XSIAM-Analyst Practice Test

XSIAM-Analyst Practice Test practice questions, page 2 of 3, with answer review and explanations.

Question 6

For a critical incident, Cortex XSIAM suggests several playbooks which should have been executed automatically. Why were the playbooks not executed?

  1. Playbook triggers were not configured for those alerts.
  2. Installation of the appropriate content pack was not completed.
  3. Misconfiguration of the connector instance has occurred.
  4. Playbook classifier was not configured for the alert type.

Question 7

What information is provided in the timeline view of Cortex XSIAM?

  1. Graphic representation of an event Causality Instance (CI) with additional capabilities to enable further analysis
  2. Sequence of events, alerts, rules, and other actions involved over the lifespan of an incident
  3. Tab within an incident where analysts can collaborate and initiate further actions and automations
  4. Detailed overview of behavior or activity that triggered an Analytics Alert, Analytics BIOC alert, or correlation rule

Question 8

Which two methods can be used to create and share queries into the Query Library? (Choose two.)

  1. From XQL Search, locate the query to save to a personal Query Library Right-click, and select "Save query to library" Enable the "Share with others" option
  2. From the Query Center, in the XQL query field, define the parameters of the query Save as, and choose the "Query to Library" option Enable the "Share with others" option
  3. From XQL Search, in the XQL query field, define the parameters of the query Save as, and choose the "Query to Library" option Enable the "Share with others" option
  4. From the Query Center, locate the query to save to a personal Query Library Right-click, and select "Save query to library" Enable the "Share with others" option

Question 9

Which type of task can be used to create a decision tree in a playbook?

  1. Sub-playbook
  2. Job
  3. Standard
  4. Conditional

Question 10

A Cortex XSIAM analyst is investigating a security incident involving a workstation after having deployed a Cortex XDR agent for 45 days. The incident details include the Cortex XDR Analytics Alert "Uncommon remote scheduled task creation." Which response will mitigate the threat?

  1. Revoke user access and conduct a user audit.
  2. Allow list the processes to reduce alert noise.
  3. Initiate the endpoint isolate action to contain the threat.
  4. Prioritize blocking the source IP address to prevent further login attempts.