XSIAM-Engineer practice questions 1–10

1. Question 1 · 62 in bank

   Select 2

   In which two locations can correlation rules be monitored for errors? (Choose two.)

   • AXDR Collector audit logs (type = Rules, subtype = Error)
   • Bcorrelations_auditing dataset through XQL
   • CManagement audit logs (type = Rules, subtype = Error)
   • DAlerts table as a health alert

   Show answer

   Answer: BD

   Next question

2. Question 2 · 62 in bank

   Which option should be used when customizing a dashboard in Cortex XSIAM to include a widget that will display data filtered by more than one dynamic value?

   • AFree text/number
   • BMulti-select
   • CFixed filter
   • DSingle-select

   Show answer

   Answer: B

   Next question

3. Question 3 · 62 in bank

   How must Cloud Identity Engine be deployed and activated on Cortex XSIAM?

   • AIn a different region than Cortex XSIAM; logs can be verified using pan_dss_raw dataset
   • BIn a different region than Cortex XSIAM; logs can be verified using endpoints dataset
   • CIn the same region as Cortex XSIAM; logs can be verified using pan_dss_raw dataset
   • DIn the same region as Cortex XSIAM; logs can be verified using endpoints dataset

   Show answer

   Answer: C

   Next question

4. Question 4 · 62 in bank

   How will Cortex XSIAM help with raw log ingestion from third-party sources in an existing infrastructure?

   • AAny structured logs coming into it are left completely unchanged, and only metadata is added to the raw data.
   • BFor structured logs, like CEF, LEEF, and JSON, it decouples the key-value pairs and saves them in table format.
   • CAny unstructured logs coming into it are left completely unchanged, and metadata is not added to the raw data.
   • DFor unstructured logs, it decouples the key-value pairs and saves them in a table format.

   Show answer

   Answer: B

   Next question

5. Question 5 · 62 in bank

   Which common issue can result in sudden data ingestion loss for a data source that was previously successful?

   • AData source is using an unsupported data format.
   • BData source has reached its maximum storage capacity.
   • CData source has reached its end of life for support.
   • DAPI key used for the integration has expired.

   Show answer

   Answer: D

   Next question

6. Question 6 · 62 in bank

   Select 2

   While using the remote repository on a Development XSIAM tenant, which two objects can be pushed or pulled to the remote repository? (Choose two.)

   • AScripts
   • BParsing rules
   • CLists
   • DLayouts

   Show answer

   Answer: AD

   Next question

7. Question 7 · 62 in bank

   Select 2

   When a Cortex XSIAM playbook execution reaches a breakpoint on a non-manual task, which two actions will allow the playbook to continue? (Choose two.)

   • ADisable the breakpoint and rerun the playbook from the start.
   • BSkip the task with the breakpoint to let the playbook proceed automatically.
   • CWait for all parallel tasks to be completed before the breakpoint task resumes automatically.
   • DClick Run Script Now or Complete Manually.

   Show answer

   Answer: BD

   Next question

8. Question 8 · 62 in bank

   What is the purpose of using rolling tokens to manage Cortex XDR agents?

   • ATo periodically rotate encryption keys used for tenant communication
   • BTo perform administration on agents without requiring static credentials
   • CTo authorize agents to download and install content updates
   • DTo temporarily disable the agents during maintenance windows

   Show answer

   Answer: B

   Next question

9. Question 9 · 62 in bank

   Based on the image below, which statement applies to the ability to remove tabs when creating a new alert layout?

   

   • AOnly "Alert Info" tab can be removed.
   • BOnly "Alert Info" and "War Room" tabs can be removed.
   • COnly "War Room" and "Work Plan" tabs can be removed.
   • DOnly "Work Plan" tab can be removed.

   Show answer

   Answer: A

   Next question

10. Question 10 · 62 in bank

    A Cortex XSIAM engineer is developing a playbook that uses reputation commands such as '!ip' to enrich and analyze indicators. Which statement applies to the use of reputation commands in this scenario?

    • AIf no reputation integration instance is configured, the '!ip' command will execute but will return no results.
    • BReputation commands such as '!ip' will fail if the required reputation integration instance is not configured and enabled.
    • CThe mapping flow for enrichment commands is disabled if extraction is set to "None."
    • DEnrichment data will not be saved to the indicator unless the extraction setting is manually configured in the playbook task.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

XSIAM-Engineer practice, question 1. 62 questions available.