1.4 Install and Configure Cortex XSIAM Components XSIAM-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company is deploying a Broker VM in a VMware environment. They need to ensure the Broker VM has enough resources to handle the expected data volume. What should they do?

   • AAllocate the recommended CPU, memory, and disk resources as per the deployment guide.
   • BAllocate resources dynamically based on current usage.
   • CDeploy multiple Broker VMs to distribute the load.
   • DUse the minimum resources to save costs.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization has deployed Cortex XSIAM agents on Linux servers. They notice that the agents are not sending all expected log data to Cortex XSIAM. The security team wants to ensure that specific log types (e.g., authentication logs) are collected. What should they configure?

   • ARestart the agent service to reinitialize data collection.
   • BIncrease the agent's logging level to debug to capture more data.
   • CReinstall the agent with default settings.
   • DEnable the appropriate collection policies in the agent configuration to include the required log types.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which configuration is essential for the engine to process data correctly?

   • AUser interface theme
   • BEndpoint collection policies
   • CAgent update schedule
   • DData processing and storage settings
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of the Cortex XSIAM agent on an endpoint?

   • ACollect security-related data and forward it to Cortex XSIAM
   • BReplace the endpoint's native firewall
   • CManage the endpoint's operating system updates
   • DProvide a remote desktop connection to the endpoint
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization has deployed a Broker VM and wants to forward syslog data from a legacy firewall to Cortex XSIAM. The firewall sends syslog to the Broker VM's IP address. What must be configured on the Broker VM to ensure the data is forwarded to Cortex XSIAM?

   • AEnable the Broker VM's firewall to allow outbound traffic to Cortex XSIAM.
   • BInstall a syslog collector on the firewall.
   • CAdd the firewall as a data source and configure the syslog listener on the Broker VM.
   • DConfigure the firewall to send syslog directly to Cortex XSIAM.
   Reveal Solution Discussion Select an answer first