A Cortex XSIAM analyst is investigating a security incident involving a workstation after having deployed a Cortex XDR agent for 45 days. The incident details include the Cortex XDR Analytics Alert "Uncommon remote scheduled task creation."
Which response will mitigate the threat?
ARevoke user access and conduct a user audit.
BAllow list the processes to reduce alert noise.
CInitiate the endpoint isolate action to contain the threat.
DPrioritize blocking the source IP address to prevent further login attempts.
0
Question 2
Threat Intelligence Management and ASM
0
Question 3
Data Analysis with XQL
0
Question 4
Alerting and Detection Processes
0
Question 5
Data Analysis with XQL
0
That's the end of the Preview
This exam has 60 community-verified practice questions. Create a free account to access all questions, comments, and explanations.
Topics covered:
Alerting and Detection ProcessesIncident Handling and ResponseAutomation and PlaybooksData Analysis with XQLEndpoint Security ManagementThreat Intelligence Management and ASM
A Cortex XSIAM analyst is reading a blog that references an unfamiliar critical zero-day vulnerability. This vulnerability has been weaponized, and there is evidence that it is being exploited by threat actors targeting a customer's industry.
Where can the analyst go within Cortex XSIAM to learn more about this vulnerability and any potential impacts on the customer environment?
AThreat Intel Management --> Sample Analysis
BAttack Surface --> Threat Response Center
CAttack Surface --> Attack Surface Rules
DThreat Intel Management --> Indicator
Which pane in the User Risk View will identify the country from which a user regularly logs in, based on the past few weeks of data?
ALogin Attempts
BACTUAL ACTIVITY
CLatest Authentication Attempts
DCommon Locations
Which interval is the duration of time before an analytics detector can raise an alert?
AActivation period
BDeduplication period
CTraining period
DTest period
Which attributes can be used as featured fields?
ADevice-ID, URL, port, and indicator
BCIDR range, file hash, tags, and log source
CEndpoint-ID, alert source, critical asset, and threat name
DHostnames, user names, IP addresses, and Active Directory
Question 6
Data Analysis with XQL
0
Question 7
Automation and Playbooks
Question 8
Alerting and Detection Processes
Question 9
Endpoint Security Management
Question 10
Incident Handling and Response
Question 11
Endpoint Security Management
Question 12
Automation and Playbooks
Question 13
Alerting and Detection Processes
Question 14
Data Analysis with XQL
Question 15
Threat Intelligence Management and ASM
Question 16
Incident Handling and Response
Question 17
Incident Handling and Response
Question 18
Incident Handling and Response
Question 19
Threat Intelligence Management and ASM
Question 20
Data Analysis with XQL
Question 21
Automation and Playbooks
Question 22
Data Analysis with XQL
Question 23
Threat Intelligence Management and ASM
Question 24
Endpoint Security Management
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ad
Want a break from the ads?
Become a Supporter and enjoy a completely ad-free experience, plus unlock Learn Mode, Exam Mode, AstroTutor AI, and more.
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Ask AstroTutor
0
Which dataset should an analyst search when looking for Palo Alto Networks NGFW logs?
Adataset = pan_dss_raw
Bdataset = ngfw_threat_panw_raw
Cdataset = panw_ngfw_traffic_raw
Ddataset = ngfw*
Which two actions will allow a security analyst to review updated commands from the core pack and interpret the results without altering the incident audit? (Choose two.)
ACreate a playbook with the commands and run it from within the War Room.
BRun the core commands directly by typing them into the playground CLI.
CRun the core commands directly from the Command and Scripts menu inside playground.
DRun the core commands directly from the playground and invite other collaborators.
How can a SOC analyst highlight alerts generated on C-level executive hosts?
AAdd the C-level executive users to the Executive Accounts asset role.
BAdd a tag to the C-level executive users.
CCreate a Featured Alert field for the C-level hosts.
DCreate a dynamic group for the C-level hosts.
An analyst conducting a threat hunt needs to collect multiple files from various endpoints. The analyst begins the file retrieval process by using the Action Center, but upon review of the retrieved files, notices that the list is incomplete and missing files, including kernel files.
What could be the reason for this issue?
AThe file retrieval policy applied to the endpoints may restrict access to certain system or kernel files.
BThe retrieval process is limited to 500 MB in total file size.
CThe endpoint agents were in offline mode during the file retrieval process, causing some files to be skipped.
DThe analyst must manually retrieve kernel files by accessing the machine directly.
What information is provided in the timeline view of Cortex XSIAM?
AGraphic representation of an event Causality Instance (CI) with additional capabilities to enable further analysis
BSequence of events, alerts, rules, and other actions involved over the lifespan of an incident
CTab within an incident where analysts can collaborate and initiate further actions and automations
DDetailed overview of behavior or activity that triggered an Analytics Alert, Analytics BIOC alert, or correlation rule
Which Cytool command will re-enable protection on an endpoint that has Cortex XDR agent protection paused?
