logo
Exam overview and study plan

XSIAM Engineer 270-402 Practice Questions

XSIAM Engineer

Read questions, check verified answers and discuss the reasoning. Use reading options to shape your revision, or switch to the simulator for timed practice.

View 58 free questions

58 questions in this view

Page 1 of 10

Question 1

Which two methods may be used by Cortex XSIAM to collect Windows DHCP logs? (Choose two.)

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

Which exception type should be configured when globally blocking a specific SHA256 hash but allowing its execution on some endpoints in the development environment?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

Which alert source has the capability to automatically map fields to the Cortex Data Model (XDM)?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

Based on the _raw_log and XQL query information below, what will be the result(s) of the temp_value?

_raw_log:

XQL query:

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

Based on the image below, which statement applies to the ability to remove tabs when creating a new alert layout?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

Cortex XSIAM has not received any logs for 30 minutes from a Palo Alto Networks NGFW named "MainFW." An engineer wants to create an alert for this scenario.

Correlation rule settings include:
  • Time Schedule: Every 30 minutes
  • Query Timeframe: 30 minutes
  • Action: Generate alert
  • Alert Name: No logs received from MainFW in the past 30 minutes
Which query should be used in the correlation rule?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.