1.5 Configure User Roles, Permissions, and Access Controls XSIAM-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A new hire joins the threat intelligence team. Their responsibilities include updating threat intel feeds and viewing reports, but they should NOT be able to modify detection rules or manage users. Which role assignment best follows the principle of least privilege?

   • AAssign the built-in 'Threat Intel' role, which includes feed management and report viewing permissions.
   • BAssign the 'Administrator' role and then remove the 'Manage Users' permission.
   • CAssign the 'Analyst' role, which includes all necessary permissions for threat intelligence work.
   • DCreate a custom role with only 'View Reports' permission and assign it to the user.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company wants to enforce a password policy that requires users to change their passwords every 60 days and prevents reuse of the last 5 passwords. Where should the administrator configure this in XSIAM?

   • AIn the user management settings, under password policy options.
   • BIn the role configuration, by adding a password policy to each role.
   • CIn the access control settings, by creating a new access policy for password changes.
   • DIn the audit log settings, by enabling password change logging.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security operations center (SOC) manager needs to grant a new analyst access to XSIAM so they can view and investigate alerts, but they must NOT be able to modify detection rules or manage user accounts. The analyst should only see data from the 'Finance' business unit. What is the most appropriate way to configure this access?

   • ACreate a custom role with view-only permissions for alerts and incidents, assign the analyst to that role, and apply a data filter for the Finance business unit.
   • BAdd the analyst to the 'Administrator' role and then manually remove the 'Manage Users' permission from their user account.
   • CCreate a new role that includes all permissions except 'Manage Users', then assign the analyst to this role.
   • DAssign the analyst the built-in 'Analyst' role and rely on the default data visibility, which already restricts access to only the Finance business unit.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What happens when a permission is overridden for a specific user in XSIAM?

   • AThe override applies to all users in the same role
   • BThe user is automatically removed from all roles
   • CThe user's account is locked until an administrator reviews the change
   • DThe user's effective permissions change for that specific permission, potentially granting or denying access
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an example of an audit log entry in XSIAM?

   • AThe list of active network connections
   • BThe version of the XSIAM software
   • CThe current CPU usage of the XSIAM server
   • DA record of a user logging in and viewing an incident
   Reveal Solution Discussion Select an answer first