Planning And Installation

An enterprise environment has deployed multiple Cortex XDR agents across diverse operating systems. The administrator wants to organize endpoints logically within XSIAM before assigning granular security policies. Which Cortex XSIAM feature should be used to dynamically group these endpoints based on criteria such as OS version, domain, or IP subnet?

An administrator is configuring a Broker VM in a secured DMZ zone to collect logs from on-premises security devices. The network security team requires strict verification of outbound ports to the Cortex XSIAM tenant. Which exact combination of destination ports must be permitted outbound from the Broker VM to ensure proper operation and cloud communication?

An administrator is preparing to deploy the Cortex XDR agent on Windows workstations via an Active Directory Group Policy Object (GPO). Which file format must the administrator download from the XSIAM console for this deployment method?

An XSIAM architect is planning the deployment size for an enterprise environment generating 5 TB of raw telemetry data per day. During the capacity sizing phase, the architect must account for indexing, replication, and data retention requirements. Which architectural factor is primarily responsible for the baseline storage multiplier before long-term retention is applied?

A security engineer needs to ingest custom syslog data from an on-premises legacy firewall into Cortex XSIAM. No native content pack exists for this specific legacy device. What is the recommended approach to ingest and correctly parse this unstructured log data?

An organization has strict regulatory compliance mandates requiring all data ingested into Cortex XSIAM to be encrypted in transit and at rest using customer-managed encryption keys (CMEK). During the tenant initialization and planning phase, where must the administrator configure the CMEK parameters?

During the initial onboarding phase of a Cortex XSIAM tenant, an administrator needs to download and deploy the Broker VM OVA template. Where within the Cortex XSIAM UI can the administrator find the Broker VM image download link and deployment tokens?

An architect is designing a multi-tenant XSIAM data ingestion pipeline where distinct business units must have isolated visibility and role-based access control over their respective log sources. Which XSIAM architectural construct should be configured to ensure strict data segregation between business units?

An engineer is tasked with reviewing the health and status of data collectors deployed across various remote sites. Within the Cortex XSIAM management console, which navigation path provides a consolidated view of all Broker VMs and their current operational status?

An administrator is verifying that firewall rules at the corporate perimeter permit outbound communication from Cortex XDR agents. Which destination criteria must be allowed for agent communication?

An administrator is planning network changes for an environment where endpoints communicate through a corporate HTTP proxy. To ensure Cortex XDR agents maintain continuous connectivity to the XSIAM tenant, what must the administrator verify regarding the proxy configuration?

During a high-availability planning session for an on-premises Broker VM deployment, an architect considers deploying multiple Broker VMs behind a load balancer to handle syslog collection from thousands of network devices. What is a critical architectural limitation or consideration when placing Broker VMs behind a load balancer for syslog collection?

When planning the installation of Cortex XSIAM content packs from the Marketplace, what prerequisite check must an administrator perform to ensure successful installation and utilization?

An administrator needs to integrate third-party threat intelligence feeds into Cortex XSIAM to enrich incoming security telemetry. Where should the administrator configure and manage these threat intelligence integrations within the XSIAM platform?

An organization plans to ingest cloud audit logs from Amazon Web Services (AWS) into Cortex XSIAM using an automated collector architecture. Which native AWS service integration mechanism is typically recommended and supported by XSIAM for scalable log collection?

An administrator is troubleshooting a newly configured API-based integration that is failing to ingest logs into Cortex XSIAM. The test connection fails with an authentication error, despite valid API credentials being entered. What is a common architectural oversight that causes this failure?

An engineer wants to verify the version and resource utilization of a running Broker VM. Where in the Cortex XSIAM user interface can this operational metric be inspected?

An architect is designing an automated deployment script for rolling out Cortex XDR agents across thousands of Linux servers using an enterprise configuration management tool (e.g., Ansible). To ensure silent installation and proper initial group assignment, what must be included in the installation command parameters?

When planning an enterprise-wide rollout of Cortex XDR agents, administrators often utilize 'Upgrade Rings'. What is the primary purpose of an upgrade ring in Cortex XSIAM deployment strategy?

An enterprise is deploying Cortex XSIAM in an isolated environment that requires all outgoing traffic to traverse an explicit forward proxy requiring authentication (Kerberos/NTLM). How must the Broker VM be configured to support this network topology?

An administrator is configuring data collection policies in Cortex XSIAM to optimize storage and ingestion costs. The organization wishes to exclude verbose, non-security-relevant informational logs from a specific firewall source. Which mechanism should the administrator configure?

An architect is designing the high-availability and disaster recovery (HA/DR) strategy for an on-premises log collection tier utilizing multiple Broker VMs. If Primary Broker VM 'A' fails completely, what happens to the log streams being sent to it from local security devices?

An organization requires that certain sensitive datasets ingested into Cortex XSIAM be automatically purged after a specific retention period shorter than the default tier. Where can an administrator configure custom retention policies for specific datasets?

During the planning of a Cortex XSIAM deployment in an environment utilizing strict network segmentation, an administrator must ensure that communication between the Broker VM and local log sources (such as firewalls and SIEM forwarders) uses supported protocols. Which protocol combination is natively supported by Broker VM collectors for incoming log ingestion?

An administrator needs to verify whether a newly deployed Broker VM is successfully forwarding logs to the Cortex XSIAM tenant. Which tool or menu within the XSIAM console allows the administrator to view real-time incoming log counts and ingestion rates?

