4.1 Identify and Describe Cortex Data Models (XDMs) XSIAM-ANALYST Practice Questions (Page 5)

Questions 21–24

1. 21expert · hard

   An analyst needs to create a report that shows the top 10 source IPs by number of failed authentication attempts. The report should include data from both on-premises and cloud sources. The analyst has access to XDM data and raw data. Which approach is most appropriate?

   • AUse XDM data for cloud sources and raw data for on-premises sources.
   • BUse raw data to query failed authentication events and group by source IP.
   • CUse raw data for all sources and manually map fields in the query.
   • DUse XDM data to query failed authentication events and group by source IP.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   An analyst wants to write a single XQL query that searches for suspicious activity across firewall logs, endpoint telemetry, and cloud audit logs. How do XDMs make this possible?

   • ABy duplicating all data into a single table that contains every possible field from every source
   • BBy providing a common set of field names and structures that all sources map to
   • CBy converting all data into a single proprietary format that only XSIAM can read
   • DBy requiring each source to be queried separately and then merging results manually
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Why does using XDM fields in XQL queries make it easier to analyze data from multiple sources?

   • ABecause XDM fields are always populated, unlike raw fields which may be empty
   • BBecause XDM fields are automatically indexed for faster queries
   • CBecause XDM fields are the only fields that can be used in XQL queries
   • DBecause the same field name works across all sources without needing to know the source-specific format
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is investigating a security incident and wants to find all related alerts, events, and the final incident record. The analyst knows that these are different XDM data types. Which statement correctly describes the hierarchical relationship among these XDM data types?

   • AEvents are composed of alerts, and alerts are composed of incidents.
   • BIncidents are a subtype of alerts, and alerts are a subtype of events.
   • CIncidents are composed of alerts, and alerts are composed of events.
   • DAlerts, events, and incidents are independent data types with no relationship.
   Reveal Solution Discussion Select an answer first