3.2 Develop Plans to Integrate Existing Detection Rules and Automation Use Cases from Legacy SIEM to Cortex XSIAM SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is assessing its legacy SIEM automation use cases for migration to Cortex XSIAM. One use case automatically adds a newly discovered internal IP address to a network access control (NAC) system's quarantine list. The team is evaluating whether this use case is applicable in XSIAM. What is the most significant factor in this assessment?

   • AWhether the quarantine action can be performed manually by an analyst as a fallback.
   • BWhether Cortex XSIAM has a supported integration with the NAC system to execute the quarantine action.
   • CWhether the NAC system is on the same network segment as the Cortex XSIAM instance.
   • DWhether the legacy SIEM's automation was triggered by an alert or a scheduled task.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When aligning a legacy SIEM log source with Cortex XSIAM, what is the first step you should take?

   • ACreate a correlation rule to test the data
   • BDisable the legacy SIEM's data collection
   • CDeploy a new log collector
   • DIdentify the log format and map its fields to XSIAM's data model
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A large enterprise is planning a migration from a legacy SIEM to Cortex XSIAM. The team has discovered that the legacy SIEM contains over 500 detection rules, some of which are duplicates or have been disabled for years. The team needs to create an accurate inventory to guide the migration. What is the most effective approach to building this inventory?

   • AExport all rules from the legacy SIEM, then review each rule to identify its logic, data sources, status, and relevance before categorizing them for migration.
   • BInterview the security analysts to ask which rules they remember using in the past year.
   • CMigrate all rules as-is to XSIAM and then disable the ones that generate noise.
   • DOnly inventory rules that are associated with a critical asset or a compliance requirement.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a key piece of metadata that should be captured for each detection rule during a legacy SIEM rule inventory?

   • AThe rule's severity and associated MITRE ATT&CK techniques
   • BThe number of analysts in the SOC
   • CThe IP address of the legacy SIEM server
   • DThe name of the SIEM vendor
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A team has migrated a critical detection rule and its associated playbook to Cortex XSIAM. The rule is designed to trigger on a specific attack pattern. The team has replayed historical data and the rule triggers correctly. However, the playbook fails intermittently when trying to block an IP on the firewall. The team needs to ensure the playbook is reliable. What is the most effective strategy to address this issue?

   • ARemove the firewall block action from the playbook and rely on manual intervention.
   • BReplay the historical data again to see if the playbook fails consistently.
   • CAdd error handling and retry logic to the playbook for the firewall integration step, and test the failure scenario.
   • DIncrease the timeout for the entire playbook to allow more time for the firewall to respond.
   Reveal Solution Discussion Select an answer first