XSIAM-Engineer practice questions 21–30

1. Question 21 · 62 in bank

   Which step must be taken to enable Cloud Identity Engine on Cortex XSIAM?

   • AEnable SSO integration.
   • BActivate it in the Customer Support Portal.
   • CActivate it on HUB.
   • DEnable Active Directory log collection.

   Show answer

   Answer: C

   Next question

2. Question 22 · 62 in bank

   A vulnerability analyst asks a Cortex XSIAM engineer to identify assets vulnerable to newly reported zero-day CVE affecting the "ai_app" application and versions 12.1, 12.2, 12.4, and 12.5. Which XQL query will provide the required result?

   • A//IMG//
   • B//IMG//
   • C//IMG//
   • D//IMG//

   Show answer

   Answer: C

   Next question

3. Question 23 · 62 in bank

   When Cortex XDR agents are on servers in a zone with no internet access, which configuration will keep them communicating with the platform?

   • ALogging service in the isolated zone
   • BBroker VM
   • CIntegration using filebeat
   • DEngine

   Show answer

   Answer: B

   Next question

4. Question 24 · 62 in bank

   Which installer type should be used when upgrading a non-Linux Kubernetes cluster?

   • AStandalone
   • BHelm
   • CUpgrade from ESM
   • DKubernetes

   Show answer

   Answer: B

   Next question

5. Question 25 · 62 in bank

   A systems engineer overseeing the integration of data from various sources through data pipelines into Cortex XSIAM notices modifications occurring during the ingestion process, and these modifications reduce the accuracy of threat detection and response. The engineer needs to assess the risks associated with the pre-ingestion data modifications and develop effective solutions for data integrity and system efficacy. Which set of steps must be followed to meet these goals?

   • ADevelop an advanced monitoring system to track and log all changes made to data during ingestion, and use analytics to compare pre- and post-ingestion states based on XDM to identify and mitigate discrepancies.
   • BDesign a hybrid approach for critical data fields to be safeguarded against modifications during ingestion, while less critical data fields undergo allowable modifications that are rectified post-ingestion by using XDM to balance performance with data integrity.
   • CImplement a pre-ingestion data validation process that aligns with the post-ingestion standards set by XDM, ensuring data consistency and integrity before it enters Cortex XSIAM.
   • DEstablish a process to minimize data modifications during ingestion, prioritizing raw data capture and using XDM post-ingestion for necessary transformations and integrity checks.

   Show answer

   Answer: D

   Next question

6. Question 26 · 62 in bank

   An engineer is conducting a threat actor emulated test to determine which Cortex XDR module would provide protection or alert on a real-world attack. The first test was prevented. Which action must the engineer take to enable continued testing?

   • ARemove the hash from the restrictions profile.
   • BAdd an indicator exclusion.
   • CAdd a prevention rule.
   • DChange the profile from "alert" to "prevent" for the BTP module.

   Show answer

   Answer: B

   Next question

7. Question 27 · 62 in bank

   A Cortex XSIAM engineer adds a disable injection and prevention rule for a specific running process. After an hour, the engineer disables the rule to reinstate the security capabilities, but the capabilities are not applied. What is the explanation for this behavior?

   • AThe engineer needs to restart the process to get back the security capabilities.
   • BThe engineer needs a support exception to get back the security capabilities.
   • CThe engineer needs to wait for the time period configured in the rule to pass first.
   • DThe engineer can disable the rule, but security capabilities are not applied to the process.

   Show answer

   Answer: A

   Next question

8. Question 28 · 62 in bank

   A security engineer notices that in the past week ingestion has spiked significantly. Upon investigating the anomaly, it is determined that a custom application developed in-house caused the spike. The custom application is sending syslog to the Broker VM Syslog Collector applet. The engineer consults with the SOC analyst, who determines that 90% of the logs from the custom application are not used. What can the engineer configure to reduce the ingestion?

   • AParsing rule to drop the unnecessary data at the Broker VM
   • BData model rule to drop the unnecessary data
   • CCorrelation rule on the Cortex XSIAM server to drop the unnecessary data
   • DData model rule to map the useful data

   Show answer

   Answer: A

   Next question

9. Question 29 · 62 in bank

   What is the function of the "MODEL" section when creating a data model rule?

   • ATo make a list of all the relevant fields to be mapped from the logs to XDM
   • BTo define the mapping between a single dataset and XDM
   • CTo finalize rule definition with all XQL statements
   • DTo map log fields to corresponding Cortex XSIAM Data Model (XDM) fields

   Show answer

   Answer: B

   Next question

10. Question 30 · 62 in bank

    What is the primary benefit of setting the "--memory-swap" option to "-1" during Cortex XSIAM engine deployment?

    • AIt enhances the network throughput by optimizing memory usage.
    • BIt increases the total disk space available to the engine.
    • CIt allows the engine to operate without requiring swap capabilities.
    • DIt automatically doubles the available RAM to the engine.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

XSIAM-Engineer practice, question 21. 62 questions available.