Threat Intelligence Management And ASM practice questions

dataset = asm_assets | filter ti_reliability == "A"

Why it fails: ASM assets represent external infrastructure, not the threat intelligence indicator repository.

dataset = panw_threat_feed | filter grade == "A"

Why it fails: 'panw_threat_feed' is not the standard dataset name for generic threat intelligence in XSIAM.

dataset = xdr_data | lookup threat_intel on indicator | filter score == "High"

Why it fails: The lookup syntax and field names do not match standard XSIAM threat intelligence data schema.

Edit the global indicator whitelist to elevate matching items to Critical

Why it fails: Whitelists are used to exclude or suppress indicators, not elevate severity.

Manually update each indicator via the incident management console after ingestion

Why it fails: Manual updating is inefficient and does not scale for automated CSV feed ingestion.

Create an XQL alert rule that rewrites the indicator severity field upon ingestion

Why it fails: XQL alert rules run on events, not directly on the threat intelligence indicator database table during feed normalization.

In the XQL Search query parameters using the 'expiration' modifier

Why it fails: Expiration parameters are handled at the threat intelligence module configuration level, not in XQL search queries.

Inside the incident correlation rule builder

Why it fails: Correlation rules handle incident grouping, not indicator lifecycle management.

By modifying the local collector agent configuration file on endpoints

Why it fails: Indicator expiration is managed centrally on the XSIAM platform, not via endpoint collector agents.

cmd.ping.ip

Why it fails: Ping is a basic network utility, not an intelligence reputation command.

xql.query.execute

Why it fails: While XQL can search data, dedicated indicator lookup commands are standard for enrichment playbooks.

asm.asset.scan

Why it fails: ASM scan commands trigger external attack surface discovery, not IP reputation lookup.

Active Directory group membership list

Why it fails: Directory memberships are identity attributes, not threat intelligence indicator attributes.

Local workstation physical disk serial number

Why it fails: Hardware serial numbers belong to endpoint asset inventory, not threat intelligence.

Manual trigger on demand

Why it fails: While manual sync is available, it is an on-demand action rather than a synchronization interval schedule option in the interval dropdown.

Lunar phase synchronization

Why it fails: Lunar schedules do not exist in enterprise security platforms.

Quarantined by Endpoint Agent

Why it fails: Endpoint quarantine is an EDR status, not an ASM asset state.

Archived in Syslog Archive

Why it fails: Syslog archiving is a log management function, not an ASM asset status.

Create a custom dashboard widget that queries all threat intelligence feeds and displays the results for the IP addresses.

Why it fails: While dashboards can display aggregated data, creating a custom widget to query all feeds for specific IPs on-the-fly is not a native capability. Dashboards typically show pre-defined metrics or saved queries, not ad-hoc enrichment for individual entities. This approach would require significant custom development and is not a standard action for immediate investigation.

Run the 'threat-intel-enrich' command from the CLI with the IP address as an argument to retrieve a combined report.

Why it fails: Cortex XSIAM does not have a CLI command named 'threat-intel-enrich'. While XSIAM offers CLI commands for various tasks, this specific command does not exist. The platform provides enrichment through the UI and playbooks, not via this non-existent CLI command. Therefore, this option is incorrect.

Manually query each feed integration separately using its dedicated integration command and compile the results.

Why it fails: Manually querying each feed is time-consuming and does not provide a consolidated view. It requires the analyst to run multiple commands and correlate data manually, which is inefficient and error-prone. The scenario specifically asks for a single consolidated view, so this approach does not meet the requirement.

The XSIAM correlation engine caches every indicator it has ever seen and ignores expiration for indicators that previously produced a match.

Why it fails: There is no caching mechanism in Cortex XSIAM that permanently pins previously matched indicators regardless of expiration. The correlation engine evaluates current indicator state, and expired indicators stop contributing to new matches. This option invents a behavior that would defeat the purpose of TTLs and would be a serious design flaw, so it is not a valid explanation for indicators persisting beyond their window.

The indicators were ingested as a custom indicator type that bypasses the feed's TTL expiration logic.

