4.4 Troubleshoot Cortex XSIAM Components (e.g., Agents, Integrations, Playbooks) XSIAM-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Before engaging Palo Alto Networks support for a Cortex XSIAM issue, what should the administrator prepare to ensure an efficient support experience?

   • AA request for a refund or credit.
   • BA list of all users who have access to the XSIAM tenant.
   • CA detailed description of the issue, steps already taken, and relevant logs.
   • DA copy of the organization's security policies.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A group of agents on Linux servers is showing as 'Connected' in XSIAM, but the 'Data Collection' status is 'Failed'. The agents are configured to collect audit logs from /var/log/audit. The analyst checks the agent logs and finds 'Permission denied' errors. The agent service is running as the 'xsiam' user. What is the most likely cause and the correct fix?

   • AThe agent's configuration is incorrect; reinstall the agent.
   • BThe audit log files are corrupted; restart the audit daemon.
   • CThe 'xsiam' user does not have read permission on the audit log files; add the user to the 'adm' group.
   • DThe XSIAM tenant is not accepting data; check the tenant's health.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security operations team notices that Cortex XSIAM agents on a group of Windows servers in a remote branch office have stopped sending telemetry. The agents show as 'Connected' in the XSIAM console, but no new data has arrived for the past two hours. The network team confirms the branch office has a stable internet connection. Which troubleshooting step should the analyst perform first?

   • AVerify that the branch office firewall is allowing outbound traffic on port 443.
   • BReinstall the agent on one of the affected servers to test if the configuration is corrupt.
   • CRestart the Cortex XSIAM agent service on all affected servers.
   • DReview the agent's local diagnostic logs for errors related to data collection or forwarding.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An administrator is troubleshooting a failed playbook in Cortex XSIAM. Where should they look to find detailed error messages and execution logs for the playbook?

   • AThe playbook's execution history and logs.
   • BThe Cortex XSIAM system logs.
   • CThe third-party integration's API logs.
   • DThe agent's local log files.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A third-party integration in Cortex XSIAM is failing with an 'Authentication Failed' error. Which of the following is the most likely cause?

   • AThe API credentials configured in the integration are invalid or expired.
   • BThe Cortex XSIAM tenant is out of storage space.
   • CThe integration is not enabled in the Cortex XSIAM marketplace.
   • DThe integration's webhook URL is misconfigured.
   Reveal Solution Discussion Select an answer first