2.1 Onboard Data Sources (e.g., Endpoint, Network, Cloud, Identity) XSIAM-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What type of logs are typically ingested from an identity provider like Active Directory?

   • AAuthentication and user activity logs
   • BEndpoint process logs
   • CNetwork traffic logs
   • DCloud resource audit logs
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has deployed the XSIAM agent to 1,000 endpoints. The agent is configured to collect Windows Event Logs and send them to XSIAM. After a week, the security team notices that some endpoints are sending logs with a delay of several hours. What is the most likely cause?

   • AThe endpoints are running out of disk space, preventing the agent from writing logs.
   • BThe agent's log collection settings are set to batch logs and send them at intervals.
   • CThe agent is configured to use a proxy that is experiencing high latency.
   • DThe XSIAM collector is overloaded and cannot process logs in real-time.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a common log type collected from Azure for cloud source onboarding?

   • ANetFlow
   • BWindows Event Log
   • CActivity Log
   • DSyslog
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which protocol is commonly used to onboard network source logs from firewalls and switches into XSIAM?

   • ASyslog
   • BSNMP
   • CSMTP
   • DFTP
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the purpose of data normalization in XSIAM?

   • ATo map raw logs to a consistent data model
   • BTo encrypt logs in transit
   • CTo compress logs for storage efficiency
   • DTo filter out irrelevant logs
   Reveal Solution Discussion Select an answer first