Certified XSIAM Analyst (XSIAM-Analyst) (XSIAM-Analyst) — Questions 76–150

During a routine audit, an analyst notices that several endpoints have an agent status of 'Unmanaged' or 'Disconnected' for over 30 days. What is the standard behavior of XSIAM regarding endpoints that remain disconnected for extended periods?

An analyst wants to suppress a specific threat intelligence indicator that has been identified as a false positive across all correlation rules in XSIAM. What is the correct procedure?

When an analytic alert triggers in XSIAM, what role does confidence play in alert prioritization?

An administrator needs to verify whether disk encryption (BitLocker / FileVault) is active and reporting status correctly across managed endpoints in XSIAM. Where can this compliance status be monitored?

When configuring an automated playbook to trigger based on specific incident severity changes, where is the primary association between the incident type and the playbook configured in XSIAM?

Which TWO protocols or formats are natively supported for importing threat intelligence feeds into Cortex XSIAM? (Choose two)

What is the purpose of tagging threat intelligence indicators in XSIAM?

An administrator needs to ensure that custom threat intelligence indicators ingested via a CSV file maintain a specific custom severity rating of 'Critical' regardless of external provider scores. How should this be configured in XSIAM?

An administrator is setting up Attack Surface Management (ASM) discovery scopes in XSIAM. Which THREE types of seed assets can be provided to initiate external discovery? (Choose three)

An analyst needs to filter out noise by excluding events where the username starts with 'svc_'. Which XQL operator or function should be used?

An incident responder is investigating a ransomware outbreak. Which THREE immediate containment or remediation actions can be executed directly from XSIAM to mitigate the threat? (Choose three)

Which type of analytic alert in XSIAM focuses specifically on identifying unauthorized or anomalous credential usage?

An analyst is investigating an ASM finding regarding an exposed service on an external asset. Which THREE details are typically provided within the ASM finding record in XSIAM? (Choose three)

A security analyst is reviewing endpoint telemetry and needs to find all execution events where a command shell (cmd.exe or powershell.exe) was spawned by a web server process (such as w3wp.exe). Which XSIAM tool is best suited for constructing and running this forensic query across historical endpoint data?

Which THREE features are provided by the XQL search query interface in XSIAM to assist analysts during query authoring? (Choose three)

An XSIAM Analyst is investigating an analytic alert that has an unusually high priority score. The analyst wants to audit how the final score was calculated, specifically looking at the base score versus modifier weights. Where can the analyst inspect the score breakdown for an alert?

An administrator is designing a data ingestion pipeline in XSIAM. Which THREE data source categories can be ingested and normalized into XSIAM for security analytics? (Choose three)

Which TWO methods can an analyst use to investigate matches between internal network telemetry and threat intelligence indicators in XSIAM? (Choose two)

An analyst writes an XQL query combining two different datasets using an inner join based on a matching hostname. Which syntax structure is correct?

An ASM discovery run identifies a rogue cloud storage bucket publicly exposed to the internet. How does XSIAM's ASM module typically discover this asset without requiring internal cloud credentials?

An analyst is troubleshooting a correlation rule that is failing to trigger incidents despite matching raw logs. Where can the analyst test and debug the rule logic against historical or sample log data in XSIAM?

An analyst is investigating how XSIAM processes incoming analytic alerts and determines their initial lifecycle state. Which THREE characteristics or actions are associated with analytic alerts upon generation? (Choose three)

An analyst observes that a specific endpoint has stopped generating endpoint telemetry events (such as process execution and file creation logs) into XSIAM, although the endpoint is powered on and connected to the corporate network. Upon checking the agent, the service is running. Which troubleshooting step should the analyst perform next to diagnose endpoint event streaming issues?

Where in the XSIAM user interface should an analyst navigate to review discovered external assets, shadow IT, and exposed services identified by Attack Surface Management?

