2.2 Configure Automation and Feed Integrations (e.g., Messaging, SIEM, Authentication, Threat Intelligence Feeds) XSIAM-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SIEM integration is ingesting events from an external platform, but some events are being dropped. The integration logs show no errors. What is the most likely cause?

   • AThe threat intelligence feed is consuming too much bandwidth.
   • BThe integration is not assigned to any playbook.
   • CThe events are being filtered out by the integration's ingestion rules.
   • DThe LDAP authentication is failing.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Slack messaging integration in XSIAM is failing to send notifications. The integration was working yesterday. The administrator has verified that the bot token is valid and the Slack workspace is accessible. What should they check next?

   • AConfirm that the integration is linked to an LDAP directory.
   • BVerify that the integration is assigned to a threat intelligence feed.
   • CEnsure that the integration is being used in a playbook.
   • DCheck if the Slack app has been removed from the workspace or if its permissions have been changed.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of an authentication integration in XSIAM?

   • ATo encrypt all data stored in XSIAM
   • BTo enable secure access to XSIAM and manage user identities
   • CTo monitor user activity for compliance
   • DTo provide a backup of user credentials
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the context of XSIAM automation integrations, what is the typical architecture used to connect to external systems?

   • APeer-to-peer network connections between XSIAM and each external system
   • BA centralized integration layer that uses APIs and connectors to communicate with external systems
   • CDirect database connections to external systems
   • DManual file transfers between XSIAM and external systems
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team wants to automatically enrich an incident with threat intelligence from an external feed and then notify the incident responder via email. What is the most efficient way to achieve this in XSIAM?

   • AConfigure the threat feed to send email notifications directly.
   • BCreate a playbook that includes a threat intelligence lookup action followed by an email notification action.
   • CManually enrich the incident and then send an email using a separate tool.
   • DSet up an email integration that triggers the threat feed update.
   Reveal Solution Discussion Select an answer first