5.2 Explain Cortex XSIAM Processes, Capabilities, Use Cases, and Rules SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is considered a key artifact used in Cortex XSIAM investigations?

   • AEntities such as IP addresses, hashes, and usernames
   • BThe name of the security analyst
   • CThe physical location of the data center
   • DThe version number of the XSIAM software
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst at a financial firm needs to investigate a potential data exfiltration incident. The firm uses Cortex XSIAM and has enabled the built-in XDR data sources, but also needs to ingest custom application logs from an on-premises legacy system that generates logs in a proprietary format. The analyst wants to ensure these logs are searchable and can be correlated with existing XDR alerts. What should the analyst do first?

   • AUpload the logs as static evidence files to the incident.
   • BUse the XSIAM query builder to search for the logs directly from the legacy system.
   • CCreate a custom parser and ingestion rule for the proprietary log format.
   • DEnable the built-in XDR data source for the legacy system.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is a common method Cortex XSIAM uses to ingest data from third-party security tools?

   • ADirect database replication from the vendor's internal storage
   • BManual CSV uploads for every event
   • CAPI-based collectors and log forwarding
   • DScreen scraping of the third-party's web console
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In Cortex XSIAM, what is the relationship between an alert and an incident?

   • AIncidents are generated only from manual user reports, not from alerts
   • BAn incident is a collection of one or more related alerts that together represent a security event
   • CAlerts and incidents are interchangeable terms for the same entity
   • DAn alert is a collection of incidents that share the same indicator
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security operations team is configuring Cortex XSIAM to automatically respond to phishing alerts. They want to automatically quarantine the affected endpoint and block the sender's email address, but only after confirming the alert is not a false positive. Which approach should they use?

   • AManually investigate each alert and then use the XSIAM API to quarantine the endpoint.
   • BCreate a playbook that runs automated response actions triggered by the alert, with a manual approval step before quarantine.
   • CUse a BIOC rule to detect the phishing behavior and automatically block the sender.
   • DConfigure the alert to automatically quarantine the endpoint and block the sender without any human intervention.
   Reveal Solution Discussion Select an answer first