4.4 Troubleshoot Cortex XSIAM Components (e.g., Agents, Integrations, Playbooks) XSIAM-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A playbook in Cortex XSIAM is failing during execution. The error log shows: 'Variable ${incident.owner} not found'. The playbook is triggered by an alert ingestion process that does not populate the 'owner' field. How should the analyst resolve this issue?

   • ARe-run the playbook manually, as the error is likely a transient issue.
   • BModify the playbook to use a default value or a different variable that is always populated.
   • CChange the playbook trigger to a different alert source that includes the 'owner' field.
   • DDisable the playbook until the alert source is updated to include the 'owner' field.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An XSIAM administrator is investigating a report that a specific server is not sending logs. The 'Agent Health' dashboard shows the agent as 'Disconnected'. The server is reachable via ping, and the agent service is running. What is the most likely cause of the 'Disconnected' status?

   • AThe agent cannot establish a connection to the XSIAM tenant due to a network or firewall issue.
   • BThe agent's local log files are full, preventing new data from being written.
   • CThe XSIAM tenant is experiencing a regional outage.
   • DThe agent's data collection is paused due to high CPU usage on the server.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A playbook is designed to gather forensic data from an endpoint and upload it to a cloud storage bucket. The playbook fails intermittently. The execution logs show that the 'Upload to Cloud Storage' step fails with a 'Timeout' error, but only when the endpoint has a large number of files. The analyst needs to make the playbook more reliable. What is the best approach?

   • AChange the playbook to upload files in smaller batches.
   • BIncrease the timeout value for the 'Upload to Cloud Storage' step in the playbook.
   • CDisable the playbook for endpoints with a large number of files.
   • DModify the playbook to compress the forensic data before uploading.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A Cortex XSIAM agent on a Windows endpoint is not sending data. The agent service is running, but the agent status shows 'Disconnected'. Which initial step should the administrator take to troubleshoot the connectivity issue?

   • ADisable the local firewall to allow all traffic.
   • BReinstall the agent to reset its configuration.
   • CRestart the endpoint's operating system.
   • DVerify that the agent can reach the Cortex XSIAM tenant's FQDN and required ports.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A playbook that enriches incidents with threat intelligence data is failing at the 'Enrichment' step. The step uses an integration to query an external service. The integration's health status is 'Healthy'. What should the analyst check next?

   • AVerify that the playbook is enabled and active.
   • BReview the playbook's execution logs for the specific error message from the enrichment step.
   • CCheck if the incident data contains all required fields for the enrichment query.
   • DReinstall the integration to ensure it is properly configured.
   Reveal Solution Discussion Select an answer first