New Year Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

Paloalto Networks XSIAM-Engineer - Palo Alto Networks XSIAM Engineer

Paloalto Networks XSIAM-Engineer Premium Access     Download Demo    
Page: 2 / 2
Total 59 questions

What should be considered when creating a custom incident domain?

A.

Alert grouping will not apply, but SmartScore will.

B.

Alert grouping will apply, but SmartScore will not.

C.

Alert grouping and SmartScore will not be applied to incidents.

D.

Alert grouping and SmartScore will be applied to incidents.

What is the function of the "MODEL" section when creating a data model rule?

A.

To make a list of all the relevant fields to be mapped from the logs to XDM

B.

To define the mapping between a single dataset and XDM

C.

To finalize rule definition with all XQL statements

D.

To map log fields to corresponding Cortex XSIAM Data Model (XDM) fields

When activating the Cortex XSIAM tenant, how is the data at rest configured with AES 128 encryption?

A.

Under Advanced -> Encryption Method, choose the desired encryption method during the initial setup of the tenant.

B.

Under Advanced, choose "BYOK," and adhere to the wizard's instructions as outlined in the encryption method section.

C.

Create encryption keys with AES 128 and upload it securely through Cortex Gateway.

D.

Under Advanced -> Encryption Method, choose the desired encryption method after the initial setup of the tenant.

How must Cloud Identity Engine be deployed and activated on Cortex XSIAM?

A.

In a different region than Cortex XSIAM; logs can be verified using pan_dss_raw dataset

B.

In a different region than Cortex XSIAM; logs can be verified using endpoints dataset

C.

In the same region as Cortex XSIAM; logs can be verified using pan_dss_raw dataset

D.

In the same region as Cortex XSIAM; logs can be verified using endpoints dataset

What is a key characteristic of a parsing rule in Cortex XSIAM?

A.

It uses regular expressions exclusively for data modifications, discards unmatched logs by default, and only retains fields with non-null values.

B.

It is bound to all vendors and products, performs data parsing once per log, and does not allow grouping.

C.

It is bound to a specific vendor and product, performs data parsing once per log, and does not allow grouping.

D.

It is bound to a specific vendor and product which allow grouping with a no-match policy, and retains all fields.

Cortex XSIAM has not received any logs for 30 minutes from a Palo Alto Networks NGFW named "MainFW.” An engineer wants to create an alert for this scenario.

Correlation rule settings include:

Time Schedule: Every 30 minutes

Query Timeframe: 30 minutes

Action: Generate alert

Alert Name: No logs received from MainFW in the past 30 minutes

Which query should be used in the correlation rule?

A)

B)

C)

D)

A.

Option A

B.

Option B

C.

Option C

D.

Option D

What is the role of "in" in the query line below?

action_local_port in (1122, 2234)

A.

Operand

B.

Operator

C.

Function

D.

Range