XSIAM-Engineer Exam - Free Palo Alto Networks Questions and Answers

Question #11 (Topic: Exam A)

An engineer wants to onboard data from a third-party vendor’s firewall. There is no content pack available for it, so the engineer creates custom data source integration and parsing rules to generate a dataset with the firewall data.
How can the analytics capabilities of Cortex XSIAM be used on the data?

A. Create a behavioral indicator of compromise (BIOC) rule on the network fields (source IP, source port, target IP, target port, IP protocol). B. Create a data model rule with network fields mapped (source IP, source port, target IP, target port, IP protocol). C. Create a correlation rule on the network fields (source IP, source port, target IP, target port, IP protocol). D. Create a parsing rule and ensure the network fields exist (source IP, source port, target IP, target port, IP protocol).

Answer: B

Question #12 (Topic: Exam A)

Which two requirements must be met for a Cortex XDR agent to successfully use the Broker VM as a download source for content updates? (Choose two.)

A. Device Configuration profile applied to the XDR agent must specify the Broker VM as a Download Source. B. Agent Settings profile applied to the XDR agent must specify the Broker VM as a Download Source. C. Broker VM must be configured with an FQDN. D. XDR agent must authenticate to the Broker VM using a machine certificate.

Answer: BC

Question #13 (Topic: Exam A)

During a new Cortex XSIAM deployment, a user consistently experiences timeout sessions while trying to connect to the agent through Live Terminal, even though the firewall engineer has confirmed that all source IP addresses, port 443, and destinations are allowed.
What could be causing these persistent timeout issues?

A. User does not have administrative privileges on the managed endpoint. B. SSL Decryption is currently being used to inspect the underlying traffic. C. NTP is not synchronized with the server time. D. Live Terminal feature is not supported on the current OS.

Answer: B

Question #14 (Topic: Exam A)

What should be considered when creating a custom incident domain?

A. Alert grouping will not apply, but SmartScore will. B. Alert grouping will apply, but SmartScore will not. C. Alert grouping and SmartScore will not be applied to incidents. D. Alert grouping and SmartScore will be applied to incidents.

Answer: B

Question #15 (Topic: Exam A)

How does Cortex XSIAM manage licensing for Kubernetes environments?

A. Managed per namespace and returned when the namespace is decommissioned B. Issued per container and returned upon container termination C. Issued for each node and returned when the agent is removed or the node is deleted D. Applied per service deployment and returned upon service deactivation

Answer: C

Palo Alto Networks XSIAM-Engineer - Palo Alto Networks XSIAM Engineer Exam