XSIAM-Analyst by Palo Alto Networks Actual Free Exam Q&As

Question 1

Based on the image below, which two determinations can be made from the causality chain?
(Choose two.)

A. Three alerts in total were generated by the agent on the endpoint. B. Malware.pdf.exe is responsible for the entire chain of execution resulting in the alerts. C. The process cmd.exe is responsible for the entire chain of execution resulting in the alerts. D. Cortex XDR agent malware profile module applied is set to "Report" mode.

Discussion 0

Correct Answer: C,D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 2

Which event can trigger a false positive alert in Cortex analytics?

A. A user logs in to a work computer after six weeks of vacation. B. A vulnerability scanner has been running for 45 days, then the schedule is changed to run on Saturday instead of Sunday. C. An employee uses a work computer to log in and check a personal crypto wallet. D. An employee creates a rule in Microsoft Exchange to forward emails to a personal Gmail account.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 3

Which two methods can be used to create and share queries into the Query Library? (Choose two.)

A. From the Query Center, locate the query to save to a personal Query Library Right-click, and select "Save query to library" Enable the "Share with others" option B. From XQL Search, locate the query to save to a personal Query Library Right-click, and select "Save query to library" Enable the "Share with others" option C. From XQL Search, in the XQL query field, define the parameters of the query Save as, and choose the "Query to Library" option Enable the "Share with others" option D. From the Query Center, in the XQL query field, define the parameters of the query Save as, and choose the "Query to Library" option Enable the "Share with others" option

Discussion 0

Correct Answer: C,D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 4

Based on the image below, which two additional steps should a SOC analyst take to secure the endpoint? (Choose two.)

A. Reboot the machine. B. Live Terminal into the workstation to verify. C. Isolate the affected workstation. D. Block 192.168.1.199.

Discussion 0

Correct Answer: C,D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 5

Which option allows continuous monitoring and triage of evolving threats?

A. Asset status logs B. Threat intelligence API C. Live terminal execution D. Attack Surface Threat Response Center

Discussion 0

Correct Answer: D Vote an answer

Question 6

In the Identity Threat Detection and Response (ITDR) module, what does "compromised identity" typically indicate?

A. Failed software update B. Missing antivirus signature C. Unauthorized access or behavior from a known identity D. USB device connection

Discussion 0

Correct Answer: C Vote an answer

Question 7

An analyst conducting a threat hunt needs to collect multiple files from various endpoints. The analyst begins the file retrieval process by using the Action Center, but upon review of the retrieved files, notices that the list is incomplete and missing files, including kernel files.
What could be the reason for this issue?

A. The file retrieval policy applied to the endpoints may restrict access to certain system or kernel files. B. The endpoint agents were in offline mode during the file retrieval process, causing some files to be skipped. C. The retrieval process is limited to 500 MB in total file size. D. The analyst must manually retrieve kernel files by accessing the machine directly.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 8

A Cortex XSIAM analyst is investigating a security incident involving a workstation after having deployed a Cortex XDR agent for 45 days. The incident details include the Cortex XDR Analytics Alert "Uncommon remote scheduled task creation." Which response will mitigate the threat?

A. Allow list the processes to reduce alert noise. B. Prioritize blocking the source IP address to prevent further login attempts. C. Initiate the endpoint isolate action to contain the threat. D. Revoke user access and conduct a user audit.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Palo Alto Networks XSIAM Analyst - XSIAM-Analyst Exam Practice Test