XSIAM-Analyst Exam Question 31
An alert involves credential dumping. Reviewing the causality chain, you notice the following:
- lsass.exe is accessed by powershell.exe
- Prior to this, cmd.exe launched the PowerShell script
What can you infer?
Response:
- lsass.exe is accessed by powershell.exe
- Prior to this, cmd.exe launched the PowerShell script
What can you infer?
Response:
XSIAM-Analyst Exam Question 32
What does validating an endpoint profile in Cortex XSIAM primarily ensure?
Response:
Response:
XSIAM-Analyst Exam Question 33
Which two statements apply to IOC rules? (Choose two)
XSIAM-Analyst Exam Question 34
Match the alert type to its primary detection method:
Alert Type
A) IOC
B) BIOC
C) Correlation
D) XDR Agent
Detection Method
1. Known bad indicator match
2. Behavioral anomalies in endpoint logs
3. Multi-source activity correlation
4. Native agent telemetry generation
Response:
Alert Type
A) IOC
B) BIOC
C) Correlation
D) XDR Agent
Detection Method
1. Known bad indicator match
2. Behavioral anomalies in endpoint logs
3. Multi-source activity correlation
4. Native agent telemetry generation
Response:
XSIAM-Analyst Exam Question 35
During a simulated attack, your sub-playbook fails and causes the parent playbook to stop. How can this behavior be improved?
(Choose two)
Response:
(Choose two)
Response: