XSIAM-Engineer Practice Test 13 — 15 Questions

Question 1

When setting up authentication and user management in Cortex XSIAM, which TWO features or protocols are supported for administrative access control? (Choose two)

Accepted Answer

Local user accounts with mandatory multi-factor authentication (MFA).. Option B is correct because Cortex XSIAM supports locally defined user accounts and enforces multi-factor authentication (MFA) for administrative logins, adding a required second factor beyond the password. Option C is correct because XSIAM supports SAML 2.0 federation, allowing an external Identity Provider (IdP) to authenticate administrators and provide single sign-on (SSO) with centralized access control. Options A, D, and E are not supported: NTLMv1 is a deprecated, weak challenge-response protocol, Telnet on port 23 transmits credentials in plaintext and is not used for administrative CLI access, and anonymous guest tokens would violate the least-privilege and accountability requirements of administrative access control.

Answer

Legacy Windows NT LAN Manager (NTLMv1) challenge-response authentication.

Answer

Plaintext Telnet authentication over port 23 for administrative CLI access.

Answer

Anonymous guest access tokens for public incident reviewing.

Question 2

When troubleshooting a failing integration instance in XSIAM, which THREE tools or logs are most useful for diagnosing the root cause? (Choose three)

Accepted Answer

System Audit logs for administrative actions. Option B (System Audit logs for administrative actions) is correct because in XSIAM these logs record configuration changes, integration instance edits, and user actions, letting you correlate a failure with a recent administrative change that broke the integration. Option C (The CLI command execution output for test commands) is correct because running the integration's test command from the CLI returns the actual request/response and error trace, which pinpoints authentication, connectivity, or parsing failures at the source. Option D (Integration instance execution and debug logs) is correct because these logs capture the per-instance run history, parameters, and stack traces that directly reveal why the integration instance is failing. Option A does not belong because Cortex XDR Agent endpoint quarantine logs concern endpoint malware isolation, not XSIAM integration execution. Option E does not belong because a client workstation's local BIOS event log is hardware/firmware telemetry unrelated to server-side integration troubleshooting.

Answer

Cortex XDR Agent endpoint quarantine logs

Answer

The local BIOS event log of the client workstation

Question 3

An XSIAM administrator needs to configure log forwarding from a Linux server to the XSIAM collector. Which action must be performed first on the endpoint before deploying the Collector service?

Accepted Answer

Generate and download the Collector installation script and registration token from the XSIAM UI.. Before deploying the Collector service on a Linux endpoint, the administrator must generate and download the Collector installation script and registration token from the XSIAM UI. This token authenticates the collector to the tenant and is required for the installation to register successfully. Without it, the collector cannot be associated with the correct XSIAM instance.

Answer

Enable port 22 inbound on the Cortex XSIAM management tenant for SSH tunnel establishment.

Answer

Manually create the database schema in the Cortex Data Lake to accept the raw logs.

Answer

Configure the syslog daemon on the local server to forward directly to port 443 of the cloud engine without an agent.

Question 4

An administrator needs to integrate third-party threat intelligence feeds into Cortex XSIAM to enrich incoming security telemetry. Where should the administrator configure and manage these threat intelligence integrations within the XSIAM platform?

Accepted Answer

Marketplace > Content Hub (or Settings > Integrations). Third-party threat intelligence feeds in Cortex XSIAM are delivered as content packs (integrations) that must be installed and configured from the Marketplace / Content Hub, then instantiated under Settings > Integrations. This is where API keys, feed URLs, and fetch intervals are supplied so the feeds can enrich telemetry via XDM mapping.

Answer

Endpoint Security > Policies > Threat Protection

Answer

Settings > Configurations > Threat Intelligence > Feeds

Answer

XQL Search > Settings > Threat Feeds

Question 5

An engineer is deploying a Cortex XSIAM Engine on-premises to support high-throughput log parsing and query execution. During setup, the engine fails to register with the cloud tenant. Upon checking the engine logs, the engineer sees TLS certificate validation errors. What is the most likely root cause?