An analyst is performing forensics on a suspicious process execution in XSIAM. Which THREE artifacts or views are typically available in the Causality Analysis of an alert? (Choose three)

An organization deploys Cortex XDR agents to Linux servers. Certain critical database files residing on custom mount points are experiencing I/O latency due to agent monitoring. How should the administrator configure file integrity monitoring (FIM) or malware scan paths to exclude these specific mount points on Linux endpoints?

An administrator is configuring password protection for the Cortex XDR agent on endpoints to prevent unauthorized users or malware from stopping the agent service or modifying its configuration locally. Where is this agent uninstallation/tamper protection password configured in XSIAM?

Which TWO objects or concepts are fundamental building blocks in a Cortex XSIAM playbook? (Choose two)

An analyst is reviewing endpoint security alerts and needs to filter events by specific threat categories. Which TWO threat categories are commonly associated with Cortex XDR endpoint prevention modules? (Choose two)

Which user role is typically required to create, edit, and publish custom playbooks in Cortex XSIAM?

An administrator is reviewing endpoint agent diagnostic tools available within XSIAM. Which THREE actions can be performed directly from the XSIAM console to troubleshoot or manage an endpoint agent? (Choose three)

Which operator is used in XQL filter statements to check if a field value matches any item in a provided list?

An automation script requires secure storage of an API token used to query an external threat intel feed. Where should this token be stored within Cortex XSIAM?

Where in the Cortex XSIAM web interface can an administrator view the graphical flowchart and execution status of a currently running playbook on an active incident?

An analyst is configuring behavioral threat protection rules and exceptions in XSIAM. Which THREE parameters can typically be used to define a precise exclusion rule for a benign application exhibiting suspicious behavior? (Choose three)

An administrator wants to review all endpoints running an outdated operating system version to plan an upgrade cycle. Which XSIAM feature provides grouped inventory data on operating system distribution?

You are configuring correlation rules in XSIAM to trigger an incident when internal telemetry matches indicators from a high-confidence threat feed. How do you ensure that indicators from low-confidence feeds are filtered out of this specific rule?

An analyst is investigating an incident and needs to isolate an infected endpoint directly from the XSIAM Incident View. Which response action should the analyst execute?

When developing custom Python automation scripts for Cortex XSIAM, which THREE best practices should be followed for maintainability and performance? (Choose three)

Which THREE built-in features are available in Cortex XSIAM to inspect and audit playbook executions? (Choose three)

You are debugging an automation script that interacts with a third-party REST API. The API returns pagination tokens. How can you implement a do-while or iterative paging loop within an XSIAM playbook?

An analyst is optimizing a slow-running XQL query in XSIAM. Which TWO best practices should be implemented to improve query performance? (Choose two)

When an analyst reviews an analytic alert in XSIAM, which THREE pieces of contextual information are typically available to assist in prioritization and triage? (Choose three)

Which TWO methods can be used to test a custom automation script before deploying it in a production playbook? (Choose two)

An administrator needs to deploy the Cortex XDR agent to a large fleet of Windows endpoints via Group Policy. Where can the administrator download the latest signed agent installer package and associated transform file from the XSIAM management console?

An endpoint has been compromised and cleaned, and the analyst wants to restore network connectivity for the host which was previously isolated. How should the analyst lift the network isolation in XSIAM?

What is the primary function of Attack Surface Management (ASM) within Cortex XSIAM?

You notice that an automated playbook is executing multiple duplicate sub-tasks simultaneously because multiple alerts matching the same indicator arrived within seconds. How can you prevent race conditions or duplicate execution?

While reviewing a complex multi-stage attack in XSIAM, an analyst wants to visualize the sequence of process creation events on an endpoint. Which XSIAM feature provides a graphical representation of parent-child process relationships and associated network connections?