Acytool security enable
Bcytool service start
Ccytool runtime start
Dcytool protect enable
For a critical incident, Cortex XSIAM suggests several playbooks which should have been executed automatically.
Why were the playbooks not executed?
APlaybook triggers were not configured for those alerts.
BInstallation of the appropriate content pack was not completed.
CMisconfiguration of the connector instance has occurred.
DPlaybook classifier was not configured for the alert type.
Which two actions can an analyst take to reduce the number of false positive alerts generated by a custom BIOC? (Choose two.)
AImplement a BIOC rule exception.
BImplement a global exception in the prevention profile.
CImplement an alert exclusion rule.
DImplement a shunt in a BIOC bypass rule.
Which query will hunt for only incoming traffic from 99.99.99.99 when all log sources have been mapped to XDM?
In which two locations can mapping be configured for indicators? (Choose two.)
AFeed Integration settings
BIndicator Configuration in Object Setup
CSTIX parser code
DClassification & Mapping tab
A SOC team member implements an incident starring configuration, but incidents created before this configuration were not starred.
What is the cause of this behavior?
AThe analyst must manually star incidents after determining which alerts within the incident were automatically starred.
BStarring configuration is applied to the newly created alerts, and the incident is subsequently starred.
CIt takes 48 hours for the configuration to take effect.
DStarring is applied to alerts after they have been merged into incidents, but incidents are not starred.
An incident in Cortex XSIAM contains the following series of alerts:
10:24:17 AM - Informational Severity - XDR Analytics BIOC - Rare process execution in organization
10:24:18 AM - Low Severity - XDR BIOC - Suspicious AMSI DLL load location
10:24:20 AM - Medium Severity - XDR Agent - WildFire Malware
11:57:04 AM - High Severity - Correlation - Suspicious admin account creation
Which alert was responsible for the creation of the incident?
ARare process execution in organization
BSuspicious admin account creation
CWildFire Malware
DSuspicious AMSI DLL load location
While investigating an alert, an analyst notices that a URL indicator has a related alert from a previous incident. The related alert has the same URL, but it resolved to a different IP address.
Which combination of two actions should the analyst take to resolve this issue? (Choose two.)
AEnrich the IP address indicator associated with the previous alert.
BExpire the URL indicator.
CRemove the relationship between the URL and the older IP address.
DEnrich the URL indicator.
Which attribution evidence will have the lowest confidence level when evaluating assets to determine if they belong to an organization's attack surface?
AAn asset attributed to the organization because the Subject Organization field contains the company name
BAn asset attributed to the organization because the name server domain contains the company domain
CAn asset discovered through registration information attributed to the organization
DAn asset manually approved by a Cortex Xpanse analyst
Which two methods can be used to create and share queries into the Query Library? (Choose two.)
AFrom XQL Search, locate the query to save to a personal Query LibraryRight-click, and select "Save query to library"Enable the "Share with others" option
BFrom the Query Center, in the XQL query field, define the parameters of the querySave as, and choose the "Query to Library" optionEnable the "Share with others" option
CFrom XQL Search, in the XQL query field, define the parameters of the querySave as, and choose the "Query to Library" optionEnable the "Share with others" option
DFrom the Query Center, locate the query to save to a personal Query LibraryRight-click, and select "Save query to library"Enable the "Share with others" option
Which type of task can be used to create a decision tree in a playbook?
ASub-playbook
BJob
CStandard
DConditional
Why would an analyst schedule an XQL query?
ATo auto-resolve a false positive alert
BTo increase accuracy of queries during off-peak load times
CTo trigger endpoint isolation action
DTo retrieve data either at specific intervals or at a specified time
Based on the image below, which two determinations can be made from the causality chain? (Choose two.)
AThree alerts in total were generated by the agent on the endpoint.
BCortex XDR agent malware profile module applied is set to "Report" mode.
CMalware.pdf.exe is responsible for the entire chain of execution resulting in the alerts.
DThe process cmd.exe is responsible for the entire chain of execution resulting in the alerts.
An on-demand malware scan of a Windows workstation using the Cortex XDR agent is successful and detects three malicious files. An analyst attempts further investigation of the files by right-clicking on the scan result, selecting "Additional data," then "View related alerts," but no alerts are reported.
What is the reason for this outcome?
AThe malicious files were false positives and were automatically removed from the scan results.
BThe malware scan action detects malicious files but does not generate alerts for them.
CThe malicious files were true positives and were automatically quarantined from the scan results.
DThe malicious files are currently in an excluded directory in the Malware Profile.