Paloalto Networks XSIAM-Analyst Palo Alto Networks XSIAM Analyst Exam Practice Test

The correct answer isA – cytool security enable.

The commandcytool security enableis used tore-enableCortex XDR agent protection on an endpoint after it has been paused or disabled. This command restores all core security functions as per XDR agent configuration.

“Use the cytool security enable command to re-enable the Cortex XDR agent’s protection if it has been paused on an endpoint.”

Document Reference:EDU-270c-10-lab-guide_02.docx (1).pdf

Page:Page 13 (Agent Deployment and Configuration section)

===========

The correct answer isB – Live Terminal.

In Cortex XSIAM, theLive Terminalfeature allows analysts to initiate an interactive command-line session with an endpoint directly from the management console. During an investigation, analysts can use Live Terminal to issue commands—including those that terminate suspicious or malicious processes running on the endpoint.

"Live Terminal provides analysts with a direct command line on the endpoint, enabling actions such as process termination during investigations."

Document Reference:XSIAM Analyst ILT Lab Guide.pdf

Exact Page:Page 15 (Endpoints section)

The correct answers areB and C.

FromXQL Search, you can save existing queries directly to your personal Query Library and then choose to share them with others by enabling the sharing option.

You can also build new queries in the XQL Search field, then use "Save as" and select "Query to Library," followed by enabling the "Share with others" option.

"Queries can be created and saved to the Query Library from XQL Search either by saving existing queries or using the 'Save as' feature after building a new query. The 'Share with others' option allows for team collaboration."

Document Reference:XSIAM Analyst ILT Lab Guide.pdf

Page:Page 25 (Dashboards, Reports, and Widgets section)

===========

The correct answer isD – The xdm_core fieldset will be returned by default.

In Cortex XSIAM, when no specific fields are selected in a data model query, thexdm_core fieldset(which contains essential, core fields of the dataset) is automatically returned. This ensures analysts always have a baseline set of meaningful information in the results, even when fields are not explicitly specified.

"When no fields are specified in a data model query, Cortex XSIAM defaults to returning the xdm_core fieldset, which contains key metadata and context."

Document Reference:EDU-270c-10-lab-guide_02.docx (1).pdf

Page:Page 29 (Data Model section)

===========

The correct answer isD – Conditional.

Conditional tasksare used in Cortex XSIAM playbooks to create decision trees. They enable branching logic based on the outcome of previous steps, allowing the playbook to automatically choose different paths and actions depending on analysis results, alert types, or input values.

"Conditional tasks in playbooks enable the construction of decision trees, supporting dynamic response automation based on pre-defined criteria and branching logic."

Document Reference:XSIAM Analyst ILT Lab Guide.pdf

Page:Page 38 (Automation and Playbooks section)

The correct answer isA– the query using the fieldcausality_actor_effective_username.

When analyzing events where privilege escalation is used, it is essential to identify the original effective user that initiated the causality chain, not merely the process’s own running user (as provided by other fields). The fieldcausality_actor_effective_usernamespecifically provides the effective username context of the actor behind the entire chain of actions that resulted in launching the suspicious executable.

Explanation of fields from Official Document:

causality_actor_effective_username: This field indicates the original effective user who started the entire causality chain.

actor_process_usernameandaction_process_username: These fields indicate the immediate process username, not necessarily reflecting the correct original context when privilege escalation occurs.

Therefore, to always identify the correct user context in privilege escalation scenarios, optionAis the verified correct answer.

The correct answer isD – View Actions.

Within the Cortex XSIAM Endpoints table, theView Actionscontext menu allows analysts to review historical actions performed on an endpoint, including Live Terminal access. This menu logs all actions such as isolations, scans, and terminal sessions, along with the user who initiated each action, making it the source for tracking who accessed the endpoint via Live Terminal.

"The View Actions option in the endpoints table displays a history of all performed actions, including Live Terminal sessions and the corresponding users."

Document Reference:EDU-270c-10-lab-guide_02.docx (1).pdf

Page:Page 13 (Agent Deployment and Configuration section)

The correct answer isD – Pause the step with the error, thus automatically triggering the execution of the remaining steps.

When a playbook encounters an error and the analyst does not have permissions to modify or recreate the playbook, the recommended action is topausethe step with the error. This will skip the problematic step andallow the remaining steps of the playbook to execute, ensuring the investigation or response continues.

"Pausing a failed step in the playbook work plan allows the remaining steps to continue executing, useful when immediate playbook edits are not possible due to permission restrictions."

Document Reference:XSIAM Analyst ILT Lab Guide.pdf

Page:Page 39 (Automation section)

===========

The correct answer isD – Sequence of events, alerts, rules and other actions involved over the lifespan of an incident.

Thetimeline viewin Cortex XSIAM provides achronological sequence of all events, alerts, and actionsthat have occurred in relation to a specific incident, helping analysts understand the incident’s progression from start to finish.

