XSIAM-Engineer Practice Test

XSIAM-Engineer Practice Test practice questions, page 5 of 6, with answer review and explanations.

Question 21

Which step must be taken to enable Cloud Identity Engine on Cortex XSIAM?

  1. Enable SSO integration.
  2. Activate it in the Customer Support Portal.
  3. Activate it on HUB.
  4. Enable Active Directory log collection.

Question 22

A vulnerability analyst asks a Cortex XSIAM engineer to identify assets vulnerable to newly reported zero-day CVE affecting the "ai_app" application and versions 12.1, 12.2, 12.4, and 12.5. Which XQL query will provide the required result?

Question 23

When Cortex XDR agents are on servers in a zone with no internet access, which configuration will keep them communicating with the platform?

  1. Logging service in the isolated zone
  2. Broker VM
  3. Integration using filebeat
  4. Engine

Question 24

Which installer type should be used when upgrading a non-Linux Kubernetes cluster?

  1. Standalone
  2. Helm
  3. Upgrade from ESM
  4. Kubernetes

Question 25

A systems engineer overseeing the integration of data from various sources through data pipelines into Cortex XSIAM notices modifications occurring during the ingestion process, and these modifications reduce the accuracy of threat detection and response. The engineer needs to assess the risks associated with the pre-ingestion data modifications and develop effective solutions for data integrity and system efficacy. Which set of steps must be followed to meet these goals?

  1. Develop an advanced monitoring system to track and log all changes made to data during ingestion, and use analytics to compare pre- and post-ingestion states based on XDM to identify and mitigate discrepancies.
  2. Design a hybrid approach for critical data fields to be safeguarded against modifications during ingestion, while less critical data fields undergo allowable modifications that are rectified post-ingestion by using XDM to balance performance with data integrity.
  3. Implement a pre-ingestion data validation process that aligns with the post-ingestion standards set by XDM, ensuring data consistency and integrity before it enters Cortex XSIAM.
  4. Establish a process to minimize data modifications during ingestion, prioritizing raw data capture and using XDM post-ingestion for necessary transformations and integrity checks.