Exam XSIAM-Engineer Topic 3 Question 35 Discussion

Actual exam question for Palo Alto Networks's XSIAM-Engineer exam
Question #: 35
Topic #: 3

Consider the following Python snippet for collecting Windows Event Logs, which will then be sent to an XSIAM broker:

A. The script correctly handles all necessary steps for sending logs directly to the XSIAM broker, assuming network connectivity and API keys are set. B. The current approach is suboptimal because it pulls all events without filtering, potentially overwhelming the XSIAM broker with irrelevant data. Filtering should occur at the source. C. The script lacks error handling for network connectivity issues to the XSIAM broker and should implement a retry mechanism with exponential backoff. D. The E. Security context (e.g., source IP, hostname) is not explicitly added to each event, which could hinder effective correlation within XSIAM.

Suggested Answer: B,C,D,E Vote an answer

This question tests understanding of practical data source integration challenges. B: Sending all events without filtering is inefficient and burdens XSIAM. Filtering at source is best practice. C: Robust solutions require error handling and retry mechanisms. D: While win32evtlog can collect, dedicated agents like Winlogbeat are designed for high-volume, reliable event forwarding to SIEM/XDR platforms, providing better performance and native XSIAM integration (e.g., via a XSIAM Event Collector). E: Log events almost always require contextual metadata (hostname, source IP, etc.) for effective analysis and correlation within XSIAM. The provided snippet only shows basic event details, implying a lack of enriched context. Option A is incorrect as multiple issues exist.

by Tracy at Apr 11, 2026, 02:12 AM

Limited Time Offer

15%

Off

Get Premium XSIAM-Engineer Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business