When a sub-playbook loops, which task tab will allow an analyst to determine what data the sub- playbook used in each iteration of the loop?
Answer(s): A
The correct answer is A Input Results.In Cortex XSIAM playbooks, when sub-playbooks are configured to loop, the Input Results tab within the task view allows analysts to see exactly what input data was provided to the sub-playbook during each iteration of the loop. This is essential for understanding playbook behavior and troubleshooting automation flows."The Input Results tab in the playbook task provides visibility into the data supplied to a sub- playbook for every loop iteration, allowing analysts to review how the input changes across executions."
XSIAM Analyst ILT Lab Guide.pdfPage: Page 39 (Automation section)
A Cortex XSIAM analyst in a SOC is reviewing an incident involving a workstation showing signs of a potential breach. The incident includes an alert from Cortex XDR Analytics Alert source "Remote service command execution from an uncommon source." As part of the incident handling process, the analyst must apply response actions to contain the threat effectively.Which initial Cortex XDR agent response action should be taken to reduce attacker mobility on the network?
The correct answer is A Isolate Endpoint.The most effective initial response to contain a breach and reduce attacker mobility is to isolate the endpoint. This action ensures that the compromised machine can no longer communicate with the network or external systems, effectively cutting off lateral movement and exfiltration by attackers, while still allowing controlled response operations."Isolate Endpoint is the primary response action used to immediately contain a threat by severing all network communication, thus limiting attacker movement during active incidents."
EDU-270c-10-lab-guide_02.docx (1).pdfPage: Page 40 (Incident Handling/SOC section)
In the Endpoint Data context menu of the Cortex XSIAM endpoints table, where will an analyst be able to determine which users accessed an endpoint via Live Terminal?
Answer(s): D
The correct answer is D View Actions.Within the Cortex XSIAM Endpoints table, the View Actions context menu allows analysts to review historical actions performed on an endpoint, including Live Terminal access. This menu logs all actions such as isolations, scans, and terminal sessions, along with the user who initiated each action, making it the source for tracking who accessed the endpoint via Live Terminal."The View Actions option in the endpoints table displays a history of all performed actions, includingLive Terminal sessions and the corresponding users."
EDU-270c-10-lab-guide_02.docx (1).pdfPage: Page 13 (Agent Deployment and Configuration section)
During an investigation, an analyst runs the reputation script for an indicator that is listed asSuspicious. The new reputation results display in the War Room as Malicious; however, the indicator verdict does not change.What is the cause of this behavior?
The correct answer is D The indicator verdict was manually set to Suspicious.When an indicator's verdict is manually set in Cortex XSIAM, automated reputation scripts and updates do not override this manual setting. Thus, even if the reputation result in the War Room reflects a higher risk (Malicious), the indicator's main verdict will not change until manually updated by an analyst."If an indicator's verdict is set manually, it will not be automatically updated by enrichment or reputation scripts. Manual verdicts must be changed by an analyst."
XSIAM Analyst ILT Lab Guide.pdfPage: Page 37 (Threat Intel Management section)
While investigating an alert, an analyst notices that a URL indicator has a related alert from a previous incident. The related alert has the same URL but it resolved to a different IP address.Which combination of two actions should the analyst take to resolve this issue? (Choose two.)
Answer(s): B,D
The correct answers are B (Remove the relationship between the URL and the older IP address) and D (Enrich the URL indicator).B: If the same URL now resolves to a new IP, but old relationships are still present, the analyst should remove the outdated relationship between the URL indicator and the previous IP address to avoid confusion in future investigations.D: Enriching the URL indicator will update its context, relationships, and threat intelligence attributes, ensuring the indicator reflects the most accurate and current data."Analysts should remove obsolete relationships between indicators and enrich indicators to update contextual data as network conditions change (e.g., when a URL points to a new IP address)."
XSIAM Analyst ILT Lab Guide.pdfPage: Page 36-37 (Threat Intel Management section)
Post your Comments and Discuss Palo Alto Networks XSIAM-Analyst exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the XSIAM-Analyst content, but please register or login to continue.