5.2 Validate Agent Operational Status XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An analyst is validating the health of an XSIAM agent. Which metric is most directly related to the agent's ability to respond to commands?

   • AAgent version
   • BNetwork bandwidth
   • CCPU usage
   • DDisk space
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst notices that an agent's CPU usage is consistently at 95% and memory at 90%, but the agent's status is 'Connected'. The analyst suspects the agent is causing performance issues on the endpoint. What should the analyst do to reduce the agent's resource usage without compromising security?

   • AExclude the endpoint's most resource-intensive processes from scanning.
   • BIncrease the agent's logging level to gather more data.
   • CAdjust the agent's scan schedule to run during off-peak hours.
   • DDisable the agent's real-time protection.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is troubleshooting an agent that shows 'Disconnected' in the XSIAM console. The agent's service is running, the endpoint can resolve the XSIAM server's hostname, and a ping to the server's IP address succeeds. However, the agent cannot establish a secure connection. Which of the following is the most likely cause?

   • AThe XSIAM server is overloaded and rejecting connections.
   • BThe agent's configuration file is corrupted.
   • CThe agent's certificate has expired.
   • DThe endpoint's firewall is blocking outbound HTTPS traffic.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst is looking at the XSIAM console and sees an agent with a status of 'Degraded'. The agent's last check-in was 5 minutes ago, but its CPU usage is at 95% and memory at 90%. What does this status combination most likely indicate?

   • AThe agent is not connected to the platform.
   • BThe agent has been quarantined by the security team.
   • CThe agent is waiting for a policy update.
   • DThe agent is functioning but experiencing performance issues that may affect its ability to protect the endpoint.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   An XSIAM agent is showing as 'Disconnected'. Which troubleshooting step should be performed first?

   • ARestart the XSIAM platform
   • BUpdate the agent's policy
   • CVerify that the endpoint has network connectivity
   • DReinstall the agent
   Reveal Solution Discussion Select an answer first