4.1 Identify and Describe Cortex Data Models (XDMs) XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During an investigation, an analyst identifies an incident that contains multiple alerts. Each alert references several events. The analyst wants to understand the structure of the incident. Which XDM data type hierarchy should the analyst use to navigate from the incident down to the individual events?

   • AAlert → Incident → Event
   • BEvent → Alert → Incident
   • CIncident → Event → Alert
   • DIncident → Alert → Event
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is investigating a network anomaly and needs to see the exact packet headers from a firewall log. The XDM data provides a summary of the connection, but not the raw packet details. What should the analyst do?

   • AReconfigure the firewall to send more detailed logs.
   • BQuery the raw firewall logs to see the original packet headers.
   • CUse the XDM data, as it contains all relevant packet details.
   • DContact the firewall vendor for a new parser that includes packet headers.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which XDM schema element would be used to represent multiple IP addresses associated with a single network connection event?

   • AA nested object
   • BAn array
   • CA timestamp
   • DA core field
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team ingests logs from a legacy IDS that uses a non-standard field name 'src' for the source IP. The team wants to correlate these logs with other sources using XDM. However, the parser for this IDS is not provided by Palo Alto Networks. What is the most appropriate action?

   • AUse the raw data for this source and manually correlate with other sources.
   • BRequest Palo Alto Networks to add support for this IDS.
   • CCreate a custom parser to map 'src' to the XDM field 'xdm.source.ip'.
   • DIngest the logs without a parser and use XQL to map fields at query time.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A managed security service provider (MSSP) monitors multiple customers, each with different security products. The MSSP wants to create a unified dashboard showing authentication failures across all customers. What is the most efficient approach?

   • AStore all raw data in a single dataset and query it directly.
   • BUse a third-party SIEM to normalize the data before sending it to XSIAM.
   • CWrite separate queries for each customer's data source and manually combine the results.
   • DUse XDM fields in a single query to aggregate authentication failures from all sources.
   Reveal Solution Discussion Select an answer first