5.2 Explain Cortex XSIAM Processes, Capabilities, Use Cases, and Rules SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC is experiencing a high volume of alerts from a BIOC rule that detects unusual PowerShell usage. Many alerts are false positives because administrators frequently use PowerShell for legitimate tasks. The SOC wants to reduce the noise while still detecting malicious PowerShell activity. What is the most effective way to tune the BIOC rule?

   • ARefine the BIOC rule to require additional context, such as the execution of specific commands or correlation with network connections.
   • BCreate a separate BIOC rule for each administrator to establish individual baselines.
   • CDisable the BIOC rule and rely on IOC-based detection.
   • DIncrease the severity of the BIOC rule so that only high-severity alerts are investigated.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of data normalization in Cortex XSIAM's data ingestion pipeline?

   • ATo encrypt data in transit to ensure confidentiality
   • BTo filter out low-priority logs before they are stored
   • CTo compress ingested data to reduce storage costs
   • DTo convert all incoming data into a common schema so that it can be queried and correlated consistently across sources
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is integrating a new cloud access security broker (CASB) with Cortex XSIAM. The CASB provides logs about cloud application usage and security events. The security team wants to use these logs to detect shadow IT and correlate with existing endpoint alerts. What is the first step to make the CASB logs usable in XSIAM?

   • AManually upload the CASB logs as evidence files to relevant incidents.
   • BCreate a BIOC rule that detects shadow IT based on the CASB logs.
   • CConfigure the CASB as a data source and ensure its logs are normalized to the XSIAM schema.
   • DUse the XSIAM API to query the CASB directly for logs on demand.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does Cortex XSIAM use IOCs in threat detection?

   • ABy replacing the need for behavioral analytics
   • BBy generating new IOCs automatically from every alert
   • CBy matching incoming data against known IOC lists to trigger alerts
   • DBy encrypting all data to prevent compromise
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is configuring Cortex XSIAM to detect a known malware campaign that uses a specific command-and-control (C2) domain. The analyst wants to ensure that any endpoint communicating with this domain is flagged and that the investigation is enriched with threat intelligence. What should the analyst do?

   • ACreate a BIOC rule that detects any new domain communication.
   • BUse the threat hunting query builder to search for the domain in historical logs.
   • CAdd the C2 domain as an IOC and create a rule that triggers an alert when the IOC is observed.
   • DConfigure a playbook that blocks all traffic to the domain.
   Reveal Solution Discussion Select an answer first