4.4 Troubleshoot Cortex XSIAM Components (e.g., Agents, Integrations, Playbooks) XSIAM-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A playbook is designed to automatically isolate an endpoint when a critical alert is triggered. During a test, the playbook runs successfully, but the endpoint is not isolated. The isolation action is performed by a third-party EDR integration. What should the analyst investigate first?

   • AVerify that the endpoint is online and reachable.
   • BCheck the playbook's execution logs to see if the isolation action was attempted and what the response was.
   • CReview the alert's severity and ensure it meets the playbook's trigger conditions.
   • DReinstall the EDR integration to ensure it is properly configured.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization has deployed Cortex XSIAM agents to a mix of Windows and Linux servers. The 'Agent Health' dashboard shows that all Linux agents are 'Connected', but the 'Last Seen' time is over 24 hours ago. What does this indicate?

   • AThe XSIAM tenant is having a regional outage.
   • BThe agents are connected but are not sending heartbeats or telemetry data.
   • CThe agents are disconnected and need to be reinstalled.
   • DThe agents are working correctly, and the 'Last Seen' time is not a reliable indicator.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   An administrator wants to monitor the health of all Cortex XSIAM components, including agents, integrations, and playbooks. Which XSIAM feature should they use to get an overview of component status?

   • AThe XSIAM dashboards and health monitoring views.
   • BThe Palo Alto Networks firewall logs.
   • CThe Cortex XDR management console.
   • DThe third-party integration's own dashboard.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An integration with a cloud access security broker (CASB) is failing. The XSIAM logs show 'Error: 403 Forbidden' when the integration attempts to pull logs. The integration was working yesterday. The CASB admin reports no changes to the service account permissions. The analyst suspects the CASB service account password may have expired. What is the most efficient next step?

   • AReset the CASB service account password and update it in the XSIAM integration configuration.
   • BContact Palo Alto Networks support to investigate the integration failure.
   • CCheck the CASB's API documentation to see if the API endpoint has changed.
   • DReview the XSIAM audit logs to see if the integration was modified recently.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A data ingestion integration is failing. The XSIAM logs show repeated 'HTTP 429 Too Many Requests' responses from the third-party API. The integration is configured to poll every 5 minutes. What is the most appropriate action to resolve this issue?

   • AChange the authentication method from API key to OAuth 2.0.
   • BIncrease the polling interval to reduce the number of API calls.
   • CVerify the API endpoint URL is correct.
   • DRestart the integration service in XSIAM.
   Reveal Solution Discussion Select an answer first