Why it fails: Custom indicator types in Cortex XSIAM still respect the expiration/TTL settings applied at ingestion; creating a custom type changes the schema and enrichment behavior, not the lifecycle expiration. The scenario states the feed integration is healthy and unmodified, so an unsupported custom type would not silently override the configured expiration window. This distractor confuses indicator classification with lifecycle management, which are handled by separate configuration paths in the feed integration.

Expired indicators are never removed from the indicator database; they are only hidden from the Indicators page UI while remaining fully active in correlation.

Why it fails: Cortex XSIAM does expire indicators and removes them from active matching when their TTL elapses; expiration is not a UI-only cosmetic filter. The Indicators page reflects the same lifecycle state used by correlation and search. Claiming expiration is purely visual contradicts how the indicator store is designed and would make TTL configuration meaningless, so this cannot explain the observed matches against endpoint telemetry.

Recreate the discovery scope using a broader CIDR to force rediscovery of the asset.

Why it fails: The IP is already within the scope and other assets in the same range were discovered, so scope breadth is not the limiting factor. Broadening the CIDR would rescan already-covered space without addressing why this specific asset was skipped, wasting scan resources and time.

Check whether the asset's IP is listed in the ASM exclusion list for the organization.

Why it fails: Exclusion lists are a possibility, but the scenario states the IP range is included in a discovery scope and other assets in the range appear, making a targeted exclusion less likely than port filtering. Exclusion would typically affect the whole range or documented entries, and the analyst should first examine scan profile behavior.

Restart the ASM scanner service to clear a stale asset cache.

Why it fails: Restarting the scanner is a disruptive step that does not target the specific symptom of one missing asset among many discovered ones. A stale cache would more likely affect all assets in the range or produce inconsistent results, not a single consistently absent host, so this action is unlikely to resolve the issue.

Whether the ASM module requires an agent installed on each target host before it can be discovered.

Why it fails: Attack Surface Management in Cortex XSIAM discovers external assets without requiring agents on the targets, which is the point of external attack surface visibility. Requiring host agents would defeat the purpose of unauthenticated external discovery and would not match the scenario, where the team simply provided public CIDR blocks. This distractor misrepresents how ASM operates and would send the analyst down an unnecessary deployment path.

Whether the ASM discovery scope is limited to a specific port set that excludes the services running on the missing hosts.

Why it fails: Port restrictions affect which services are probed on discovered hosts, not whether the hosts themselves are enumerated in the scan scope. Missing hosts entirely points to a scope or reachability issue rather than service-level filtering. Verifying port sets would be a reasonable follow-up once hosts are discovered, but it does not explain why a large portion of the expected hosts never appear in results at all, so it is not the first thing to check.

Whether the threat intelligence feeds are enriching the discovered hosts, since unenriched assets are hidden from the ASM inventory by default.

Why it fails: Threat intelligence enrichment adds context such as reputation and associated campaigns, but it does not gate whether an asset appears in the ASM inventory. Assets are inventoried based on discovery results, then enriched afterward. Claiming that unenriched assets are hidden by default inverts the relationship between discovery and enrichment, so it cannot explain why expected hosts are missing from scan results.

Disable the threat intelligence feed integration and re-enable it once the penetration test is complete.

Why it fails: Disabling the feed stops all indicator ingestion, not just the noisy test-range values, so the organization loses coverage for every other indicator the feed provides. The scenario explicitly asks to preserve the data for retrospective hunting and to avoid removing the feed. Re-enabling later also creates a gap in intelligence coverage during the test window, which is unacceptable for an active SOC.

Configure a correlation rule exclusion that matches the penetration-test host names and the feed indicator values together.

Why it fails: A correlation rule exclusion based on host names and indicator values is brittle and indirect. It requires the rule to evaluate both fields and may still fire if the host name changes or the indicator appears in a different field. It also does not address the underlying indicator ingestion, so the noisy indicators remain active and can trigger other detections, dashboards, or reports that the exclusion does not cover.

Add the penetration-test indicator values to an allow list in the Threat Intelligence module so they are not matched by correlation rules.

