XSIAM-Engineer Practice Test 10 — 10 Questions

Question 1

When planning the installation of Cortex XSIAM content packs from the Marketplace, what prerequisite check must an administrator perform to ensure successful installation and utilization?

Accepted Answer

Verify that the administrator account has Content Administrator or equivalent privileges and check license entitlements. Before installing content packs from the Cortex XSIAM Marketplace, the administrator must verify that their account has Content Administrator or equivalent RBAC privileges and that the tenant's license entitles them to the content being installed. Without proper permissions, the install option is unavailable or fails, and without license entitlement, packs may install but not function.

Answer

Manually compile source code files using the XQL command line

Answer

Reboot all deployed Broker VMs simultaneously

Answer

Disable all active endpoint security policies temporarily

Question 2

An administrator is configuring a new Cortex XSIAM tenant and needs to ingest custom syslog data from a third-party firewall. Which component should be configured first to receive and parse this raw syslog data before it reaches the data lake?

Accepted Answer

Broker VM configured with a Syslog collector. A Broker VM with a Syslog collector is the standard ingestion path for raw syslog from third-party devices into Cortex XSIAM. The Broker VM receives the syslog stream, and the associated parsing rules normalize the events before they are forwarded to the Cortex Data Lake for storage and analytics.

Answer

Direct API integration with the Cortex XSIAM Query Service

Answer

Cortex XSOAR mail listener integration

Answer

Traps Management Service global proxy

Question 3

An engineer wants to verify the version and resource utilization of a running Broker VM. Where in the Cortex XSIAM user interface can this operational metric be inspected?

Accepted Answer

Settings > Configurations > Data Collection > Broker VM. The Broker VM is a customer-deployed component that collects and forwards data to Cortex XSIAM, and its operational state (version, CPU, memory, disk utilization, connectivity) is surfaced in the management UI under Settings > Configurations > Data Collection > Broker VM. This is the designated administrative location for inspecting deployed broker instances and their health metrics. The other locations are investigation, query, or dashboard surfaces that do not expose Broker VM appliance telemetry.

Answer

Investigate > Alerts > System Events

Answer

XQL Search > Run > sys_resources

Answer

Dashboards > Threat Intelligence > Overview

Question 4

An architect is designing the high-availability and disaster recovery (HA/DR) strategy for an on-premises log collection tier utilizing multiple Broker VMs. If Primary Broker VM 'A' fails completely, what happens to the log streams being sent to it from local security devices?

Accepted Answer

Log collection halts unless a network load balancer, DNS failover, or secondary forwarding destination is configured. Broker VMs do not natively cluster or share state, so if Primary Broker VM A fails, the syslog and log streams pointed at its IP address simply stop being received. Log collection resumes only if an external mechanism such as a network load balancer, DNS failover, or a secondary forwarding destination on the source devices redirects traffic to Broker VM B.

Answer

Broker VM 'B' automatically polls the local disk of Broker VM 'A' via SSH to retrieve uncollected logs

Answer

The Cortex XDR agent on endpoints takes over the local syslog listening port

Answer

The XSIAM cloud backend automatically reroutes local syslog streams via cloud-to-premises BGP peering

Question 5

An administrator is configuring Active Directory synchronization within Cortex XSIAM using a Broker VM. Which prerequisite must be met on the domain controller and Broker VM to ensure successful user and group mapping ingestion?

Accepted Answer

The Broker VM must have the Active Directory App enabled and network connectivity established over LDAP/LDAPS ports to the domain controllers.. To synchronize Active Directory users and groups into Cortex XSIAM, the Broker VM must have the Active Directory app enabled and must be able to reach domain controllers over LDAP (port 389) or LDAPS (port 636). This allows the Broker VM to query AD for user and group objects and forward that identity data to the XSIAM tenant for mapping and enrichment.

Answer

The XSIAM cloud tenant must be granted Domain Administrator credentials via an Azure ExpressRoute connection.

Answer

The administrator must manually export CSV files of user lists daily and upload them via the XSIAM web console.

Answer

The Domain Controller must have the Cortex XSIAM agent installed directly on NTDS.dit.

Question 6

A security architect is planning agent installation rollouts and needs to ensure that endpoints in a high-security isolated zone can still receive policy updates without direct internet access. What is the recommended deployment pattern?

