Exam XSIAM-Engineer Topic 1 Question 64 Discussion

Actual exam question for Palo Alto Networks's XSIAM-Engineer exam
Question #: 64
Topic #: 1

An XSIAM engineer needs to create a custom 'enrichment' playbook that retrieves additional context about a suspicious IP address from an internal reputation database via a REST API. The API requires an authentication token passed in the header. How should the engineer configure the custom integration for this task within XSIAM to ensure secure and efficient API calls?

A. Define a custom 'HTTP' integration, hardcode the API key in the playbook's Python script, and use the 'requests' library. B. Create a new 'Integration' instance, select 'Generic API' type, define the API endpoint, and configure the authentication token in the integration instance's 'Configuration' tab as a 'Header' parameter. C. Use a 'Command' integration to execute a local script on the XSIAM engine that makes the API call and stores the token in an environment variable. D. Leverage an existing 'VirusTotal' integration and modify its configuration to point to the internal database. E. Build a custom 'Data Connector' to pull data from the internal database periodically, which doesn't require direct API calls in a playbook.

Suggested Answer: B Vote an answer

To securely and efficiently interact with a custom REST API from within an XSIAM playbook, the engineer should create a new 'Integration' instance. For generic REST APIs, the 'Generic API' type is suitable. Within the integration instance's configuration, sensitive details like API keys or tokens should be configured directly, allowing them to be securely stored and managed by XSIAM. When the API requires a token in the header, this can be specified as a 'Header' parameter within the integration's instance configuration, ensuring it's automatically included in calls made through this integration's commands. Hardcoding keys in scripts (A) is insecure. Command integrations (C) are for local execution and less integrated with the XSIAM platform for remote APIs. VirusTotal (D) is a specific external service. Data Connectors (E) are for periodic ingestion, not on-demand enrichment during an incident.

by Baird at Oct 05, 2026, 12:44 PM

Limited Time Offer

15%

Off

Get Premium XSIAM-Engineer Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business