XSIAM-Analyst practice questions 1–10

1. Question 1 · 22 in bank

   Which dataset should an analyst search when looking for Palo Alto Networks NGFW logs?

   • Adataset = pan_dss_raw
   • Bdataset = ngfw_threat_panw_raw
   • Cdataset = panw_ngfw_traffic_raw
   • Ddataset = ngfw*

   Show answer

   Answer: C

   Next question

2. Question 2 · 22 in bank

   An analyst conducting a threat hunt needs to collect multiple files from various endpoints. The analyst begins the file retrieval process by using the Action Center, but upon review of the retrieved files, notices that the list is incomplete and missing files, including kernel files. What could be the reason for this issue?

   • AThe file retrieval policy applied to the endpoints may restrict access to certain system or kernel files.
   • BThe retrieval process is limited to 500 MB in total file size.
   • CThe endpoint agents were in offline mode during the file retrieval process, causing some files to be skipped.
   • DThe analyst must manually retrieve kernel files by accessing the machine directly.

   Show answer

   Answer: A

   Next question

3. Question 3 · 22 in bank

   For a critical incident, Cortex XSIAM suggests several playbooks which should have been executed automatically. Why were the playbooks not executed?

   • APlaybook triggers were not configured for those alerts.
   • BInstallation of the appropriate content pack was not completed.
   • CMisconfiguration of the connector instance has occurred.
   • DPlaybook classifier was not configured for the alert type.

   Show answer

   Answer: A

   Next question

4. Question 4 · 22 in bank

   Select 2

   Which two methods can be used to create and share queries into the Query Library? (Choose two.)

   • AFrom XQL Search, locate the query to save to a personal Query Library Right-click, and select "Save query to library" Enable the "Share with others" option
   • BFrom the Query Center, in the XQL query field, define the parameters of the query Save as, and choose the "Query to Library" option Enable the "Share with others" option
   • CFrom XQL Search, in the XQL query field, define the parameters of the query Save as, and choose the "Query to Library" option Enable the "Share with others" option
   • DFrom the Query Center, locate the query to save to a personal Query Library Right-click, and select "Save query to library" Enable the "Share with others" option

   Show answer

   Answer: BC

   Next question

5. Question 5 · 22 in bank

   Which Cytool command will re-enable protection on an endpoint that has Cortex XDR agent protection paused?

   • Acytool security enable
   • Bcytool service start
   • Ccytool runtime start
   • Dcytool protect enable

   Show answer

   Answer: C

   Next question

6. Question 6 · 22 in bank

   Select 2

   Based on the image below, which two determinations can be made from the causality chain? (Choose two.)

   

   • AThree alerts in total were generated by the agent on the endpoint.
   • BCortex XDR agent malware profile module applied is set to "Report" mode.
   • CMalware.pdf.exe is responsible for the entire chain of execution resulting in the alerts.
   • DThe process cmd.exe is responsible for the entire chain of execution resulting in the alerts.

   Show answer

   Answer: AC

   Next question

7. Question 7 · 22 in bank

   How can a SOC analyst highlight alerts generated on C-level executive hosts?

   • AAdd the C-level executive users to the Executive Accounts asset role.
   • BAdd a tag to the C-level executive users.
   • CCreate a Featured Alert field for the C-level hosts.
   • DCreate a dynamic group for the C-level hosts.

   Show answer

   Answer: C

   Next question

8. Question 8 · 22 in bank

   An incident in Cortex XSIAM contains the following series of alerts: 10:24:17 AM - Informational Severity - XDR Analytics BIOC - Rare process execution in organization 10:24:18 AM - Low Severity - XDR BIOC - Suspicious AMSI DLL load location 10:24:20 AM - Medium Severity - XDR Agent - WildFire Malware 11:57:04 AM - High Severity - Correlation - Suspicious admin account creation Which alert was responsible for the creation of the incident?

   • ARare process execution in organization
   • BSuspicious admin account creation
   • CWildFire Malware
   • DSuspicious AMSI DLL load location

   Show answer

   Answer: A

   Next question

9. Question 9 · 22 in bank

   Which attribution evidence will have the lowest confidence level when evaluating assets to determine if they belong to an organization's attack surface?

   • AAn asset attributed to the organization because the Subject Organization field contains the company name
   • BAn asset attributed to the organization because the name server domain contains the company domain
   • CAn asset discovered through registration information attributed to the organization
   • DAn asset manually approved by a Cortex Xpanse analyst

   Show answer

   Answer: A

   Next question

10. Question 10 · 22 in bank

    A security analyst is reviewing alerts and incidents associated with internal vulnerability scanning performed by the security operations team. Which built-in incident domain will be assigned to these alerts and incidents in Cortex XSIAM?

    • ASecurity
    • BHunting
    • CIT
    • DHealth

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

XSIAM-Analyst practice, question 1. 22 questions available.