Why it fails: An allow list in the Threat Intelligence module prevents indicators from being treated as malicious during enrichment and correlation, but it does not stop the feed from continuing to create indicators or incidents. The analyst needs to suppress incident creation while keeping the feed data available for hunting. An allow list also risks hiding genuine malicious activity if the same indicator value later appears outside the test range, so it is broader than the stated goal.

Threat intelligence feeds have disabled automatic asset correlation by default

Why it fails: Threat intelligence feeds enrich existing assets with indicators; they do not govern ASM discovery or correlation of external ranges. It tempts because feeds are integral to XSIAM and their configuration can affect detections, but the missing subsidiary ranges reflect scan scope, not feed-driven correlation settings.

The Log Forwarder agent is not installed on the subsidiary endpoints

Why it fails: Log Forwarder agents collect endpoint telemetry for detection, not external attack surface discovery; ASM scans internet-facing ranges without agents. It tempts because missing subsidiary data often stems from uninstalled forwarders, but that applies to endpoint logs, not external IP inventory.

The ingestion service for ASM requires manual CSV asset mapping before discovery runs

Why it fails: ASM discovers external ranges by scanning them directly, so no manual CSV asset mapping is required; discovery precedes inventory population. It tempts because manual asset import exists for internal or on-premises assets, but newly acquired external IP ranges are found automatically once configured in the scan scope.

Incident Response > ASM Incidents

Why it fails: ASM Incidents only lists incidents generated from ASM findings, so it omits the full inventory of discovered external assets, shadow IT and exposed services. The dedicated ASM asset view is where those discoveries are enumerated; Incident Response would be correct when triaging a specific raised ASM incident.

Dashboards > Threat Intelligence > ASM

Why it fails: Threat Intelligence dashboards surface indicators and actor context, not the asset inventory ASM populates. Reviewing discovered external assets, shadow IT and exposed services requires the Attack Surface Management view itself, where findings are listed per asset; the Threat Intelligence area would be the right place to pivot on an indicator's reputation.

Settings > Integrations > ASM Scanner

Why it fails: Settings > Integrations configures the ASM scanner connection, not the discovered assets themselves. Reviewing external assets, shadow IT and exposed services happens in the ASM findings view; the Integrations page would be the right place to enable, authenticate or troubleshoot the scanner feeding that data.

Create an exception rule in the Endpoint Protection policy

Why it fails: Endpoint Protection policy exceptions apply only to endpoint agent detections, not to XSIAM correlation rules, so the indicator still triggers those rules. It is tempting because endpoint exceptions are the standard way to suppress false positives from endpoint protection scans.

Disable all threat intelligence feeds globally

Why it fails: Disabling threat intelligence feeds globally removes all indicators from every rule, not just the false-positive one, destroying detection coverage. It is tempting as a quick fix when a feed produces noise, but feed-level control is the wrong granularity for a single indicator.

Delete the indicator manually from every active incident

Why it fails: Deleting the indicator from incidents removes evidence but leaves the indicator active in intelligence feeds, so correlation rules keep generating incidents. Manual deletion suits one-off cleanup; suppressing a false positive across all rules requires configuring an exception at the indicator or rule level.

To ingest external threat feeds and correlate them with internal firewall logs

Why it fails: Ingesting threat feeds and correlating them with firewall logs is threat intelligence enrichment and log correlation, which XSIAM performs through its data sources and analytics engine. ASM instead scans for and inventories externally exposed assets and their vulnerabilities. Feed correlation would be correct where the goal is detecting known-bad indicators in network traffic.

To monitor internal workstation performance and CPU usage

Why it fails: Workstation CPU and performance telemetry belongs to endpoint monitoring, not ASM. Cortex XSIAM's ASM discovers and inventories externally exposed internet-facing assets, services and vulnerabilities to map the attack surface. It would be the right tool when the requirement is continuous visibility of an organisation's public-facing footprint, not host resource metrics.

To automate the deployment of security patches on cloud servers

Why it fails: Patch deployment is vulnerability and configuration management remediation, typically handled by patch orchestration tooling, not ASM. Cortex XSIAM's ASM identifies and prioritises externally exposed assets and weaknesses for the analyst to act on. Automated patching would be the right answer where the requirement is closing known software vulnerabilities on managed hosts.

