A vulnerability analyst asks a Cortex XSIAM engineer to identify assets vulnerable to newly reported zero-day CVE affecting the "ai_app" application and versions 12.1, 12.2, 12.4, and 12.5.
Which XQL query will provide the required result?

• A.
• B.
• C.
• D.

Comment: *

Name: *

Email: *

Verification: *

Which types of content may be included in a Marketplace content pack?

• A.Integrations, playbooks, parsers, and server configuration keys
• B.Predefined dashboards, indicators, and reports
• C.Scripts, playbooks, integrations, and correlation rules
• D.Behavioral indicator of compromise (BIOC) rules, layouts, and custom dashboards

Comment: *

Name: *

Email: *

Verification: *

A global enterprise with significant regulatory compliance burdens (e.g., GDPR, CCPA) is planning an XSIAM deployment. They identify sensitive personal identifiable information (PII) within certain log sources. During the 'Evaluate deployment requirements' phase, how should XSIAM's capabilities be leveraged to address PII masking and data anonymization before ingestion into Cortex Data Lake, while still allowing security analysts to perform investigations when necessary?

• A.Rely solely on XSIAM's role-based access control (RBAC) to restrict access to raw PII data in CDL.
• B.Configure log collectors (e.g., XDR agents, syslog forwarders) with pre-ingestion regex-based masking rules to anonymize PII fields before they reach CDL.
• C.Develop an XSOAR playbook that periodically scans CDL for PII and then encrypts the identified fields in place.
• D.Implement an external data anonymization service that processes all logs before forwarding them to XSIAM, with a mechanism to de-anonymize on demand.
• E.Utilize XSIAM's built-in data retention policies to automatically delete logs containing PII after a short period, regardless of investigation needs.

Comment: *

Name: *

Email: *

Verification: *

Consider the following XSIAM Playbook snippet designed to identify high-risk network connections based on IP reputation. An analyst notices that some internal IP addresses are being incorrectly flagged as malicious. Which part of the Playbook logic, if any, is most likely causing this issue, and what is the best immediate remediation?

• A.The 'Fetch Indicators' task is pulling too many indicators; add a 'Deduplicate' task.
• B.The 'IP Reputation Check' task is not configured to exclude private IP ranges; modify its configuration.
• C.The 'Conditional' task's expression is flawed; reverse the order of AND/OR operators.
• D.The 'Create Incident' task is triggered too early; add a 'Sleep' task before it.
• E.The playbook is missing a 'Manual Review' task before taking action; add one to the workflow.

Comment: *

Name: *

Email: *

Verification: *

A company is automating Cortex XSIAM agent deployment using Ansible. The challenge is to install the agent and ensure it's registered with the correct agent group dynamically, without hardcoding group names into the playbook, as new groups are frequently created. The XSIAM API documentation provides endpoints for retrieving agent group information. Which of the following Ansible playbook snippets best demonstrates the concept of dynamic agent group assignment using the XSIAM API during installation?

• A.
• B.
• C.
• D.
• E.

Comment: *

Name: *

Email: *

Verification: *