5.2 Explain Cortex XSIAM Processes, Capabilities, Use Cases, and Rules SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the role of playbooks in Cortex XSIAM's threat management capabilities?

   • AThey define automated response actions that can be triggered by alerts or incidents
   • BThey are used exclusively for threat hunting, not for response
   • CThey replace the need for any human analyst involvement
   • DThey are static documents that describe manual procedures only
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is using Cortex XSIAM to detect a malware campaign that uses a specific C2 domain. The team has added the domain as an IOC, but they are seeing a high number of false positives because some legitimate applications also communicate with this domain. The team wants to reduce false positives without missing real infections. What is the best approach?

   • ARemove the IOC and rely on behavioral analytics to detect the malware.
   • BCreate a correlation rule that triggers an alert only when the IOC is observed in conjunction with other suspicious behaviors, such as unusual process execution.
   • CKeep the IOC rule as is and manually triage all alerts.
   • DBlock all traffic to the C2 domain to prevent infections.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does Cortex XSIAM leverage behavioral analytics to detect anomalies?

   • ABy establishing a baseline of normal activity and flagging deviations from it
   • BBy scanning for known malware signatures
   • CBy requiring manual review of all logs
   • DBy blocking all traffic from unknown IP addresses
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a typical use of a query in Cortex XSIAM?

   • ATo update the antivirus signatures on endpoints
   • BTo change the retention policy for logs
   • CTo create a new user account
   • DTo identify all events involving a specific IP address within a time range
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A threat hunter is investigating a potential advanced persistent threat (APT) that has been evading detection. The hunter has identified a set of unusual behaviors, but these behaviors are also present in some legitimate activities. The hunter wants to reduce false positives while still detecting the APT. What is the most effective approach?

   • ASearch for known IOCs associated with the APT.
   • BUse a single behavioral indicator that is highly specific to the APT.
   • CCreate a correlation rule that matches the exact sequence of events from the APT.
   • DCreate a BIOC rule that combines multiple behavioral indicators and requires a correlation across data sources.
   Reveal Solution Discussion Select an answer first