XSIAM-ENGINEER Exam Questions
69 real XSIAM-ENGINEER exam questions with expert-verified answers and explanations. Page 2 of 2.
- Question #51Identity and Access Management
To enable authentication integration for automated user provisioning in Cortex XSIAM, what steps are essential?
LDAP syncSAML SSOuser provisioningauthentication integration - Question #52Content Management and Access Control
After deploying a new content pack, a user cannot access associated playbooks. What is the most likely cause?
content pack deploymentplaybook permissionsrole-based access controltroubleshooting - Question #53Integration Development
Using the integrationContext object, how is data stored and retrieved between integration command runs in Cortex XSIAM?
integrationContextget_integration_contextset_integration_contextintegration development - Question #54Content Management and Marketplace
Which types of content may be included in a Marketplace content pack?
Marketplace content packplaybooksintegrationscorrelation rules - Question #55Detection Engineering and Correlation
Cortex XSIAM has not received any logs for 30 minutes from a Palo Alto Networks NGFW named "MainFW." An engineer wants to create an alert for this scenario. Correlation rule settin...
correlation ruleslog gap detectionNGFW monitoringXQL query - Question #56Content Management and Maintenance
A Cortex XSIAM engineer at a SOC downgrades a critical threat intelligence content pack from the Cortex Marketplace while performing routine maintenance. As a result, the SOC team...
content pack versioningMarketplace rollbackmaintenancepack reinstallation - Question #57Alert Management and Notification
Which two alert notification options can be configured without creating a playbook? (Choose two.)
alert notificationsEmailSlacknotification configuration - Question #58Agent Management and Infrastructure
An engineer needs to migrate Cortex XDR agents without internet connection from Cortex XSIAM tenant A to Cortex XSIAM tenant B. There is a broker configured for each tenant. This i...
agent migrationbroker configurationmulti-tenant architectureoffline agents - Question #59Data Ingestion and Normalization
Which field is automatically mapped from the dataset to the data model when creating a data model rule?
data model rules_event_typeautomatic field mappingdataset normalization - Question #60Integration and Automation
What are two commonly used automation integrations in Cortex XSIAM for third-party connectivity?
automation integrationsPagerDutyServiceNowthird-party connectivity - Question #61Data Ingestion and Parsing
If Cortex XSIAM is ingesting logs from a custom application, which is most likely required?
custom parsing ruleslog ingestioncustom applicationdata collection - Question #62Content Management and Marketplace
What indicates that a new version of a content pack is available for update in Cortex XSIAM Marketplace?
content packmarketplaceversion managementUI navigation - Question #63Incident Management
What should be considered when creating a custom incident domain?
custom incident domainalert groupingSmartScoreincident configuration - Question #64Deployment and Agent Management
How does Cortex XSIAM manage licensing for Kubernetes environments?
Kuberneteslicensingagent managementnode-based licensing - Question #65Content Management and Marketplace
A Cortex XSIAM engineer is preparing to install a new content pack and notices that there are several optional content packs associated with the main one that needs to be installed...
content packdependenciesoptional packsmarketplace installation - Question #66Incident Management
In the Incident War Room, which command is used to update incident fields identified in the incident layout?
War Roomincident fieldsCLI commandsincident layout - Question #67Playbook Development and Automation
Based on the images below, which command will allow the context data to be displayed as a table when troubleshooting a playbook task?
playbook troubleshootingcontext datatable displayCLI commands - Question #68Query Language and Data Analysis
What is the role of "in" in the query line below? action_local_port in (1122, 2234)
XQL queryoperatorsquery syntaxdata querying - Question #69Data Ingestion and Parsing
Which section of a parsing rule defines the newly created dataset?
parsing ruledataset definitionCOLLECT sectionrule structure