Palo Alto Networks · Free Practice Questions · Last reviewed May 2026
24real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An organization requires all audit logs generated within XSIAM to be exported to an external SIEM for long-term archiving. Which feature should the administrator configure?
Enable Cortex XSOAR playbook automation to execute a daily database backup.
Set up a BIOC alert rule to email CSV exports every 24 hours.
Modify the Data Retention profile to replicate raw blocks to an external S3 bucket automatically.
Configure a Log Forwarding profile under Settings > Configurations > Data Collection > Log Forwarding.
Correct. Log Forwarding profiles allow exporting XSIAM ingested data and audit logs to external destinations.
An administrator notices that a particular correlation rule is generating a high volume of false positive incidents. What is the recommended operational step to refine the rule without disabling it entirely?
Purge the Cortex Data Lake table associated with the alert ID.
Delete the default data parser associated with the event source to block the noisy logs entirely.
Edit the correlation rule definition in Analytics / Correlation Rules to add exclusion filters for known benign entities.
Correct. Tuning rules via exception filters reduces false positives while maintaining detection coverage.
Change the tenant status from Active to Evaluation mode to suppress notifications.
An administrator wants to ensure that specific sensitive incident categories are restricted to a dedicated tier-2 response team. Which XSIAM construct should be configured to achieve this role-based operational segregation?
Modify the global tenant retention policy to purge tier-1 logs automatically.
Deploy a separate Cortex XSOAR server to handle tier-2 escalations independently.
Configure User Roles and User Groups under Settings > Access Management to limit incident viewing permissions.
Correct. Access management features including roles and groups govern what data and incidents users can view.
Write a BIOC rule to drop unauthorized access attempts at the ingestion layer.
An XSIAM tenant is approaching its licensed data ingestion volume limit. The operations team needs to identify which data sources are consuming the highest ingestion bandwidth. Where should the administrator check this information?
Go to Settings > Configurations > License Management to view data ingestion breakdown by source and vendor.
Correct. License Management provides visibility into consumption metrics across different vendors and data sources.
Review the Audit Trail dashboard for high-frequency API polling events.
Execute an XQL query using the `dataset = host_inventory` command and group by storage size.
Check the Cortex XDR Agent health status page under Endpoint Management.
During routine maintenance, an administrator notices that a custom parser is dropping incoming events from a newly integrated security appliance. Where should the administrator check to debug syntax and grok pattern failures in real time?
SSH into the Cortex XSIAM management cluster master node and check the /var/log/parser.log file.
Navigate to Settings > Configurations > Data Collection > Parsers, select the custom parser, and use the Test Parser feature with sample raw logs.
Correct. The built-in parser testing tool allows administrators to validate grok patterns against raw log samples.
Open the Cortex XDR Agent console on the local machine and export the Agent Log Collector bundle.
Review the Incident Graph to trace dropped packets from the ingestion pipeline.
An administrator needs to troubleshoot why a Broker VM is failing to ingest logs from an internal syslog source. Which diagnostic utility available on the Broker VM console should the administrator use first?
Run the `xdrctl troubleshoot` command from any managed Windows endpoint agent console.
Reset the cloud tenant encryption keys under General Settings.
Access the Broker VM management console to check service status, connectivity test tools, and container logs.
Correct. The Broker VM management interface provides dedicated tools to verify connectivity, container health, and ingestion pipelines.
Open the XSIAM Incident Graph to view packet captures from the Broker VM IP.
Want more Operations And Lifecycle Management practice?
Practice this domainAn enterprise environment has deployed multiple Cortex XDR agents across diverse operating systems. The administrator wants to organize endpoints logically within XSIAM before assigning granular security policies. Which Cortex XSIAM feature should be used to dynamically group these endpoints based on criteria such as OS version, domain, or IP subnet?
Asset Tags
Data Filters
Endpoint Groups
Endpoint Groups provide the mechanism to group endpoints dynamically using criteria or statically for targeted policy deployments.
Correlation Rules
An administrator is configuring a Broker VM in a secured DMZ zone to collect logs from on-premises security devices. The network security team requires strict verification of outbound ports to the Cortex XSIAM tenant. Which exact combination of destination ports must be permitted outbound from the Broker VM to ensure proper operation and cloud communication?
TCP 443 and TCP 22 for secure tunneling and remote management
TCP 6514 and UDP 514 for syslog relay directly to the tenant database
TCP 443 outbound for cloud communication and log ingestion APIs
Broker VMs require outbound TCP 443 access to communicate with the XSIAM tenant endpoints and ingest services securely.