Accepted Answer

The engine host is missing the root Certificate Authority (CA) certificate required to trust the SSL inspection proxy or tenant endpoint.. TLS certificate validation errors during engine registration almost always stem from a missing root CA certificate on the engine host. If the engine cannot trust the SSL inspection proxy or the tenant endpoint's certificate chain, the TLS handshake fails and registration aborts. Installing the correct root CA resolves the issue.

Answer

UDP port 514 is blocked by the local host firewall, preventing certificate handshake packets.

Answer

The Broker VM has exceeded its maximum concurrent engine connection limit.

Answer

The engine software version is newer than the Cortex XSIAM tenant cloud version.

Question 6

When preparing the network perimeter for a new Cortex XSIAM deployment, outbound connectivity from the Broker VM to the Cortex XSIAM cloud tenant must be established. Which standard network port and protocol are required for this outbound secure communication?

Accepted Answer

TCP port 443. The Broker VM communicates with the Cortex XSIAM cloud tenant over outbound TLS on TCP 443, the standard HTTPS port. All management, telemetry upload, and configuration traffic between on-prem components and the XSIAM SaaS backend uses this encrypted channel, so firewall rules must permit outbound 443 to the XSIAM tenant endpoints.

Answer

TCP port 389

Answer

UDP port 514

Answer

TCP port 22

Question 7

Which THREE security considerations are critical when configuring third-party integrations and API keys in XSIAM? (Choose three)

Accepted Answer

Restricting API key usage by source IP addresses where supported by the third-party service. Option A is correct because restricting API key usage by source IP addresses (where the third-party service supports allowlisting) limits the blast radius if a key is leaked, ensuring only XSIAM's egress IPs can authenticate. Option B is correct because regularly rotating API keys and secrets reduces the window of exposure for compromised credentials and is a core credential-hygiene control for integrations. Option D is correct because enforcing least privilege on API service accounts ensures each integration only has the scopes/permissions it needs, minimizing damage from misuse or compromise. Option C is wrong because sharing master administrator API keys across all integration instances violates least privilege and creates a single high-impact credential to steal. Option E is wrong because disabling SSL/TLS verification globally exposes traffic to man-in-the-middle attacks and should never be used to work around certificate expiration; certificates should instead be renewed or trusted properly.

Answer

Sharing master administrator API keys across all integration instances for simplicity

Answer

Disabling SSL verification globally to bypass certificate expiration issues

Question 8

An administrator wants to ensure that specific sensitive incident categories are restricted to a dedicated tier-2 response team. Which XSIAM construct should be configured to achieve this role-based operational segregation?

Accepted Answer

Configure User Roles and User Groups under Settings > Access Management to limit incident viewing permissions.. User Roles and User Groups under Settings > Access Management are the native XSIAM RBAC constructs that control which users can view or act on incidents. By assigning a role scoped to specific incident categories or severities and placing tier-2 responders in a dedicated group, the administrator restricts sensitive incident categories to that team while excluding tier-1 users.

Answer

Modify the global tenant retention policy to purge tier-1 logs automatically.

Answer

Deploy a separate Cortex XSOAR server to handle tier-2 escalations independently.

Answer

Write a BIOC rule to drop unauthorized access attempts at the ingestion layer.

Question 9

A security engineer needs to ingest custom syslog data from an on-premises legacy firewall into Cortex XSIAM. No native content pack exists for this specific legacy device. What is the recommended approach to ingest and correctly parse this unstructured log data?

Accepted Answer

Configure a Broker VM Syslog collector and build a custom parsing rule using XQL mapping. The recommended approach for ingesting custom syslog from a legacy device with no native content pack is to deploy a Broker VM with a Syslog collector, which receives the raw logs on-premises and forwards them to Cortex XSIAM. Since the data is unstructured and lacks a prebuilt parser, the engineer must create a custom parsing rule using XQL (XSIAM Query Language) mapping to extract fields and normalize the data into the XSIAM schema. This method provides full control over ingestion and parsing without relying on unsupported integrations.

Answer

Forward the logs to Panorama and enable Cortex Data Lake native mirroring

Answer

Directly upload raw text files via the incident management tab daily

Answer

Install a Cortex XDR agent directly onto the legacy firewall device

Question 10

An architect is designing an automated deployment script for rolling out Cortex XDR agents across thousands of Linux servers using an enterprise configuration management tool (e.g., Ansible). To ensure silent installation and proper initial group assignment, what must be included in the installation command parameters?

