XSIAM-Engineer Practice Test 10 — 10 Questions

Question 1

An administrator is deploying the Cortex XSIAM agent via Microsoft Intune and needs to ensure that kernel-level extensions on macOS endpoints do not block the installation. Which preliminary step must be completed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pre-approve system extensions and network filters using an MDM configuration profile. macOS deployments require MDM configuration profiles (such as System Extensions and Network Extensions) to be approved prior to agent rollout.

Answer

Convert all macOS file systems to legacy HFS+ format

Answer

Disable SIP (System Integrity Protection) on all target macOS endpoints

Answer

Install the XSIAM agent manually using an interactive terminal session

Question 2

A security architect is planning agent installation rollouts and needs to ensure that endpoints in a high-security isolated zone can still receive policy updates without direct internet access. What is the recommended deployment pattern?

Accepted Answer

Deploy a local Broker VM within the isolated zone configured as an agent distribution and collection proxy. Deploy a Broker VM locally within the isolated zone to act as an internal distribution and communication proxy.

Answer

Expose the primary Cortex XSIAM cloud tenant public IP directly to the isolated subnet

Answer

Disable cloud updates and rely exclusively on quarterly USB-based manual package updates

Answer

Configure each isolated endpoint with a direct VPN tunnel back to the primary domain controller

Question 3

During the infrastructure readiness assessment for Cortex XSIAM deployment, which outbound network connectivity requirement must be verified for the Broker VM to ensure proper communication with the XSIAM tenant?

Accepted Answer

Outbound TCP port 443 to the assigned Cortex XSIAM tenant URL and services.. Broker VMs require outbound TCP port 443 connectivity to the Cortex XSIAM tenant URL and associated threat intelligence feeds for secure API communication and updates.

Answer

Inbound TCP port 22 and TCP port 80 for remote SSH administration and unencrypted web traffic.

Answer

Bidirectional UDP port 514 for unencrypted syslog tunneling across the WAN.

Answer

Outbound TCP port 3389 for remote desktop management of the appliance.

Question 4

A deployment team is planning the rollout of Cortex XSIAM agents across a heterogeneous environment containing Windows, macOS, and Linux endpoints. Which core architectural component must be provisioned and accessible from all endpoints to ensure successful agent registration and policy synchronization?

Accepted Answer

Cortex XSIAM Broker VM. The Cortex XSIAM Broker VM acts as the intermediary for agent communications, acting as a proxy and distribution point for agents deployed across the network.

Answer

Prisma Access Remote Network

Answer

Panorama Management Server

Answer

Cortex XSOAR Engine Cluster

Question 5

An administrator is deploying a Broker VM on a VMware ESXi hypervisor. After deploying the OVA template, the administrator notices the Broker VM cannot reach the NTP server and fails activation. Which initial configuration step was likely missed?

Accepted Answer

Configuring the static IP address, subnet mask, default gateway, and DNS servers in the Broker VM console interface.. Network settings, including IP addressing, DNS, and gateway configurations, must be properly applied during the initial Broker VM console setup to ensure connectivity.

Answer

Allocating additional virtual CPU sockets to handle cryptographic handshakes.

Answer

Enabling SSH service access in the Cortex XSIAM tenant settings.

Answer

Installing the VMware Tools package inside the guest Linux operating system.

Question 6

An administrator is preparing the infrastructure readiness assessment for integrating various log sources into Cortex XSIAM. Which THREE log collection methods or mechanisms are natively supported by the Broker VM architecture? (Choose three)

Accepted Answer

API-based log polling integrations for cloud services and SaaS applications.. Broker VMs support multiple ingestion methods including Syslog (UDP/TCP), HTTP/HTTPS collectors, and API-based pollers or integrations.

Answer

Direct fiber-optic tap connection into the Broker VM PCI bus for inline packet decoding.

Answer

Raw magnetic tape drive mounting for legacy mainframe log ingestion.

Question 7

An administrator needs to install Cortex XDR agents across a fleet of Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation parameter is strictly required during the MSI execution to ensure the agent correctly pairs with the appropriate Cortex XSIAM tenant?

Accepted Answer

HANDLER_SERVER= TC_CUSTOM_ID=. When deploying agents via scripts, GPO, or enterprise tools, the installation parameters must include the server address and the unique installation token (CustomerID).

Answer

CORIFY=1 TOKEN=<Installation_Token>

Answer

INSTALLDIR="C:\Program Files\Cortex" SERVER=tenant.xdr.local

Answer

/q /norestart WINDOWS_USERNAME=admin

Question 8

When planning a Cortex XSIAM deployment, what is the primary purpose of conducting an infrastructure readiness assessment?

Accepted Answer

To evaluate network bandwidth, firewall rules, log volumes, and endpoint system requirements prior to deployment.. An infrastructure readiness assessment ensures that network bandwidth, firewall rules, endpoint OS versions, log volumes, and hypervisor resources meet the prerequisites for a successful XSIAM rollout.

Answer

To automatically generate XSOAR playbooks based on existing network architecture diagrams.

Answer

To determine the exact pricing discount negotiated with Palo Alto Networks sales representatives.

Answer

To provision cloud storage buckets in AWS or Azure for long-term data archiving.

Question 9

An administrator is reviewing log collection options during the initial planning phase of Cortex XSIAM. Which THREE sources can natively send logs to a Cortex XSIAM Broker VM collector profile? (Choose three)

Accepted Answer

Syslog streams from network security devices and servers. Broker VM collector profiles support various standard protocols including syslog, HTTP/HTTPS, and specific API integrations.

Answer

Direct kernel memory dumps from unmanaged hypervisors via raw TCP sockets

Answer

Proprietary BIOS firmware updates streamed over ICMP echo requests

Question 10

What is the primary function of the Broker VM in a Cortex XSIAM deployment architecture?

Accepted Answer

To serve as an intermediary proxy for agent communications, log collection, and infrastructure integration with Cortex XSIAM.. The Broker VM acts as an intermediary appliance for agent communication proxying, identity data collection, and log forwarding from various network and security sources into Cortex XSIAM.

Answer

To replace the organization's enterprise SIEM storage database for long-term cold storage.

Answer

To act as a localized security orchestration and automated response (XSOAR) execution engine.

Answer

To enforce inline firewall filtering and threat prevention on all internet-bound traffic.