XSIAM-Engineer Practice Test 12 — 15 Questions

Question 1

A Cortex XSIAM administrator needs to ensure that only specific IP addresses can access the Cortex XSIAM tenant's management console. The organization uses a corporate firewall and wants to restrict access to the SOC team's subnet. Which Cortex XSIAM feature should the administrator configure to enforce this restriction?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Allowed IP addresses list in the Cortex XSIAM tenant settings.. To restrict management console access by IP, Cortex XSIAM offers an allowed IP addresses list in the tenant settings. This allowlist ensures that only connections from specified IP ranges are accepted, providing a network-level security control. RBAC handles user permissions, SAML handles authentication, and engine firewalls are for engine traffic, so none of those directly enforce IP restrictions on the console.

Answer

Role-Based Access Control (RBAC) with IP-based conditions.

Answer

Cortex XSIAM engine firewall rules on the local host.

Answer

SAML 2.0 identity provider (IdP) with network policies.

Question 2

A Cortex XSIAM administrator needs to integrate an external threat intelligence feed that provides indicators of compromise (IOCs) in STIX format. The feed must be automatically ingested and used to generate alerts when IOCs match events in the tenant. Which component should the administrator configure to achieve this?

Accepted Answer

Cortex XSIAM threat intelligence management module, configured with a STIX/TAXII feed.. The threat intelligence management module in Cortex XSIAM is designed to ingest external feeds in STIX/TAXII format, normalize the indicators, and make them available for correlation against events. Configuring a STIX/TAXII feed in this module enables automatic ingestion and IOC-based alerting, fulfilling the requirement without custom development.

Answer

Cortex XSIAM Broker VM with the Threat Intelligence app installed.

Answer

Cortex XSIAM Engine with a custom parsing rule for STIX data.

Answer

Cortex XSIAM API endpoint that receives STIX data and forwards it to the correlation engine.

Question 3

Which protocol is natively supported by the Broker VM Syslog collector for receiving log streams from network devices?

Accepted Answer

Syslog over TCP and UDP. Broker VM Syslog collectors support standard syslog streaming over both TCP and UDP protocols.

Answer

Netflow v9 and IPFIX only

Answer

SNMP Trap v2c and v3

Answer

WMI and RPC protocols

Question 4

An enterprise security team wants to ensure that all data ingested from a specific untrusted data source is automatically tagged with a specific tag for downstream analytics. Where can this automatic tagging rule be applied during integration setup?

Accepted Answer

Data Collection source configuration tags. The Data Collection source configuration in Cortex XSIAM allows administrators to define tags that are automatically applied to all incoming data from that specific source. This ensures that data from untrusted sources is consistently labeled for downstream analytics, such as XQL queries, dashboards, and correlation rules. Tags applied at the collection point are inherited by all events from that source, providing a scalable and reliable method for data classification.

Answer

Incident Layout custom fields

Answer

XQL Query Builder template parameters

Answer

Global Dashboard filter properties

Question 5

During a high-availability planning session for an on-premises Broker VM deployment, an architect considers deploying multiple Broker VMs behind a load balancer to handle syslog collection from thousands of network devices. What is a critical architectural limitation or consideration when placing Broker VMs behind a load balancer for syslog collection?

Accepted Answer

Load balancing TCP or UDP syslog streams requires careful session persistence and source IP retention to ensure parser context is maintained. When placing multiple Broker VMs behind a load balancer for syslog collection, session persistence (sticky sessions) and source IP retention are critical to ensure that all syslog messages from a given device go to the same Broker VM. This maintains parser context and prevents log parsing errors due to distributed processing.

Answer

Broker VMs cannot accept syslog data if they are registered to the same XSIAM tenant token

Answer

Load balancers prevent the Broker VM from communicating with the Cortex XSIAM cloud backend via port 443

Answer

Broker VMs automatically sync local log queues across the load balancer using BGP routing

Question 6

An administrator is investigating why an automated response playbook integrated via Cortex XSOAR failed to execute when triggered by an XSIAM incident. Where should the administrator check the integration communication logs?

Accepted Answer

Review the Cortex XSOAR integration instance logs and audit trail for API communication errors.. When an XSIAM playbook fails to execute via Cortex XSOAR, the integration instance logs and audit trail in XSOAR are the authoritative place to see API errors, authentication failures, and command execution results. These logs show exactly why the integration call failed.

Answer

Examine the Data Lake storage partition allocation table.

Answer

Inspect the Cortex XDR Agent debug bundle collected from the affected server.

Answer

Check the local `syslog.log` file on the Broker VM container.