An administrator is deploying Cortex XDR agents to a fleet of macOS endpoints using a Mobile Device Management (MDM) solution like Jamf Pro. What is required to ensure the agent has full disk access and system extension approvals on modern macOS versions without user prompting?

An architect is estimating storage capacity requirements for Cortex XSIAM. Which formula correctly represents the core calculation for raw daily log ingestion planning?

An administrator needs to configure granular access control so that junior SOC analysts can view incidents and run XQL queries, but cannot modify tenant settings or install integrations. Where should the administrator configure these permissions?

An organization is integrating Microsoft Entra ID (formerly Azure AD) sign-in logs into Cortex XSIAM. The architect decides to use an Event Hub integration model via a Content Hub pack. What is the architectural role of the Event Hub in this ingestion pipeline?

An architect is planning the deployment prerequisites for a Broker VM in a customer environment. Which TWO infrastructure requirements must be verified before deploying the OVA template? (Choose two)

An organization is deploying Cortex XSIAM in an environment with strict data residency requirements. The tenant is provisioned in the European Union (EU) region. During the deployment of Broker VMs and API integrations, what must the architect ensure regarding endpoint and collector configurations?

When planning log collection and ingestion strategies in Cortex XSIAM, an architect can ingest data from multiple sources. Which THREE log sources are natively supported for direct or Broker VM-mediated ingestion? (Choose three)

An administrator is preparing to deploy Cortex XDR agents across a heterogeneous enterprise network. Which THREE deployment methods are natively supported and commonly utilized for agent rollout? (Choose three)

An administrator is configuring data collection settings and incident rules in Cortex XSIAM. Which TWO configuration steps are required to ensure proper data parsing and alert generation for a newly added third-party firewall log source? (Choose two)

When defining custom user roles and permissions in Cortex XSIAM, which TWO granular access controls can an administrator assign? (Choose two)

An administrator is troubleshooting network connectivity between a Broker VM and the Cortex XSIAM cloud backend. Which THREE diagnostic checks or network requirements must be verified? (Choose three)

An administrator is reviewing the prerequisites for deploying Cortex XDR agents across virtual desktop infrastructure (VDI) environments. Which TWO best practices should be considered for VDI golden image preparation? (Choose two)

An enterprise environment is planning to ingest threat intelligence feeds into Cortex XSIAM. Which THREE threat intelligence formats or integration methods are natively supported by XSIAM content packs? (Choose three)

An architect is designing an automated log forwarding pipeline where Cortex XSIAM forwards specific enriched telemetry or incidents to an external destination (such as a third-party SIEM or data lake). Which THREE mechanisms or integrations are available for exporting data out of XSIAM? (Choose three)

When planning an initial Cortex XSIAM deployment, an administrator must configure organizational settings. Which TWO configurations are typically established during the initial tenant setup phase? (Choose two)

An organization is preparing to ingest Microsoft Windows Event Forwarding (WEF) logs into Cortex XSIAM via a Broker VM. Which THREE components or prerequisites are required for a successful WEF ingestion architecture? (Choose three)

An administrator wants to verify agent health and operational status across endpoints in Cortex XSIAM. Which TWO metrics or statuses can be viewed in the Endpoints inventory view? (Choose two)

An architect is designing an enterprise deployment strategy for Cortex XSIAM in an environment with strict change management windows. Which THREE planning considerations are critical for a successful rollout? (Choose three)

When configuring integrations in Cortex XSIAM via Content Hub, which TWO actions can an administrator perform after installing an integration pack? (Choose two)

A deployment team is planning the rollout of Cortex XSIAM agents across a heterogeneous environment containing Windows, macOS, and Linux endpoints. Which core architectural component must be provisioned and accessible from all endpoints to ensure successful agent registration and policy synchronization?

An organization requires high availability for its on-premises log ingestion architecture using Broker VMs. Which THREE architectural elements contribute to building a resilient log collection tier? (Choose three)

An administrator is configuring a new Cortex XSIAM tenant and needs to ingest custom syslog data from a third-party firewall. Which component should be configured first to receive and parse this raw syslog data before it reaches the data lake?

During the sizing phase of a Cortex XSIAM deployment, an architect needs to estimate the required IOPS and storage retention footprint for endpoint telemetry. Which factor has the most direct impact on the raw ingestion volume calculation?

An administrator is deploying the Cortex XSIAM agent via Microsoft Intune and needs to ensure that kernel-level extensions on macOS endpoints do not block the installation. Which preliminary step must be completed?

When preparing the network perimeter for a new Cortex XSIAM deployment, outbound connectivity from the Broker VM to the Cortex XSIAM cloud tenant must be established. Which standard network port and protocol are required for this outbound secure communication?

An organization requires strict data residency compliance, ensuring that all log data collected by Cortex XSIAM remains within the European Union. During tenant initialization, how must the administrator satisfy this requirement?

A security architect is planning agent installation rollouts and needs to ensure that endpoints in a high-security isolated zone can still receive policy updates without direct internet access. What is the recommended deployment pattern?

Which TWO prerequisites must be validated before deploying a Cortex XSIAM Broker VM in a VMware ESXi environment? (Choose two)

An administrator is reviewing log collection options during the initial planning phase of Cortex XSIAM. Which THREE sources can natively send logs to a Cortex XSIAM Broker VM collector profile? (Choose three)

When planning identity and access management integration for Cortex XSIAM administration, which THREE authentication or directory methods are natively supported? (Choose three)