XSIAM-Engineer practice questions 51–60

1. Question 51 · 62 in bank

   Which action is required to enable use of a custom script in an alert layout?

   • ATag the script with "dynamic-section," add a general purpose dynamic section, and edit the section settings to add the automation script.
   • BTag the script with "general-purpose-dynamic-section," add a custom script section, and edit the section settings to add the automation script.
   • CAdd a general purpose dynamic section and edit the section settings to add the automation script.
   • DTag the script with "general-purpose-dynamic-section," add a general purpose dynamic section, and edit the section settings to add the automation script.

   Show answer

   Answer: A

   Next question

2. Question 52 · 62 in bank

   What is the reason all Broker VM options are greyed out when a user attempts to select a Broker VM as a download source in the Agent Settings profile?

   • AThe Broker VM is offline.
   • BNTP is not synchronized properly on the Broker VM.
   • CLocal Agent Setting applet is currently activated without SSL certificate.
   • DLocal Agent Setting applet is currently activated without FQDN.

   Show answer

   Answer: D

   Next question

3. Question 53 · 62 in bank

   What is a key characteristic of a parsing rule in Cortex XSIAM?

   • AIt uses regular expressions exclusively for data modifications, discards unmatched logs by default, and only retains fields with non-null values.
   • BIt is bound to all vendors and products, performs data parsing once per log, and does not allow grouping.
   • CIt is bound to a specific vendor and product, performs data parsing once per log, and does not allow grouping.
   • DIt is bound to a specific vendor and product which allow grouping with a no-match policy, and retains all fields.

   Show answer

   Answer: D

   Next question

4. Question 54 · 62 in bank

   Which type of parsing error is categorized in the dataset "parsing_rules_errors"?

   • ACompilation
   • BUnrecognized code
   • CInvalid syntax
   • DData mismatch

   Show answer

   Answer: A

   Next question

5. Question 55 · 62 in bank

   Select 2

   Before initiating a malware scan action on a Linux workstation, an engineer notices that the Cortex XDR agent's operational status on the workstation is reporting as "partially protected." There have been no configuration changes made from the Cortex XSIAM server. What are two explanations for this operational status? (Choose two.)

   • AThe Linux endpoint is currently running 4.0 kernel version.
   • BThe Linux endpoint's kernel modules failed to load due to unsupported kernel versions.
   • CThe agent is outdated and requires an upgrade to the latest version to regain full protection.
   • DThe agent was manually disabled on the endpoint by the user or an administrator.

   Show answer

   Answer: BC

   Next question

6. Question 56 · 62 in bank

   Select 2

   A Cortex XSIAM engineer is implementing role-based access control (RBAC) and scope-based access control (SBAC) for users accessing the Cortex XSIAM tenant with the following requirements: Users managing machines in Europe should be able to manage and control all endpoints and installations, create profiles and policies, view alerts, and initiate Live Terminal, but only for endpoints in the Europe region. Users managing machines in Europe should not be able to create, modify, or delete new or existing user roles. The Europe region endpoints are identified by both of the following: Endpoint Tag = "Europe-Servers" and Endpoint Group = "Europe" for servers in Europe Endpoint Group = "Europe" and Endpoint Tag = "Europe-Workstation" for workstations in Europe Which two sets of implementation actions should the engineer take? (Choose two.)

   • AVerify and confirm that SBAC mode under "Server Settings" is set to "Restrictive," and assign "EG:Europe" under the user permission scope configuration.
   • BUse the pre-defined roles, assign the "Instance Administrator" role to the user or user group managing Europe-based endpoints.
   • CVerify and confirm that SBAC mode under "Server Settings" is set to "Permissive," and assign "EG:Europe" under the user permission scope configuration.
   • DUse the pre-defined roles, assign the "Privileged IT Admin" role to the user or user group managing Europe-based endpoints.

   Show answer

   Answer: AD

   Next question

7. Question 57 · 62 in bank

   Administrators from Building 3 have been added to Cortex XSIAM to perform limited functions on a subset of endpoints. Custom roles have been created and applied to the administrators to limit their permissions, but their access should also be constrained through the principle of least privilege according to the endpoints they are allowed to manage. All endpoints are part of an endpoint group named "Building3," and some endpoints may also be members of other endpoint groups. Which technical control will restrict the ability of the administrators to manage endpoints outside of their area of responsibility, while maintaining visibility to Building 3's endpoints?

   • ASBAC enabled in Building 3's IP range with the "EG:Building3" tag assigned to each administrator's scope
   • BSBAC enabled in Permissive Mode with the "EG:Building3" tag assigned to each administrator's scope
   • CSBAC enabled in Restrictive Mode with the "EG:Building3" tag assigned to each administrator's scope
   • DSBAC enabled globally with the "EG:Building3" tag assigned to each administrator's scope

   Show answer

   Answer: C

   Next question

8. Question 58 · 62 in bank

   While using the playbook debugger, an engineer attaches the context of an alert as test data. What happens with respect to the interactions with the list objects via tasks in this scenario?

   • AThe original content of the list and the original context are not altered, because Cortex XSIAM is running inside debug mode.
   • BThe original content of the list is not altered, but the original context is, because XSIAM commands are running within debug mode.
   • CThe original content of the list is altered, but the original context is not, because Cortex XSIAM commands interact directly with the original list objects within debug mode.
   • DThe original content of the list and the original context are altered, because Cortex XSIAM tasks interact directly with the objects, even within debug mode.

   Show answer

   Answer: A

   Next question

9. Question 59 · 62 in bank

   What is the primary function of the URL "https://<region>-docker.pkg.dev" in the context of a Palo Alto Networks infrastructure?

   • AIt downloads Docker content updates.
   • BIt downloads Kubernetes images for agent installation.
   • CIt imports Docker licensing.
   • DIt downloads Engine Docker containers.

   Show answer

   Answer: D

   Next question

10. Question 60 · 62 in bank

    In the Marketplace, a Cortex XSIAM engineer sees the revision note for a content pack with new alert fields, updated alert layouts, and a revised playbook. The engineer completes the update without errors. The new alert fields and layouts are then reflected, but the playbook is not updated. What is the reason for this behavior?

    • AThe playbook is detached.
    • BThe playbook was duplicated for use.
    • CThe playbook is being used in incident configuration.
    • DThe last execution of the playbook resulted in an error.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

XSIAM-Engineer practice, question 51. 62 questions available.