4.3 Troubleshoot Data Management Issues (e.g., Data Ingestion, Normalization, Parsing) XSIAM-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is ingesting logs from a legacy system that sends logs via UDP. The logs are being received by the collector, but they are not appearing in XSIAM. The team suspects that the UDP packets are being dropped due to high volume. What should they do to confirm this?

   • ARestart the collector to clear any UDP buffer issues.
   • BSwitch the log source to TCP to ensure reliable delivery.
   • CIncrease the collector's UDP buffer size to handle more packets.
   • DCheck the collector's UDP receive statistics for dropped packets.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is ingesting logs from a cloud service via API. The logs were working, but after a recent update to the cloud service, they stopped appearing. The API integration shows successful calls, and the collector is receiving data. What should the team investigate?

   • ACheck if the cloud service changed the log format or API response structure.
   • BDisable and re-enable the log source in XSIAM.
   • CIncrease the collector's buffer size to handle more data.
   • DRestart the collector to re-establish the API connection.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC manager wants to proactively detect when a specific log source stops sending data or when parsing errors spike. Which XSIAM feature should the team use to monitor the data pipeline?

   • ASet up a scheduled search that runs every hour to check for missing logs.
   • BConfigure an automation rule that triggers when a log source does not send data for 10 minutes.
   • CCreate a custom dashboard that queries the ingestion and parsing metrics from the data pipeline.
   • DUse the XSIAM 'Data Ingestion' page to view the health of all log sources and parsing errors.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An engineer wants to detect if a log source is sending data that is failing to parse. Which monitoring metric should the engineer review?

   • AParsing error rate
   • BNormalization success rate
   • CIngestion volume
   • DSource latency
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company has a log source that sends logs in a format that is not recognized by the default parser. The team has created a custom parser, but the logs are still not being parsed correctly. The raw logs are visible in the collector. What should the team do next?

   • AUse the default parser instead of the custom one.
   • BDisable the log source and re-enable it to apply the custom parser.
   • CTest the custom parser with sample logs to identify where it fails.
   • DRestart the collector to ensure the custom parser is loaded.
   Reveal Solution Discussion Select an answer first