4.1 Identify and Describe Cortex Data Models (XDMs) XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is deploying XSIAM and wants to ensure that data from their existing SIEM, which uses a proprietary log format, can be queried using XDM fields. What is the first step they should take?

   • ADevelop or configure a parser to map the proprietary log format to XDM fields.
   • BConvert the proprietary logs to a standard format like JSON before ingestion.
   • CIngest the raw data and rely on XSIAM's automatic normalization.
   • DUse XQL to manually map fields during every query.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is reviewing an XDM schema for an alert. The schema shows that the alert has a top-level field 'actor' that contains an array of objects, each with 'user' and 'process' sub-fields. How should the analyst query for alerts where the actor process name is 'powershell.exe'?

   • Afilter 'powershell.exe' in actor.process.name
   • Bfilter actor.process.name = 'powershell.exe'
   • Cfilter actor[0].process.name = 'powershell.exe'
   • Dfilter arraycontains(actor.process.name, 'powershell.exe')
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An analyst sees that an XDM alert record contains a field that references the original event(s) that triggered it. Which XDM data type does this reference point to?

   • ARaw log
   • BDetection
   • CEvent
   • DIncident
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security operations team needs to correlate authentication failures from on-premises Active Directory, AWS CloudTrail, and Azure AD sign-in logs. They want to write a single XQL query that can search across all three sources without needing to know the original field names for each log type. What is the primary reason this is possible?

   • AXSIAM automatically merges all raw logs into a single table with identical fields.
   • BXQL queries can only access raw data, so the team must use separate queries for each source.
   • CXDM normalizes data from different sources into a common schema with standardized field names.
   • DThe XDM schema is identical to the raw data schema for all supported sources.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is field mapping necessary when ingesting data from multiple vendors into XSIAM?

   • ATo ensure that the same semantic field (e.g., 'user name') has the same name across all sources
   • BTo reduce the storage size of the ingested data
   • CTo convert all data into a single file format for easier export
   • DTo encrypt the data so that only authorized analysts can read it
   Reveal Solution Discussion Select an answer first