Planning And Installation

An administrator is preparing to deploy the Cortex XDR agent on Windows workstations via an Active Directory Group Policy Object (GPO). Which file format must the administrator download from the XSIAM console for this deployment method?

A security engineer needs to ingest custom syslog data from an on-premises legacy firewall into Cortex XSIAM. No native content pack exists for this specific legacy device. What is the recommended approach to ingest and correctly parse this unstructured log data?

During the initial onboarding phase of a Cortex XSIAM tenant, an administrator needs to download and deploy the Broker VM OVA template. Where within the Cortex XSIAM UI can the administrator find the Broker VM image download link and deployment tokens?

An architect is designing a multi-tenant XSIAM data ingestion pipeline where distinct business units must have isolated visibility and role-based access control over their respective log sources. Which XSIAM architectural construct should be configured to ensure strict data segregation between business units?

An engineer is tasked with reviewing the health and status of data collectors deployed across various remote sites. Within the Cortex XSIAM management console, which navigation path provides a consolidated view of all Broker VMs and their current operational status?

An administrator is verifying that firewall rules at the corporate perimeter permit outbound communication from Cortex XDR agents. Which destination criteria must be allowed for agent communication?

An administrator is planning network changes for an environment where endpoints communicate through a corporate HTTP proxy. To ensure Cortex XDR agents maintain continuous connectivity to the XSIAM tenant, what must the administrator verify regarding the proxy configuration?

During a high-availability planning session for an on-premises Broker VM deployment, an architect considers deploying multiple Broker VMs behind a load balancer to handle syslog collection from thousands of network devices. What is a critical architectural limitation or consideration when placing Broker VMs behind a load balancer for syslog collection?

When planning the installation of Cortex XSIAM content packs from the Marketplace, what prerequisite check must an administrator perform to ensure successful installation and utilization?

An administrator needs to integrate third-party threat intelligence feeds into Cortex XSIAM to enrich incoming security telemetry. Where should the administrator configure and manage these threat intelligence integrations within the XSIAM platform?

An organization plans to ingest cloud audit logs from Amazon Web Services (AWS) into Cortex XSIAM using an automated collector architecture. Which native AWS service integration mechanism is typically recommended and supported by XSIAM for scalable log collection?

An administrator is troubleshooting a newly configured API-based integration that is failing to ingest logs into Cortex XSIAM. The test connection fails with an authentication error, despite valid API credentials being entered. What is a common architectural oversight that causes this failure?

An engineer wants to verify the version and resource utilization of a running Broker VM. Where in the Cortex XSIAM user interface can this operational metric be inspected?

An architect is designing an automated deployment script for rolling out Cortex XDR agents across thousands of Linux servers using an enterprise configuration management tool (e.g., Ansible). To ensure silent installation and proper initial group assignment, what must be included in the installation command parameters?

When planning an enterprise-wide rollout of Cortex XDR agents, administrators often utilize 'Upgrade Rings'. What is the primary purpose of an upgrade ring in Cortex XSIAM deployment strategy?

An enterprise is deploying Cortex XSIAM in an isolated environment that requires all outgoing traffic to traverse an explicit forward proxy requiring authentication (Kerberos/NTLM). How must the Broker VM be configured to support this network topology?

An administrator is configuring data collection policies in Cortex XSIAM to optimize storage and ingestion costs. The organization wishes to exclude verbose, non-security-relevant informational logs from a specific firewall source. Which mechanism should the administrator configure?

An architect is designing the high-availability and disaster recovery (HA/DR) strategy for an on-premises log collection tier utilizing multiple Broker VMs. If Primary Broker VM 'A' fails completely, what happens to the log streams being sent to it from local security devices?

An organization requires that certain sensitive datasets ingested into Cortex XSIAM be automatically purged after a specific retention period shorter than the default tier. Where can an administrator configure custom retention policies for specific datasets?

During the planning of a Cortex XSIAM deployment in an environment utilizing strict network segmentation, an administrator must ensure that communication between the Broker VM and local log sources (such as firewalls and SIEM forwarders) uses supported protocols. Which protocol combination is natively supported by Broker VM collectors for incoming log ingestion?

