XSIAM-Engineer Exam Dumps - Palo Alto Networks XSIAM Engineer

Go to page:

Question # 4

What is the primary benefit of setting the "--memory-swap" option to "-1" during Cortex XSIAM engine deployment?

It enhances the network throughput by optimizing memory usage.

It increases the total disk space available to the engine.

It allows the engine to operate without requiring swap capabilities.

It automatically doubles the available RAM to the engine.

Full Access

Question # 5

What is the function of the "MODEL" section when creating a data model rule?

To make a list of all the relevant fields to be mapped from the logs to XDM

To define the mapping between a single dataset and XDM

To finalize rule definition with all XQL statements

To map log fields to corresponding Cortex XSIAM Data Model (XDM) fields

Full Access

Question # 6

An engineer needs to migrate Cortex XDR agents without internet connection from Cortex XSIAM tenant A to Cortex XSIAM tenant B. There is a broker configured for each tenant. This is the communication flow:

XDR agents <-> Broker A <-> XSIAM tenant A

XDR agents <-> Broker B <-> XSIAM tenant B

Which two steps should be taken before moving the agents? (Choose two.)

Install a new Broker C on site B, and register it into Cortex XSIAM tenant A.

Install a new Broker C on site and register it into Cortex XSIAM tenant B.

Also register Broker A to Cortex XSIAM tenant B.

Select all endpoints in the console and add a new Broker C as proxy.

Full Access

Question # 7

A security engineer notices that in the past week ingestion has spiked significantly. Upon investigating the anomaly, it is determined that a custom application developed in-house caused the spike. The custom application is sending syslog to the Broker VM Syslog Collector applet. The engineer consults with the SOC analyst, who determines that 90% of the logs from the custom application are not used.

What can the engineer configure to reduce the ingestion?

Parsing rule to drop the unnecessary data at the Broker VM

Data model rule to drop the unnecessary data

Correlation rule on the Cortex XSIAM server to drop the unnecessary data

Data model rule to map the useful data

Full Access

Question # 8

A vulnerability analyst asks a Cortex XSIAM engineer to identify assets vulnerable to newly reported zero-day CVE affecting the "ai_app" application and versions 12.1, 12.2, 12.4, and 12.5.

Which XQL query will provide the required result?