XSIAM Analyst 270-388 Practice Questions & Answers • ExamPrepare

40 questions in this view

Page 1 of 7

Question 1

Which alert source supports the ability to drill down query?

XDR Analytics
PAN NGFW
Correlation
XDR agent

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

Which two statements apply to indicator of compromise (IOC) rules? (Choose two.)

They can have an expiration date of up to 180 days.
They can be uploaded using REST API.
They can be used to detect a specific registry key.
They can be excluded using suppression rules but not alert exclusions.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

A security engineer is writing a custom Python script to parse a JSON file and wants to verify the script's output.

What is the benefit of using Playground for this task?

It executes scripts with Super User privileges by default.
It bypasses all API rate limits for third-party integrations.
It provides an isolated setting for actions not to affect live incident data.
It automatically remediates any errors that are present in the Python code.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

What is the cause when alerts generated by a correlation rule are not creating an incident?

The rule does not have a drill-down query configured.
The rule is configured with alert severity below Medium.
The rule is using the preconfigured Cortex XSIAM alert field mapping.
The rule has alert suppression enabled.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

A security analyst is constructing an XQL query in Cortex XSIAM to analyze only the security events where the src_ip field contains a valid, non-empty IP address. The analyst wants to eliminate all records where the src_ip value is missing or an empty string.

Which XQL filter clause meets the requirement?

dataset = xdr_data | filter event_type = ENUM.NETWORK | filter action_local_ip != null and action_local_ip !=""
dataset = xdr_data | filter event_type = ENUM.NETWORK | filter action_local_ip is not empty and action_local_ip !=""
dataset = xdr_data | filter event_type = ENUM.NETWORK | filter action_local_ip = null and action_local_ip !="
dataset = xdr_data | filter event_type = ENUM.NETWORK | filter action_local_ip != null and action_local_ip ="N/A"

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

How can a security operations center (SOC) analyst highlight alerts generated on C-level executive hosts?

Add the C-level executive users to the Executive Accounts asset role.
Create a dynamic group for the C-level hosts.
Create a Featured Alert field for the C-level hosts.
Add a tag to the C-level executive users.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.