Question 7

An administrator needs to ensure that all new endpoint agents automatically receive the latest security policy upon registration. Which XSIAM feature should the administrator configure to enforce this behavior?

Accepted Answer

Agent Policy. Agent Policies are the central mechanism in XSIAM for defining and distributing security configurations to endpoints. When a new agent registers, it checks in with the management console and retrieves the policy assigned to its group or the default policy. By ensuring the correct Agent Policy is in place and properly assigned, the administrator guarantees that all new endpoints automatically receive the latest security settings without manual intervention.

Answer

Exception Policy

Answer

Response Action

Answer

Alert Rule

Question 8

An XSIAM administrator needs to ensure that a newly deployed correlation rule does not generate an excessive number of alerts during its initial tuning phase. The administrator wants to limit the rule's impact while still collecting data for analysis. What is the most appropriate approach?

Accepted Answer

Configure the rule in 'Simulation' or 'Test' mode to log matches without generating incidents.. Using simulation mode is the best approach because it allows the rule to run and log matches without creating incidents. This provides a safe environment for tuning and data collection, ensuring that when the rule is enabled, it generates only high-fidelity alerts.

Answer

Set the rule to 'Disabled' and rely on manual queries to collect data.

Answer

Reduce the rule's severity to 'Informational' so alerts are less noticeable.

Answer

Create a suppression rule that filters out all alerts from the correlation rule.

Question 9

An administrator is planning to upgrade the XSIAM instance to a new major version. The administrator must ensure that the upgrade process does not disrupt ongoing security operations. Which two actions should be taken before initiating the upgrade? (Choose two.)

Accepted Answer

Review the release notes for any breaking changes or deprecated features.. Before upgrading XSIAM, it is crucial to back up custom configurations and review release notes. These steps ensure that you can recover from unforeseen issues and are aware of changes that might affect your environment. Avoiding actions that disrupt data ingestion or delete historical data is equally important to maintain continuous security monitoring.

Answer

Delete old incidents to free up database space for the new version.

Answer

Schedule the upgrade during peak business hours to ensure maximum support availability.

Answer

Disable all data sources to prevent new logs from being ingested during the upgrade.

Question 10

An administrator notices high resource utilization on a Broker VM. Which THREE diagnostic steps or remediation actions should be taken? (Choose three)

Accepted Answer

Review ingestion volume per data source to identify noisy log senders overwhelming the collector.. Option E is correct because the first diagnostic step for a saturated Broker VM is to inspect its management console resource utilization metrics (CPU, memory, disk) to confirm which resource is actually constrained and to establish a baseline before remediation. Option C is correct because excessive ingestion volume from a small number of noisy log senders is a common cause of Broker VM overload; reviewing per-data-source ingestion volume identifies the offending senders so they can be filtered, throttled, or excluded to relieve the collector. Option D is correct because once the bottleneck is confirmed, the appropriate remediation is vertical scaling (adding CPU/RAM to the underlying VM) or horizontal scaling (deploying additional Broker VM nodes) to distribute the ingestion and processing load. Option A does not belong because global tenant encryption keys are unrelated to Broker VM cache memory and changing them would not flush cache or reduce utilization. Option B does not belong because reinstalling the Cortex XDR agent on Windows domain controllers has no bearing on Broker VM resource consumption and is not a valid diagnostic or remediation step for this scenario.

Answer

Modify the global tenant encryption keys to flush cache memory.

Answer

Reinstall the Cortex XDR agent on all Windows domain controllers.

Question 11

A security analyst needs to automate a recurring task that involves enriching alerts with data from a third-party threat intelligence platform. Which component of XSIAM is specifically designed for this cross-platform workflow?

Accepted Answer

XSIAM Playbooks. XSIAM Playbooks are the automation component designed to orchestrate cross-platform workflows, including enriching alerts with data from third-party threat intelligence platforms. Playbooks can call external APIs, run scripts, and integrate with various tools to automate recurring tasks. They are specifically built for this purpose, unlike the other options which serve different roles.