Upload a static CSV file export from the TAXII server on a scheduled basis

Why it fails: A static CSV export is a manual snapshot with no incremental polling, so new indicators published on the TAXII 2.1 server are never collected. Native TAXII integration queries collections and retrieves updates automatically. CSV upload suits one-off bulk imports of indicators that do not change.

Deploy an external syslog collector to forward TAXII feeds to the XSIAM ingestion endpoint

Why it fails: TAXII 2.1 is an HTTP/REST collection-polling protocol, so XSIAM's native TAXII client pulls indicators directly; syslog forwarding cannot parse TAXII JSON or honour its pagination and added/removed semantics. Syslog collection suits sources that only emit line-based events, such as firewalls or proxies.

Configure a custom Script Runner playbook to parse the TAXII JSON payload

Why it fails: A Script Runner playbook executes custom code but does not provide native TAXII 2.1 polling, collection discovery, or indicator parsing; the analyst would hand-build protocol handling. XSIAM's built-in TAXII integration performs this natively. Script Runner suits bespoke enrichment or remediation logic, not standard feed ingestion.

Only network traffic packet captures (PCAP files)

Why it fails: XSIAM's Threat Intelligence module ingests structured indicator feeds such as IP addresses, domains, file hashes and URLs; PCAP files are raw packet data, not indicators, so they are not accepted there. It is tempting because PCAPs are genuinely useful for network forensic analysis elsewhere in the platform.

Only file hashes (SHA256 and MD5)

Why it fails: XSIAM's Threat Intelligence module ingests multiple indicator types — domains, IP addresses, URLs and file hashes — so restricting ingestion to SHA256 and MD5 hashes excludes the network and domain indicators needed for correlation. Hash-only feeds suit static malware triage, not broad IOC matching across endpoint, network and email telemetry.

Only internal Active Directory user account names

Why it fails: Internal Active Directory account names are identity data, not external threat indicators; XSIAM's Threat Intelligence module ingests domains, IPs, URLs and file hashes for IOC matching. Account names would be relevant to identity analytics or UEBA detections, not to threat-intelligence ingestion.

To increase the processing speed of the ingestion engine

Why it fails: Tags add contextual classification to indicators for analyst filtering and prioritisation; they have no effect on ingestion throughput or engine performance. It tempts because faster processing is desirable at scale, but ingestion speed is governed by infrastructure and parsing capacity, not indicator metadata.

To automatically block network traffic without creating alerts

Why it fails: Tagging categorises indicators for triage and correlation; enforcement actions such as blocking are driven by configured policies and response actions, not by the tag itself. It tempts because tags can feed automation, but the tag alone neither blocks traffic nor suppresses alert generation.

To encrypt sensitive indicators stored in the database

Why it fails: Tags are metadata labels applied to indicators for classification, prioritisation and search; they perform no cryptographic function and do not encrypt stored data. Encryption tempts because sensitive intelligence warrants protection, but that is handled by platform-level storage controls, not indicator tagging.

Disable the correlation engine when low-confidence feeds are syncing

Why it fails: Disabling the correlation engine halts all detections, not just low-confidence feed matching, creating blind spots. It is tempting as a blunt way to avoid false positives, but the scenario needs the rule to evaluate only high-confidence feed indicators while other rules continue running normally.

Configure the firewall to drop low-confidence indicators automatically

Why it fails: Firewall rules act on network traffic, not on XSIAM correlation logic, so they cannot filter which feed indicators the rule evaluates. It is tempting because blocking low-confidence indicators sounds protective, but that is enforcement, not correlation scoping; the rule itself must reference only the high-confidence feed.

Delete all low-confidence indicators from the database daily via XQL delete commands

Why it fails: Deleting indicators destroys data other rules and investigations may rely on, and daily XQL deletes do not scope this rule's matching. It is tempting as a cleanup habit, but the requirement is per-rule filtering; the rule should join only the high-confidence feed's indicator dataset.