Accepted Answer

Deploy a local Broker VM within the isolated zone configured as an agent distribution and collection proxy. A Broker VM deployed within the isolated zone acts as a local agent distribution and collection proxy, allowing endpoints without direct internet access to receive policy updates and forward telemetry through the Broker VM to the XSIAM tenant. This is the recommended pattern for air-gapped or high-security network segments because it maintains a single controlled egress point.

Answer

Expose the primary Cortex XSIAM cloud tenant public IP directly to the isolated subnet

Answer

Disable cloud updates and rely exclusively on quarterly USB-based manual package updates

Answer

Configure each isolated endpoint with a direct VPN tunnel back to the primary domain controller

Question 7

A security operations center (SOC) manager wants to ensure that all analysts can view a newly created custom dashboard that displays critical incident metrics. The dashboard was created by a senior analyst and saved in their personal folder. What is the most efficient way to make this dashboard available to the entire SOC team?

Accepted Answer

Move the dashboard from the personal folder to a shared folder or mark it as public.. The most efficient way is to move the dashboard to a shared location or make it public. This leverages XSIAM's built-in sharing capabilities, ensuring all analysts can view it without manual intervention. It also maintains a single source of truth for the dashboard, reducing administrative overhead.

Answer

Ask each analyst to manually recreate the dashboard in their own personal folder.

Answer

Create a new role with dashboard viewing permissions and assign it to all analysts.

Answer

Export the dashboard as a JSON file and distribute it to analysts for import into their personal folders.

Question 8

A Cortex XSIAM administrator needs to configure a new Broker VM to collect logs from a remote site. The Broker VM must be registered with the XSIAM tenant and then configured to forward logs to the XSIAM instance. Which sequence of actions should the administrator perform?

Accepted Answer

Install the Broker VM, obtain the registration token from the XSIAM console, register the Broker VM, and then configure log collection in the Broker VM settings.. The correct order is to install the Broker VM, register it with the XSIAM tenant using a token generated in the console, and then configure log collection. Registration establishes trust and allows the Broker VM to receive configuration from XSIAM. Only after registration can log sources be defined and forwarded. Skipping or reordering these steps will prevent successful log ingestion.

Answer

Install the Broker VM, configure log collection first, and then register the Broker VM with the XSIAM tenant using a token.

Answer

Register the Broker VM using a token, install the Broker VM software, and then configure log collection.

Answer

Install the Broker VM, register it with the XSIAM tenant, and then deploy a separate log forwarder on the same host to send logs to XSIAM.

Question 9

A SOC manager wants to reduce alert fatigue by suppressing alerts that are triggered by a known benign scanner running on a critical server. The scanner generates repeated alerts with the same signature. Which XSIAM capability should the administrator use to suppress these specific alerts while still logging the events?

Accepted Answer

Alert Exclusion. Alert Exclusions are designed to suppress specific alerts without affecting the underlying event collection. By creating an exclusion that matches the scanner's signature and the server, the administrator can prevent the noisy alerts from appearing in the incident queue while still retaining the raw event data in XSIAM. This reduces alert fatigue without losing visibility. Other options either disable detection entirely or are not designed for targeted suppression.

Answer

Exception Policy

Answer

Correlation Rule

Answer

BIOC Rule

Question 10

An engineer has a Cortex XSIAM playbook that enriches alerts by querying an internal CMDB through a REST API integration. The integration instance is configured and passes connectivity tests, but during playbook execution the enrichment task returns an authentication error only when the playbook is triggered by an alert from a specific data source. The same task succeeds on every other trigger. What is the most likely cause?

Accepted Answer

The playbook task is using an incident-level credential scope, and the affected data source's incidents have no credential attached to that scope.. Credential scope determines where a playbook task looks up a secret. System-scoped credentials are available everywhere, while incident-scoped credentials are resolved from the triggering incident. If the affected data source does not populate the expected incident credential, only incidents from that source will fail authentication, which exactly matches the selective failure pattern described. Changing the task to a system-scoped credential or ensuring the source attaches the credential resolves the issue.

Answer

The integration instance is disabled for the tenant that owns the affected data source.

Answer

The affected data source's alert contains a field value that overrides the credential used by the integration, such as a malformed authorization header mapped from the alert.

Answer

The REST API integration is being rate-limited by the CMDB, and the affected data source generates a burst of alerts that exhausts the quota.