最新的Security Operations認證 XSIAM-Analyst考試題庫

問題1

For a critical incident, Cortex XSIAM suggests several playbooks which should have been executed automatically.
Why were the playbooks not executed?

A. Playbook triggers were not configured for those alerts.

B. Playbook classifier was not configured for the alert type.

C. Misconfiguration of the connector instance has occurred.

D. Installation of the appropriate content pack was not completed.

正確答案: A

說明：（僅 VCESoft 成員可見）

問題2

An analyst conducting a threat hunt needs to collect multiple files from various endpoints. The analyst begins the file retrieval process by using the Action Center, but upon review of the retrieved files, notices that the list is incomplete and missing files, including kernel files.
What could be the reason for this issue?

A. The analyst must manually retrieve kernel files by accessing the machine directly.

B. The file retrieval policy applied to the endpoints may restrict access to certain system or kernel files.

C. The retrieval process is limited to 500 MB in total file size.

D. The endpoint agents were in offline mode during the file retrieval process, causing some files to be skipped.

正確答案: B

說明：（僅 VCESoft 成員可見）

問題3

In the Endpoint Data context menu of the Cortex XSIAM endpoints table, where will an analyst be able to determine which users accessed an endpoint via Live Terminal?

A. View Endpoint Logs

B. View Incidents

C. View Actions

D. View Endpoint Policy

正確答案: C

說明：（僅 VCESoft 成員可見）

問題4

You notice multiple endpoints reporting offline in XSIAM. Which actions would help confirm their operational status?

A. Ping the endpoint from the agent

B. Review recent heartbeat logs

C. Perform a live terminal scan

D. Check agent connection timestamps

正確答案: B,D

問題5

Based on the image below, which two determinations can be made from the causality chain?
(Choose two.)

A. Three alerts in total were generated by the agent on the endpoint.

B. Cortex XDR agent malware profile module applied is set to "Report" mode.

C. Malware.pdf.exe is responsible for the entire chain of execution resulting in the alerts.

D. The process cmd.exe is responsible for the entire chain of execution resulting in the alerts.

正確答案: B,D

說明：（僅 VCESoft 成員可見）

問題6

In the Identity Threat Detection and Response (ITDR) module, what does "compromised identity" typically indicate?

A. Missing antivirus signature

B. USB device connection

C. Unauthorized access or behavior from a known identity

D. Failed software update

正確答案: C

問題7

An alert fires indicating lateral movement between endpoints. It was triggered after evaluating multiple unrelated activities, such as credential access and abnormal port scanning. What are likely characteristics of this alert? (Choose two)

A. Suggests a pre-configured playbook was executed

B. Triggered by an IOC match

C. Likely caused by a multi-stage correlation rule

D. Behaviorally inferred by a correlation rule

正確答案: C,D

問題8

Why would an analyst schedule an XQL query?

A. To trigger endpoint isolation action

B. To auto-resolve a false positive alert

C. To increase accuracy of queries during off-peak load times

D. To retrieve data either at specific intervals or at a specified time

正確答案: D

說明：（僅 VCESoft 成員可見）

最新的Palo Alto Networks XSIAM Analyst - XSIAM-Analyst免費考試真題

最新更新

站內鏈接

聯系我們