XSIAM-Analyst Threat Intelligence Management And ASM Practice Test 5 — 15 Questions

Question 1

A threat intelligence administrator has ingested a feed of domain indicators into Cortex XSIAM. Several of those domains are legitimate business partners, and the administrator wants future correlation and detection logic to ignore them without deleting the indicators or disabling the entire feed. Which XSIAM mechanism should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an allow list entry for the partner domains so they are treated as known-good. The administrator needs indicators to remain stored while being excluded from correlation and detection. Allow listing marks the partner domains as known-good inside Cortex XSIAM, so detections skip them while the indicators stay visible and auditable. Ingestion exclusions delete them from the store, confidence thresholds affect unrelated indicators, and retention changes degrade the whole feed.

Answer

Add the partner domains to the feed's exclusion list so they are dropped at ingestion

Answer

Lower the feed's confidence score threshold so low-confidence indicators are not correlated

Answer

Set the feed to expire indicators after a short retention window so stale entries stop matching

Question 2

A threat intelligence analyst in Cortex XSIAM notices that a specific indicator from a feed is causing a high number of false positive alerts in correlation rules. The analyst wants to prevent this indicator from triggering any future alerts without removing it from the threat intelligence database, as it may still be useful for historical context. What is the most appropriate action to take?

Accepted Answer

Create an indicator exclusion rule that matches the indicator and set it to 'Exclude from correlation'.. Creating an indicator exclusion rule that excludes the indicator from correlation is the precise method to prevent alerts while retaining the indicator in the database. It allows for centralized management and does not alter the indicator's data or the rules themselves. This is the recommended approach in XSIAM for handling false positive indicators.

Answer

Set the indicator's reputation to 'Benign' to prevent it from triggering alerts.

Answer

Modify the correlation rule that triggers on this indicator to include an exception for the indicator's value.

Answer

Delete the indicator from the threat intelligence database and add it to a watchlist for future monitoring.

Question 3

A Cortex XSIAM analyst is reviewing how threat intelligence indicators flow from an enabled feed into detection. The analyst wants to understand which actions occur when the feed integration polls and new indicators are retrieved. (Choose two.)

Accepted Answer

Indicators can be enriched or matched against telemetry during correlation and used to raise alerts or populate the incident view.. When an enabled feed polls, XSIAM normalizes retrieved indicators into its schema and stores them in the indicator repository with a reputation and expiration, making them available platform-wide. Those indicators are then evaluated during correlation against telemetry and used for enrichment, which can raise alerts or feed incidents. Automatic rule modification, endpoint blocklisting, and mandatory manual approval are not part of the standard ingestion flow.

Answer

Every retrieved indicator is immediately pushed to all managed endpoint agents as a blocklist entry.

Answer

Newly retrieved indicators are automatically written into every enabled correlation rule's indicator filter without analyst action.

Answer

Retrieved indicators are quarantined in a staging area and require manual approval before they become visible to any XSIAM component.

Question 4

A security manager wants Cortex XSIAM to automatically raise the severity of incidents involving indicators that appear on a specific high-confidence threat intelligence feed, without affecting incidents tied to lower-confidence feeds. Which configuration achieves this requirement?

Accepted Answer

Set the feed's reputation to 'Bad' and assign a high severity value to the feed's indicators in the feed integration configuration.. XSIAM feed integrations let analysts define the reputation and severity applied to indicators from each source. By assigning a high severity to a high-confidence feed, incidents correlated with those indicators inherit elevated severity automatically, while indicators from other feeds keep their own severity values, providing selective, source-aware prioritization without disabling coverage.

Answer

Modify the incident's severity manually each time a matching indicator appears.

Answer

Create a separate tenant dedicated to the high-confidence feed so its indicators are isolated.

Answer

Disable all other feeds so only the high-confidence feed contributes indicators to incidents.

Question 5

A Cortex XSIAM analyst is reviewing external attack surface findings and wants to reduce noise from ASM by focusing only on genuinely risky exposures. The analyst plans to use ASM finding attributes to filter and triage. Which TWO attributes are most useful for identifying externally exposed services that represent elevated risk and warrant immediate investigation? (Choose two.)

Accepted Answer

Services with weak or misconfigured TLS, such as expired or self-signed certificates. Elevated-risk ASM triage centers on exposures that an external attacker could realistically exploit or that reveal neglected security posture. Exposed services running known vulnerable software and services with weak or misconfigured TLS both meet that bar, because they represent concrete, exploitable weaknesses on the internet-facing surface. Reachability and hosting attributes such as ICMP response, CDN fronting, or private addressing do not indicate exploitable risk and only add noise.

