Exam XSIAM-Analyst Topic 2 Question 54 Discussion
Actual exam question for Palo Alto Networks's XSIAM-Analyst exam
Question #: 54
Topic #: 2
Question #: 54
Topic #: 2
An analyst is responding to a critical incident involving a potential ransomware attack. The analyst immediately initiates full isolation on the compromised endpoint using Cortex XSIAM to prevent the malware from spreading across the network. However, the analyst now needs to collect additional forensic evidence from the isolated machine, including memory dumps and disk images without reconnecting it to the network.
Which action will allow the analyst to collect the required forensic evidence while ensuring the endpoint remains fully isolated?
Which action will allow the analyst to collect the required forensic evidence while ensuring the endpoint remains fully isolated?
Suggested Answer: B Vote an answer
The correct answer isB, Collecting the evidence manually through the agent by accessing the machine directly and running "Generate Support File".
In situations where full isolation is enabled on an endpoint, all network communication is completely restricted. To ensure that the endpoint remains isolated while still obtaining forensic evidence such as memory dumps or disk images, the analyst needs to use manual collection via the agent directly on the machine. The
"Generate Support File" feature within the agent allows analysts to locally gather detailed forensic data without breaking network isolation.
This manual method ensures the endpoint does not reconnect or communicate externally, maintaining strict isolation for security purposes.
"In endpoint isolation mode, network communication is completely blocked. Analysts should utilize the local
'Generate Support File' function on the agent to collect forensic data while maintaining full isolation." Document Reference:XSIAM Analyst ILT Lab Guide.pdf Exact Page:Page 14 (Endpoints section)
In situations where full isolation is enabled on an endpoint, all network communication is completely restricted. To ensure that the endpoint remains isolated while still obtaining forensic evidence such as memory dumps or disk images, the analyst needs to use manual collection via the agent directly on the machine. The
"Generate Support File" feature within the agent allows analysts to locally gather detailed forensic data without breaking network isolation.
This manual method ensures the endpoint does not reconnect or communicate externally, maintaining strict isolation for security purposes.
"In endpoint isolation mode, network communication is completely blocked. Analysts should utilize the local
'Generate Support File' function on the agent to collect forensic data while maintaining full isolation." Document Reference:XSIAM Analyst ILT Lab Guide.pdf Exact Page:Page 14 (Endpoints section)
by Marsh at Oct 14, 2026, 04:31 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).