Free Palo Alto Networks XSIAM-Engineer Exam Dumps Questions & Answers

An engineer needs to migrate Cortex XDR agents without internet connection from Cortex XSIAM tenant A to Cortex XSIAM tenant B. There is a broker configured for each tenant. This is the communication flow:
- XDR agents <-> Broker A <-> XSIAM tenant A
- XDR agents <-> Broker B <-> XSIAM tenant B
Which two steps should be taken before moving the agents? (Choose two.)

• A.  Also register Broker A to Cortex XSIAM tenant B.
• B.  Install a new Broker C on site and register it into Cortex XSIAM tenant B.
• C.  Select all endpoints in the console and add a new Broker C as proxy.
• D.  Install a new Broker C on site B, and register it into Cortex XSIAM tenant A.

Using the integrationContext object, how is data stored and retrieved between integration command runs in Cortex XSIAM?

• A.  The get_integration_context() method overrides the existing object that is stored.
• B.  The integrationContex object supports get_integration_context() and set_integration_context().
• C.  The integrationContex object can only store strings, not key-value dictionaries.
• D.  The integrationContex object is retrieved and set using the test-module command.

An engineer sees alerts with Medium severity in Cortex XSIAM by using the filter in the image below:

How can future alerts be changed to high severity instead of medium?

• A.  Create a playbook with a task to change the severity to high, then create a playbook trigger for the alert.
• B.  Create a starring configuration rule for high severity.
• C.  Create a scoring rule that will assign a score of 100 to that specific alert.
• D.  Create a similar behavioral indicator of compromise (BIOC) rule that will have a severity of high, enable it, then disable the original BIOC rule.

An engineer wants a playbook to perform different actions based on the incident severity. Which task should be used?

• A.  Loop
• B.  Timer
• C.  Condition
• D.  Start

What is the function of the data source onboarding wizard in Cortex XSIAM?

• A.  It simplifies access to raw data via dataset views for an onboarded data source.
• B.  It helps create a dedicated HTTP receiver instance to receive logs from the data source.
• C.  It assists with configuring a new data source by installing required components and suggesting additional content.
• D.  It provides documentation regarding advanced settings to configure a custom data source, regardless of connection method.