Accepted Answer

The silent installation flag along with the correct installation token (ID) and optional group parameters. Linux silent installations require specific command-line arguments, including the installation token (auth-code or customer ID) and optionally the initial group tag to ensure proper onboarding without user prompts.

Answer

A manual SSH key exchange with the Cortex XSIAM cloud backend

Answer

The interactive GUI installer switch combined with root password prompting

Answer

Pre-formatting the Linux root file system with XSIAM-specific journaling

Question 11

An engineer needs to ingest custom JSON-formatted logs from an internal application using an HTTP API. Which XSIAM feature should be configured to receive these incoming webhook payloads?

Accepted Answer

Broker VM HTTP API Collector. The HTTP API log collector on the Broker VM allows external applications to push JSON payloads directly into XSIAM.

Answer

Cortex XDR REST API direct ingestion

Answer

Syslog over TCP/UDP Collector

Answer

XPANSE Attack Surface Management feed

Question 12

An administrator needs to deploy Cortex XDR agents to Linux servers that have strict change management controls and cannot be rebooted. Which installation consideration is most critical for Linux deployments?

Accepted Answer

Linux installations do not require a system reboot, but matching kernel headers or supported OS distributions must be verified.. Cortex XDR/XSIAM Linux agents install as user-space services and kernel modules loaded on demand, so no full system reboot is required — critical for change-controlled servers. However, the agent depends on kernel-level hooks, so the OS distribution and kernel version must be on the supported list and matching kernel headers must be present for the module to build/load. Verifying compatibility before deployment prevents failed installs on unsupported kernels.

Answer

Linux installations always require a mandatory full system reboot to load kernel components.

Answer

Linux agents require disabling SELinux and AppArmor permanently across all servers.

Answer

Linux agents must be installed using graphical user interface installers.

Question 13

An engineer is configuring a Cortex XSIAM Broker VM to collect logs from a high-volume syslog source. The Broker VM is deployed on-premises and must forward logs to the Cortex XSIAM tenant. The engineer notices that logs are being dropped during peak traffic. Which of the following should the engineer adjust to increase the Broker VM's buffering capacity?

Accepted Answer

Modify the Broker VM's disk buffer size in the Broker VM configuration settings.. When a Broker VM drops logs during high traffic, it often means the internal buffer is too small to hold incoming logs while forwarding to Cortex XSIAM. The Broker VM provides a configurable disk buffer that can be increased to accommodate larger bursts. Modifying this setting allows the Broker VM to queue more logs, preventing drops until the forwarding catches up. Other options address different bottlenecks like CPU or bandwidth, but not buffer capacity.

Answer

Increase the number of vCPUs assigned to the Broker VM.

Answer

Increase the syslog receiving rate limit on the source device.

Answer

Enable compression on the syslog forwarder to reduce bandwidth usage.

Question 14

An administrator is troubleshooting an issue where an endpoint agent is unable to connect to the XSIAM cloud management console, and local logs indicate certificate pinning verification failure. What is the most likely cause?

Accepted Answer

An intermediate network security device or proxy is performing SSL decryption and re-signing traffic with an untrusted certificate.. Certificate pinning failures on endpoint agents usually indicate an SSL inspection appliance or proxy in the network is re-signing traffic with an untrusted root certificate, causing the agent to reject the connection.

Answer

The Cortex XDR agent version is too new for the cloud tenant and must be downgraded.

Answer

The local firewall is blocking UDP port 514 outbound from the endpoint.

Answer

The XSIAM tenant license has expired, causing all agents to enter a permanent lock state.

Question 15

Which TWO of the following actions can be performed within the Cortex XSIAM Marketplace?

Accepted Answer

Install and manage integration plugins.. The Marketplace is used for installing integrations and managing content packs.

Answer

Directly edit the source code of the underlying XSIAM engine.

Answer

Configure individual log forwarding destinations.

Answer

Provision new physical server hardware for collectors.