Which step must be taken to enable Cloud Identity Engine on Cortex XSIAM?
Answer(s): C
To enable Cloud Identity Engine on Cortex XSIAM, it must first be activated on HUB, Palo Alto Networks' centralized service management platform. Once activated, it can be configured and integrated with Cortex XSIAM for identity-based visibility and enforcement.
A vulnerability analyst asks a Cortex XSIAM engineer to identify assets vulnerable to newly reported zero-day CVE affecting the "ai_app" application and versions 12.1, 12.2, 12.4, and 12.5.Which XQL query will provide the required result?A)B)C)D)
The correct query is the preset = host_inventory_applications with filters for application_name contains "ai_app" and version in ("12.1", "12.2", "12.4", "12.5"). This directly identifies hosts that have the vulnerable application and specific versions installed, matching the analyst's request to find assets exposed to the zero-day CVE.
When Cortex XDR agents are on servers in a zone with no internet access, which configuration will keep them communicating with the platform?
Answer(s): B
For Cortex XDR agents running on servers in zones without internet access, a Broker VM is used as a communication bridge. The Broker VM securely relays traffic between the isolated agents and the Cortex platform, maintaining connectivity without requiring direct internet access from the servers.
Which installer type should be used when upgrading a non-Linux Kubernetes cluster?
For upgrading a non-Linux Kubernetes cluster, the correct installer type is Helm, since Helm charts are the supported method for deploying and managing Cortex XDR agents in Kubernetes environments.
A systems engineer overseeing the integration of data from various sources through data pipelines into Cortex XSIAM notices modifications occurring during the ingestion process, and these modifications reduce the accuracy of threat detection and response. The engineer needs to assess the risks associated with the pre-ingestion data modifications and develop effective solutions for data integrity and system efficacy.Which set of steps must be followed to meet these goals?
Answer(s): D
The best approach is to minimize data modifications during ingestion, prioritizing raw data capture to preserve accuracy. Then, apply XDM (XSIAM Data Model) transformations and integrity checks post- ingestion. This ensures that threat detection and response are based on unaltered, high-fidelity data while still enabling normalization and enrichment after ingestion.
Post your Comments and Discuss Palo Alto Networks XSIAM-Engineer exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the XSIAM-Engineer content, but please register or login to continue.