最新的Palo Alto Networks XSIAM-Analyst免費考試真題

問題1

Which query will hunt for only incoming traffic from 99.99.99.99 when all log sources have been mapped to XDM?

A. preset = network_story | filter agent_ip_addresses = "99.99.99.99"

B. xdm.source.ipv4 = "99.99.99.99"
datamodel dataset = * | filter XDM.ALIAS.ipv4 = "99.99.99.99"

C. datamodel preset = * | filter XDM.ALIAS.ip = "99.99.99.99"

D. datamodel dataset = * | fields fieldset.xdm_network | filter

正確答案: D

說明：（僅 Fast2test 成員可見）

問題2

Which two statements apply to IOC rules? (Choose two.)

A. They can be used to detect a specific registry key.

B. They can be excluded using suppression rules but not alert exclusions.

C. They can be uploaded using REST API.

D. They can have an expiration date of up to 180 days.

正確答案: A,C

說明：（僅 Fast2test 成員可見）

問題3

When a sub-playbook loops, which task tab will allow an analyst to determine what data the sub- playbook used in each iteration of the loop?

A. Outputs

B. Results

C. Inputs

D. Input Results

正確答案: D

說明：（僅 Fast2test 成員可見）

問題4

Which attribution evidence will have the lowest confidence level when evaluating assets to determine if they belong to an organization's attack surface?

A. An asset discovered through registration information attributed to the organization

B. An asset manually approved by a Cortex Xpanse analyst

C. An asset attributed to the organization because the Subject Organization field contains the company name

D. An asset attributed to the organization because the name server domain contains the company domain

正確答案: C

說明：（僅 Fast2test 成員可見）

問題5

An incident in Cortex XSIAM contains the following series of alerts:
10:24:17 AM - Informational Severity - XDR Analytics BIOC - Rare
process execution in organization
10:24:18 AM - Low Severity - XDR BIOC - Suspicious AMSI DLL load
location
10:24:20 AM - Medium Severity - XDR Agent - WildFire Malware
11:57:04 AM - High Severity - Correlation - Suspicious admin account
creation
Which alert was responsible for the creation of the incident?

A. Suspicious AMSI DLL load location

B. Rare process execution in organization

C. WildFire Malware

D. Suspicious admin account creation

正確答案: B

說明：（僅 Fast2test 成員可見）

問題6

Which configuration will ensure any alert involving a specific critical asset will always receive a score of 100?

A. A risk scoring policy for the critical asset

B. SmartScore to apply the specific score to the critical asset

C. An asset as critical in Asset Inventory

D. A user scoring rule for the critical asset

正確答案: A

說明：（僅 Fast2test 成員可見）

問題7

You observe that a CVE is impacting multiple assets. How can you use ASM to investigate further? (Choose two)

A. Validate attack surface rule hits

B. Trigger a Cortex data purge

C. Review asset tags and status

D. Disable detection rules

正確答案: A,C

問題8

A threat hunter discovers a true negative event from a zero-day exploit that is using privilege escalation to launch "Malware.pdf.exe." Which XQL query will always show the correct user context used to launch "Malware.pdf.exe"?
config case_sensitive = false | dataset = xdr_data | filter event_type =

A. ENUM.PROCESS | filter action_process_image_name = "Malware.pdf.exe" |
fields causality_actor_effective_username
config case_sensitive = false | dataset = xdr_data | filter event_type =

B. xdm.source.process.name = "Malware.pdf.exe" | fields
xdm.target.user.username
config case_sensitive = false | dataset = xdr_data | filter event_type =

C. ENUM.PROCESS | filter action_process_image "Malware.pdf.exe" | fields
actor_process_username

D. ENUM.PROCESS | filter action_process_image_name = "Malware.pdf.exe" |
fields action_process_username
config case_sensitive = false | datamodel dataset = xdr_data | filter

正確答案: A

說明：（僅 Fast2test 成員可見）

最新的Palo Alto Networks XSIAM Analyst - XSIAM-Analyst免費考試真題

聯系我們

站內鏈接

最新更新