XSIAM-Analyst Practice Exam Questions and Answers

A.  

The malicious files were true positives and were automatically quarantined from the scan results

B.  

The malware scan action detects malicious files but does not generate alerts for them

C.  

The malicious files are currently in an excluded directory in the Malware Profile

D.  

The malicious files were false positives and were automatically removed from the scan results

A.  

config case_sensitive = false | dataset = xdr_data | filter event_type = ENUM.PROCESS | filter action_process_image_name = "Malware.pdf.exe" | fields causality_actor_effective_username

B.  

config case_sensitive = false | dataset = xdr_data | filter event_type = ENUM.PROCESS | filter action_process_image_name = "Malware.pdf.exe" | fields actor_process_username

C.  

config case_sensitive = false | datamodel dataset = xdrdata | filter xdm.source.process.name = "Malware.pdf.exe" | fields xdm.target.user.username

D.  

config case_sensitive = false | dataset = xdr_data | filter event_type = ENUM.PROCESS | filter action_process_image_name = "Malware.pdf.exe" | fields action_process_username

A.  

Contextual

B.  

Baseline

C.  

Behavioral

D.  

Anomaly

A.  

View Endpoint Policy

B.  

View Endpoint Logs

C.  

View Incidents

D.  

View Actions

A.  

Detailed overview of behavior or activity that triggered an Analytics Alert, Analytics BIOC alert or correlation rule

B.  

Graphic representation of an event Causality Instance (CI) with additional capabilities to enable further analysis

C.  

Tab within an incident where analysts can collaborate and initiate further actions and automations

D.  

Sequence of events, alerts, rules and other actions involved over the lifespan of an incident

A.  

Activation period

B.  

Test period

C.  

Training period

D.  

Deduplication period

A.  

Clone the playbook, remove the faulty step and run the new playbook to bypass the error

B.  

Contact TAC to resolve the task error, as the playbook cannot proceed without it

C.  

Navigate to the step where the error occurred and run the task again

D.  

Pause the step with the error, thus automatically triggering the execution of the remaining steps.

A.  

Input Results

B.  

Outputs

C.  

Results

D.  

Inputs

A.  

The WildFire verdict returned is "Low Confidence."

B.  

The artifact verdict has changed from a previous state to "Malware."

C.  

The malicious artifact was injected.

D.  

The malware requires further analysis.

A.  

IcreateNewIndicator value="indicator@test.com"

B.  

!extractIndicators text="indicator@test.com" auto-extract=inline

C.  

!checkIndicatorExtraction text="indicator@test.com"

D.  

Iemailvalue="indicator@test.com"