問題1
A SOC team uses a default parsing rule for a firewall integration but needs to parse a proprietary field specific to their environment. The team wants to ensure the custom parsing logic runs after the default rule and remains intact during content updates.
Which parsing rule section should be used?
A SOC team uses a default parsing rule for a firewall integration but needs to parse a proprietary field specific to their environment. The team wants to ensure the custom parsing logic runs after the default rule and remains intact during content updates.
Which parsing rule section should be used?
正確答案: D
說明：（僅 NewDumps 成員可見）
問題2
A security engineer is configuring the Cloud Identity Engine integration in Cortex XSIAM but cannot select a Cloud Identity Engine instance in the configuration dialog until the instance is activated.
Which platform is used for activation?
A security engineer is configuring the Cloud Identity Engine integration in Cortex XSIAM but cannot select a Cloud Identity Engine instance in the configuration dialog until the instance is activated.
Which platform is used for activation?
正確答案: A
說明：（僅 NewDumps 成員可見）
問題3
Which option should be used when customizing a dashboard in Cortex XSIAM to include a widget that will display data filtered by more than one dynamic value?
Which option should be used when customizing a dashboard in Cortex XSIAM to include a widget that will display data filtered by more than one dynamic value?
正確答案: B
說明：（僅 NewDumps 成員可見）
問題4
Before updating the XDR Collector, what should an administrator verify to avoid disruption?
Before updating the XDR Collector, what should an administrator verify to avoid disruption?
正確答案: C
問題5
An engineer is integrating third-party logs into Cortex XSIAM and observes that data transformations during ingestion are causing inconsistencies in the Analytics Engine. The engineer needs to ensure that logs are normalized to a consolidated schema with predefined data types to support out-of-the-box analytics.
Which feature should be used to achieve this normalization?
An engineer is integrating third-party logs into Cortex XSIAM and observes that data transformations during ingestion are causing inconsistencies in the Analytics Engine. The engineer needs to ensure that logs are normalized to a consolidated schema with predefined data types to support out-of-the-box analytics.
Which feature should be used to achieve this normalization?
正確答案: B
說明：（僅 NewDumps 成員可見）
問題6
Which type of indicator is commonly used to uniquely identify a file?
Which type of indicator is commonly used to uniquely identify a file?
正確答案: C
說明：（僅 NewDumps 成員可見）
問題7
An engineer wants a playbook to perform different actions based on the incident severity. Which task should be used?
An engineer wants a playbook to perform different actions based on the incident severity. Which task should be used?
正確答案: B
說明：（僅 NewDumps 成員可見）