An analyst is investigating an incident where an endpoint downloaded a suspicious file. Which TWO XSIAM tools or views can the analyst use to inspect the file's characteristics, hash, and reputation across the tenant? (Choose two)

Which THREE components or views in XSIAM assist analysts in recognizing and understanding analytic alert types and their context? (Choose three)

An analyst needs to share specific indicator of compromise (IOC) details discovered during an incident with an external ISAC. Which mechanism in XSIAM allows exporting or sharing threat indicators?

You need to format a raw JSON timestamp retrieved from an API call into a readable date string before displaying it in an incident layout. Which XSIAM playbook feature accomplishes this without custom Python code?

An analyst notices that an analytic alert is repeatedly firing for legitimate administrative activity (a false positive). Aside from custom prioritization, how can an analyst manage this specific alert instance to aid future investigations?

An enterprise uses Broker VMs to proxy agent traffic from an isolated internal network segment to the XSIAM cloud. Several endpoints have stopped reporting via the Broker VM. Where should the administrator check to verify the health and connectivity between the Broker VM and the internal endpoints?

An analyst needs to extract specific Regex matching patterns from an incoming email body during an automated phishing investigation playbook. Which built-in mechanism should be used?

An organization utilizes custom asset criticality tags in XSIAM. How does XSIAM incorporate asset criticality into the overall incident scoring process?

A security engineer is configuring a new Exploit Prevention profile in XSIAM. The requirement is to ensure that attempts to inject code into legitimate processes (DLL injection) are blocked and logged. Which section of the profile configuration controls memory protection techniques?

An analyst is examining an alert timeline in XSIAM. What does the timestamp on a security event represent?

An analyst wants to create a custom XQL query to investigate security events. Which THREE clauses or functions are valid components of an XQL query structure? (Choose three)

An analyst needs to verify which endpoints have out-of-date Cortex XDR agent versions across the organization. Where should the analyst navigate in XSIAM to view a summary dashboard of agent versions and deployment health?

When analyzing security events in XSIAM, what are THREE key benefits of data normalization? (Choose three)

An automated playbook task fails intermittently due to a temporary network timeout when contacting an external asset management database. What is the most resilient way to handle this inside the playbook configuration?

Which TWO actions can be performed directly within the Cortex XSIAM Playbook Designer? (Choose two)

An administrator is planning a staged rollout of a new Cortex XDR agent version across the enterprise. To mitigate risk, the administrator wants to deploy the new version to a test group of endpoints first. How is this staged deployment managed in XSIAM?

Which THREE factors are dynamically evaluated by XSIAM when calculating the default severity score of an analytic alert? (Choose three)

When designing a playbook, you want to assign an incident to a specific Tier 2 analyst group only if the alert severity is marked as 'High'. Which playbook element should you place before the assignment task?

An analyst reviews an analytic alert and notices its severity is classified as 'Medium', but wants to understand which specific sub-techniques triggered the detection. Where should the analyst look within the XSIAM interface?

A playbook designer needs to reference a specific value extracted from a previous task's output within Cortex XSIAM. Which syntax must be used to access this context data?

When configuring a new threat intelligence feed integration in Cortex XSIAM, which TWO configuration parameters are typically required for successful API-based ingestion? (Choose two)

An analyst is investigating an incident where an attacker attempted to clear Windows Event Logs to hide malicious activity. Which XSIAM behavioral detection category typically flags this suspicious administrative tampering?

When reviewing incident scoring in XSIAM, an analyst observes that multiple low-severity alerts have aggregated into a single high-severity incident. Which component of XSIAM is primarily responsible for grouping and scoring these related alerts into an incident?

An analyst needs to retrieve running process information from a specific active endpoint in real time without waiting for scheduled telemetry uploads. Which XSIAM feature should the analyst use?

When configuring a manual task in a playbook that requires an analyst to approve or reject a host isolation action, which element defines the available response buttons?

An analyst needs to filter the Incident Queue to display only incidents that contain specific high-priority analytic alert types. Which filtering mechanism should the analyst use in the XSIAM Incident view?