TCP 8443 and UDP 123 for internal heartbeat synchronization
An administrator is preparing to deploy the Cortex XDR agent on Windows workstations via an Active Directory Group Policy Object (GPO). Which file format must the administrator download from the XSIAM console for this deployment method?
.exe
.tar.gz
.msi
Active Directory GPO natively supports deploying software packages packaged in .msi format.
.ova
An XSIAM architect is planning the deployment size for an enterprise environment generating 5 TB of raw telemetry data per day. During the capacity sizing phase, the architect must account for indexing, replication, and data retention requirements. Which architectural factor is primarily responsible for the baseline storage multiplier before long-term retention is applied?
The mandatory inclusion of Prisma Cloud posture data within the same storage quota
The inclusion of raw log retention alongside parsed dataset indices
XSIAM retains both raw logs and normalized/indexed datasets, requiring a multiplier to account for original data plus indexed representations and replication.
The real-time synchronization of local syslog forwarder configurations to Panorama
The automatic generation of daily Cortex XDR agent binaries for endpoints
A security engineer needs to ingest custom syslog data from an on-premises legacy firewall into Cortex XSIAM. No native content pack exists for this specific legacy device. What is the recommended approach to ingest and correctly parse this unstructured log data?
Forward the logs to Panorama and enable Cortex Data Lake native mirroring
Directly upload raw text files via the incident management tab daily
Install a Cortex XDR agent directly onto the legacy firewall device
Configure a Broker VM Syslog collector and build a custom parsing rule using XQL mapping
Broker VMs ingest raw syslog streams, and custom parsing rules normalize the fields into the XSIAM common schema.
An organization has strict regulatory compliance mandates requiring all data ingested into Cortex XSIAM to be encrypted in transit and at rest using customer-managed encryption keys (CMEK). During the tenant initialization and planning phase, where must the administrator configure the CMEK parameters?
Directly inside the XSIAM web UI under Settings > Configurations > Security > Encryption
Within the Broker VM local hypervisor configuration console via CLI
Inside the Cortex XDR agent installation wizard command-line parameters
During the initial tenant provisioning workflow coordinated with Palo Alto Networks cloud operations and KMS integration
CMEK requires specialized backend setup between the cloud provider's KMS and the tenant's storage accounts during provisioning.
Want more Planning And Installation practice?
Practice this domainWhile configuring a Cortex XSOAR integration instance in XSIAM for automated enrichment, the test fails with a certificate validation error when communicating with an on-premises internal API. Where should the custom CA certificate be uploaded within XSIAM to resolve this?
Data Collection > Broker VM > Trust Store
XSIAM Marketplace > Integrations > Advanced Settings
Settings > Configurations > Integrations > Certificate Management
Correct. Certificate Management allows administrators to trust custom internal CAs used by internal integration endpoints.
Incident Response > Playbooks > Settings > Certs
An automation engineer is writing a custom Python script for an XSIAM automation task and needs to query XSIAM incident data. Which integration library or command standard must be used to execute commands against the Cortex XSOAR/XSIAM engine?
The paloalto_xsiam SDK
The demisto Python library
Correct. The demisto library provides the standard wrapper functions (`demisto.executeCommand`, etc.) for scripts.
The pan-os-python library
The requests module with direct tenant URL authentication
An administrator needs to monitor the health and status of active data collection integrations in XSIAM. Which dashboard or menu provides visibility into data ingestion rates and agent/collector statuses?
Settings > Configurations > Data Collection
Correct. Data Collection provides operational status, status of collectors, and ingestion rates.
Settings > Access Management > Audit
Dashboards > Incident Overview
XSIAM Marketplace > Installed Packs
An engineer needs to ingest custom JSON-formatted logs from an internal application using an HTTP API. Which XSIAM feature should be configured to receive these incoming webhook payloads?
Cortex XDR REST API direct ingestion
Syslog over TCP/UDP Collector
Broker VM HTTP API Collector
Correct. The HTTP API collector on the Broker VM exposes an endpoint to receive incoming webhooks and JSON logs.
XPANSE Attack Surface Management feed
An administrator is configuring a new syslog data source in XSIAM to ingest logs from a third-party firewall. Which component must be deployed on-premises to securely receive and forward these logs to the XSIAM tenant?
Panorama Virtual Appliance
Cortex XDR Agent
Palo Alto Networks Broker VM
Correct. The Broker VM hosts the necessary log collector modules to ingest syslog traffic.
XSIAM Management Server
An XSIAM engineer is troubleshooting a newly configured AWS CloudTrail integration. Log data is not appearing in the XSIAM query builder. Which log collection method is natively utilized by XSIAM to pull AWS CloudTrail logs?
