XSIAM-Engineer Practice Test 12 — 15 Questions

Question 1

When troubleshooting a failing integration instance in XSIAM, which THREE tools or logs are most useful for diagnosing the root cause? (Choose three)

Accepted Answer

System Audit logs for administrative actions. Troubleshooting integrations involves checking the Audit logs, the Automation Debug / Integration logs, and testing connectivity via CLI.

Answer

Cortex XDR Agent endpoint quarantine logs

Answer

The local BIOS event log of the client workstation

Question 2

Which THREE best practices should be followed when designing custom automation integrations and playbooks in XSIAM? (Choose three)

Accepted Answer

Design modular sub-playbooks for reusable automation tasks. Best practices include handling errors gracefully, using credentials securely via integration parameters, and designing modular playbooks.

Answer

Hardcode admin service account passwords directly into Python automation scripts

Answer

Execute all integration commands synchronously on the main UI thread without timeout limits

Question 3

An enterprise has multiple distinct business units, and the security operations team wants to ensure that analysts from Business Unit A can only investigate incidents assigned to their own unit, while global administrators can view everything. Which feature enables this multi-tenant or partitioned operational structure within a single XSIAM tenant?

Accepted Answer

Configure Security Domains / Data Partitioning to restrict incident visibility by organizational boundaries.. Custom Security Domains or tenant partitioning features in XSIAM allow segregating data and incidents by organizational units using granular access controls.

Answer

Deploy separate Broker VMs for each business unit without configuring user roles.

Answer

Create separate correlation rules with identical logic for each user.

Answer

Set up independent data retention periods for each analyst account.

Question 4

An administrator is preparing to deploy the Cortex XDR agent on Windows workstations via an Active Directory Group Policy Object (GPO). Which file format must the administrator download from the XSIAM console for this deployment method?

Accepted Answer

.msi. Active Directory GPO software installation deployments require an MSI (Microsoft Installer) package format.

Answer

.exe

Answer

.tar.gz

Answer

.ova

Question 5

An administrator needs to ensure that custom dashboards created by SOC analysts are backed up or migrated between environments. Which TWO options are available for content portability in XSIAM? (Choose two)

Accepted Answer

Export dashboard definitions to JSON format for migration across tenants.. Dashboards and custom content can be exported and imported as content packs or JSON definitions through Content Management features.

Answer

Copy the browser cookies of the analyst's session.

Answer

Print physical paper copies of the dashboard screens.

Answer

Manually retype every XQL query into a notepad file on a local workstation without export tools.

Question 6

An XSIAM architect is planning the deployment size for an enterprise environment generating 5 TB of raw telemetry data per day. During the capacity sizing phase, the architect must account for indexing, replication, and data retention requirements. Which architectural factor is primarily responsible for the baseline storage multiplier before long-term retention is applied?

Accepted Answer

The inclusion of raw log retention alongside parsed dataset indices. Data parsed, normalized, and indexed into XSIAM typically incurs a storage footprint multiplier due to indices, metadata, and search optimization structures, alongside default high-availability replication factors.

Answer

The mandatory inclusion of Prisma Cloud posture data within the same storage quota

Answer

The real-time synchronization of local syslog forwarder configurations to Panorama

Answer

The automatic generation of daily Cortex XDR agent binaries for endpoints

Question 7

Which THREE configuration steps are typically required when setting up a new Broker VM instance in XSIAM? (Choose three)

Accepted Answer

Deploy the OVA image on an on-premises hypervisor (e.g., VMware ESXi). Setting up a Broker VM involves generating a registration token, deploying the OVA image to a hypervisor, and configuring the network and proxy settings.

Answer

Manually compile the Linux kernel on the Broker VM

Answer

Install the Cortex XDR Agent on the Broker VM host machine

Question 8

Which TWO of the following are valid ways to trigger an automation playbook in Cortex XSIAM?

Accepted Answer

Trigger based on specific alert criteria (e.g., severity, vendor).. Playbooks can be triggered manually by an analyst from the alert view or automatically based on predefined conditions.

Answer

Scheduled tasks based on XQL search results.

