Weekend Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

Paloalto Networks XSIAM-Engineer - Palo Alto Networks XSIAM Engineer

Paloalto Networks XSIAM-Engineer Premium Access     Download Demo    
Page: 1 / 2
Total 59 questions

Which cytool command will look up the policy being applied to a Cortex XDR agent?

A.

cytool adaptive_policy interval 0

B.

cytool payload_execution query

C.

cytool adaptive_policy recalc

D.

cytool persist print agent_settings.db

Which field is automatically mapped from the dataset to the data model when creating a data model rule?

A.

_event_type

B.

_insert_time

C.

_host_name

D.

_cloud_id

A vulnerability analyst asks a Cortex XSIAM engineer to identify assets vulnerable to newly reported zero-day CVE affecting the "ai_app" application and versions 12.1, 12.2, 12.4, and 12.5.

Which XQL query will provide the required result?

A)

B)

C)

D)

A.

Option A

B.

Option B

C.

Option C

D.

Option D

Which types of content may be included in a Marketplace content pack?

A.

Integrations, playbooks, parsers, and server configuration keys

B.

Predefined dashboards, indicators, and reports

C.

Scripts, playbooks, integrations, and correlation rules

D.

Behavioral indicator of compromise (BIOC) rules, layouts, and custom dashboards

A Cortex XSIAM engineer is preparing to install a new content pack and notices that there are several optional content packs associated with the main one that needs to be installed.

What must the engineer take into consideration when deciding whether or not to install the optional content packs?

A.

Mandatory dependencies required by the optional content packs are automatically included during installation. The engineer should consider the additional functionality and potential impact on system performance.

B.

The optional content packs without their associated dependencies are installed first, and then the main content pack installation is triggered. The engineer should ensure that the optional content packs do not conflict with existing configurations.

C.

Optional content packs are installed without any dependencies, as they are not necessary. The engineer should only install them if they require the additional features.

D.

Only the selected optional content packs are installed, without including any additional dependencies. The engineer should manually check for any required dependencies.

What is the primary benefit of setting the "--memory-swap" option to "-1" during Cortex XSIAM engine deployment?

A.

It enhances the network throughput by optimizing memory usage.

B.

It increases the total disk space available to the engine.

C.

It allows the engine to operate without requiring swap capabilities.

D.

It automatically doubles the available RAM to the engine.

A Cortex XSIAM engineer at a SOC downgrades a critical threat intelligence content pack from the Cortex Marketplace while performing routine maintenance. As a result, the SOC team loses access to the latest threat intelligence data.

Which action will restore the functionality of the content pack to its previously installed version?

A.

Contact Palo Alto Networks Support to create an exception to revert to the previously installed version.

B.

Back up the current configuration and data, then revert to the previously installed version.

C.

Remove all integrations and playbooks associated with the content pack, then revert to the previously installed version.

D.

Directly reinstall the previously installed version over the current one.

Based on the images below, which command will allow the context data to be displayed as a table when troubleshooting a playbook task?

A.

!ConvertTableToHTML table=${parentIncidentFields.custom_fields}

B.

!JsonToTable value=${parentIncidentFields.custom_fields}

C.

!ToTable data=${parentIncidentFields.custom_fields.incidentassignment}

D.

!ExtractHTMLTables html=${parentIncidentFields.custom_fields.incidentassignment}

Which two alert notification options can be configured without creating a playbook? (Choose two.)

Which two alert notification options can be configured without creating a playbook? (Choose two.)

A.

Pager Duty

B.

Email

C.

Slack

D.

SMS

What is the reason all Broker VM options are greyed out when a user attempts to select a Broker VM as a download source in the Agent Settings profile?

A.

The Broker VM is offline.

B.

NTP is not synchronized properly on the Broker VM.

C.

Local Agent Setting applet is currently activated without SSL certificate.

D.

Local Agent Setting applet is currently activated without FQDN.