Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An organization requires all audit logs generated within XSIAM to be exported to an external SIEM for long-term archiving. Which feature should the administrator configure?
Enable Cortex XSOAR playbook automation to execute a daily database backup.
Set up a BIOC alert rule to email CSV exports every 24 hours.
Modify the Data Retention profile to replicate raw blocks to an external S3 bucket automatically.
Configure a Log Forwarding profile under Settings > Configurations > Data Collection > Log Forwarding.
The Log Forwarding profile under Settings > Configurations > Data Collection defines the external destination and which log types XSIAM forwards, satisfying the long-term archiving requirement. Configuring it there establishes continuous export to the external SIEM rather than relying on local retention.
An administrator notices that a particular correlation rule is generating a high volume of false positive incidents. What is the recommended operational step to refine the rule without disabling it entirely?
Purge the Cortex Data Lake table associated with the alert ID.
Delete the default data parser associated with the event source to block the noisy logs entirely.
Edit the correlation rule definition in Analytics / Correlation Rules to add exclusion filters for known benign entities.
Editing the correlation rule definition in Analytics / Correlation Rules to add exclusion filters for known benign entities suppresses false positives while preserving detection logic. This refines the rule's scope without disabling it, maintaining coverage for genuine threats.
Change the tenant status from Active to Evaluation mode to suppress notifications.
An administrator wants to ensure that specific sensitive incident categories are restricted to a dedicated tier-2 response team. Which XSIAM construct should be configured to achieve this role-based operational segregation?
Modify the global tenant retention policy to purge tier-1 logs automatically.
Deploy a separate Cortex XSOAR server to handle tier-2 escalations independently.
Configure User Roles and User Groups under Settings > Access Management to limit incident viewing permissions.
User Roles and User Groups under Settings > Access Management define role-based permissions, including which incident categories each group can view. Assigning the tier-2 team a restricted role enforces the operational segregation the scenario requires.
Write a BIOC rule to drop unauthorized access attempts at the ingestion layer.
An administrator needs to troubleshoot why a Broker VM is failing to ingest logs from an internal syslog source. Which diagnostic utility available on the Broker VM console should the administrator use first?
Run the `xdrctl troubleshoot` command from any managed Windows endpoint agent console.
Reset the cloud tenant encryption keys under General Settings.
Access the Broker VM management console to check service status, connectivity test tools, and container logs.
The Broker VM management console exposes service status, connectivity test utilities, and container logs, letting the administrator verify whether the syslog listener and forwarding containers are running and reachable. This directly diagnoses why ingestion from the internal syslog source fails.
Open the XSIAM Incident Graph to view packet captures from the Broker VM IP.
An administrator needs to update the Cortex XDR agent installation package across 5,000 endpoints without causing network saturation. Which feature should be utilized to manage this rollout effectively?
Configure an Agent Upgrade schedule and phased deployment profile within Endpoint Management > Agent Settings.
An Agent Upgrade schedule with a phased deployment profile stages the package rollout in controlled waves, throttling concurrent downloads so 5,000 endpoints do not saturate bandwidth. This directly satisfies the no-network-saturation constraint, unlike a single immediate push to every endpoint.
Manually push the MSI package via Active Directory Group Policy Objects using an external script.
Execute an XQL remediation action with the `upgrade_agent` command across all active sessions.
Set up a global Log Forwarding profile to broadcast the binary over syslog.
An XSIAM administrator needs to configure log forwarding from a Linux server to the XSIAM collector. Which action must be performed first on the endpoint before deploying the Collector service?
Enable port 22 inbound on the Cortex XSIAM management tenant for SSH tunnel establishment.
Generate and download the Collector installation script and registration token from the XSIAM UI.
The registration token and installation script must be generated in the XSIAM UI first, because the Collector service authenticates and binds to the tenant using that token during deployment. Without it, the endpoint cannot register, so this step precedes installing the Collector on the Linux server.
Manually create the database schema in the Cortex Data Lake to accept the raw logs.
Configure the syslog daemon on the local server to forward directly to port 443 of the cloud engine without an agent.
Want more Operations And Lifecycle Management practice?
