5.1 Explain the Function of Key Cortex XSIAM Components SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of log stitching in Cortex XSIAM?

   • ATo correlate related events from different data sources into a single unified view
   • BTo compress log files to reduce storage costs
   • CTo delete duplicate logs to improve query performance
   • DTo encrypt logs to ensure data privacy during transmission
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   A playbook is triggered by a specific alert type. The team wants to test the playbook without waiting for a real alert. What should they do?

   • ACreate a new alert type that triggers the playbook.
   • BModify the playbook to run on a schedule.
   • CDisable the trigger and run the playbook manually.
   • DManually trigger the playbook from the Cortex XSIAM interface using a test alert.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which statement best describes the role of a Cortex XSIAM sensor in data collection?

   • AIt is a software component that collects security data from a source and forwards it to Cortex XSIAM for processing
   • BIt is a dashboard that displays collected data in real time to security analysts
   • CIt is a hardware appliance that stores all security logs locally for long-term retention
   • DIt is a firewall rule that filters which logs are allowed to enter the network
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization wants to automate the initial response to phishing alerts: isolate the affected endpoint, block the sender, and notify the security team. What should they create in Cortex XSIAM to execute these steps automatically?

   • AAn integration to the email gateway that blocks the sender automatically.
   • BA playbook that contains the sequence of actions and is triggered by the alert.
   • CA content pack that includes the phishing detection rules.
   • DA log stitching rule that correlates phishing alerts with endpoint data.
   Reveal Solution Discussion Select an answer first
6. 5application · easy

   A team wants to quickly deploy detection and response capabilities for a specific threat category, such as ransomware, without building everything from scratch. They need pre-built dashboards, alerts, and playbooks. What should they use?

   • AInstall a content pack designed for ransomware use cases.
   • BCreate a custom playbook that includes all necessary detection rules.
   • CConfigure a log stitching rule to detect ransomware patterns.
   • DDeploy a network sensor with ransomware detection signatures.
   Reveal Solution Discussion Select an answer first