最新的Palo Alto Networks XSIAM-Engineer免費考試真題

問題1

Which step must be taken to enable Cloud Identity Engine on Cortex XSIAM?

A. Activate it in the Customer Support Portal.

B. Activate it on HUB.

C. Enable SSO integration.

D. Enable Active Directory log collection.

正確答案: B

說明：（僅 Fast2test 成員可見）

問題2

A file for a support exception that needs to be updated locally on a Linux endpoint has been supplied.
Which cytool command will upload this support exception file to the endpoint?

A. cytool upload suexfile -target </local/file/path>

B. cytool import suexfile -path </local/file/path>

C. cytool upload suex -file </local/file/path>

D. cytool import suex -path </local/file/path>

正確答案: D

說明：（僅 Fast2test 成員可見）

問題3

An engineer wants a playbook to perform different actions based on the incident severity. Which task should be used?

A. Timer

B. Loop

C. Start

D. Condition

正確答案: D

說明：（僅 Fast2test 成員可見）

問題4

Based on the image below, what will fail to function correctly as a result of missing Load Balancer FQDN configuration in the Broker VM cluster configuration?

A. Agent Installer and Content Caching

B. Files and Folders Collector applet

C. Kafka Collector applet

D. All applets

正確答案: A

說明：（僅 Fast2test 成員可見）

問題5

An analyst reports to an engineer that after merging two incidents, specific custom context fields from the source incident are no longer visible in the destination incident.
What is the explanation for this behavior?

A. Source context data is not preserved, but War Room entries transfer to the destination incident.

B. Source context data is moved to the Linked Incidents tab of the destination incident.

C. War Room entries from the source incident are deleted for security reasons.

D. Source context data is hidden in the destination incident, and an unhide action must be completed manually.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題6

Which action is required to enable use of a custom script in an alert layout?

A. Tag the script with "dynamic-section," add a general purpose dynamic section, and edit the section settings to add the automation script.

B. Tag the script with "general-purpose-dynamic-section," add a custom script section, and edit the section settings to add the automation script.

C. Tag the script with "general-purpose-dynamic-section," add a general purpose dynamic section, and edit the section settings to add the automation script.

D. Add a general purpose dynamic section and edit the section settings to add the automation script.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題7

Using the integrationContext object, how is data stored and retrieved between integration command runs in Cortex XSIAM?

A. The integrationContex object supports get_integration_context() and set_integration_context().

B. The get_integration_context() method overrides the existing object that is stored.

C. The integrationContex object can only store strings, not key-value dictionaries.

D. The integrationContex object is retrieved and set using the test-module command.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題8

A Cortex XSIAM administrator decides to modify how indicators are handled during playbook execution, and sets the indicator extraction mode to "None" for a specific playbook task that runs the !domaincommand.
Which statement describes the behavior of the mapping flow for this command?

A. It is disabled to save system resources when extraction is not required.

B. It is only triggered if the indicator already exists in the threat intel database.

C. It will only trigger if the auto-extract global setting is enabled for the tenant.

D. It is triggered in enrichment commands, regardless of the extraction setting.

正確答案: D

說明：（僅 Fast2test 成員可見）

最新的Palo Alto Networks XSIAM Engineer - XSIAM-Engineer免費考試真題

聯系我們

站內鏈接

最新更新