2.2 Configure Automation and Feed Integrations (e.g., Messaging, SIEM, Authentication, Threat Intelligence Feeds) XSIAM-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A threat intelligence feed is being used in a playbook to enrich incidents. Recently, the enrichment has been returning outdated indicators. The feed is configured to update every 15 minutes, but the indicators are not changing. What is the most likely cause?

   • AThe feed provider is not updating the indicators on their end.
   • BThe playbook is not triggering the feed update.
   • CThe feed is not assigned to a SIEM integration.
   • DThe email integration is not sending the updated feed.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When configuring a messaging integration in XSIAM, what is typically required to establish the connection?

   • AA shared folder on the messaging server
   • BA valid API token or webhook URL from the messaging platform
   • CA VPN connection to the messaging provider
   • DThe IP address of the messaging server
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which authentication protocol is commonly used for single sign-on (SSO) in XSIAM?

   • AKerberos
   • BLDAP
   • CSAML
   • DRADIUS
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization wants to ingest security events from their on-premises Splunk instance into XSIAM for centralized correlation. They have network connectivity between Splunk and XSIAM. What is the first step they should take in XSIAM to establish this integration?

   • ACreate a playbook that queries Splunk and ingests the results.
   • BSet up a threat intelligence feed pointing to Splunk's REST API.
   • CConfigure an authentication integration using SAML to allow Splunk to push events.
   • DConfigure a SIEM integration by providing the Splunk API endpoint and authentication credentials.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An organization is setting up XSIAM and wants to use SAML for SSO. They have configured the SAML integration, but users are unable to log in. The identity provider logs show that the SAML response is being sent, but XSIAM is rejecting it. What is the most likely cause?

   • AThe threat intelligence feed is blocking the SAML response.
   • BThe LDAP integration is not configured.
   • CThe SIEM integration is not forwarding the SAML response.
   • DThe SAML assertion is missing the required attributes that XSIAM expects.
   Reveal Solution Discussion Select an answer first