2.2 Configure Automation and Feed Integrations (e.g., Messaging, SIEM, Authentication, Threat Intelligence Feeds) XSIAM-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team wants to automate the response to a phishing incident. They have a playbook that extracts indicators from an email and queries a threat intelligence feed. If the indicators are malicious, they want to block the sender's email address in their email gateway. What should they add to the playbook?

   • AAdd a conditional action that checks the threat feed result and, if malicious, calls the email gateway API to block the sender.
   • BAdd a SIEM integration to ingest the indicators as security events.
   • CAdd an email notification to the security team about the malicious indicators.
   • DAdd an LDAP authentication step to verify the sender's identity.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization wants to enable single sign-on (SSO) for their XSIAM users using their existing identity provider that supports SAML 2.0. What should they configure in XSIAM?

   • ASet up a SAML authentication integration with the identity provider's metadata.
   • BUse a SIEM integration to import user accounts from the identity provider.
   • CCreate a threat intelligence feed that includes user identities.
   • DConfigure an LDAP integration to the identity provider's user store.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How can feed and messaging integrations be used in automation playbooks?

   • ATo replace the need for human decision-making in all incidents
   • BTo trigger actions based on external data and notify teams via messaging
   • CTo store feed data in a separate database
   • DTo manually update feed configurations
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SIEM integration in XSIAM is failing to ingest events from an external platform. The integration was working previously. What should the administrator check first?

   • ACheck if the integration is being used in any playbooks.
   • BVerify that the API credentials are still valid and have not expired.
   • CConfirm that the external platform is sending events in the correct format.
   • DEnsure that the integration is assigned to a threat intelligence feed.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a common cause of feed integration failures in XSIAM?

   • AThe feed provider being too reliable
   • BToo much storage space on the XSIAM server
   • CThe feed data being in a human-readable format
   • DIncorrect API keys or authentication credentials
   Reveal Solution Discussion Select an answer first