XSIAM Analyst Practice Test — 60 Free Questions Online

Join Us Among the Stars

Sign Up & unlock 100% of Exam Questions

Log in / Sign up

No Strings Attached!

60Practice Questions

3Study Modes

Free

TopicSort

Question 1

Incident Handling and Response

A Cortex XSIAM analyst is investigating a security incident involving a workstation after having deployed a Cortex XDR agent for 45 days. The incident details include the Cortex XDR Analytics Alert "Uncommon remote scheduled task creation."
Which response will mitigate the threat?

A Revoke user access and conduct a user audit.
B Allow list the processes to reduce alert noise.
C Initiate the endpoint isolate action to contain the threat.
D Prioritize blocking the source IP address to prevent further login attempts.

Question 2

Threat Intelligence Management and ASM

Question 3

Data Analysis with XQL

Question 4

Alerting and Detection Processes

Question 5

Data Analysis with XQL

Question 6

Data Analysis with XQL

Question 7

Automation and Playbooks

Question 8

Alerting and Detection Processes

Question 9

Endpoint Security Management

Question 10

Incident Handling and Response

Question 11

Endpoint Security Management

Question 12

Automation and Playbooks

Question 13

Alerting and Detection Processes

Question 14

Data Analysis with XQL

Question 15

Threat Intelligence Management and ASM

Question 16

Incident Handling and Response

Question 17

Incident Handling and Response

Question 18

Incident Handling and Response

Question 19

Threat Intelligence Management and ASM

Question 20

Data Analysis with XQL

Question 21

Automation and Playbooks

Question 22

Data Analysis with XQL

Question 23

Threat Intelligence Management and ASM

Question 24

Endpoint Security Management

That's the end of the Preview

This exam has 60 community-verified practice questions. Create a free account to access all questions, comments, and explanations.

Topics covered:

Alerting and Detection ProcessesIncident Handling and ResponseAutomation and PlaybooksData Analysis with XQLEndpoint Security ManagementThreat Intelligence Management and ASM

Log In / Sign Up

Page 1 of 3 • Questions 1-25 of 60

1 2 3

→

Know a question that should be here? Contribute to this exam

A Cortex XSIAM analyst is reading a blog that references an unfamiliar critical zero-day vulnerability. This vulnerability has been weaponized, and there is evidence that it is being exploited by threat actors targeting a customer's industry.
Where can the analyst go within Cortex XSIAM to learn more about this vulnerability and any potential impacts on the customer environment?

A Threat Intel Management --> Sample Analysis
B Attack Surface --> Threat Response Center
C Attack Surface --> Attack Surface Rules
D Threat Intel Management --> Indicator

Which pane in the User Risk View will identify the country from which a user regularly logs in, based on the past few weeks of data?

A Login Attempts
B ACTUAL ACTIVITY
C Latest Authentication Attempts
D Common Locations

Which interval is the duration of time before an analytics detector can raise an alert?

A Activation period
B Deduplication period
C Training period
D Test period

Which attributes can be used as featured fields?

A Device-ID, URL, port, and indicator
B CIDR range, file hash, tags, and log source
C Endpoint-ID, alert source, critical asset, and threat name
D Hostnames, user names, IP addresses, and Active Directory

Question 6

Data Analysis with XQL

Question 7

Automation and Playbooks

Question 8

Alerting and Detection Processes

Question 9

Endpoint Security Management

Question 10

Incident Handling and Response

Question 11

Endpoint Security Management

Question 12

Automation and Playbooks

Question 13

Alerting and Detection Processes

Question 14

Data Analysis with XQL

Question 15

Threat Intelligence Management and ASM

Question 16

Incident Handling and Response

Question 17

Incident Handling and Response

Question 18

Incident Handling and Response

Question 19

Threat Intelligence Management and ASM

Question 20

Data Analysis with XQL

Question 21

Automation and Playbooks

Question 22

Data Analysis with XQL

Question 23

Threat Intelligence Management and ASM

Question 24

Endpoint Security Management

Which dataset should an analyst search when looking for Palo Alto Networks NGFW logs?

A dataset = pan_dss_raw
B dataset = ngfw_threat_panw_raw
C dataset = panw_ngfw_traffic_raw
D dataset = ngfw*

Which two actions will allow a security analyst to review updated commands from the core pack and interpret the results without altering the incident audit? (Choose two.)

A Create a playbook with the commands and run it from within the War Room.
B Run the core commands directly by typing them into the playground CLI.
C Run the core commands directly from the Command and Scripts menu inside playground.
D Run the core commands directly from the playground and invite other collaborators.

How can a SOC analyst highlight alerts generated on C-level executive hosts?

A Add the C-level executive users to the Executive Accounts asset role.
B Add a tag to the C-level executive users.
C Create a Featured Alert field for the C-level hosts.
D Create a dynamic group for the C-level hosts.

An analyst conducting a threat hunt needs to collect multiple files from various endpoints. The analyst begins the file retrieval process by using the Action Center, but upon review of the retrieved files, notices that the list is incomplete and missing files, including kernel files.
What could be the reason for this issue?

A The file retrieval policy applied to the endpoints may restrict access to certain system or kernel files.
B The retrieval process is limited to 500 MB in total file size.
C The endpoint agents were in offline mode during the file retrieval process, causing some files to be skipped.
D The analyst must manually retrieve kernel files by accessing the machine directly.

What information is provided in the timeline view of Cortex XSIAM?

