Exam XSIAM-Engineer Topic 2 Question 88 Discussion

Actual exam question for Palo Alto Networks's XSIAM-Engineer exam
Question #: 88
Topic #: 2
An XSIAM Playbook is being developed to automate the analysis of newly discovered command-and-control (C2) domains. The Playbook receives a domain as input. It must perform the following actions: 1. Resolve the domain to IP addresses. 2. Perform WHOIS lookups on the domain and each resolved IP. 3. Query multiple external threat intelligence platforms (TIPS) for reputation and associated IOCs. 4. Store all collected enrichment data in the incident context and tag the incident. 5. If any TIP returns a 'malicious' verdict, block the domain and all associated IPs on a Palo Alto Networks NGFW via API. Which combination of Playbook tasks and data handling mechanisms are essential and efficient for this end-to-end automation?

Suggested Answer: C Vote an answer

Option C offers the most complete and efficient approach: - 'DNS Resolve: Directly resolves the domain to IPs within XSIAM. -'WHOIS Domain Lookup' and 'WHOIS IP Lookups (within a 'Loop'): Dedicated tasks for WHOIS lookups on domains and IPs. - SLOOP' (for multiple TIPS with 'Generic API Call'): Allows iterating through various TIPS efficiently using their APIs for reputation checks. - 'Set Incident Field& (for data storage): The correct way to store collected enrichment data within the incident context. - 'Update Incident Tags : For applying relevant tags based on the analysis. - 'Generic API Call' (for NGFW API): The standard and secure method to interact with a Palo Alto Networks NGFW for blocking, especially for dynamic blocks like this. Option B uses 'Run Command Line which is less integrated and less secure for external lookups and interactions. Option A is too simplistic. Options D and E are completely off-topic for the scenario.

by Winifred at Jul 11, 2026, 03:17 PM

Limited Time Offer

15%

Off

Get Premium XSIAM-Engineer Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10