Answer

Custom Data Schema

Answer

Data Collector groups

Answer

Cortex Query Language (XQL) scripts

Question 12

When configuring Role-Based Access Control (RBAC) within Cortex XSIAM, an administrator needs to define custom roles using specific parameters and permission scopes. Which THREE capabilities can be assigned or restricted when building a custom role? (Choose three)

Accepted Answer

Granting permission to execute remote endpoint remediation actions such as host isolation.. In Cortex XSIAM RBAC, custom roles are built from granular permissions that include action-level rights, so option A is correct because executing remote endpoint remediation actions such as host isolation is a controllable response action permission that can be granted or withheld per role. Option C is correct because role scopes can restrict an analyst's visibility to specific folder scopes containing designated assets and logs, limiting what data they can see and act on. Option D is correct because access to specific XQL dataset queries and dashboards is governed by role permissions, allowing administrators to enable or restrict query and dashboard usage. Option B is not correct because built-in Palo Alto Networks detection analytics source code is vendor-managed and cannot be directly modified through RBAC role configuration. Option E is not correct because tenant data lake infrastructure sizing and CPU allocation are platform/tenant management concerns, not assignable RBAC permissions for custom roles.

Answer

Directly modifying the core source code of built-in Palo Alto Networks detection analytics algorithms.

Answer

Modifying the underlying cloud infrastructure sizing and CPU allocation of the XSIAM tenant data lake.

Question 13

An XSIAM engineer is configuring automated incident response playbooks that interact with third-party tools via Cortex XSOAR integration commands. Which THREE best practices should be followed when designing robust automation playbooks? (Choose three)

Accepted Answer

Incorporate approval or notification gates (such as 'Send Email' or 'Ask' tasks) for destructive remediation actions. Option B is correct because incorporating approval or notification gates (e.g., 'Send Email' or 'Ask' tasks) before destructive remediation actions ensures human oversight and prevents unintended damage from automated responses. Option D is correct because using explicit task inputs and output mappings makes playbooks deterministic and maintainable, avoiding fragile dependencies on global context keys that may change or be missing. Option E is correct because implementing error-handling branches using conditional tasks on the '${.Error}' context key allows playbooks to gracefully handle integration failures and continue or escalate appropriately. Option A is incorrect because infinite loops without termination conditions waste resources and can cause playbook hangs, rather than robust automation. Option C is incorrect because hardcoding API tokens in script parameters exposes credentials in playbook exports and logs; credentials should be stored in Cortex XSOAR's credential store or integration instances.

Answer

Design every playbook task to execute as a continuous infinite loop until manually terminated

Answer

Hardcode API tokens directly inside script task parameters for portability

Question 14

An organization is preparing its internal firewall infrastructure and network architecture for a large-scale Cortex XSIAM deployment involving agents, Broker VMs, and cloud engines. Which THREE network traffic requirements must be verified and configured to ensure proper operational connectivity? (Choose three)

Accepted Answer

Endpoints and Broker VMs must have outbound HTTPS (TCP port 443) access to the assigned Cortex XSIAM tenant URL.. Option C is correct because Cortex XSIAM agents and Broker VMs initiate outbound TLS connections over TCP 443 to the tenant URL for registration, heartbeat, and data upload, so this egress path must be allowed through the firewall. Option D is correct because Broker VMs and cloud engines rely on DNS to resolve the tenant FQDN and external update/content repositories; without working name resolution, agent-broker communication and updates fail. Option E is correct because Broker VMs act as log collection points and must accept inbound syslog traffic (UDP/TCP 514 or custom ports) from internal log sources for ingestion into XSIAM. Option A is wrong because XSIAM does not require inbound SSH from the cloud tenant to every managed endpoint; agent communication is agent-initiated outbound, not inbound administrative access. Option B is wrong because XSIAM agents do not use peer-to-peer multicast heartbeat broadcasting across subnets; heartbeats are unicast HTTPS sessions to the tenant or Broker.

Answer

The Cortex XSIAM cloud tenant requires inbound administrative SSH access (TCP port 22) to all managed corporate endpoints.

Answer

Endpoints must have direct peer-to-peer multicast routing enabled across subnet boundaries for agent heartbeat broadcasting.

Question 15

An engineer is troubleshooting a Cortex XSIAM playbook that fails at a task calling a custom integration command. The command works when run manually from the War Room but fails within the playbook. The playbook task is configured to use the integration instance 'TI-Platform'. Which is the most likely cause of the failure?

Accepted Answer

The playbook task is missing the 'using' keyword or has an incorrect instance name in the command arguments.. The most common reason a command works manually but fails in a playbook is incorrect instance specification in the task. Playbook tasks must explicitly state which integration instance to use, often via the 'using' argument. If this is missing or misspelled, the command may fail or use the wrong instance. The other options describe non-existent restrictions or unlikely network issues, given that manual execution succeeds.

Answer

The integration command requires an API key that is only available in the War Room context, not in playbooks.

Answer

The playbook runs in a different Docker container that does not have network access to the external API.

Answer

The integration instance 'TI-Platform' is not enabled for use in playbooks.