Practice this domainAn administrator is preparing to deploy the Cortex XDR agent on Windows workstations via an Active Directory Group Policy Object (GPO). Which file format must the administrator download from the XSIAM console for this deployment method?
.exe
.tar.gz
.msi
Active Directory Group Policy Object software deployment installs Windows Installer packages, so the administrator must download the .msi from the XSIAM console. This format satisfies the GPO deployment constraint; .exe or .dmg packages cannot be assigned through Group Policy.
.ova
A security engineer needs to ingest custom syslog data from an on-premises legacy firewall into Cortex XSIAM. No native content pack exists for this specific legacy device. What is the recommended approach to ingest and correctly parse this unstructured log data?
Forward the logs to Panorama and enable Cortex Data Lake native mirroring
Directly upload raw text files via the incident management tab daily
Install a Cortex XDR agent directly onto the legacy firewall device
Configure a Broker VM Syslog collector and build a custom parsing rule using XQL mapping
A Broker VM Syslog collector receives the raw syslog stream on-premises, then forwards it to Cortex XSIAM. Because no native content pack parses this legacy device's format, a custom parsing rule with XQL mapping extracts the required fields, satisfying the unstructured-data constraint.
During the initial onboarding phase of a Cortex XSIAM tenant, an administrator needs to download and deploy the Broker VM OVA template. Where within the Cortex XSIAM UI can the administrator find the Broker VM image download link and deployment tokens?
Marketplace > Content Hub > Broker VM Management
Incidents > Response > Integrations > Broker VM
Dashboards > System Status > Virtual Appliances
Settings > Configurations > Data Collection > Broker VM
Broker VM deployment artefacts, including the OVA template download and enrolment tokens, are surfaced under Settings > Configurations > Data Collection > Broker VM. This path satisfies the administrator's onboarding need to retrieve both the image and the token required to register the Broker VM with the Cortex XSIAM tenant.
An architect is designing a multi-tenant XSIAM data ingestion pipeline where distinct business units must have isolated visibility and role-based access control over their respective log sources. Which XSIAM architectural construct should be configured to ensure strict data segregation between business units?
Broker VM interface bonding configurations
Agent Installation Packages with embedded proxy exclusions
Dataset-level Role-Based Access Control (RBAC) and Query Scopes
Dataset-level RBAC with query scopes restricts each business unit to only its own ingested datasets, enforcing strict segregation within the shared tenant. This satisfies the isolation and role-based visibility constraint, preventing cross-unit data exposure in the multi-tenant pipeline.
Log Collector Profiles with dedicated forwarding keys
An engineer is tasked with reviewing the health and status of data collectors deployed across various remote sites. Within the Cortex XSIAM management console, which navigation path provides a consolidated view of all Broker VMs and their current operational status?
Settings > Configurations > Data Collection > Broker VM
Settings > Configurations > Data Collection > Broker VM opens the consolidated Broker VM view, listing every deployed collector with its current operational status. This navigation path satisfies the requirement to review health across remote sites from one console location.
Cloud Identity > Integrations > Status
Dashboards > Incident Management > Overview
Investigate > Endpoint Security > Collectors
An administrator is verifying that firewall rules at the corporate perimeter permit outbound communication from Cortex XDR agents. Which destination criteria must be allowed for agent communication?
Outbound TCP port 443 to Palo Alto Networks XSIAM cloud FQDNs
Cortex XDR agents communicate with Cortex XSIAM exclusively over outbound TCP 443 to Palo Alto Networks cloud FQDNs. Permitting this destination satisfies the perimeter firewall constraint, since agents initiate all traffic and require no inbound rules.
Inbound TCP port 22 and 3389 for remote diagnostics
Outbound UDP port 514 for direct syslog streaming to the cloud
Inbound and outbound TCP port 80 for unencrypted configuration checks
Want more Planning And Installation practice?
Practice this domainAn automation engineer is writing a custom Python script for an XSIAM automation task and needs to query XSIAM incident data. Which integration library or command standard must be used to execute commands against the Cortex XSOAR/XSIAM engine?
