XSIAM-Engineer practice questions 41–50

1. Question 41 · 62 in bank

   Which field is automatically mapped from the dataset to the data model when creating a data model rule?

   • A_event_type
   • B_insert_time
   • C_host_name
   • D_cloud_id

   Show answer

   Answer: B

   Next question

2. Question 42 · 62 in bank

   Select 2

   A Cortex XSIAM engineer plans to add Kafka and Syslog Collectors to a Broker VM cluster. What are two expected behaviors of the applets when they are added to the cluster? (Choose two.)

   • ASyslog Collector applet is automatically initiated, enters an active state on the primary node, and is on standby on the standby nodes.
   • BKafka Collector applet is automatically initiated, enters an active state on the primary node, and is on standby on the standby nodes.
   • CSyslog Collector applet is active on all cluster nodes, including primary and standby.
   • DKafka Collector applet is active on all cluster nodes, including primary and standby.

   Show answer

   Answer: BC

   Next question

3. Question 43 · 62 in bank

   Based on the _raw_log and XQL query information below, what will be the result(s) of the temp_value?

   

   • A123 192.168.10.1
   • B20
   • C10.120.80.2
   • D149.235.219.208 59977

   Show answer

   Answer: A

   Next question

4. Question 44 · 62 in bank

   When activating the Cortex XSIAM tenant, how is the data at rest configured with AES 128 encryption?

   • AUnder Advanced -> Encryption Method, choose the desired encryption method during the initial setup of the tenant.
   • BUnder Advanced, choose "BYOK," and adhere to the wizard's instructions as outlined in the encryption method section.
   • CCreate encryption keys with AES 128 and upload it securely through Cortex Gateway.
   • DUnder Advanced -> Encryption Method, choose the desired encryption method after the initial setup of the tenant.

   Show answer

   Answer: A

   Next question

5. Question 45 · 62 in bank

   A sub-playbook is configured to loop with a For Each Input. The following inputs are given to the sub-playbook: Input x: W,X,Y,Z - Input y: a,b,c,d - Input z: 9 - Which inputs will be used for the second iteration of the loop?

   • Aa,b,c,d
   • BX,b,9
   • CX,b
   • DX,b,c

   Show answer

   Answer: B

   Next question

6. Question 46 · 62 in bank

   The following string is a value of a key named "Data2" in the context: {"@admin":"admin","@dirtyld":"1","@loc":"Lab","@name":"default1","@oldname":"Test","@time":"2024/08/28 07:45:15","alert":{"@admin":"admin","@dirtyld":"2","@time":"2024/08/28 07:45:15","member":{"#text":" Based on the image below, what will be displayed in the "Test result" field when the "Test" button is pressed?

   

   • A1
   • B"1
   • C2
   • D"2

   Show answer

   Answer: A

   Next question

7. Question 47 · 62 in bank

   A Cortex XDR agent is installed on an endpoint, but the agent is unable to download content updates and has not registered with the Cortex XSIAM server. An engineer troubleshoots the network connection and determines that, by design, this endpoint does not have direct internet access to the required network destinations for the Cortex XDR agent traffic. A Broker VM that has the local agent settings applet enabled with Agent Proxy configured is reachable by the endpoint. The Broker VM details are as follows: FQDN: crtxbroker01.company.net - Proxy listening port: 8888 - How should the engineer configure the Cortex XDR agent to use the existing Broker VM as a proxy for the agent network traffic?

   • Acytool proxy set "crtxbroker01. company.net: 8888"
   • Bcytool config proxy --host crtxbroker01.company.net --port 8888
   • Ccytool set proxy --host crtxbroker01.company.net --port 8888
   • Dcytool proxy config "crtxbroker01.company.net:8888"

   Show answer

   Answer: A

   Next question

8. Question 48 · 62 in bank

   A Behavioral Threat Protection (BTP) alert is triggered with an action of "Prevented (Blocked)" on one of several application servers running Windows Server 2022. The investigation determines the involved processes to be legitimate core OS binaries, and the description from the triggered BTP rule is an acceptable risk for the company to allow the same activity in the future. This type of activity is only expected on the endpoints that are members of the endpoint group "AppServers," which already has a separate prevention policy rule with an exceptions profile named "Exceptions-AppServers" and a malware profile named "Malware-AppServers." The CGO that was terminated has the following properties: SHA256: eb71ea69dd19f728ab9240565e8c7efb59821e19e3788e289301e1e74940c208 File path: C:\Windows\System32\cmd.exe Digital Signer: Microsoft Corporation How should the exception be created so that it is scoped as narrowly as possible to minimize the security gap?

   • ACreate the exception via the alert itself, selecting the CGO hash, CGO signer, CGO process path, and applying the scope to the "Exceptions-AppServers" profile.
   • BCreate a Disable Prevention Rule via Exceptions Configuration with the following selections: //IMG//
   • CCreate a Legacy Agent Exception via Exceptions Configuration with the following selections: //IMG//
   • DCreate the exception via the alert itself, selecting the CGO hash, CGO signer, CGO process path, and applying the scope to "Global."

   Show answer

   Answer: A

   Next question

9. Question 49 · 62 in bank

   Which action will prevent the automatic extraction of indicators such as IP addresses and URLs from a script's output?

   • AAdd 'ExtractIndicators': False to the script.
   • BAdd 'IgnoreAutoExtract': True to the script.
   • CUse 'AutoExtract': False in the script.
   • DSet 'IndicatorExtraction': None in the script.

   Show answer

   Answer: B

   Next question

10. Question 50 · 62 in bank

    An application which ingests custom application logs is hosted in an on-premises virtual environment on an Ubuntu server, and it logs locally to a .csv file. Which set of actions will allow the ingestion of the .csv logs into Cortex XSIAM directly from the server?

    • AInstall a Broker VM in the environment, and configure the CSV Collector to collect the files of interest.
    • BInstall a Cortex XDR agent on the Ubuntu server, and configure the agent to collect the files of interest.
    • CInstall a Broker VM in the environment, and migrate the application to the Broker VM.
    • DInstall XDR Collector on the Ubuntu server, and configure the agent to collect the files of interest.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

XSIAM-Engineer practice, question 41. 62 questions available.