6.6 Validate and Monitor Asset Inventory XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company's XSIAM asset inventory shows 500 assets, but the IT service management (ITSM) tool, which is the authoritative source for all managed devices, lists 520. The security analyst is tasked with reconciling the discrepancy. What is the first step the analyst should take?

   • ARemove the 20 assets from the ITSM tool to make the counts match.
   • BInvestigate the 20 missing assets to determine if they are active, managed, and should be in the XSIAM inventory.
   • CIgnore the discrepancy because the ITSM tool is known to have stale data.
   • DAdd the 20 missing assets from the ITSM tool directly into the XSIAM inventory.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is validating the XSIAM asset inventory and finds that several assets have incorrect IP addresses. The analyst suspects the IP addresses were changed during a recent network reconfiguration. What is the most appropriate action?

   • AIgnore the incorrect IP addresses because they will be updated eventually.
   • BRemove the assets with incorrect IP addresses and re-add them later.
   • CRun a new discovery cycle to update the IP addresses automatically.
   • DManually correct the IP addresses in the inventory based on the analyst's knowledge.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is performing a quarterly asset inventory reconciliation. The XSIAM inventory contains 1,000 assets, while the configuration management database (CMDB) lists 980. After investigation, the analyst finds that 25 assets in XSIAM are not in the CMDB. What is the most likely explanation for this discrepancy?

   • AThe CMDB is the authoritative source, so the 25 assets in XSIAM are unauthorized.
   • BThe CMDB is missing assets that were discovered by XSIAM, indicating a gap in the CMDB's discovery process.
   • CThe XSIAM inventory is incorrect and all 25 assets should be removed.
   • DThe 25 assets are all virtual machines that are not tracked by the CMDB.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is reviewing the asset inventory and notices that a server's operating system has changed from 'Windows Server 2016' to 'Windows Server 2019'. The analyst did not receive any notification about this change. What should the analyst do?

   • AIgnore the change because it is not a security issue.
   • BRevert the OS back to 'Windows Server 2016' in the inventory.
   • CInvestigate the change to determine if it was a legitimate upgrade or an unauthorized modification.
   • DUpdate the inventory to reflect the new OS and move on.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security analyst is responsible for monitoring the asset inventory. The organization has a policy that any new asset must be added to the inventory within 24 hours of being connected to the network. The analyst is configuring alerts to enforce this policy. Which configuration best meets this requirement?

   • ACreate an alert that triggers when an asset is added to the inventory.
   • BCreate a scheduled search that runs every 24 hours and alerts on assets that were discovered but not added to the inventory.
   • CManually check the inventory daily for assets that are not listed.
   • DCreate an alert that triggers when an asset's first-seen time is more than 24 hours ago.
   Reveal Solution Discussion Select an answer first