Answer

Assets whose hostnames resolve to a content delivery network

Answer

Services listening only on private RFC 1918 address ranges

Answer

Assets that respond to ICMP echo requests

Question 6

A security operations team wants Cortex XSIAM to continuously discover internet-facing assets belonging to their organization without manually supplying individual hostnames each time a new subsidiary is onboarded. Which ASM capability should they configure to achieve ongoing discovery from a broad organizational identifier?

Accepted Answer

An ASM discovery configuration seeded with the organization's registered domain names and related identifiers. Continuous external discovery requires seeds that the platform can expand on its own. Seeding ASM with the organization's registered domains and related identifiers lets Cortex XSIAM enumerate subdomains and external services as the footprint changes, removing manual per-host entry. Static CSVs, fixed-range schedules, and endpoint agents all fail to deliver automatic expansion of external coverage.

Answer

Manually importing a CSV of external IP addresses for each subsidiary

Answer

An endpoint agent deployment policy pushed to all subsidiary workstations

Answer

A recurring ASM scan schedule applied to a fixed list of seed IP ranges

Question 7

A security manager asks an analyst to explain how Cortex XSIAM uses the Threat Intelligence module during alert triage. The analyst wants to describe the primary operational benefit correctly. Which statement best describes its role?

Accepted Answer

It enriches observed artifacts with external reputation and context so analysts can judge whether activity is likely malicious.. Threat intelligence enrichment adds external reputation and context to artifacts observed in alerts, letting analysts judge likelihood of maliciousness during triage. It complements internal telemetry rather than replacing it, and it does not automatically enforce blocking. Understanding this distinction sets correct expectations about what the module contributes to investigations and what still requires explicit response actions.

Answer

It replaces the need for internal telemetry by providing a complete record of all activity on the network.

Answer

It stores raw packet captures from all monitored network segments for forensic replay.

Answer

It automatically blocks all traffic to any IP address that appears in any enabled threat intelligence feed.

Question 8

An analyst is reviewing the results of an Attack Surface Management scan in Cortex XSIAM and sees a finding for an exposed service on a non-standard port. The analyst wants to understand the potential risk and remediation steps. Where can the analyst find detailed information about this finding, including the service banner and recommended actions?

Accepted Answer

In the 'ASM Findings' table, click on the finding to open a side panel with details and remediation guidance.. The ASM Findings table is the central place to review and investigate individual findings. Clicking a finding opens a side panel with comprehensive details, including service banners and remediation guidance. This allows analysts to quickly assess risk and take action, making it the correct choice.

Answer

In the 'Incidents' module, search for an incident related to the finding to view its details.

Answer

In the 'Threat Intelligence' tab of the asset's entity page, look for the finding's context.

Answer

In the 'Reports' section, generate an ASM report and locate the finding in the report output.

Question 9

An analyst has just enabled a new threat intelligence feed in Cortex XSIAM and wants to quickly confirm whether indicators from that feed are actually being stored and are available for investigation, without waiting for a correlation rule to fire. Which action best accomplishes this?

Accepted Answer

Open the indicator repository and filter by the feed's source, confirming that indicators with recent timestamps are listed.. The indicator repository is the platform location where ingested threat intelligence is stored and can be filtered by source. Filtering for the new feed's source and observing recently timestamped indicators directly verifies that ingestion is working and that the data is ready for investigation, independent of whether any correlation rule has matched.

Answer

Inspect the correlation rule library for a rule named after the feed to confirm the feed registered successfully.

Answer

Run a manual ASM scan against the feed's IP ranges to see whether the indicators resolve to live assets.

Answer

Check the management server's endpoint device inventory for entries matching the feed's indicators.

Question 10

A Cortex XSIAM analyst wants to review which external IP addresses and domains belong to the organization's internet-facing footprint after an ASM scan completes, so they can validate that no unexpected assets were discovered. Where does the analyst review the inventory of discovered external assets in XSIAM?

Accepted Answer

The Attack Surface Management asset inventory view. ASM discovered assets are surfaced in the Attack Surface Management asset inventory, which lists external IP addresses, domains, and services with their attributes. This view is where an analyst validates the organization's internet-facing footprint and identifies unexpected exposures after a scan. The indicator store, audit log, and correlation rule pages serve unrelated purposes and do not contain the external asset inventory.

Answer

The Cortex XSIAM audit log

Answer

The threat intelligence indicator store

Answer

The correlation rule management page

Question 11

An analyst is triaging an alert in Cortex XSIAM where an internal host contacted an external IP address that appears in multiple threat intelligence feeds. The analyst wants to determine, within the platform, why the indicator is considered malicious and how it relates to known campaigns. Which TWO actions help the analyst understand the indicator's context and provenance? (Choose two.)

