A company is integrating Azure Activity Logs into XSIAM. The integration is configured using the native API, and the status shows 'Connected'. However, the security team notices that only a subset of the expected logs are appearing. What is the most likely cause?

The Azure logs are being sent to a different region.

The XSIAM collector is using the wrong Azure tenant ID.

The Azure subscription is not sending all activity log categories to the integration.

The Azure logs are not being normalized to the XSIAM data model.

A security analyst has deployed the XSIAM agent to 500 Windows endpoints. After 24 hours, the XSIAM console shows only 450 endpoints reporting. The analyst checks the agent status on a non-reporting endpoint and sees the service is running. What should the analyst do next to troubleshoot the missing endpoints?

Verify that the agent's log collection settings are enabled for the missing endpoints.

Check the firewall rules on the XSIAM collector to ensure it accepts connections from all endpoints.

Confirm that the missing endpoints are running a supported operating system version.

Reinstall the agent on all 500 endpoints to ensure a clean deployment.

A company is onboarding Okta logs to XSIAM. The integration is configured, and logs are appearing in the raw log viewer. However, the security team cannot search for the `user_name` field in the normalized data. The team has verified that the Okta API is returning the `user_name` field in the raw JSON. What is the most likely cause and the appropriate action?

The Okta API token does not have permission to read user activity logs.

The XSIAM parser for Okta logs is not mapping the `user_name` field to the normalized schema.

The Okta integration is not configured to ingest user activity logs.

The Okta logs are being sent to a different XSIAM tenant.

A company is onboarding logs from a custom application that sends JSON logs to a syslog collector. The logs are visible in the raw log viewer, but the security team cannot search for the `app_id` field in the normalized data. What is the most likely cause?

The custom application's JSON format is not recognized by the XSIAM parser.

The syslog collector is not configured to forward JSON logs.

The custom application is sending logs to the wrong port.

The XSIAM data model does not support custom application logs.

Which method is typically used to onboard cloud source logs from AWS into XSIAM?

Agent installation on cloud VMs

Palo Alto NetworksCertified XSIAM Engineer

Domain 2Objective 1

2.1 Onboard Data Sources (e.g., Endpoint, Network, Cloud, Identity) XSIAM-ENGINEER Practice Questions (Page 1)

Part of the Integration and Automation domain, which accounts for 30% of the XSIAM-ENGINEER exam.

21questions here

5free pages

7concepts

30%of the exam

Questions 1–5

1application · medium
A company is integrating Azure Activity Logs into XSIAM. The integration is configured using the native API, and the status shows 'Connected'. However, the security team notices that only a subset of the expected logs are appearing. What is the most likely cause?
Select an answer first
2application · medium
A security analyst has deployed the XSIAM agent to 500 Windows endpoints. After 24 hours, the XSIAM console shows only 450 endpoints reporting. The analyst checks the agent status on a non-reporting endpoint and sees the service is running. What should the analyst do next to troubleshoot the missing endpoints?
Select an answer first
3expert · medium
A company is onboarding Okta logs to XSIAM. The integration is configured, and logs are appearing in the raw log viewer. However, the security team cannot search for the `user_name` field in the normalized data. The team has verified that the Okta API is returning the `user_name` field in the raw JSON. What is the most likely cause and the appropriate action?
Select an answer first
4application · medium
A company is onboarding logs from a custom application that sends JSON logs to a syslog collector. The logs are visible in the raw log viewer, but the security team cannot search for the `app_id` field in the normalized data. What is the most likely cause?
Select an answer first
5foundation · easy
Which method is typically used to onboard cloud source logs from AWS into XSIAM?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XSIAM-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XSIAM-ENGINEER” is a trademark of its owner, used for identification only.

2.1 Onboard Data Sources (e.g., Endpoint, Network, Cloud, Identity) XSIAM-ENGINEER Practice Questions (Page 1)

Questions 1–5

A company is integrating Azure Activity Logs into XSIAM. The integration is configured using the native API, and the status shows 'Connected'. However, the security team notices that only a subset of the expected logs are appearing. What is the most likely cause?

A company is onboarding logs from a custom application that sends JSON logs to a syslog collector. The logs are visible in the raw log viewer, but the security team cannot search for the `app_id` field in the normalized data. What is the most likely cause?

Which method is typically used to onboard cloud source logs from AWS into XSIAM?

Keep studying — Integration and Automation