XSIAM-Engineer Practice Test 13 — 15 Questions

Question 1

An enterprise security team wants to ensure that all data ingested from a specific untrusted data source is automatically tagged with a specific tag for downstream analytics. Where can this automatic tagging rule be applied during integration setup?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Collection source configuration tags. Ingestion rules and source tagging can be configured in the data collection settings where streams are tagged upon entry.

Answer

Incident Layout custom fields

Answer

XQL Query Builder template parameters

Answer

Global Dashboard filter properties

Question 2

An organization is updating its internal Certificate Authority (CA). The administrator needs to update the trusted CA certificates used by the Broker VMs for secure syslog ingestion. Where must this certificate update be performed?

Accepted Answer

Manage and update trusted CA certificates within the Broker VM configuration settings in the XSIAM console.. Broker VM certificate management and trust stores are managed through the Broker VM configuration settings in the XSIAM management console under Settings > Configurations > Data Collection > Broker VM.

Answer

Modify the global tenant license key to include custom CA extensions.

Answer

Upload the certificate directly into the browser's local trusted root store.

Answer

Run the `certmgr /add` command on every managed Windows endpoint.

Question 3

What is the recommended method for upgrading Broker VMs in a Cortex XSIAM deployment?

Accepted Answer

Initiating the upgrade directly from the Cortex XSIAM web management console under Broker VM settings.. Broker VMs are upgraded centrally from the Cortex XSIAM web interface under the deployments or infrastructure management menu, ensuring version compatibility.

Answer

Executing an 'apt-get upgrade' command via SSH on every Broker VM instance.

Answer

Manually downloading ISO images from the Palo Alto Networks Customer Support Portal and burning them to physical media.

Answer

Re-deploying a brand-new OVA template for every minor software release.

Question 4

An organization requires strict adherence to data governance policies. Which TWO configurations help ensure that sensitive data is handled properly within XSIAM? (Choose two)

Accepted Answer

Configure Role-Based Access Control (RBAC) to limit who can view sensitive datasets.. Data governance in XSIAM is supported through data retention policies, role-based access control, and masking or filtering sensitive log fields.

Answer

Share global administrator credentials among all employees.

Answer

Store raw logs on public unsecured FTP servers.

Answer

Disable all data ingestion encryption in transit to speed up parsing.

Question 5

An XSIAM administrator needs to configure log forwarding from a Linux server to the XSIAM collector. Which action must be performed first on the endpoint before deploying the Collector service?

Accepted Answer

Generate and download the Collector installation script and registration token from the XSIAM UI.. Before installing or registering a Collector service on a Linux host, the administrator must generate and download the appropriate installation script and tokens from the XSIAM UI under Settings > Configurations > Data Collection > Collectors.

Answer

Enable port 22 inbound on the Cortex XSIAM management tenant for SSH tunnel establishment.

Answer

Manually create the database schema in the Cortex Data Lake to accept the raw logs.

Answer

Configure the syslog daemon on the local server to forward directly to port 443 of the cloud engine without an agent.

Question 6

A security engineer needs to ingest custom syslog data from an on-premises legacy firewall into Cortex XSIAM. No native content pack exists for this specific legacy device. What is the recommended approach to ingest and correctly parse this unstructured log data?

Accepted Answer

Configure a Broker VM Syslog collector and build a custom parsing rule using XQL mapping. Custom log ingestion in XSIAM is achieved by configuring a generic syslog collector on a Broker VM and defining a custom parsing rule using XQL or schema mapping.

Answer

Forward the logs to Panorama and enable Cortex Data Lake native mirroring

Answer

Directly upload raw text files via the incident management tab daily

Answer

Install a Cortex XDR agent directly onto the legacy firewall device

Question 7

An architect is designing an enterprise deployment strategy for Cortex XSIAM in an environment with strict change management windows. Which THREE planning considerations are critical for a successful rollout? (Choose three)

Accepted Answer

Defining data ingestion scopes and filtering rules to manage storage quotas and costs. Planning a successful XSIAM rollout requires defining data collection scopes, establishing testing/pilot rings for agents, and coordinating network firewall/proxy rule changes.

Answer

Requiring all end users to manually rewrite their local operating system kernels

Answer

Replacing all physical network switches with fiber-optic hubs

Question 8

An administrator wants to install a new integration pack to automate ticket creation in ServiceNow. Where in the XSIAM interface should the administrator navigate to find and install this pack?

