4.4 Troubleshoot Cortex XSIAM Components (e.g., Agents, Integrations, Playbooks) XSIAM-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In Cortex XSIAM, what does an integration status of 'Healthy' typically indicate?

   • AThe integration has not been configured yet.
   • BThe integration has encountered an error but is still running.
   • CThe integration is currently ingesting data.
   • DThe integration is functioning correctly and is able to communicate with the third-party service.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A Cortex XSIAM integration is configured correctly but is not ingesting any data. The integration status shows 'Healthy'. What should the administrator check first?

   • AThe integration's authentication credentials.
   • BThe Cortex XSIAM tenant's network connectivity.
   • CThe integration's installation package.
   • DThe data source's API endpoint and query parameters.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization has deployed Cortex XSIAM agents to 500 endpoints. The 'Agent Health' dashboard shows that 50 agents are 'Uninstalled'. The security team confirms that these endpoints are still active and have not been decommissioned. What is the most likely cause of this status?

   • AThe agents were manually uninstalled or removed by a user or a software deployment tool.
   • BThe agents are failing to collect data due to a permissions issue.
   • CThe XSIAM tenant has reached its agent limit and is rejecting new registrations.
   • DThe agents are experiencing a network connectivity issue.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A playbook is failing intermittently. The execution logs show that a step that queries an external API sometimes fails with a 'Timeout' error. The API is known to be slow during peak hours. The analyst needs to ensure the playbook completes successfully. What is the best approach?

   • AAdd a retry mechanism to the playbook step that retries the API call a specified number of times.
   • BChange the playbook to run only during off-peak hours.
   • CDisable the playbook and run it manually when the API is responsive.
   • DIncrease the timeout value for the API call step.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An integration between XSIAM and a ticketing system is failing to create new tickets. The integration's status is 'Healthy', but the logs show 'Error: Invalid payload format'. The ticketing system's API documentation has recently changed. What is the most likely cause?

   • AThe integration's API key has expired.
   • BThe ticketing system is temporarily offline.
   • CThe integration is sending data in an outdated format that no longer matches the API's current schema.
   • DThe integration's polling interval is too short.
   Reveal Solution Discussion Select an answer first