The paloalto_xsiam SDK
The demisto Python library
The demisto library is the Python SDK that wraps the Cortex XSOAR/XSIAM engine, exposing commands such as demisto.executeCommand and incident data retrieval. Custom scripts must import it to run against the engine; no other library provides that command interface.
The pan-os-python library
The requests module with direct tenant URL authentication
An engineer needs to ingest custom JSON-formatted logs from an internal application using an HTTP API. Which XSIAM feature should be configured to receive these incoming webhook payloads?
Cortex XDR REST API direct ingestion
Syslog over TCP/UDP Collector
Broker VM HTTP API Collector
The Broker VM HTTP API Collector exposes an HTTP endpoint that receives incoming webhook payloads and parses custom JSON logs before forwarding them into XSIAM. Other ingestion methods, such as syslog or agent-based collection, cannot accept pushed HTTP POST data.
XPANSE Attack Surface Management feed
An administrator is configuring a new syslog data source in XSIAM to ingest logs from a third-party firewall. Which component must be deployed on-premises to securely receive and forward these logs to the XSIAM tenant?
Panorama Virtual Appliance
Cortex XDR Agent
Palo Alto Networks Broker VM
The Broker VM is deployed on-premises to receive syslog traffic from internal devices such as the third-party firewall, then securely forwards it to the XSIAM tenant. It satisfies the stem's on-premises constraint because cloud-only ingestion cannot directly reach internal log sources without this local collector.
XSIAM Management Server
An XSIAM engineer is troubleshooting a newly configured AWS CloudTrail integration. Log data is not appearing in the XSIAM query builder. Which log collection method is natively utilized by XSIAM to pull AWS CloudTrail logs?
Amazon SQS queue polling via an integration instance
XSIAM's AWS CloudTrail integration uses an integration instance to poll an Amazon SQS queue, where CloudTrail delivers its log notifications. This pull-based SQS polling is the native collection method, so misconfigured queue permissions or instance credentials explain missing log data.
Direct Syslog forwarding from AWS VPC to Broker VM
Scheduled SCP file transfer to a Broker VM SFTP directory
Cortex XDR Agent polling AWS metadata
An administrator wants to install a new integration pack to automate ticket creation in ServiceNow. Where in the XSIAM interface should the administrator navigate to find and install this pack?
Administration > Updates > Packs
Incident Response > Automation > Store
Settings > Configurations > Data Sources
Marketplace
The Marketplace is the XSIAM interface area that hosts integration packs, including the ServiceNow content pack for automated ticket creation. Browsing it lets the administrator locate and install the pack directly, satisfying the requirement to find and install it within the console.
An engineer is configuring a webhook integration to forward XSIAM alerts to an external ticketing platform. The external system requires custom HTTP headers for authentication. Where can these custom headers be configured within the integration instance?
Within the Broker VM local firewall rules
In the integration instance configuration parameter fields
Integration instance parameters accept arbitrary key-value pairs, including custom HTTP header names and values, which XSIAM injects into every outbound webhook request. This satisfies the external ticketing platform's authentication requirement without modifying the integration code itself.
Inside the incident layout designer
In the XSIAM Global Server proxy configuration file
Want more Integration And Automation practice?
Practice this domainDuring the infrastructure readiness assessment for Cortex XSIAM deployment, which outbound network connectivity requirement must be verified for the Broker VM to ensure proper communication with the XSIAM tenant?
Inbound TCP port 22 and TCP port 80 for remote SSH administration and unencrypted web traffic.
Bidirectional UDP port 514 for unencrypted syslog tunneling across the WAN.
Outbound TCP port 3389 for remote desktop management of the appliance.
Outbound TCP port 443 to the assigned Cortex XSIAM tenant URL and services.
The Broker VM initiates all communication to the Cortex XSIAM tenant, so outbound TCP 443 to the assigned tenant URL and services must be permitted through firewalls and proxies for registration, telemetry, and management traffic.
An administrator is deploying a Broker VM on a VMware ESXi hypervisor. After deploying the OVA template, the administrator notices the Broker VM cannot reach the NTP server and fails activation. Which initial configuration step was likely missed?
