiding any third-party assets. Which configuration step should the analyst take to define the scope of the scan?

Accepted Answer

Upload a CSV file containing the organization's owned IP ranges and domains to the ASM scan configuration.. Defining the scan scope by uploading a CSV of owned IP ranges and domains ensures that only authorized assets are scanned. This is the standard method in XSIAM ASM to prevent scanning third-party assets. Other options either do not restrict scope or could inadvertently include unauthorized assets.

Answer

Enable the 'Auto-Discovery' option to automatically detect all assets associated with the organization's name.

Answer

Configure the scan to use a public DNS resolver to resolve domain names to IP addresses, ensuring only publicly accessible assets are scanned.

Answer

Set the scan intensity to 'Low' to minimize the chance of scanning unintended assets.

Question 11

A Cortex XSIAM analyst is configuring an Attack Surface Management (ASM) discovery scope for a subsidiary and wants to ensure that only externally reachable assets are included in the inventory, excluding internal-only hosts. Which configuration should the analyst apply to the scope?

Accepted Answer

Define the scope using external seed assets such as public domain names and public IP ranges so ASM discovers only internet-facing assets.. ASM discovery is driven by the seeds defined in the scope. Providing public domain names and public IP ranges as seeds naturally limits discovery to internet-facing assets, which is the intended way to exclude internal-only hosts from the inventory.

Answer

Enable the 'internal only' option in the ASM scope settings and then manually tag external assets for removal.

Answer

Add internal RFC 1918 address ranges as seeds and enable a filter that removes private IPs from the inventory after discovery.

Answer

Create the scope with no seeds and rely on passive DNS and certificate transparency data to populate the inventory.

Question 12

During an Attack Surface Management (ASM) review, an analyst needs to confirm which external-facing assets belonging to the organization have a specific known-vulnerable service version exposed. Where in Cortex XSIAM should the analyst look to see the discovered assets, their open ports, and detected service versions for the configured external IP ranges?

Accepted Answer

The Attack Surface Management view under the inventory, where discovered external assets and their observed attributes such as ports and service versions are listed for the configured scan ranges.. Attack Surface Management discovery results are surfaced in the ASM inventory view, which lists external-facing assets and their observed attributes including open ports and detected service versions. To find assets exposing a specific vulnerable service version, the analyst reviews this inventory for the configured external IP ranges rather than looking at threat intelligence, correlation rules, or endpoint inventory.

Answer

The Threat Intelligence indicator repository, filtered by the 'ASM' source tag, where discovered services are stored as indicators.

Answer

The correlation rule library, by searching for rules that reference the vulnerable service version.

Answer

The endpoint device inventory on the management server, since ASM discoveries are merged into the endpoint asset list.

Question 13

An analyst wants to enrich an incident in Cortex XSIAM by correlating its associated IP addresses against the organization's active threat intelligence feeds. Which TWO actions will produce a list of matching indicators for those IPs? (Choose two.)

Accepted Answer

Use the built-in threat intelligence enrichment command on the incident's IP entity to retrieve associated indicators.. Correlating an incident's IP against threat intelligence in XSIAM is best done through native lookup mechanisms. Searching the Indicators view by indicator value returns all stored matches across enabled feeds, while the enrichment action on an incident entity queries configured sources and returns matches with source and verdict context. Both are direct, on-demand, and preserve source attribution.

Answer

Disable all feeds except one, then re-enable them one at a time to isolate which feed contains the IP.

Answer

Create a new correlation rule that matches the IP against all feeds and wait for the next scheduled evaluation.

Answer

Export the raw incident JSON and manually grep for the IP in the threat intelligence database dump.

Question 14

A Cortex XSIAM analyst notices that a threat intelligence feed integration shows a status of 'Disconnected' and no new indicators have appeared in the indicator store for several hours. The feed uses an API key that the vendor recently rotated. What is the most likely cause and the appropriate first action?

Accepted Answer

The API key credential is invalid; update the credential in the feed integration instance and test connectivity. A vendor-rotated API key makes the credential stored in the feed integration instance stale, so authentication fails, the integration reports Disconnected, and no indicators are ingested. Updating the credential and testing connectivity restores the integration, after which indicator fetching resumes normally. The other actions do not address the authentication failure indicated by the Disconnected status.

Answer

The correlation rules referencing the feed's indicator set have been disabled; re-enable them

Answer

The indicator store has reached its maximum capacity; purge old indicators to resume ingestion

Answer

The feed's fetch interval is set too long; reduce it to force an immediate fetch

Question 15

An analyst is tuning Cortex XSIAM Attack Surface Management (ASM) after a scan generated a large volume of findings, many of which are expected and low risk. The analyst wants to reduce noise so future scans surface only meaningful exposure. Which TWO actions are appropriate for this goal? (Choose two.)

Accepted Answer

Assign severity and ownership to findings so the team can triage and prioritize the ones that matter.. Reducing ASM noise requires distinguishing accepted findings from meaningful exposure. Classification or exclusion rules stop known, accepted items from recurring as issues, while severity and ownership assignment organizes remaining findings for triage. Together they preserve detection of new risk while filtering expected results. Disabling scans, deleting inventory, or blanket-downgrading severity all suppress or destroy useful signal rather than refining it.

Answer

Disable the ASM scan schedule entirely so no further findings are generated until the backlog is cleared.

Answer

Lower the global severity of every ASM finding to informational so nothing alerts the team.

Answer

Delete the ASM inventory of external assets and let the next scheduled scan rebuild it from scratch.