Accepted Answer

Marketplace. The Marketplace tab is the central repository in XSIAM for discovering and installing content packs and integrations.

Answer

Administration > Updates > Packs

Answer

Incident Response > Automation > Store

Answer

Settings > Configurations > Data Sources

Question 9

While configuring a Cortex XSOAR integration instance in XSIAM for automated enrichment, the test fails with a certificate validation error when communicating with an on-premises internal API. Where should the custom CA certificate be uploaded within XSIAM to resolve this?

Accepted Answer

Settings > Configurations > Integrations > Certificate Management. Custom CA certificates required for integrations to trust internal servers must be managed through the Server Settings and Certificate Management menus in the platform settings.

Answer

Data Collection > Broker VM > Trust Store

Answer

XSIAM Marketplace > Integrations > Advanced Settings

Answer

Incident Response > Playbooks > Settings > Certs

Question 10

You are configuring a custom integration that requires sending an HTTP POST request to a legacy internal system. Which feature allows you to securely manage the connection credentials?

Accepted Answer

Use the 'Credentials' module in the integration instance settings to store and reference the secret.. Integration instances use Credentials objects stored securely in the XSIAM vault to perform authenticated requests.

Answer

Hardcode the credentials in the Python script of the custom integration.

Answer

Set up a global environment variable in the Data Collector configuration.

Answer

Add the credentials as plain text in the playbook input fields.

Question 11

An administrator needs to monitor the health and status of active data collection integrations in XSIAM. Which dashboard or menu provides visibility into data ingestion rates and agent/collector statuses?

Accepted Answer

Settings > Configurations > Data Collection. Data Collection status, ingestion metrics, and collector health are monitored under the Data Collection section.

Answer

Settings > Access Management > Audit

Answer

Dashboards > Incident Overview

Answer

XSIAM Marketplace > Installed Packs

Question 12

An engineer is mapping a non-standard third-party security log source into the XSIAM Common Data Model (XDM). Which tool within XSIAM should be used to define custom parsing rules and field mappings?

Accepted Answer

Parsing Rules. Log Forwarding and parsing rules, including custom XDM mapping, are configured using the Parsing rules feature in XSIAM.

Answer

Data Masking Policy Engine

Answer

Incident Classifier Builder

Answer

XSIAM Query Language (XQL) Sandbox

Question 13

An XSIAM administrator is troubleshooting an integration instance that is failing to connect to an external ticketing system. The administrator needs to verify whether the underlying API calls are failing due to invalid credentials or network timeouts. Where should the administrator review detailed debug logs for this specific integration instance?

Accepted Answer

The integration instance execution logs / War Room / Docker container logs available via troubleshooting settings. In XSIAM/XSOAR, integration debugging logs can be reviewed within the Cortex XSOAR War Room or by checking the specific integration execution logs under Settings > Integrations > Instances or the Audit/Log files.

Answer

The Data Stitching execution summary report

Answer

The Endpoint Agent audit trail under Cortex XDR > Agents

Answer

The Broker VM system log file (/var/log/broker/broker.log)

Question 14

An administrator needs to integrate third-party threat intelligence feeds into Cortex XSIAM to enrich incoming security telemetry. Where should the administrator configure and manage these threat intelligence integrations within the XSIAM platform?

Accepted Answer

Marketplace > Content Hub (or Settings > Integrations). Threat intelligence integrations and feeds in Cortex XSIAM are managed via the Content Hub and managed under the Settings or Integrations menus depending on the specific feed pack.

Answer

Endpoint Security > Policies > Threat Protection

Answer

Settings > Configurations > Threat Intelligence > Feeds

Answer

XQL Search > Settings > Threat Feeds

Question 15

Which TWO prerequisites must be validated before deploying a Cortex XSIAM Broker VM in a VMware ESXi environment? (Choose two)

Accepted Answer

Network access allowing outbound HTTPS communication to the Cortex XSIAM cloud tenant. Broker VMs require specific hypervisor hardware allocations and network connectivity parameters to function correctly.

Answer

An installed Cortex XSOAR Server instance running on the same virtual machine

Answer

A local physical Fibre Channel storage attachment for high-speed raw log archiving

Answer

An active Microsoft Active Directory domain controller role installed directly on the Broker VM appliance