Accepted Answer

Open the indicator's detail view to review its sources, confidence, and associated threat intelligence metadata. Understanding an indicator requires both provenance and relationships. The indicator detail view shows contributing sources, confidence, and metadata that explain the verdict, while pivoting to related indicators and campaign associations places the address in operational context. Disabling feeds, manually inflating severity, and inspecting raw payloads do not answer why the indicator is considered malicious.

Answer

Export the raw feed payload from the integration logs to inspect the original JSON structure

Answer

Disable the feed that reported the indicator to stop further matches while the investigation continues

Answer

Raise the indicator's severity manually so it appears at the top of the alert queue

Question 12

An analyst needs to ingest a commercial threat intelligence feed into Cortex XSIAM. The feed publishes indicators in a proprietary XML schema that no built-in integration supports, and the vendor provides only a REST endpoint returning that XML. What is the correct approach to make these indicators available in XSIAM?

Accepted Answer

Build a custom feed integration or parser that fetches the REST endpoint, transforms the proprietary XML into the expected indicator format, and ingests it.. Proprietary schemas are handled through custom integrations or parsers that fetch from the available endpoint, transform the data into XSIAM's expected indicator format, and ingest it into the store. This keeps enrichment automated and current. Manual uploads, direct live querying, and forcing vendor reformatting all fail to deliver reliable, automated ingestion for a non-standard commercial feed.

Answer

Request that the vendor reformat its feed to the STIX/TAXII standard before any ingestion can occur.

Answer

Point the XSIAM indicator store directly at the vendor's XML endpoint so it parses the schema natively at query time.

Answer

Manually copy the indicators from the vendor portal into a text file and upload it once as a static indicator list.

Question 13

An analyst investigating a phishing alert wants to confirm whether a domain seen in the email headers is associated with known malicious activity. The domain does not appear in any enabled feed. Which Cortex XSIAM capability allows the analyst to check the domain's reputation and enrich the investigation without leaving the platform?

Accepted Answer

Run an indicator enrichment or search against the domain in the Threat Intelligence module to query configured intelligence sources.. On-demand enrichment against configured intelligence sources lets analysts check an artifact's reputation in-platform even when it is absent from the local indicator store. This supports active investigations like phishing triage, where speed matters and new domains may not yet be in feeds. Waiting for syncs, sandboxing, or filing support tickets all fail to deliver an immediate, in-platform reputation answer.

Answer

Open a support ticket asking the vendor to add the domain to the global indicator database.

Answer

Export the domain to an external sandbox and import the results as a new indicator manually.

Answer

Wait for the next scheduled feed sync, which will automatically add the domain if it is malicious anywhere on the internet.

Question 14

A Cortex XSIAM administrator notices that an ASM scan completed successfully but a known external web application was not listed in the results. The application is reachable from the internet and is owned by the organization. Which troubleshooting step is most appropriate to determine why the asset was missed?

Accepted Answer

Verify that the asset's hostname or address falls within the configured discovery seeds and that the relevant ports are included in the scan scope. A reachable asset that does not appear in ASM results is usually outside the configured seed set or listening on a port that is not scanned. Verifying seed coverage and port scope directly addresses the discovery boundary. Re-running discovery, tuning request rates, or manually adding the asset all skip the diagnostic step and leave the coverage gap in place.

Answer

Re-run the entire discovery configuration from scratch to force a fresh enumeration of all seeds

Answer

Add the web application to the asset inventory manually so it appears in ASM reports going forward

Answer

Increase the scan's request rate to ensure the web application responds before the scan times out

Question 15

An analyst wants to enrich Cortex XSIAM incidents with context from an external threat intelligence provider so that severity and indicator reputation appear directly on the incident. The provider exposes a REST API keyed by indicator value. Which Cortex XSIAM capability should the analyst use to bring this context into incidents?

Accepted Answer

A threat intelligence feed integration configured to fetch indicators and enable indicator enrichment.. Cortex XSIAM threat intelligence feed integrations are the supported way to ingest indicators from external REST-based providers. When enrichment is enabled on the feed, reputation and related provider context are attached to matching indicators and to the incidents that reference them. This directly satisfies the requirement to surface external provider context on incidents without custom code or endpoint-side distribution.

Answer

A dashboard widget that queries the provider's API on a schedule and displays results alongside incident metrics.

Answer

An endpoint policy that pushes the provider's indicator list to every managed agent for local matching.

Answer

A custom correlation rule that calls the provider's API from within the rule logic at evaluation time.