Palo Alto Networks XSIAM Engineer - XSIAM-Engineer Exam Practice Test

Cortex XSIAM has not received any logs for 30 minutes from a Palo Alto Networks NGFW named
"MainFW." An engineer wants to create an alert for this scenario.
Correlation rule settings include:
- Time Schedule: Every 30 minutes
- Query Timeframe: 30 minutes
- Action: Generate alert
- Alert Name: No logs received from MainFW in the past 30 minutes
Which query should be used in the correlation rule?

An engineer sees alerts with Medium severity in Cortex XSIAM by using the filter in the image below:

How can future alerts be changed to high severity instead of medium?

Which War Room command displays the current incident context during playbook troubleshooting?

A Cortex XDR agent is installed on an endpoint, but the agent is unable to download content updates and has not registered with the Cortex XSIAM server. An engineer troubleshoots the network connection and determines that, by design, this endpoint does not have direct internet access to the required network destinations for the Cortex XDR agent traffic.
A Broker VM that has the local agent settings applet enabled with Agent Proxy configured is reachable by the endpoint. The Broker VM details are as follows:
- FQDN: crtxbroker01.company.net
- Proxy listening port: 8888
How should the engineer configure the Cortex XDR agent to use the existing Broker VM as a proxy for the agent network traffic?

How must Cloud Identity Engine be deployed and activated on Cortex XSIAM?

After deploying a new content pack, a user cannot access associated playbooks. What is the most likely cause?

A CISO has asked an engineer to create a custom dashboard in Cortex XSIAM that can be filtered to show incidents assigned to a specific user.
Which feature should be used to filter the incident data in the dashboard?

An application which ingests custom application logs is hosted in an on-premises virtual environment on an Ubuntu server, and it logs locally to a .csv file.
Which set of actions will allow the ingestion of the .csv logs into Cortex XSIAM directly from the server?

An analyst needs to combine endpoint telemetry with asset inventory information using a common hostname field. Which XQL command should be used?