An administrator needs to verify whether a newly deployed Broker VM is successfully forwarding logs to the Cortex XSIAM tenant. Which tool or menu within the XSIAM console allows the administrator to view real-time incoming log counts and ingestion rates?

An administrator is deploying Cortex XDR agents to a fleet of macOS endpoints using a Mobile Device Management (MDM) solution like Jamf Pro. What is required to ensure the agent has full disk access and system extension approvals on modern macOS versions without user prompting?

An architect is estimating storage capacity requirements for Cortex XSIAM. Which formula correctly represents the core calculation for raw daily log ingestion planning?

An administrator needs to configure granular access control so that junior SOC analysts can view incidents and run XQL queries, but cannot modify tenant settings or install integrations. Where should the administrator configure these permissions?

An organization is integrating Microsoft Entra ID (formerly Azure AD) sign-in logs into Cortex XSIAM. The architect decides to use an Event Hub integration model via a Content Hub pack. What is the architectural role of the Event Hub in this ingestion pipeline?

An architect is planning the deployment prerequisites for a Broker VM in a customer environment. Which TWO infrastructure requirements must be verified before deploying the OVA template? (Choose two)

When planning log collection and ingestion strategies in Cortex XSIAM, an architect can ingest data from multiple sources. Which THREE log sources are natively supported for direct or Broker VM-mediated ingestion? (Choose three)

An administrator is configuring data collection settings and incident rules in Cortex XSIAM. Which TWO configuration steps are required to ensure proper data parsing and alert generation for a newly added third-party firewall log source? (Choose two)

When defining custom user roles and permissions in Cortex XSIAM, which TWO granular access controls can an administrator assign? (Choose two)

An administrator is troubleshooting network connectivity between a Broker VM and the Cortex XSIAM cloud backend. Which THREE diagnostic checks or network requirements must be verified? (Choose three)

An administrator is reviewing the prerequisites for deploying Cortex XDR agents across virtual desktop infrastructure (VDI) environments. Which TWO best practices should be considered for VDI golden image preparation? (Choose two)

When planning an initial Cortex XSIAM deployment, an administrator must configure organizational settings. Which TWO configurations are typically established during the initial tenant setup phase? (Choose two)

An administrator wants to verify agent health and operational status across endpoints in Cortex XSIAM. Which TWO metrics or statuses can be viewed in the Endpoints inventory view? (Choose two)

An architect is designing an enterprise deployment strategy for Cortex XSIAM in an environment with strict change management windows. Which THREE planning considerations are critical for a successful rollout? (Choose three)

When configuring integrations in Cortex XSIAM via Content Hub, which TWO actions can an administrator perform after installing an integration pack? (Choose two)

A deployment team is planning the rollout of Cortex XSIAM agents across a heterogeneous environment containing Windows, macOS, and Linux endpoints. Which core architectural component must be provisioned and accessible from all endpoints to ensure successful agent registration and policy synchronization?

An organization requires high availability for its on-premises log ingestion architecture using Broker VMs. Which THREE architectural elements contribute to building a resilient log collection tier? (Choose three)

An administrator is configuring a new Cortex XSIAM tenant and needs to ingest custom syslog data from a third-party firewall. Which component should be configured first to receive and parse this raw syslog data before it reaches the data lake?

During the sizing phase of a Cortex XSIAM deployment, an architect needs to estimate the required IOPS and storage retention footprint for endpoint telemetry. Which factor has the most direct impact on the raw ingestion volume calculation?

An administrator is deploying the Cortex XSIAM agent via Microsoft Intune and needs to ensure that kernel-level extensions on macOS endpoints do not block the installation. Which preliminary step must be completed?

When preparing the network perimeter for a new Cortex XSIAM deployment, outbound connectivity from the Broker VM to the Cortex XSIAM cloud tenant must be established. Which standard network port and protocol are required for this outbound secure communication?

An organization requires strict data residency compliance, ensuring that all log data collected by Cortex XSIAM remains within the European Union. During tenant initialization, how must the administrator satisfy this requirement?

A security architect is planning agent installation rollouts and needs to ensure that endpoints in a high-security isolated zone can still receive policy updates without direct internet access. What is the recommended deployment pattern?

