QUESTION 61
What information is provided in the timeline view of Cortex XSIAM?

QUESTION 62
You’re tasked with building a report for daily alert trends. Which XQL features will support this automation?
(Choose two)
Response:

QUESTION 63
What is the primary function of hunting in Cortex XSIAM?
Response:

QUESTION 64
Which dataset should an analyst search when looking for Palo Alto Networks NGFW logs?

QUESTION 65
An asset is flagged in ASM for hosting an exposed RDP port. What steps might follow?
(Choose two)
Response:

QUESTION 66
During a simulated attack, your sub-playbook fails and causes the parent playbook to stop. How can this behavior be improved?
(Choose two)
Response:

QUESTION 67
A Cortex XSIAM analyst in a SOC is reviewing an incident involving a workstation showing signs of a potential breach. The incident includes an alert from Cortex XDR Analytics Alert source “Remote service command execution from an uncommon source.” As part of the incident handling process, the analyst must apply response actions to contain the threat effectively.
Which initial Cortex XDR agent response action should be taken to reduce attacker mobility on the network?

QUESTION 68
Which feature enables incident responders to directly respond from within Cortex XSIAM?
Response:

QUESTION 69
A team wants to increase priority for alerts involving finance endpoints. Which methods would apply in Cortex XSIAM?
(Choose two)
Response:

QUESTION 70
In addition to defining the Rule Name and Severity Level, which step or set of steps accurately reflects how an analyst should configure an indicator prevention rule before reviewing and saving it?

QUESTION 71
Which two actions will allow a security analyst to review updated commands from the core pack and interpret the results without altering the incident audit? (Choose two)

QUESTION 72
Match each playbook component to its function:
Component
A) Conditional Task
B) Sub-playbook
C) Manual Task
D) Error Handling
Function
1. Executes different paths based on field values
2. Reusable sequence of steps
3. Waits for analyst input
4. Defines fallback steps if task fails
Response:

QUESTION 73
SCENARIO:
A security analyst has been assigned a ticket from the help desk stating that users are experiencing errors when attempting to open files on a specific network share. These errors state that the file format cannot be opened. IT has verified that the file server is online and functioning, but that all files have unusual extensions attached to them.
The security analyst reviews alerts within Cortex XSIAM and identifies malicious activity related to a possible ransomware attack on the file server. This incident is then escalated to the incident response team for further investigation.
Upon reviewing the incident, the responders confirm that ransomware was successfully executed on the file server. Other details of the attack are noted below:
* An unpatched vulnerability on an externally facing web server was exploited for initial access
* The attackers successfully used Mimikatz to dump sensitive credentials that were used for privilege escalation
* PowerShell was used on a Windows server for additional discovery, as well as lateral movement to other systems
* The attackers executed SystemBC RAT on multiple systems to maintain remote access
* Ransomware payload was downloaded on the file server via an external site “file io” QUESTION STATEMENT:
Which hunt collection category in Cortex XSIAM should the incident responders use to identify all systems where the attackers established persistence during the attack?

QUESTION 74
For a critical incident, Cortex XSIAM suggests several playbooks which should have been executed automatically.
Why were the playbooks not executed?

QUESTION 75
A SOC team member implements an incident starring configuration, but incidents created before this configuration were not starred.
What is the cause of this behavior?

QUESTION 76
What is the causality chain used for in Cortex XSIAM investigations?
Response:

QUESTION 77
Based on the image below, which two determinations can be made from the causality chain? (Choose two.)

QUESTION 78
An alert for malware propagation triggers an incident. The associated playbook isolates the endpoint and notifies the SOC team. What advantages does this approach provide?
(Choose two)
Response:

QUESTION 79
Based on the artifact details in the image below, what can an analyst infer from the hexagon-shaped object with the exclamation mark (!) at the center?

QUESTION 80
Which type of alert in Cortex XSIAM is primarily based on endpoint telemetry and behavior?
Response:

QUESTION 81
You notice multiple endpoints reporting offline in XSIAM. Which actions would help confirm their operational status?
Response:

QUESTION 82
Which type of analytics will trigger the alert on the image shown?

QUESTION 83
A threat hunter discovers a true negative event from a zero-day exploit that is using privilege escalation to launch “Malware pdf.exe”. Which XQL query will always show the correct user context used to launch
“Malware pdf.exe”?

QUESTION 84
Which action can be performed through custom prioritization logic?
Response: