2.3 Demonstrate Understanding of Data Source Ingestion CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is ingesting logs from a cloud-based application that generates high volumes of data. They are considering using direct upload vs. API-based ingestion. The company has limited bandwidth and wants to minimize the impact on their network. Which method should they choose?

   • AAny method, because bandwidth is not a concern
   • BDirect upload, because it can be scheduled during off-peak hours
   • CAPI-based ingestion, because it is real-time
   • DAgent-based ingestion, because it is automated
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security analyst notices that logs from a firewall are not appearing in Cortex. The firewall is configured to send logs to Cortex via syslog. What is the most likely cause of this issue?

   • ANetwork connectivity issue between the firewall and Cortex
   • BThe logs are being deleted after ingestion
   • CThe logs are being normalized incorrectly
   • DThe firewall is not generating any logs
   Reveal Solution Discussion Select an answer first
4. 3expert · hard · select all that apply

   A company is planning to ingest data into Cortex XSIAM from various sources. They need to ensure that the data is normalized for consistent analysis. Which of the following are valid data source types that can be ingested? (Select all that apply.)

   • AConfiguration files from network devices
   • BLogs from firewalls
   • CUser credentials from Active Directory
   • DTelemetry from cloud infrastructure
   • EAlerts from endpoint protection
   Check answers Discussion Select an answer first
5. 4expert · hard

   An organization is ingesting logs from a legacy system into Cortex XSIAM using a custom API script. The script runs on a scheduled basis and sends logs in batches. Recently, the script has been failing intermittently, and logs are missing. The script logs show that the API requests are timing out. What is the most likely cause?

   • AThe script is sending data too frequently
   • BThe API endpoint is not reachable from the script's network
   • CThe logs are too large for the API to handle
   • DThe Cortex storage is full
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is data normalization important for security analytics in Cortex?

   • AIt eliminates the need for data retention policies
   • BIt allows analysts to query and correlate data from different sources using common fields
   • CIt automatically generates security alerts
   • DIt increases the volume of data ingested
   Reveal Solution Discussion Select an answer first