Which TWO prerequisites must be validated before deploying a Cortex XSIAM Broker VM in a VMware ESXi environment? (Choose two)

An administrator is reviewing log collection options during the initial planning phase of Cortex XSIAM. Which THREE sources can natively send logs to a Cortex XSIAM Broker VM collector profile? (Choose three)

A security architect is planning the network requirements for a new Cortex XSIAM tenant. The organization wants to ensure that the on-premises Broker VM can securely communicate with the Cortex XSIAM cloud services. Which outbound port must be allowed from the Broker VM to the Cortex XSIAM cloud for management and data plane traffic?

During a Cortex XSIAM deployment planning meeting, an architect must determine how endpoint telemetry will reach the tenant from a segmented OT network with no direct internet access. Which deployment component is explicitly designed to collect and forward endpoint data from restricted network segments to the Cortex XSIAM cloud?

A security architect is planning a Cortex XSIAM deployment for a mid-sized enterprise. The CISO wants to know which component is responsible for collecting and forwarding logs from on-premises sources to the Cortex XSIAM tenant. Which component should the architect identify?

An engineer is planning a Cortex XSIAM deployment and must ensure that the Broker VM can forward logs to the tenant even when the primary internet path is saturated. Which configuration should be verified on the Broker VM to allow it to use an alternate outbound path?

An engineer is preparing the network prerequisites for a new Cortex XSIAM deployment. The security team must allow outbound connectivity from the Broker VM to the Cortex XSIAM cloud tenant. Which destination port must be permitted for the Broker VM to establish and maintain its connection?

A security architect is planning the initial deployment of Cortex XSIAM for a company with three geographically separated data centers. The architect wants to ensure that if the primary Cortex XSIAM tenant becomes unavailable, log ingestion continues without data loss. Which deployment model should the architect recommend?

An engineer is planning the initial deployment of a Cortex XSIAM tenant in a region where the corporate security policy requires all log data to remain within the country. The organization operates primarily in Germany and wants to minimize latency for data ingestion. Which deployment consideration should the engineer prioritize?

An architect is planning the installation of a Broker VM in a high-security environment. The security team requires that all outbound communication from the Broker VM to the Cortex XSIAM tenant be encrypted and mutually authenticated. Which characteristic of the Broker VM's communication satisfies this requirement?

An architect is planning a large Cortex XSIAM deployment where the Broker VM will collect high-volume syslog from dozens of network devices. The architect must size the Broker VM appropriately. Which resource is most critical to evaluate when determining the Broker VM's ability to handle sustained log ingestion without dropping data?

A security architect is designing the network flow for a Cortex XSIAM deployment that will ingest logs from on-premises firewalls. The firewalls cannot send logs directly to the internet. The architect plans to deploy a Broker VM in the DMZ. Which outbound connectivity requirement must be met for the Broker VM to forward logs to the Cortex XSIAM tenant?

A security engineer is planning the network requirements for a new Cortex XSIAM deployment. The organization uses a strict egress firewall policy. The engineer must ensure that the Broker VM can communicate with the Cortex XSIAM tenant. Which outbound connectivity requirement must be met?

An administrator is planning the initial onboarding of data sources into a new Cortex XSIAM tenant. When configuring a Broker VM to collect logs from on-premises sources, which TWO tasks are required to make the appliance operational and able to forward data to the tenant? (Choose two.)

An engineer is planning to deploy Cortex XDR agents to endpoints as part of a Cortex XSIAM rollout. The organization has a strict change management policy that requires a phased rollout with the ability to roll back if issues arise. Which Cortex XSIAM feature should the engineer use to control the agent version and rollout pace?

A security administrator is planning to deploy Cortex XSIAM agents to endpoints across multiple operating systems. They need to ensure that the agents can communicate with the Cortex XSIAM tenant. Which statement accurately describes the agent communication requirement?

An engineer is planning the initial deployment of Cortex XSIAM for a large enterprise that uses an on-premises data center with strict change control. The security team requires that no inbound firewall ports be opened to the internet. Which deployment component must be deployed to allow outbound-only communication from the data center to the Cortex XSIAM tenant?

A security architect is planning a Cortex XSIAM deployment for a company with a single data center and no existing Cortex products. The company wants to forward syslog from 40 network devices to Cortex XSIAM. Which component is required to receive and forward these logs to the Cortex XSIAM tenant?

