Palo Alto Networks XSIAM-Analyst 考試大綱：

主題	簡介
主題 1	Incident Handling and Response: This section of the exam measures the skills of Incident Response Analysts and covers managing the complete lifecycle of incidents. It involves explaining the incident creation process, reviewing and investigating evidence through forensics and identity threat detection, analyzing and responding to security events, and applying automated responses. The section also focuses on interpreting incident context data, differentiating between alert grouping and data stitching, and hunting for potential IOCs.
主題 2	Threat Intelligence Management and ASM: This section of the exam measures the skills of Threat Intelligence Analysts and focuses on handling and analyzing threat indicators and attack surface management (ASM). It includes importing and managing indicators, validating reputations and verdicts, creating prevention and detection rules, and monitoring asset inventories. Candidates are expected to use the Attack Surface Threat Response Center to identify and remediate threats effectively.
主題 3	Endpoint Security Management: This section of the exam measures the skills of Endpoint Security Administrators and focuses on validating endpoint configurations and monitoring activities. It includes managing endpoint profiles and policies, verifying agent status, and responding to endpoint alerts through live terminals, isolation, malware scans, and file retrieval processes.

參考：https://www.paloaltonetworks.com/services/education/palo-alto-networks-xsiam-analyst

Palo Alto Networks XSIAM-Analyst 考試概覽:

認證廠商:	Palo Alto Networks
考試名稱:	Palo Alto Networks Certified XSIAM Analyst
考試代碼:	XSIAM-Analyst
考試形式:	多選題, 單選題
考試時間:	90 分鐘
支援語言:	英文
相關認證:	Palo Alto Networks Certified Security Operations Specialist Cortex XDR Analyst Certification
實際考試題數:	60-75
考試費用:	$160 USD
及格分數:	70%
證照有效期限:	2年
推薦課程:	Cortex XSIAM產品文檔 Palo Alto Networks教育服務 - Cortex XSIAM課程
考試報名:	Pearson VUE Palo Alto Networks考試 Palo Alto Networks認證入口
範例考題:	Palo Alto Networks XSIAM-Analyst 範例考題
考試方式:	透過Pearson VUE或授權考試中心進行線上監考考試
必備條件:	建議具備SOC運營經驗，並熟悉Cortex XSIAM或相關Palo Alto Networks安全平台。強烈建議完成官方培訓課程。
官方大綱網址:	https://www.paloaltonetworks.com/services/education/certification

最新的 Security Operations XSIAM-Analyst 免費考試真題：

問題 #1

Which two features can trigger Cortex XSIAM playbooks? (Choose two.)

A. Action center
B. Indicator query
C. Detection rule
D. Alert

顯示解答討論 0

答案：C,D 🗳️

說明：（僅 VCESoft 成員可見）

問題 #2

In which two locations can mapping be configured for indicators? (Choose two.)

A. Feed Integration settings
B. STIX parser code
C. Indicator Configuration in Object Setup
D. Classification & Mapping tab

顯示解答討論 0

答案：A,D 🗳️

說明：（僅 VCESoft 成員可見）

問題 #3

While investigating an incident on the Incident Overview page, an analyst notices that the playbook encountered an error. Upon playbook work plan review, it is determined that the error was caused by a timeout. However, the analyst does not have the necessary permissions to fix or create a new playbook.
Given the critical nature of the incident, what can the analyst do to ensure the playbook continues executing the remaining steps?

A. Navigate to the step where the error occurred and run the task again.
B. Pause the step with the error, thus automatically triggering the execution of the remaining steps.
C. Contact TAC to resolve the task error, as the playbook cannot proceed without it.
D. Clone the playbook, remove the faulty step, and run the new playbook to bypass the error.

顯示解答討論 0

答案：B 🗳️

說明：（僅 VCESoft 成員可見）

問題 #4

In addition to defining the Rule Name and Severity Level, which step or set of steps accurately reflects how an analyst should configure an indicator prevention rule before reviewing and saving it?

A. Filter and select indicators of any type.
B. Filter and select file, IP address, and domain indicators.
C. Select profiles for prevention.
Filter and select one or more SHA256 and MD5 indicators.
D. Select profiles for prevention.
Filter and select one or more file, IP address, and domain indicators.

顯示解答討論 0

答案：D 🗳️

說明：（僅 VCESoft 成員可見）

問題 #5

What information does a section header within a playbook task allow an analyst to see?