XSIAM-Engineer 무료 덤프문제 온라인 액세스

A Cortex XSIAM engineer plans to add Kafka and Syslog Collectors to a Broker VM cluster.
What are two expected behaviors of the applets when they are added to the cluster? (Choose two.)

• A.Kafka Collector applet is automatically initiated, enters an active state on the primary node, and is on standby on the standby nodes.
• B.Syslog Collector applet is active on all cluster nodes, including primary and standby.
• C.Kafka Collector applet is active on all cluster nodes, including primary and standby.
• D.Syslog Collector applet is automatically initiated, enters an active state on the primary node, and is on standby on the standby nodes.

A Cortex XSIAM engineer adds a disable injection and prevention rule for a specific running process. After an hour, the engineer disables the rule to reinstate the security capabilities, but the capabilities are not applied.
What is the explanation for this behavior?

• A.The engineer needs to restart the process to get back the security capabilities.
• B.The engineer needs a support exception to get back the security capabilities.
• C.The engineer can disable the rule, but security capabilities are not applied to the process.
• D.The engineer needs to wait for the time period configured in the rule to pass first.

A security architect is planning to deploy a specialized security use case using a Marketplace content pack in Cortex XSIAM.
Which set of components is bundled within these content packs for end-to-end automation and detection?

• A.Server configuration keys, Docker images, API tokens
• B.Predefined global search queries, user accounts, email templates
• C.Integrations, playbooks, scripts, correlation rules
• D.Tenant license keys, database schemas, compute resources

Based on the images below, which command will allow the context data to be displayed as a table when troubleshooting a playbook task?

• A.!ToTable data=${parentIncidentFields.custom_fields.incidentassignment}
• B.!JsonToTable value=${parentIncidentFields.custom_fields}
• C.!ConvertTableToHTML table=${parentIncidentFields.custom_fields}
• D.!ExtractHTMLTables
  html=${parentIncidentFields.custom_fields.incidentassignment}

A security team has integrated a threat intelligence platform with Cortex XSIAM to enhance threat detection and response capabilities. The platform provides regular updates on malicious indicators. An engineer discovers that certain indicators are incorrectly applied in Cortex XSIAM's indicator rules. After verifying that the integration is healthy and that the indicators are present and property formatted on the platform side, the engineer suspects an issue with how Cortex XSIAM initially fetched the indicators.
Which action is a timely and sustainable resolution for this issue?

• A.Manually update Cortex XSIAM's correlation rules to include the missing indicators.
• B.Wait for the next scheduled synchronization interval between Cortex XSIAM and the threat intelligence platform.
• C.Delete the integration instance and recreate it to force a full resynchronization.
• D.Locate the threat intelligence integration instance settings and initiate a "re-fetch indicators" operation.