An architect is planning a Cortex XSIAM deployment for a company with strict change management. The company wants to validate the deployment in a non-production environment before rolling out to production endpoints. Which approach best supports this requirement while aligning with Cortex XSIAM deployment best practices?

An architect is planning the installation of Cortex XSIAM in a hybrid environment where some log sources are in the cloud and some are on-premises. The architect wants to ensure that all log sources can be onboarded efficiently. Which statement about log source onboarding in Cortex XSIAM is correct?

An architect is planning the installation of Cortex XSIAM in a regulated environment that requires all data to be stored within the country. The architect must ensure that the Cortex XSIAM tenant is deployed in the correct region. Which factor determines the data residency of the Cortex XSIAM tenant?

A security engineer is preparing to deploy Cortex XSIAM in a new environment. The engineer needs to ensure that the Cortex XSIAM tenant can receive data from the Broker VM. Which outbound connectivity requirement must be met from the Broker VM?

A security engineer is preparing to install a Broker VM in a Demilitarized Zone (DMZ) to collect logs from internet-facing devices. The engineer needs to ensure the Broker VM can receive syslog data. Which configuration should be applied on the firewall?

A security architect is planning the network requirements for a new Cortex XSIAM deployment. The organization uses an explicit forward proxy for all outbound internet traffic. Which configuration must be applied to the Broker VM to ensure it can reach the Cortex XSIAM tenant through the proxy?

A security administrator is preparing to install a Broker VM in a VMware environment. The administrator needs to ensure the virtual appliance meets the network requirements for communicating with the Cortex XSIAM tenant. Which network setting must be configured on the Broker VM to allow it to resolve the Cortex XSIAM cloud FQDN?

A security administrator is planning the initial installation of Cortex XSIAM and needs to register a new Broker VM with the tenant. Which action must be performed first to allow the Broker VM to authenticate and establish a connection?

A security administrator is planning the installation of a Broker VM in a data center that uses a proxy for internet access. The administrator needs to ensure that the Broker VM can communicate with the Cortex XSIAM tenant through the proxy. Which TWO configuration steps are required? (Choose two.)

An engineer is planning the deployment of multiple Broker VMs in a large environment with several network segments. The goal is to ensure high availability and local log collection without requiring inbound firewall rules. Which TWO design considerations are valid for this deployment? (Choose two.)

An architect is planning the installation of a Broker VM in a high-security environment. The security policy requires that all outbound traffic from the Broker VM be inspected and that the Broker VM not initiate connections to arbitrary internet destinations. Which Cortex XSIAM configuration should the architect use to meet these requirements?

A security administrator is planning the deployment of Cortex XSIAM and needs to integrate it with an existing SIEM for data enrichment. The administrator wants to query external threat intelligence sources from within Cortex XSIAM. Which component should be used to enable this integration?

An architect is planning the deployment of Cortex XSIAM in a large enterprise with multiple data centers. The architect must ensure high availability and scalability for log collection. Which TWO design considerations are critical for the Broker VM deployment? (Choose two.)

An engineer is planning the installation of Cortex XDR agents on endpoints as part of a Cortex XSIAM deployment. The organization wants to minimize the risk of a bad agent version affecting all endpoints simultaneously. Which deployment strategy should the engineer use?

An architect is planning a Cortex XSIAM deployment for an organization that requires all log data to be stored within a specific geographic region due to data sovereignty laws. The organization has a mix of cloud and on-premises log sources. Which deployment option should the architect choose to meet this requirement?

An administrator is planning the installation of a Broker VM in a network segment that has limited outbound internet access. The Broker VM must communicate with the Cortex XSIAM tenant. Which two components must be allowed through the firewall to ensure successful communication? (Choose two.)

A security administrator is planning the initial deployment of Cortex XSIAM and needs to ensure that the platform can ingest logs from a variety of sources. Which component is responsible for collecting and forwarding logs from on-premises sources to Cortex XSIAM?

An architect is planning the deployment of Cortex XSIAM for an organization that uses a proxy for all outbound internet traffic. The Broker VM must be configured to use the proxy to reach the Cortex XSIAM tenant. Which configuration step is required during the Broker VM setup?