XSIAM-Analyst Threat Intelligence Management And ASM — Timed 15 Questions

Question 1

You are writing an XQL query to search for internal network traffic matching threat intelligence indicators that have a reliability rating of 'A' and a minimum severity of 'High'. Which syntax correctly filters the threat intelligence dataset in XSIAM?

15 minute time limit — choose an answer to begin.

Accepted Answer

dataset = threat_intelligence | filter reliability == "A" and severity >= "High". XSIAM's threat intelligence dataset can be queried using XQL with specific filtering on indicator attributes such as reliability and severity.

Answer

dataset = asm_assets | filter ti_reliability == "A"

Answer

dataset = panw_threat_feed | filter grade == "A"

Answer

dataset = xdr_data | lookup threat_intel on indicator | filter score == "High"

Question 2

An administrator needs to ensure that custom threat intelligence indicators ingested via a CSV file maintain a specific custom severity rating of 'Critical' regardless of external provider scores. How should this be configured in XSIAM?

Accepted Answer

Modify the default severity mapping in the Threat Intelligence settings for the custom CSV integration instance to override incoming scores with 'Critical'. The Threat Intelligence settings for a custom CSV integration instance include a default severity mapping that can be configured to override incoming provider scores. By setting this mapping to 'Critical', all indicators ingested through that instance will be assigned the Critical severity regardless of the original score. This is the intended administrative control for normalizing severity from custom feeds.

Answer

Edit the global indicator whitelist to elevate matching items to Critical

Answer

Manually update each indicator via the incident management console after ingestion

Answer

Create an XQL alert rule that rewrites the indicator severity field upon ingestion

Question 3

An XSIAM analyst notices that a high-fidelity threat intelligence indicator is generating low-priority alerts because its default expiration time is set too short. Where can the indicator expiration settings be adjusted?

Accepted Answer

Within the Threat Intelligence module settings under Indicator Management and Expiration rules. Indicator expiration rules and reliability scores are configured in the Threat Intelligence module settings.

Answer

In the XQL Search query parameters using the 'expiration' modifier

Answer

Inside the incident correlation rule builder

Answer

By modifying the local collector agent configuration file on endpoints

Question 4

An analyst wants to create an automated playbook action that checks the reputation of a suspicious IP address against all active threat intelligence feeds in XSIAM. Which built-in command should be used in the playbook?

Accepted Answer

indicator.reputation.get or equivalent threat intelligence enrichment command. XSIAM playbooks support standard commands for threat intelligence enrichment, such as 'ip' or indicator reputation lookup commands.

Answer

cmd.ping.ip

Answer

xql.query.execute

Answer

asm.asset.scan

Question 5

Which THREE attributes are automatically evaluated and stored for indicators ingested into Cortex XSIAM's Threat Intelligence module? (Choose three)

Accepted Answer

Confidence Score. Inaz ingested indicators are characterized by type, severity, confidence, and source reliability.

Answer

Active Directory group membership list

Answer

Local workstation physical disk serial number

Question 6

When managing threat intelligence feeds in XSIAM, which THREE options are available for configuring feed synchronization intervals? (Choose three)

Accepted Answer

Hourly synchronization. In Cortex XSIAM, threat intelligence feed synchronization can be scheduled at Hourly synchronization (A), which runs the feed fetch every hour for near-real-time indicators; Daily synchronization (C), which runs once per day for lower-velocity feeds; and Custom minute-based intervals (D), which let you define a specific minute value for more granular polling. These three represent the supported recurring interval configurations in the feed setup. Manual trigger on demand (B) is not a synchronization interval configuration—it is an ad hoc action, not a scheduled interval. Lunar phase synchronization (E) is not a real scheduling option in XSIAM and is technically nonsensical.

