XSIAM-Analyst Timed Practice Test 3 — 10 Questions

Question 1

An administrator needs to prevent end users from stopping the Cortex XDR agent service on their Windows workstations. The administrator plans to enable password protection for the agent. Which statement correctly describes how password protection affects agent operations in Cortex XSIAM?

10 minute time limit — choose an answer to begin.

Accepted Answer

Password protection requires a password to uninstall or tamper with the agent, and the password is set in the agent configuration profile applied to the endpoint.. Cortex XSIAM agent password protection is configured in the agent profile and requires a password for uninstall or tamper operations, preventing users from stopping or removing the agent. It is not an OS-level encryption or Group Policy feature, and it applies to Windows agents. The other options misdescribe the mechanism or incorrectly limit its platform support.

Answer

Password protection encrypts the agent's local database and requires a password each time the endpoint boots.

Answer

Password protection is enforced by the Windows operating system's Group Policy and is unrelated to the Cortex XDR agent configuration.

Answer

Password protection only applies to macOS and Linux agents; Windows agents rely solely on Windows service permissions.

Question 2

A threat intelligence administrator has ingested a feed of domain indicators into Cortex XSIAM. Several of those domains are legitimate business partners, and the administrator wants future correlation and detection logic to ignore them without deleting the indicators or disabling the entire feed. Which XSIAM mechanism should the administrator use?

Accepted Answer

Create an allow list entry for the partner domains so they are treated as known-good. The administrator needs indicators to remain stored while being excluded from correlation and detection. Allow listing marks the partner domains as known-good inside Cortex XSIAM, so detections skip them while the indicators stay visible and auditable. Ingestion exclusions delete them from the store, confidence thresholds affect unrelated indicators, and retention changes degrade the whole feed.

Answer

Add the partner domains to the feed's exclusion list so they are dropped at ingestion

Answer

Lower the feed's confidence score threshold so low-confidence indicators are not correlated

Answer

Set the feed to expire indicators after a short retention window so stale entries stop matching

Question 3

Which TWO actions can be performed directly within the Cortex XSIAM Playbook Designer? (Choose two)

Accepted Answer

Configure conditional branches and links between tasks.. Playbook designers allow building visual workflows, configuring task parameters, and linking conditions.

Answer

Write custom XQL queries for data ingestion pipelines.

Answer

Modify global firewall routing tables.

Answer

Install local endpoint security agents.

Question 4

When designing a playbook, you want to assign an incident to a specific Tier 2 analyst group only if the alert severity is marked as 'High'. Which playbook element should you place before the assignment task?

Accepted Answer

Condition Task. A condition task evaluates the incident severity and directs flow accordingly.

Answer

Notification Task

Answer

Data Parsing Task

Answer

Enrichment Task

Question 5

An analyst reviews an analytic alert and notices its severity is classified as 'Medium', but wants to understand which specific sub-techniques triggered the detection. Where should the analyst look within the XSIAM interface?

Accepted Answer

The MITRE ATT&CK section within the Alert Details view.. MITRE ATT&CK tactics and techniques associated with an analytic alert are visible in the alert details and MITRE coverage views.

Answer

Settings > Analytics > MITRE Mapping Table.

Answer

The Incident Graph timeline nodes.

Answer

Dashboards > Threat Intelligence widgets.

Question 6

What is the primary purpose of the Cortex Data Model (CDM) in XSIAM?

Accepted Answer

To normalize disparate log sources into a standardized schema for consistent querying.. The Cortex Data Model normalizes disparate log sources into standardized schemas and fields for uniform querying.

Answer

To encrypt telemetry data before it leaves the endpoint agent.

Answer

To automatically remediate incidents without analyst intervention.

Answer

To compress log storage sizes on disk by removing redundant headers.

Question 7

When configuring a new threat intelligence feed integration in Cortex XSIAM, which TWO configuration parameters are typically required for successful API-based ingestion? (Choose two)

Accepted Answer

API Authentication Key, Token, or Credentials. API-based threat intelligence integrations require endpoint URLs and authentication credentials (such as API keys or tokens) to connect and pull data.

Answer

Endpoint agent installation package version

Answer

Active Directory Domain Controller IP address

Answer

Syslog facility number

Question 8

Which XSIAM construct allows you to package a reusable set of playbook tasks into a modular component that can be invoked by multiple parent playbooks?

Accepted Answer

Sub-playbook. Sub-playbooks provide modular, reusable playbook logic that can be called from main playbooks.

Answer

Integration Instance

Answer

Custom Layout

Answer

XQL Alert Rule

Question 9

A playbook designer needs to reference a specific value extracted from a previous task's output within Cortex XSIAM. Which syntax must be used to access this context data?

Accepted Answer

${Path.To.Data}. Context data in Cortex XSIAM playbooks is referenced using the ${Path.To.Data} syntax to dynamically pull information from previous task outputs.

Answer

#{Path.To.Data}

Answer

Answer

[[Path.To.Data]]

Question 10

An analyst needs to create a custom analytic rule in XSIAM using XQL (XSIAM Query Language) to detect unusual PowerShell activity. Which section of the XSIAM platform should the analyst navigate to build and test this rule?

Accepted Answer

Analytics > Detection Rules > Add Rule > XQL Rule. Custom analytics rules based on XQL are created and managed within the Analytics rule builder under the Detection rules section.

Answer

Settings > Automation > Playbooks > New Rule

Answer

Frames > Dashboards > Query Builder

Answer

Investigation > XQL Search > Save as Incident