XSIAM-Analyst Threat Intelligence Management And ASM — Timed 10 Questions

Question 1

You are writing an XQL query to search for internal network traffic matching threat intelligence indicators that have a reliability rating of 'A' and a minimum severity of 'High'. Which syntax correctly filters the threat intelligence dataset in XSIAM?

10 minute time limit — choose an answer to begin.

Accepted Answer

dataset = threat_intelligence | filter reliability == "A" and severity >= "High". XSIAM's threat intelligence dataset can be queried using XQL with specific filtering on indicator attributes such as reliability and severity.

Answer

dataset = asm_assets | filter ti_reliability == "A"

Answer

dataset = panw_threat_feed | filter grade == "A"

Answer

dataset = xdr_data | lookup threat_intel on indicator | filter score == "High"

Question 2

An administrator needs to ensure that custom threat intelligence indicators ingested via a CSV file maintain a specific custom severity rating of 'Critical' regardless of external provider scores. How should this be configured in XSIAM?

Accepted Answer

Modify the default severity mapping in the Threat Intelligence settings for the custom CSV integration instance to override incoming scores with 'Critical'. The Threat Intelligence settings for a custom CSV integration instance include a default severity mapping that can be configured to override incoming provider scores. By setting this mapping to 'Critical', all indicators ingested through that instance will be assigned the Critical severity regardless of the original score. This is the intended administrative control for normalizing severity from custom feeds.

Answer

Edit the global indicator whitelist to elevate matching items to Critical

Answer

Manually update each indicator via the incident management console after ingestion

Answer

Create an XQL alert rule that rewrites the indicator severity field upon ingestion

Question 3

An XSIAM analyst notices that a high-fidelity threat intelligence indicator is generating low-priority alerts because its default expiration time is set too short. Where can the indicator expiration settings be adjusted?

Accepted Answer

Within the Threat Intelligence module settings under Indicator Management and Expiration rules. Indicator expiration rules and reliability scores are configured in the Threat Intelligence module settings.

Answer

In the XQL Search query parameters using the 'expiration' modifier

Answer

Inside the incident correlation rule builder

Answer

By modifying the local collector agent configuration file on endpoints

Question 4

An analyst wants to create an automated playbook action that checks the reputation of a suspicious IP address against all active threat intelligence feeds in XSIAM. Which built-in command should be used in the playbook?

Accepted Answer

indicator.reputation.get or equivalent threat intelligence enrichment command. XSIAM playbooks support standard commands for threat intelligence enrichment, such as 'ip' or indicator reputation lookup commands.

Answer

cmd.ping.ip

Answer

xql.query.execute

Answer

asm.asset.scan

Question 5

Which THREE attributes are automatically evaluated and stored for indicators ingested into Cortex XSIAM's Threat Intelligence module? (Choose three)

Accepted Answer

Confidence Score. Inaz ingested indicators are characterized by type, severity, confidence, and source reliability.

Answer

Active Directory group membership list

Answer

Local workstation physical disk serial number

Question 6

When managing threat intelligence feeds in XSIAM, which THREE options are available for configuring feed synchronization intervals? (Choose three)

Accepted Answer

Hourly synchronization. In Cortex XSIAM, threat intelligence feed synchronization can be scheduled at Hourly synchronization (A), which runs the feed fetch every hour for near-real-time indicators; Daily synchronization (C), which runs once per day for lower-velocity feeds; and Custom minute-based intervals (D), which let you define a specific minute value for more granular polling. These three represent the supported recurring interval configurations in the feed setup. Manual trigger on demand (B) is not a synchronization interval configuration—it is an ad hoc action, not a scheduled interval. Lunar phase synchronization (E) is not a real scheduling option in XSIAM and is technically nonsensical.