Answer

Manual trigger on demand

Answer

Lunar phase synchronization

Question 7

When reviewing Attack Surface Management (ASM) scan results in XSIAM, an administrator can classify discovered assets using various status designations. Which THREE statuses are standard asset classifications in ASM? (Choose three)

Accepted Answer

Unapproved / Shadow IT. In Cortex XSIAM Attack Surface Management, discovered assets are triaged into standard classification statuses that reflect their governance state: B. Unapproved / Shadow IT marks assets that were discovered but not sanctioned by the organization, C. Approved / Authorized marks assets that are recognized and permitted, and E. Under Investigation marks assets whose risk or ownership is still being assessed. These three statuses are the built-in ASM asset classifications used to track and manage discovered attack surface. The remaining options are not ASM asset statuses: A. Quarantined by Endpoint Agent is an endpoint protection action, not an ASM classification, and D. Archived in Syslog Archive refers to log retention, not asset classification.

Answer

Quarantined by Endpoint Agent

Answer

Archived in Syslog Archive

Question 8

An analyst is investigating a security incident and wants to enrich the involved IP addresses with threat intelligence from multiple sources. The analyst needs to view, for each IP, the reputation score, associated campaigns, and the last seen date from all configured feeds in a single consolidated view. Which TWO actions in Cortex XSIAM allow the analyst to achieve this? (Choose two.)

Accepted Answer

Use the 'Indicator Search' feature to search for the IP address and view results from all feeds in the search results grid.. The Threat Intelligence tab on the IP entity page and the Indicator Search feature both provide consolidated views of threat intelligence from all feeds. They display reputation, campaigns, and last seen dates in one place, enabling efficient investigation. Other methods either do not exist, require manual effort, or are not designed for ad-hoc enrichment.

Answer

Create a custom dashboard widget that queries all threat intelligence feeds and displays the results for the IP addresses.

Answer

Run the 'threat-intel-enrich' command from the CLI with the IP address as an argument to retrieve a combined report.

Answer

Manually query each feed integration separately using its dedicated integration command and compile the results.

Question 9

An analyst is reviewing a Cortex XSIAM threat intelligence feed that has been running for a week. The feed's indicator count keeps growing, but the analyst notices that indicators older than the feed's configured expiration window are still showing up in indicator searches and matching against endpoint telemetry. The feed integration is healthy and no manual overrides exist. What is the most likely explanation for this behavior?

Accepted Answer

The feed is configured to overwrite indicator expiration with the value supplied by the source feed, so the source's own expiry dates are being honored instead of the local TTL.. Feed integrations in Cortex XSIAM let you decide whether the local expiration window or the source-provided expiration value governs indicator lifetime. When the source value is honored, indicators can live far longer than the configured TTL, so they remain visible in searches and continue matching endpoint telemetry. Because the integration is healthy and no manual overrides exist, this feed-level setting is the most likely cause of the persistence.

Answer

The XSIAM correlation engine caches every indicator it has ever seen and ignores expiration for indicators that previously produced a match.

Answer

The indicators were ingested as a custom indicator type that bypasses the feed's TTL expiration logic.

Answer

Expired indicators are never removed from the indicator database; they are only hidden from the Indicators page UI while remaining fully active in correlation.

Question 10

An analyst is reviewing ASM findings in Cortex XSIAM and notices that a critical external asset is missing from the attack surface inventory even though its IP range is included in a discovery scope and the scan reports success. Other assets in the same range appear correctly. Which action should the analyst take to diagnose the missing asset?

Accepted Answer

Verify whether the asset's services respond only on ports excluded by the scan profile's port configuration.. When most assets in a scanned range appear but one is missing, the cause is often scan profile configuration rather than scope or scanner health. ASM scan profiles define which ports and protocols are probed, so an asset whose services listen only on unprobed ports remains invisible. Adjusting the port configuration or creating a profile that includes those ports is the targeted remedy.

Answer

Recreate the discovery scope using a broader CIDR to force rediscovery of the asset.

Answer

Check whether the asset's IP is listed in the ASM exclusion list for the organization.

Answer

Restart the ASM scanner service to clear a stale asset cache.