Amazon SQS queue polling via an integration instance
Correct. AWS integrations typically rely on SQS queues and IAM roles for reliable event streaming.
Direct Syslog forwarding from AWS VPC to Broker VM
Scheduled SCP file transfer to a Broker VM SFTP directory
Cortex XDR Agent polling AWS metadata
Want more Integration And Automation practice?
Practice this domainDuring the infrastructure readiness assessment for Cortex XSIAM deployment, which outbound network connectivity requirement must be verified for the Broker VM to ensure proper communication with the XSIAM tenant?
Inbound TCP port 22 and TCP port 80 for remote SSH administration and unencrypted web traffic.
Bidirectional UDP port 514 for unencrypted syslog tunneling across the WAN.
Outbound TCP port 3389 for remote desktop management of the appliance.
Outbound TCP port 443 to the assigned Cortex XSIAM tenant URL and services.
Outbound HTTPS on port 443 is mandatory for Broker VM telemetry and control channels.
An administrator is deploying a Broker VM on a VMware ESXi hypervisor. After deploying the OVA template, the administrator notices the Broker VM cannot reach the NTP server and fails activation. Which initial configuration step was likely missed?
Allocating additional virtual CPU sockets to handle cryptographic handshakes.
Enabling SSH service access in the Cortex XSIAM tenant settings.
Configuring the static IP address, subnet mask, default gateway, and DNS servers in the Broker VM console interface.
Without proper network configuration, the VM lacks routing to reach NTP and the XSIAM cloud.
Installing the VMware Tools package inside the guest Linux operating system.
A deployment engineer is sizing a Broker VM for a large enterprise environment with 20,000 Cortex XDR agents and multiple log collection sources. During the initial deployment, the administrator notices high CPU and memory utilization on the single Broker VM. What is the recommended architectural remedy for this scenario?
Configure the Cortex XDR agents to bypass the Broker VM and report directly to the Cortex XSIAM tenant cloud.
Upgrade the underlying hypervisor memory allocation for the single Broker VM beyond the maximum supported limit of 64GB.
Install a dedicated syslog forwarder daemon directly on every individual endpoint to reduce Broker VM processing overhead.
Deploy an additional Broker VM and group them logically to distribute agent check-ins and log forwarding workloads.
Scaling horizontally by adding Broker VMs distributes the workload effectively.
An enterprise environment has strict network segmentation where log sources in a secure DMZ cannot communicate directly with the primary Broker VM located in the corporate network. How should an architect design the log collection architecture to feed data into Cortex XSIAM?
Configure a port-mirroring session on the core firewall to duplicate all DMZ traffic to the Broker VM via local loopback.
Install the Cortex XDR agent on all network routers and switches in the DMZ to capture syslog locally.
Deploy a secondary Broker VM within the DMZ configured to forward logs securely to the primary Broker VM or directly to the XSIAM tenant.
Placing a Broker VM in the DMZ isolates the network zones while maintaining ingestion pipelines.
Open bidirectional UDP port 514 across the internal corporate firewall to allow DMZ devices to stream raw syslog directly.
When establishing Role-Based Access Control (RBAC) in Cortex XSIAM, what is the purpose of assigning 'Folder' scopes to a custom role?
To specify the directory path where agent installation logs are written on endpoints.
To limit visibility and management capabilities to specific subsets of endpoints and data sources organized within the folder hierarchy.
Folder scoping enforces multi-tenancy or regional boundaries within a single XSIAM tenant.
To restrict which log files are stored on the local Broker VM disk storage.
To determine which software packages can be downloaded from the Cortex XSIAM Marketplace.
An administrator needs to install Cortex XDR agents across a fleet of Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation parameter is strictly required during the MSI execution to ensure the agent correctly pairs with the appropriate Cortex XSIAM tenant?
CORIFY=1 TOKEN=<Installation_Token>
INSTALLDIR="C:\Program Files\Cortex" SERVER=tenant.xdr.local
HANDLER_SERVER=<tenant_address> TC_CUSTOM_ID=<installation_token>
Using the correct installer properties ensures the agent registers to the correct tenant.
/q /norestart WINDOWS_USERNAME=admin
Want more XSIAM Platform Architecture And Deployment practice?
Practice this domainThe XSIAM-Engineer exam has 200 questions and must be completed in 90 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Operations And Lifecycle Management, Planning And Installation, Integration And Automation, XSIAM Platform Architecture And Deployment. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Palo Alto Networks XSIAM-Engineer exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.