Answer

Manual trigger on demand

Answer

Lunar phase synchronization

Question 7

When reviewing Attack Surface Management (ASM) scan results in XSIAM, an administrator can classify discovered assets using various status designations. Which THREE statuses are standard asset classifications in ASM? (Choose three)

Accepted Answer

Unapproved / Shadow IT. In Cortex XSIAM Attack Surface Management, discovered assets are triaged into standard classification statuses that reflect their governance state: B. Unapproved / Shadow IT marks assets that were discovered but not sanctioned by the organization, C. Approved / Authorized marks assets that are recognized and permitted, and E. Under Investigation marks assets whose risk or ownership is still being assessed. These three statuses are the built-in ASM asset classifications used to track and manage discovered attack surface. The remaining options are not ASM asset statuses: A. Quarantined by Endpoint Agent is an endpoint protection action, not an ASM classification, and D. Archived in Syslog Archive refers to log retention, not asset classification.

Answer

Quarantined by Endpoint Agent

Answer

Archived in Syslog Archive

Question 8

An analyst is investigating a security incident and wants to enrich the involved IP addresses with threat intelligence from multiple sources. The analyst needs to view, for each IP, the reputation score, associated campaigns, and the last seen date from all configured feeds in a single consolidated view. Which TWO actions in Cortex XSIAM allow the analyst to achieve this? (Choose two.)

Accepted Answer

Use the 'Indicator Search' feature to search for the IP address and view results from all feeds in the search results grid.. The Threat Intelligence tab on the IP entity page and the Indicator Search feature both provide consolidated views of threat intelligence from all feeds. They display reputation, campaigns, and last seen dates in one place, enabling efficient investigation. Other methods either do not exist, require manual effort, or are not designed for ad-hoc enrichment.

Answer

Create a custom dashboard widget that queries all threat intelligence feeds and displays the results for the IP addresses.

Answer

Run the 'threat-intel-enrich' command from the CLI with the IP address as an argument to retrieve a combined report.

Answer

Manually query each feed integration separately using its dedicated integration command and compile the results.

Question 9

An analyst is reviewing a Cortex XSIAM threat intelligence feed that has been running for a week. The feed's indicator count keeps growing, but the analyst notices that indicators older than the feed's configured expiration window are still showing up in indicator searches and matching against endpoint telemetry. The feed integration is healthy and no manual overrides exist. What is the most likely explanation for this behavior?

Accepted Answer

The feed is configured to overwrite indicator expiration with the value supplied by the source feed, so the source's own expiry dates are being honored instead of the local TTL.. Feed integrations in Cortex XSIAM let you decide whether the local expiration window or the source-provided expiration value governs indicator lifetime. When the source value is honored, indicators can live far longer than the configured TTL, so they remain visible in searches and continue matching endpoint telemetry. Because the integration is healthy and no manual overrides exist, this feed-level setting is the most likely cause of the persistence.

Answer

The XSIAM correlation engine caches every indicator it has ever seen and ignores expiration for indicators that previously produced a match.

Answer

The indicators were ingested as a custom indicator type that bypasses the feed's TTL expiration logic.

Answer

Expired indicators are never removed from the indicator database; they are only hidden from the Indicators page UI while remaining fully active in correlation.

Question 10

An analyst is reviewing ASM findings in Cortex XSIAM and notices that a critical external asset is missing from the attack surface inventory even though its IP range is included in a discovery scope and the scan reports success. Other assets in the same range appear correctly. Which action should the analyst take to diagnose the missing asset?

Accepted Answer

Verify whether the asset's services respond only on ports excluded by the scan profile's port configuration.. When most assets in a scanned range appear but one is missing, the cause is often scan profile configuration rather than scope or scanner health. ASM scan profiles define which ports and protocols are probed, so an asset whose services listen only on unprobed ports remains invisible. Adjusting the port configuration or creating a profile that includes those ports is the targeted remedy.

Answer

Recreate the discovery scope using a broader CIDR to force rediscovery of the asset.

Answer

Check whether the asset's IP is listed in the ASM exclusion list for the organization.

Answer

Restart the ASM scanner service to clear a stale asset cache.