Question 11

A security team wants Cortex XSIAM to continuously discover internet-facing assets belonging to a business unit whose public IP ranges were recently reallocated. The team provides the CIDR blocks, but the ASM scan results only show a fraction of the expected hosts, and no authentication issues are reported. Which configuration detail should the analyst verify first?

Accepted Answer

Whether the CIDR blocks were entered in a format the ASM engine accepts, since malformed or overlapping ranges can silently reduce the effective scan scope.. When ASM returns far fewer hosts than the supplied address space should contain, and no authentication or agent issues exist, the most common cause is the scope definition itself. Cortex XSIAM ASM parses CIDR entries and can silently reduce coverage if ranges are malformed, overlapping, or truncated. Verifying the exact syntax and completeness of the entered CIDR blocks is the correct first diagnostic step before investigating service-level or enrichment factors.

Answer

Whether the ASM module requires an agent installed on each target host before it can be discovered.

Answer

Whether the ASM discovery scope is limited to a specific port set that excludes the services running on the missing hosts.

Answer

Whether the threat intelligence feeds are enriching the discovered hosts, since unenriched assets are hidden from the ASM inventory by default.

Question 12

An analyst is tuning Cortex XSIAM Threat Intelligence enrichment after a noisy week of alerts. Several indicators from an internal research feed are creating high-severity incidents for hosts that are actually part of an authorized penetration-test range. The analyst wants to stop these indicators from generating new incidents without removing the feed, preserving the data for retrospective hunting. Which TWO actions should the analyst take? (Choose two.)

Accepted Answer

Set the threat intelligence feed's confidence threshold to High so low-confidence indicators from the research feed are not ingested.. The analyst needs to stop incident creation from a specific set of indicators without disabling the feed or losing data. A feed-level exclusion removes matching indicators at ingestion, and a confidence threshold prevents low-confidence indicators from being ingested. Both keep the feed enabled and preserve other indicators for retrospective hunting. Disabling the feed removes all coverage, while allow listing or rule-level exclusions do not address the ingestion path and can leave the noisy indicators active in other detections.

Answer

Disable the threat intelligence feed integration and re-enable it once the penetration test is complete.

Answer

Configure a correlation rule exclusion that matches the penetration-test host names and the feed indicator values together.

Answer

Add the penetration-test indicator values to an allow list in the Threat Intelligence module so they are not matched by correlation rules.

Question 13

You are troubleshooting an Attack Surface Management (ASM) scan in XSIAM where external IP ranges belonging to a newly acquired subsidiary are not showing up in the asset inventory. What is the most likely reason for this discrepancy?

Accepted Answer

The seed domains or IP ranges for the subsidiary have not been added to the ASM configuration scope. ASM relies on defined organization seed assets and authorized external scopes. If the discovery seed is missing, ASM will not map the assets.

Answer

Threat intelligence feeds have disabled automatic asset correlation by default

Answer

The Log Forwarder agent is not installed on the subsidiary endpoints

Answer

The ingestion service for ASM requires manual CSV asset mapping before discovery runs

Question 14

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

Accepted Answer

Attack Surface Management > Assets. Attack Surface Management features have a dedicated workspace within the XSIAM navigation menu.

Answer

Incident Response > ASM Incidents

Answer

Dashboards > Threat Intelligence > ASM

Answer

Settings > Integrations > ASM Scanner

Question 15

An analyst wants to suppress a specific threat intelligence indicator that has been identified as a false positive across all correlation rules in XSIAM. What is the correct procedure?

Accepted Answer

Add the indicator to an active Indicator Whitelist / Exclusion list within Threat Intelligence settings. The correct procedure is to add the false-positive indicator to an active Indicator Whitelist or Exclusion list within Threat Intelligence settings, which prevents it from triggering any correlation rules globally. This is the centralized, supported mechanism for suppressing known-benign indicators across all rules without disabling feeds or altering endpoint policies. It ensures the indicator is ignored at the threat intelligence layer before rule evaluation.

Answer

Create an exception rule in the Endpoint Protection policy

Answer

Disable all threat intelligence feeds globally

Answer

Delete the indicator manually from every active incident