Palo Alto Networks XSIAM Engineer XSIAM-Engineer Exam Questions
When Cortex XDR agents are on servers in a zone with no internet access, which configuration will keep them communicating with the platform?
Correct Answer: B
For Cortex XDR agents running on servers in zones without internet access, a Broker VM is used as a communication bridge. The Broker VM securely relays traffic between the isolated agents and the Cortex platform, maintaining connectivity without requiring direct internet access from the servers.
Which option should be used when customizing a dashboard in Cortex XSIAM to include a widget that will display data filtered by more than one dynamic value?
Correct Answer: B
The Multi-select option allows a dashboard widget in Cortex XSIAM to be filtered by more than one dynamic value, enabling flexible data exploration and visualization across multiple selected criteria.
Which common issue can result in sudden data ingestion loss for a data source that was previously successful?
Correct Answer: D
A sudden data ingestion loss for a previously successful data source commonly occurs when the API key used for the integration has expired, breaking authentication and preventing further log collection.
How will Cortex XSIAM help with raw log ingestion from third-party sources in an existing infrastructure?
Correct Answer: B
Cortex XSIAM ingests structured third-party logs (such as CEF, LEEF, and JSON) by breaking down the key-value pairs and saving them in a normalized table format. This enables efficient correlation, analytics, and query performance across diverse log sources while preserving data fidelity.
What is the reason all Broker VM options are greyed out when a user attempts to select a Broker VM as a download source in the Agent Settings profile?
Correct Answer: D
Broker VM options appear greyed out in the Agent Settings profile when the Local Agent Settings applet is activated without an FQDN. An FQDN is required for agents to resolve and connect to the Broker VM as a download source.