Online Access Free XSIAM-Analyst Practice Test
| Exam Code: | XSIAM-Analyst |
| Exam Name: | Palo Alto Networks XSIAM Analyst |
| Certification Provider: | Palo Alto Networks |
| Free Question Number: | 72 |
| Posted: | Jun 01, 2026 |
An alert fires indicating lateral movement between endpoints. It was triggered after evaluating multiple unrelated activities, such as credential access and abnormal port scanning. What are likely characteristics of this alert? (Choose two)
A user navigates to a non-malicious URL. The firewall logs contain information on the network connection, and the endpoint logs contain information on the process that triggered the connection-both of which are ingested into Cortex XSIAM.
What is the term for combining this information upon ingestion?
An analyst is responding to a critical incident involving a potential ransomware attack. The analyst immediately initiates full isolation on the compromised endpoint using Cortex XSIAM to prevent the malware from spreading across the network. However, the analyst now needs to collect additional forensic evidence from the isolated machine, including memory dumps and disk images, without reconnecting it to the network.
Which action will allow the analyst to collect the required forensic evidence while ensuring the endpoint remains fully isolated?
An alert involves credential dumping. Reviewing the causality chain, you notice the following:
- lsass.exe is accessed by powershell.exe
- Prior to this, cmd.exe launched the PowerShell script
What can you infer?