1.5 Configure User Roles, Permissions, and Access Controls XSIAM-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is included in user management in XSIAM?

   • ADefining the network firewall rules for the XSIAM platform
   • BConfiguring the data retention period for logs
   • CSetting up the email server for notifications
   • DCreating user accounts and setting authentication methods
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization wants to ensure that all user accounts are disabled after 30 days of inactivity. What is the most appropriate way to configure this in XSIAM?

   • ASet the password policy to require a password change every 30 days.
   • BCreate a scheduled task to manually disable accounts that have not logged in for 30 days.
   • CConfigure the audit log to alert when accounts are inactive for 30 days.
   • DEnable the account inactivity timeout setting in user management and set it to 30 days.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is an example of a role-based permission in XSIAM?

   • AThe user's last login time
   • BThe user's email address
   • CThe user's assigned tenant ID
   • DThe ability to create and modify detection rules
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company wants to create a role for 'SOC Managers' that can view all incidents, approve playbook executions, and manage other SOC users, but cannot modify detection rules. What should the administrator do?

   • ACreate a custom role and select the specific permissions for incident viewing, playbook approval, and user management.
   • BAssign the 'Analyst' role and add the 'Manage Users' permission to it.
   • CCreate a new role by copying the 'Viewer' role and adding user management permissions.
   • DModify the built-in 'Administrator' role to remove detection rule permissions.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A user is moving from a junior analyst role to a senior analyst role. The senior role requires additional permissions to modify detection rules. What is the correct way to update the user's access?

   • ARemove the junior analyst role assignment and assign the senior analyst role.
   • BModify the junior analyst role to include the senior analyst permissions.
   • CKeep the junior analyst role and add the senior analyst role.
   • DCreate a new role that combines both junior and senior permissions and assign it to the user.
   Reveal Solution Discussion Select an answer first