XSIAM-Engineer practice questions 31–40

1. Question 31 · 62 in bank

   A CISO has asked an engineer to create a custom dashboard in Cortex XSIAM that can be filtered to show incidents assigned to a specific user. Which feature should be used to filter the incident data in the dashboard?

   • AFilters and inputs in the custom dashboard
   • BReport template to set the incident user filter
   • CVisualization filter options in the widget configuration
   • DIncident summary view to filter by user

   Show answer

   Answer: A

   Next question

2. Question 32 · 62 in bank

   How can a Cortex XSIAM engineer resolve the issue when a SOC analyst escalates missing details after merging two similar incidents?

   • ACheck the War Room of the destination incident.
   • BExamine the incident context of the source incident.
   • CUnmerge the incidents and copy the missing details into the incident notes.
   • DCheck the child incident of the destination incident.

   Show answer

   Answer: A

   Next question

3. Question 33 · 62 in bank

   Which cytool command will look up the policy being applied to a Cortex XDR agent?

   • Acytool adaptive_policy interval 0
   • Bcytool payload_execution query
   • Ccytool adaptive_policy recalc
   • Dcytool persist print agent_settings.db

   Show answer

   Answer: D

   Next question

4. Question 34 · 62 in bank

   A file for a support exception that needs to be updated locally on a Linux endpoint has been supplied. Which cytool command will upload this support exception file to the endpoint?

   • Acytool upload suexfile -target </local/file/path>
   • Bcytool upload suex -file </local/file/path>
   • Ccytool import suex -path </local/file/path>
   • Dcytool import suexfile -path </local/file/path>

   Show answer

   Answer: C

   Next question

5. Question 35 · 62 in bank

   Which types of content may be included in a Marketplace content pack?

   • AIntegrations, playbooks, parsers, and server configuration keys
   • BPredefined dashboards, indicators, and reports
   • CScripts, playbooks, integrations, and correlation rules
   • DBehavioral indicator of compromise (BIOC) rules, layouts, and custom dashboards

   Show answer

   Answer: C

   Next question

6. Question 36 · 62 in bank

   Using the integrationContext object, how is data stored and retrieved between integration command runs in Cortex XSIAM?

   • AThe integrationContex object can only store strings, not key-value dictionaries.
   • BThe integrationContex object is retrieved and set using the test-module command.
   • CThe get_integration_context() method overrides the existing object that is stored.
   • DThe integrationContex object supports get_integration_context() and set_integration_context().

   Show answer

   Answer: D

   Next question

7. Question 37 · 62 in bank

   Cortex XSIAM has not received any logs for 30 minutes from a Palo Alto Networks NGFW named "MainFW.” An engineer wants to create an alert for this scenario. Correlation rule settings include: Time Schedule: Every 30 minutes - Query Timeframe: 30 minutes - Action: Generate alert - Alert Name: No logs received from MainFW in the past 30 minutes Which query should be used in the correlation rule?

   • A//IMG//
   • B//IMG//
   • C//IMG//
   • D//IMG//

   Show answer

   Answer: D

   Next question

8. Question 38 · 62 in bank

   A Cortex XSIAM engineer at a SOC downgrades a critical threat intelligence content pack from the Cortex Marketplace while performing routine maintenance. As a result, the SOC team loses access to the latest threat intelligence data. Which action will restore the functionality of the content pack to its previously installed version?

   • AContact Palo Alto Networks Support to create an exception to revert to the previously installed version.
   • BBack up the current configuration and data, then revert to the previously installed version.
   • CRemove all integrations and playbooks associated with the content pack, then revert to the previously installed version.
   • DDirectly reinstall the previously installed version over the current one.

   Show answer

   Answer: D

   Next question

9. Question 39 · 62 in bank

   Select 2

   Which two alert notification options can be configured without creating a playbook? (Choose two.)

   • APager Duty
   • BEmail
   • CSlack
   • DSMS

   Show answer

   Answer: BC

   Next question

10. Question 40 · 62 in bank

    Select 2

    An engineer needs to migrate Cortex XDR agents without internet connection from Cortex XSIAM tenant A to Cortex XSIAM tenant B. There is a broker configured for each tenant. This is the communication flow: XDR agents <-> Broker A <-> XSIAM tenant A XDR agents <-> Broker B <-> XSIAM tenant B Which two steps should be taken before moving the agents? (Choose two.)

    • AInstall a new Broker C on site B, and register it into Cortex XSIAM tenant A.
    • BInstall a new Broker C on site and register it into Cortex XSIAM tenant B.
    • CAlso register Broker A to Cortex XSIAM tenant B.
    • DSelect all endpoints in the console and add a new Broker C as proxy.

    Show answer

    Answer: BC

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

XSIAM-Engineer practice, question 31. 62 questions available.