"The timeline view provides a detailed, chronological sequence of events, alerts, and actions for the lifespan of an incident."

Document Reference:XSIAM Analyst ILT Lab Guide.pdf

Page:Page 32 (Incident Handling section)

===========

Comprehensive and Detailed Explanation From Exact Extract:

The correct answer isB – The artifact verdict has changed from a previous state to "Malware."

Thehexagon-shaped object with an exclamation markin Cortex XSIAM artifact analysis indicates achange or escalation in verdict—typically from "Unknown" or another previous state to "Malware." This symbol is a visual cue for analysts to pay attention to the updated status, as the system has reclassified the file/object to "Malware" based on new intelligence or analysis.

“The exclamation mark in a hexagon is used to signal that the verdict of the artifact has changed, most commonly to indicate a new classification as 'Malware.'”

Document Reference:XSIAM Analyst ILT Lab Guide.pdf

Page:Page 37 (Threat Intel Management section, Artifact verdict/status changes)

The correct answer isB – Unmerge the incidents to capture the missing details.

When incidents are merged in Cortex XSIAM, custom field values from the source (secondary) incident are not always automatically transferred to the destination (primary) incident. The recommended way to retrieve the missing custom incident field values is tounmergethe incidents. This action restores the original incidents, including all their individual fields and context, allowing analysts to access and capture the missing details.

"If incident field values are missing after a merge, unmerging incidents will restore the original context and custom field data from each incident."

Document Reference:XSIAM Analyst ILT Lab Guide.pdf

Page:Page 45 (Incident Handling section)

===========

The correct answer isA – The file retrieval policy applied to the endpoints may restrict access to certain system or kernel files.

Cortex XSIAM and XDR implement security policies and permissions that mayrestrict the retrieval of sensitive system files, including kernel files, for safety and compliance reasons. When a file retrieval action is initiated, the endpoint policy controls which files are accessible; kernel and other protected files are often excluded from remote retrieval actions to prevent accidental or unauthorized access.

"The file retrieval policy controls which files can be remotely collected from endpoints. Sensitive files, such as kernel or system files, may be restricted by policy and are not accessible through standard remote retrieval actions."

Document Reference:EDU-270c-10-lab-guide_02.docx (1).pdf

Exact Page:Page 13 (Agent Deployment and Configuration section)

Comprehensive and Detailed Explanation From Exact Extract:

The correct answers areC – Block 192.168.1.199andD – Isolate the affected workstation.

Block 192.168.1.199:The image shows that the suspicious or malicious activity originated from this source IP address, making it a potential threat actor or compromised system on the network. Blocking this IP helps prevent further communication or lateral movement from the suspected attacker.

Isolate the affected workstation:Since suspicious activities (like powershell_ise.exe running as an admin and launching splunkd.exe) are detected, isolating the workstation is a critical containment measure. This action disconnects the endpoint from the network, stopping any ongoing attack, lateral movement, or command-and-control activity, while allowing for forensic investigation.

"Isolating an endpoint and blocking the source IP address are best practices for immediate containment in the event of detected compromise or suspicious activity."

Document Reference:XSIAM Analyst ILT Lab Guide.pdf

Page:Page 40 (Incident Handling section)

(Both steps together are needed for accurate configuration: "Filter and select one or more file, IP address, and domain indicators." AND "Select profiles for prevention")

The correct steps are tofilter and select one or more file, IP address, and domain indicators(C) and thenselect profiles for prevention(D).

When configuring an indicator prevention rule in Cortex XSIAM/XDR, after naming the rule and setting its severity, the analyst should:

Filter and select the specific indicators(e.g., file hashes, IP addresses, domains) that are to be blocked or prevented.

Select the appropriate endpoint profiles or groupswhere the rule should be enforced for active prevention.

"Before saving an indicator prevention rule, filter and select the relevant indicators (file, IP address, and domain), then assign the prevention profiles that will enforce the rule on endpoints."

Document Reference:EDU-270c-10-lab-guide_02.docx (1).pdf

Page:Page 16-17 (Endpoint Policy Management section)

The correct answer isC – An asset attributed to the organization because the Subject Organization field contains the company name.

When determining ownership of assets in the attack surface, attribution based solely on the Subject Organization field containing the company name is considered less reliable than evidence based on domain registration, authoritative DNS relationships, or manual analyst validation. This is because the Subject Organization field may contain non-unique or common names, leading to a higher rate of false associations, and is not as strong as direct registration records or explicit analyst verification.

“The confidence level is lowest when asset attribution is based on the Subject Organization field, since this field may not be unique to the organization and can result in inaccurate mapping.”

Document Reference:XSIAM Analyst ILT Lab Guide.pdf

Page:Page 42 (Attack Surface Management section)