Question 1

What is a key characteristic of a parsing rule in Cortex XSIAM?

Options :

A : It uses regular expressions exclusively for data modifications, discards unmatched logs by default, and only retains fields with non-null values.

B : It is bound to all vendors and products, performs data parsing once per log, and does not allow grouping.

C : It is bound to a specific vendor and product, performs data parsing once per log, and does not allow grouping.

D : It is bound to a specific vendor and product which allow grouping with a no-match policy, and retains all fields.

Answer: C

Question 2

Based on the image below, which statement applies to the ability to remove tabs when creating a new alert layout?

Options :

A : Only "Alert Info" tab can be removed.

B : Only "Alert Info" and "War Room" tabs can be removed.

C : Only "War Room" and "Work Plan" tabs can be removed.

D : Only "Work Plan" tab can be removed.

Answer: C

Question 3

A file for a support exception that needs to be updated locally on a Linux endpoint has been supplied.

Which cytool command will upload this support exception file to the endpoint?

Options :

A : cytool upload suexfile -target

B : cytool upload suex -file

C : cytool import suex -path

D : cytool import suexfile -path

Answer: C

Question 4

Which two requirements must be met for a Cortex XDR agent to successfully use the Broker VM as a download source for content updates? (Choose two.)

Options :

A : Device Configuration profile applied to the XDR agent must specify the Broker VM as a Download Source.

B : Agent Settings profile applied to the XDR agent must specify the Broker VM as a Download Source.

C : Broker VM must be configured with an FQDN.

D : XDR agent must authenticate to the Broker VM using a machine certificate.\

Answer: B,C

Question 5

How does Cortex XSIAM manage licensing for Kubernetes environments?

Options :

A : Managed per namespace and returned when the namespace is decommissioned

B : Issued per container and returned upon container termination

C : Issued for each node and returned when the agent is removed or the node is deleted

D : Applied per service deployment and returned upon service deactivation

Answer: C

Confidently Practice Online with Free XSIAM-Engineer Exam Cram