Answer

Directly modifying the underlying XSIAM database.

Answer

Automatic deployment via Marketplace updates.

Question 9

An administrator notices that a particular correlation rule is generating a high volume of false positive incidents. What is the recommended operational step to refine the rule without disabling it entirely?

Accepted Answer

Edit the correlation rule definition in Analytics / Correlation Rules to add exclusion filters for known benign entities.. Correlation rules and analytics rules in XSIAM can be tuned by modifying their exception filters, threshold criteria, or matching logic directly within the Analytics or Correlation rule configuration page.

Answer

Purge the Cortex Data Lake table associated with the alert ID.

Answer

Delete the default data parser associated with the event source to block the noisy logs entirely.

Answer

Change the tenant status from Active to Evaluation mode to suppress notifications.

Question 10

Which TWO of the following features help maintain data security during the integration process?

Accepted Answer

Encrypted credential vaulting for API keys.. Role-based access and secure credential storage are essential for maintaining the security of integrations.

Answer

Automatic public IP assignment for every collector.

Answer

Full administrative rights for every integration service account.

Answer

Disabling all logs for third-party integrations.

Question 11

A security analyst needs to automate a recurring task that involves enriching alerts with data from a third-party threat intelligence platform. Which component of XSIAM is specifically designed for this cross-platform workflow?

Accepted Answer

XSIAM Playbooks. Cortex XSOAR playbooks, integrated into XSIAM, are used for orchestrating workflows and enrichment across external platforms.

Answer

Custom Data Schema

Answer

Data Collector groups

Answer

Cortex Query Language (XQL) scripts

Question 12

An administrator is configuring a new syslog data source in XSIAM to ingest logs from a third-party firewall. Which component must be deployed on-premises to securely receive and forward these logs to the XSIAM tenant?

Accepted Answer

Palo Alto Networks Broker VM. A Broker VM is the designated on-premises component used by XSIAM to host log collectors, such as syslog, agentless vulnerability assessment, and other data forwarders.

Answer

Panorama Virtual Appliance

Answer

Cortex XDR Agent

Answer

XSIAM Management Server

Question 13

An administrator wants to configure automated email notifications to be sent to external stakeholders whenever a Critical severity incident is created. Which feature should be configured?

Accepted Answer

Configure an Incident Notification profile or webhook integration under Settings > Integrations / Notifications.. Incident notification profiles and alerting integrations can be configured under Settings > Integrations or Notifications to send alerts via email, webhooks, or ticketing systems when specific incident criteria are met.

Answer

Enable Auto-Isolation rules on all endpoints.

Answer

Modify the Log Forwarding profile to send raw JSON syslog packets to the stakeholder's email address.

Answer

Set up a scheduled XQL query that emails CSV attachments every minute.

Question 14

An XSIAM administrator has created a custom parsing rule using Logstash-like syntax within XSIAM to normalize a non-standard application log format. After saving and enabling the parsing rule, incoming logs still appear unparsed under the 'Default' vendor product type. What is the most likely reason for this behavior?

Accepted Answer

The matching criteria or vendor/product identifiers in the parsing rule do not align with the incoming log header fields.. Custom parsing rules in XSIAM require proper vendor and product identifier matching criteria (such as matching header keys or regex patterns) to hook incoming logs correctly. If the conditions do not match the incoming log structure, the parser is bypassed.

Answer

Parsing rules can only be applied to logs ingested via HTTP API, not Broker VM inputs.

Answer

Custom parsing rules require a mandatory XSOAR playbook to trigger the parsing pipeline.

Answer

The Broker VM service must be completely restarted for parsing rules to take effect.

Question 15

A customer wants to forward alerts from XSIAM to an external SIEM. Which method provides the most efficient way to achieve this continuously?

Accepted Answer

Configuring an 'External Log Forwarding' profile in XSIAM.. The Log Forwarding configuration in XSIAM allows for real-time streaming of alert data to external destinations.

Answer

Manual API requests for alert history.

Answer

Scheduled XQL report exports via email.

Answer

Using a playbook to copy every alert into a text file.