A Graphic representation of an event Causality Instance (CI) with additional capabilities to enable further analysis
B Sequence of events, alerts, rules, and other actions involved over the lifespan of an incident
C Tab within an incident where analysts can collaborate and initiate further actions and automations
D Detailed overview of behavior or activity that triggered an Analytics Alert, Analytics BIOC alert, or correlation rule

Which Cytool command will re-enable protection on an endpoint that has Cortex XDR agent protection paused?

A cytool security enable
B cytool service start
C cytool runtime start
D cytool protect enable

For a critical incident, Cortex XSIAM suggests several playbooks which should have been executed automatically.
Why were the playbooks not executed?

A Playbook triggers were not configured for those alerts.
B Installation of the appropriate content pack was not completed.
C Misconfiguration of the connector instance has occurred.
D Playbook classifier was not configured for the alert type.

Which two actions can an analyst take to reduce the number of false positive alerts generated by a custom BIOC? (Choose two.)

A Implement a BIOC rule exception.
B Implement a global exception in the prevention profile.
C Implement an alert exclusion rule.
D Implement a shunt in a BIOC bypass rule.

Which query will hunt for only incoming traffic from 99.99.99.99 when all log sources have been mapped to XDM?

A datamodel dataset = * | fields fieldset.xdm_network | filter xdm.source.ipv4 = "99.99.99.99"
B datamodel dataset = * | filter XDM.ALIAS.ipv4 = "99.99.99.99"
C preset = network_story | filter agent_ip_addresses = "99.99.99.99"
D datamodel preset = * | filter XDM.ALIAS.ip = "99.99.99.99"

In which two locations can mapping be configured for indicators? (Choose two.)

A Feed Integration settings
B Indicator Configuration in Object Setup
C STIX parser code
D Classification & Mapping tab

A SOC team member implements an incident starring configuration, but incidents created before this configuration were not starred.
What is the cause of this behavior?

A The analyst must manually star incidents after determining which alerts within the incident were automatically starred.
B Starring configuration is applied to the newly created alerts, and the incident is subsequently starred.
C It takes 48 hours for the configuration to take effect.
D Starring is applied to alerts after they have been merged into incidents, but incidents are not starred.

An incident in Cortex XSIAM contains the following series of alerts:
10:24:17 AM - Informational Severity - XDR Analytics BIOC - Rare process execution in organization
10:24:18 AM - Low Severity - XDR BIOC - Suspicious AMSI DLL load location
10:24:20 AM - Medium Severity - XDR Agent - WildFire Malware
11:57:04 AM - High Severity - Correlation - Suspicious admin account creation
Which alert was responsible for the creation of the incident?

A Rare process execution in organization
B Suspicious admin account creation
C WildFire Malware
D Suspicious AMSI DLL load location

While investigating an alert, an analyst notices that a URL indicator has a related alert from a previous incident. The related alert has the same URL, but it resolved to a different IP address.
Which combination of two actions should the analyst take to resolve this issue? (Choose two.)

A Enrich the IP address indicator associated with the previous alert.
B Expire the URL indicator.
C Remove the relationship between the URL and the older IP address.
D Enrich the URL indicator.

Which attribution evidence will have the lowest confidence level when evaluating assets to determine if they belong to an organization's attack surface?

A An asset attributed to the organization because the Subject Organization field contains the company name
B An asset attributed to the organization because the name server domain contains the company domain
C An asset discovered through registration information attributed to the organization
D An asset manually approved by a Cortex Xpanse analyst

Which two methods can be used to create and share queries into the Query Library? (Choose two.)

A From XQL Search, locate the query to save to a personal Query LibraryRight-click, and select "Save query to library"Enable the "Share with others" option
B From the Query Center, in the XQL query field, define the parameters of the querySave as, and choose the "Query to Library" optionEnable the "Share with others" option
C From XQL Search, in the XQL query field, define the parameters of the querySave as, and choose the "Query to Library" optionEnable the "Share with others" option
D From the Query Center, locate the query to save to a personal Query LibraryRight-click, and select "Save query to library"Enable the "Share with others" option

Which type of task can be used to create a decision tree in a playbook?

A Sub-playbook
B Job
C Standard
D Conditional

Why would an analyst schedule an XQL query?

A To auto-resolve a false positive alert
B To increase accuracy of queries during off-peak load times
C To trigger endpoint isolation action
D To retrieve data either at specific intervals or at a specified time

Based on the image below, which two determinations can be made from the causality chain? (Choose two.)

Question Image

A Three alerts in total were generated by the agent on the endpoint.
B Cortex XDR agent malware profile module applied is set to "Report" mode.
C Malware.pdf.exe is responsible for the entire chain of execution resulting in the alerts.
D The process cmd.exe is responsible for the entire chain of execution resulting in the alerts.

An on-demand malware scan of a Windows workstation using the Cortex XDR agent is successful and detects three malicious files. An analyst attempts further investigation of the files by right-clicking on the scan result, selecting "Additional data," then "View related alerts," but no alerts are reported.
What is the reason for this outcome?

A The malicious files were false positives and were automatically removed from the scan results.
B The malware scan action detects malicious files but does not generate alerts for them.
C The malicious files were true positives and were automatically quarantined from the scan results.
D The malicious files are currently in an excluded directory in the Malware Profile.

Join Us Among the Stars

XSIAM AnalystPreview

About the XSIAM Analyst Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

That's the end of the Preview

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24