Allocating additional virtual CPU sockets to handle cryptographic handshakes.
Enabling SSH service access in the Cortex XSIAM tenant settings.
Configuring the static IP address, subnet mask, default gateway, and DNS servers in the Broker VM console interface.
The OVA template deploys with DHCP by default, so the Broker VM never obtains a routable address, gateway or DNS resolution. Without static IP, subnet mask, gateway and DNS set in the console, it cannot reach the NTP server, so activation fails.
Installing the VMware Tools package inside the guest Linux operating system.
A deployment engineer is sizing a Broker VM for a large enterprise environment with 20,000 Cortex XDR agents and multiple log collection sources. During the initial deployment, the administrator notices high CPU and memory utilization on the single Broker VM. What is the recommended architectural remedy for this scenario?
Configure the Cortex XDR agents to bypass the Broker VM and report directly to the Cortex XSIAM tenant cloud.
Upgrade the underlying hypervisor memory allocation for the single Broker VM beyond the maximum supported limit of 64GB.
Install a dedicated syslog forwarder daemon directly on every individual endpoint to reduce Broker VM processing overhead.
Deploy an additional Broker VM and group them logically to distribute agent check-ins and log forwarding workloads.
Adding a second Broker VM and grouping them logically distributes agent check-ins and log forwarding across brokers, relieving the CPU and memory saturation on the single appliance. Vertical scaling alone would not address the workload distribution requirement.
An enterprise environment has strict network segmentation where log sources in a secure DMZ cannot communicate directly with the primary Broker VM located in the corporate network. How should an architect design the log collection architecture to feed data into Cortex XSIAM?
Configure a port-mirroring session on the core firewall to duplicate all DMZ traffic to the Broker VM via local loopback.
Install the Cortex XDR agent on all network routers and switches in the DMZ to capture syslog locally.
Deploy a secondary Broker VM within the DMZ configured to forward logs securely to the primary Broker VM or directly to the XSIAM tenant.
A secondary Broker VM in the DMZ accepts logs from segmented sources locally, then forwards them outbound to the primary Broker VM or directly to the XSIAM tenant, respecting the segmentation constraint that blocks direct DMZ-to-corporate communication.
Open bidirectional UDP port 514 across the internal corporate firewall to allow DMZ devices to stream raw syslog directly.
When establishing Role-Based Access Control (RBAC) in Cortex XSIAM, what is the purpose of assigning 'Folder' scopes to a custom role?
To specify the directory path where agent installation logs are written on endpoints.
To limit visibility and management capabilities to specific subsets of endpoints and data sources organized within the folder hierarchy.
Folder scopes bind a custom role to a node in the Cortex XSIAM asset hierarchy, so permissions apply only to endpoints and data sources beneath that folder. This satisfies least-privilege requirements by restricting visibility and management to defined subsets rather than the whole tenant.
To restrict which log files are stored on the local Broker VM disk storage.
To determine which software packages can be downloaded from the Cortex XSIAM Marketplace.
A security architect is aligning deployment objectives with Cortex XSIAM architecture for an organization migrating from a legacy SIEM. The organization requires continuous ingestion of custom application logs using HTTP. Which XSIAM architectural component should be configured to ingest these logs securely?
Palo Alto Networks Next-Gen Firewall configured as a syslog relay.
Broker VM with an enabled HTTP/HTTPS Collector service.
The Broker VM hosts the HTTP/HTTPS Collector service, which receives custom application logs pushed over HTTP and forwards them securely to Cortex XSIAM. This satisfies the continuous ingestion requirement for custom logs while keeping collection mediated by an authenticated broker rather than direct exposure.
Cortex XDR Agent running in 'Collector Mode' on every application server.
Direct API integration from the application servers to the Cortex XSIAM query service without intermediary gateways.
Want more XSIAM Platform Architecture And Deployment practice?
Practice this domainThe vendor does not publish an exact question count for the XSIAM-Engineer. The passing score is 860 (scaled 300–1,000). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Operations And Lifecycle Management, Planning And Installation, Integration And Automation, XSIAM Platform Architecture And Deployment. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks XSIAM-Engineer exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.