XSIAM-Engineer 試験問題を無料オンラインアクセス

Which installer type should be used when upgrading a non-Linux Kubernetes cluster?

• A.Kubernetes
• B.Upgrade from ESM
• C.Standalone
• D.Helm

A security engineer is integrating several third-party firewalls and web proxies with Cortex XSIAM by using a Syslog collector. The logs are sent in Common Event Format (CEF) and JSON.
How does the Cortex XSIAM ingestion engine process these structured logs to facilitate efficient querying and analysis?

• A.It identifies and decouples key-value pairs into a structured table format while retaining the original raw log.
• B.It stores the logs as flat text files and only applies parsing logic at the time a user runs an XQL query.
• C.It encrypts the key-value pairs and requires a manual decryption key for each third-party vendor during the parsing phase.
• D.It converts all logs into a proprietary binary format and discards the original raw string to save storage space.

While using the remote repository on a Development XSIAM tenant, which two objects can be pushed or pulled to the remote repository? (Choose two.)

• A.Scripts
• B.Layouts
• C.Parsing rules
• D.Lists

If Cortex XSIAM is ingesting logs from a custom application, which is most likely required?

• A.Deactivating data modeling
• B.Switching to agentless logging
• C.Building a custom parsing rule
• D.Creating a custom BIOC rule

An administrator wants to verify the specific policy rules currently applied to a running process named finance_app.exe on a Windows endpoint.
Which Cytool command should be used?

• A.cytool policy query finance_app.exe
• B.cytool protect query finance_app.exe
• C.cytool runtime query finance_app.exe
• D.cytool enum finance_app.exe