Question 46
Which exception type should be configured when globally blocking a specific SHA256 hash but allowing its execution on some endpoints in the development environment?
Question 47
An XSIAM automation workflow needs to fetch specific log data from an on-premises Splunk instance, perform complex statistical analysis on this data using a custom Python script, and then ingest the summarized results back into XSIAM as a new dataset for dashboarding. The Python script requires several external libraries not pre-installed in the XSIAM environment. Which is the most appropriate and scalable method for executing this Python script within the XSIAM automation context?
Question 48
After deploying a new custom log source via the Broker VM, an engineer notices the daily ingestion quota is being exceeded. Analysis shows that a specific "verbose" flag on the source application is sending unneeded system state data which needs to be excluded from the logs being committed to the data lake.
Which Cortex XSIAM feature allows the engineer to define the logic?
Question 49
An engineer wants to onboard data from a third-party vendor's firewall. There is no content pack available for it, so the engineer creates custom data source integration and parsing rules to generate a dataset with the firewall data.
How can the analytics capabilities of Cortex XSIAM be used on the data?
Question 50
A new zero-day exploit targeting a widely used web server application has been announced. Your XSIAM deployment needs to rapidly deploy an indicator rule to detect exploitation attempts. You receive the following highly specific indicators of compromise (IOCs): a unique HTTP User-Agent string, a specific URL path with a known malicious payload, and a suspicious process execution (e.g., 'cmd.exe' or 'bash') initiated by the web server process. Which XQL query structure would be most appropriate for a robust indicator rule in XSIAM to detect this attack, ensuring high fidelity?