XSIAM-Analyst 試験問題を無料オンラインアクセス

Which two features can trigger Cortex XSIAM playbooks? (Choose two.)

• A.Alert
• B.Indicator query
• C.Action center
• D.Detection rule

You notice multiple endpoints reporting offline in XSIAM. Which actions would help confirm their operational status?

• A.Ping the endpoint from the agent
• B.Check agent connection timestamps
• C.Perform a live terminal scan
• D.Review recent heartbeat logs

How can a SOC analyst highlight alerts generated on C-level executive hosts?

• A.Add a tag to the C-level executive users.
• B.Create a Featured Alert field for the C-level hosts.
• C.Create a dynamic group for the C-level hosts.
• D.Add the C-level executive users to the Executive Accounts asset role.

An analyst is responding to a critical incident involving a potential ransomware attack. The analyst immediately initiates full isolation on the compromised endpoint using Cortex XSIAM to prevent the malware from spreading across the network. However, the analyst now needs to collect additional forensic evidence from the isolated machine, including memory dumps and disk images, without reconnecting it to the network.
Which action will allow the analyst to collect the required forensic evidence while ensuring the endpoint remains fully isolated?

• A.Using the endpoint isolation feature to create a secure tunnel for evidence collection
• B.Disabling full isolation temporarily to allow forensic tools to communicate with the endpoint
• C.Collecting the evidence manually through the agent by accessing the machine directly and running "Generate Support File"
• D.Using the management console to remotely run a predefined forensic playbook on the associated alert

Which type of alert in Cortex XSIAM is primarily based on endpoint telemetry and behavior?

• A.Correlation
• B.XDR Agent
• C.IOC
• D.BIOC