Free XSIAM-ANALYST sample questions

Correct answer: preset = xdr_network_story | filter domain_is_nrd = true and event_timestamp >= 1d_ago | stats dc(action_net_flow_domain) as nrd_count by agent_hostname | filter nrd_count > 10

This query correctly uses the `preset = xdr_network_story` which is an efficient way to query network events from endpoints. It filters for NRDs (`domain_is_nrd = true`) within the last day (`event_timestamp >= 1d_ago`). The `stats dc(...) as ... by ...` command correctly calculates the distinct count of domains and groups the results by the endpoint's hostname. Finally, the `filter nrd_count > 10` correctly filters for the required threshold. The other options use incorrect syntax, fields, or datasets.

Correct answers: The reliability score assigned to the third-party feed during its configuration.; Manual verdict overrides previously set by an analyst for that specific hash.

Correct answer: False

This statement is false. When an endpoint is isolated, it is prevented from communicating with other devices on the network to contain a potential threat. However, it critically maintains its connection to the Cortex XDR management service. This allows analysts to continue managing the endpoint, such as running a malware scan, retrieving files, or using the Live Terminal to investigate and remediate the issue before removing the isolation.

Correct answer: Create an exception for the specific BIOC rule that suppresses the alert if the parent process command line contains the name of the specific finance spreadsheet.

The most precise and secure way to tune this alert is to create a targeted exception. By creating an exception for this specific BIOC rule based on the parent process (Word) command line arguments (which would include the document name), the analyst can suppress alerts only for this legitimate activity. This allows the rule to remain active and detect potentially malicious behavior from other Office documents or users, maintaining security posture while reducing noise.

Correct answer: `stats`

The `stats` command is the primary aggregation function in XQL used for statistical calculations. To find the MTTR, the analyst would first need to calculate the duration of each incident (`resolve_timestamp - creation_timestamp`) and then use `stats avg(duration) by tags` to get the average (mean) resolution time, grouped by the tags which include the shift information. `summarize` is not a valid XQL command, and while `filter` and `alter` might be used in the query, `stats` is the core function for performing the calculation.

Correct answer: The terminal output is automatically saved to the incident timeline after the session is closed.

XSIAM is designed to streamline evidence collection. When an analyst uses the Live Terminal as part of an incident investigation, the entire session, including all commands run and their outputs, is automatically recorded. Once the session is terminated, this transcript is added to the incident's timeline as an evidentiary artifact, ensuring a complete and auditable record of investigative actions.

Correct answer: To continuously monitor the organization's external assets and generate an alert or incident when a matching server is discovered.

Attack Surface Management (ASM) rules in XSIAM are designed for discovery and alerting. Their primary function is to analyze the data collected about an organization's external assets and identify systems that match specific criteria, such as running a vulnerable software version. When a match is found, the rule triggers a notification, alert, or incident, bringing the high-risk exposure to the attention of the security team for remediation. It does not perform active response actions like patching or isolation itself.

Correct answer: The task's error handling and retry settings.

XSIAM playbook tasks have built-in settings specifically for error handling. This includes options to define retry logic, such as the number of retry attempts and the interval between them. By configuring these settings on the specific task that is failing, the developer can build resilience into the playbook, allowing it to automatically recover from transient errors like API rate limiting without manual intervention.

Correct answer: Alert grouping combines alerts into an incident after they have been generated, while data stitching combines raw logs into a single event record before any alert is created.

This is the core distinction. Data stitching is a pre-processing step where XSIAM combines related raw logs from different sources (e.g., firewall, proxy, endpoint) into a single, enriched event record. This happens before analytics are run. Alert grouping, on the other hand, is a post-processing step that takes multiple, discrete alerts that have already been generated and groups them into a single incident based on common entities like user, host, or IP address.

Correct answer: The process on the source endpoint that initiated the token request.

While time and location are useful context, the initiating process is the most critical piece of evidence. If the request was initiated by a legitimate, known administrative tool (e.g., Azure CLI, a sanctioned PowerShell script) as part of a standard process, it might be a false positive. However, if the request was initiated by an unrecognized process, a user-downloaded executable, or a process running from an unusual directory, it is a strong indicator of a true positive attack, such as credential theft and privilege escalation.