3.2 Develop Plans to Integrate Existing Detection Rules and Automation Use Cases from Legacy SIEM to Cortex XSIAM SECURITY-OPERATIONS-ARCHITECT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A team has migrated a critical detection rule and its associated automation playbook from a legacy SIEM to Cortex XSIAM. Before declaring the migration complete, the team must validate that the rule and playbook work correctly. What is the most effective validation strategy?

   • AReview the rule's syntax and the playbook's code to ensure they are error-free.
   • BAsk the original rule author to confirm the migration is accurate.
   • CCompare the raw log counts ingested by XSIAM with the counts from the legacy SIEM for the same period.
   • DReplay historical data from the legacy SIEM into XSIAM and verify that the rule triggers and the playbook executes as expected.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team is planning a phased migration from a legacy SIEM to Cortex XSIAM. The team has limited resources and must prioritize its efforts. They have identified the following items: (1) a high-risk rule that depends on a log source that is not yet integrated into XSIAM, (2) a medium-risk rule that is fully self-contained and ready to migrate, and (3) a low-risk automation playbook that requires a new integration to be built. The team's goal is to reduce overall security risk as quickly as possible. What should the team do first?

   • AMigrate the medium-risk rule first because it is ready to go and will provide a quick win.
   • BMigrate all three items simultaneously to maximize the amount of work completed.
   • CBuild the new integration for the low-risk automation playbook first because it is a foundational capability.
   • DIntegrate the missing log source for the high-risk rule, then migrate and validate that rule.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A legacy SIEM rule uses a statistical baseline to flag unusual user behavior. Which Cortex XSIAM detection mechanism is best suited to replicate this type of detection?

   • AA log forwarding policy
   • BA custom rule with a fixed threshold
   • CA correlation rule
   • DA machine learning model
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In a phased integration plan for migrating detection rules to Cortex XSIAM, which factor should be given the highest priority when deciding which rules to migrate first?

   • ARules that have been in place the longest
   • BRules that address the highest risk and have the greatest security impact
   • CRules that generate the most alerts
   • DRules that are easiest to migrate
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following is an effective method for testing a migrated detection rule in Cortex XSIAM?

   • AReplaying historical log data that triggered the rule in the legacy SIEM
   • BReviewing the rule's documentation
   • CComparing the rule's syntax to the legacy rule's syntax
   • DAsking the SOC team if they think the rule is correct
   Reveal Solution Discussion Select an answer first