XSIAM-Engineer Practice Test 14 — 15 Questions

Question 1

An administrator wants to create a custom dashboard displaying key SOC metrics such as open incidents by severity and top alerted hosts. Which section of XSIAM should the administrator use to build this dashboard?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Navigate to Dashboards > Create Dashboard to add widgets based on XQL queries.. Custom dashboards can be created and managed under the Dashboards section of the XSIAM navigation menu using widgets powered by XQL queries.

Answer

Use the Report Builder to schedule weekly PDF summaries.

Answer

Go to Settings > Configurations > Data Collection > Dashboards.

Answer

Open the Incident Graph and click Export as Dashboard.

Question 2

Which THREE best practices should be followed when designing custom automation integrations and playbooks in XSIAM? (Choose three)

Accepted Answer

Design modular sub-playbooks for reusable automation tasks. Option B is correct because designing modular sub-playbooks for reusable automation tasks promotes maintainability, reduces duplication, and allows common logic to be invoked across multiple parent playbooks in XSIAM. Option C is correct because storing sensitive API keys and tokens in integration instance credential parameters (rather than hardcoding them) leverages XSIAM's secure credential store, preventing secret exposure in scripts and enabling centralized rotation. Option D is correct because handling API rate limits and connection timeouts with error-handling logic ensures playbooks degrade gracefully, retry appropriately, and avoid silent failures when external services throttle or become unreachable. Option A is incorrect because hardcoding admin service account passwords in Python scripts exposes credentials in plaintext and violates least-privilege and secret-management practices. Option E is incorrect because executing all integration commands synchronously on the main UI thread without timeout limits would block the interface and risk indefinite hangs; asynchronous execution with timeouts is the proper approach.

Answer

Hardcode admin service account passwords directly into Python automation scripts

Answer

Execute all integration commands synchronously on the main UI thread without timeout limits

Question 3

An enterprise environment requires all outbound API traffic from XSIAM integrations to pass through an explicit corporate proxy server. Where is the global proxy configuration specified for integration instances?

Accepted Answer

Settings > Configurations > Integrations > Server Configurations. Global proxy settings for integrations are managed under Settings > Configurations > Integrations > Servers and Services or global integration settings.

Answer

Incident Response > Automation > Global Variables

Answer

XSIAM User Preferences > Network Profile

Answer

Data Collection > Broker VM > Network Settings

Question 4

An architect is estimating storage capacity requirements for Cortex XSIAM. Which formula correctly represents the core calculation for raw daily log ingestion planning?

Accepted Answer

Average daily log volume (GB/day) multiplied by retention period (days), adjusted for indexing and replication multipliers. The core capacity planning formula for XSIAM multiplies average daily log volume in GB/day by the retention period in days, then applies indexing and replication multipliers to account for how the platform stores and duplicates data. This yields the raw storage estimate needed before factoring in compression and any additional datasets.

Answer

Number of active user accounts multiplied by active session duration

Answer

Number of endpoints multiplied by total RAM capacity

Answer

Total CPU cores on Broker VMs divided by network latency

Question 5

An architect is designing a multi-tenant XSIAM data ingestion pipeline where distinct business units must have isolated visibility and role-based access control over their respective log sources. Which XSIAM architectural construct should be configured to ensure strict data segregation between business units?

Accepted Answer

Dataset-level Role-Based Access Control (RBAC) and Query Scopes. Dataset-level RBAC combined with query scopes is the XSIAM construct that restricts which users or roles can view and query specific datasets, enabling strict segregation between business units. By assigning roles that only grant access to the datasets belonging to a given business unit, the architect ensures that analysts in one unit cannot see another unit's log data. This is the documented mechanism for multi-tenant style isolation within a single XSIAM tenant.

Answer

Broker VM interface bonding configurations

Answer

Agent Installation Packages with embedded proxy exclusions

Answer

Log Collector Profiles with dedicated forwarding keys

Question 6

When deploying Cortex XDR agents across an enterprise, what is the primary role of an installation token?

Accepted Answer

To uniquely identify the target tenant and securely authenticate the agent during initial registration.. An installation token in Cortex XDR is a tenant-specific credential that the agent presents during initial registration so the management server can authenticate it and bind it to the correct tenant. It uniquely identifies the target tenant and ensures the agent only enrolls into the intended Cortex XDR instance.

Answer

To license the endpoint for Microsoft Windows Enterprise features.

Answer

To grant the analyst SSH access to the endpoint operating system.

Answer

To encrypt the local endpoint hard drive using BitLocker or FileVault.

Question 7

An enterprise environment utilizes a strict certificate-based Proxy for all outbound internet connections. During the deployment of Cortex XDR agents via software deployment tools, the agents fail to establish a connection to the XSIAM tenant because they do not trust the proxy's interception certificate. How should this be resolved?

Accepted Answer

Deploy the enterprise root CA certificate to the endpoint's trusted root certificate store and configure agent proxy settings using the appropriate installer properties.. When a proxy performs TLS interception, it presents its own certificate to the endpoint, signed by the enterprise root CA. If the endpoint's trusted root store does not contain that CA, the Cortex XDR agent rejects the connection. The fix is to deploy the enterprise root CA certificate to the endpoint's trusted root store and configure the agent's proxy settings via installer properties so it uses the proxy correctly.

Answer

Uninstall the Cortex XDR agent and replace it with a standard syslog forwarding daemon.

Answer

Configure the proxy to bypass decryption exclusively for IP addresses belonging to the internal subnet.

Answer

Disable TLS encryption on the Broker VM so the proxy can inspect traffic without validation errors.

Question 8

During the initial onboarding phase of a Cortex XSIAM tenant, an administrator needs to download and deploy the Broker VM OVA template. Where within the Cortex XSIAM UI can the administrator find the Broker VM image download link and deployment tokens?

Accepted Answer

Settings > Configurations > Data Collection > Broker VM. The Broker VM OVA download link and deployment tokens are located in Cortex XSIAM under Settings > Configurations > Data Collection > Broker VM. This is where administrators generate the deployment token and download the OVA for on-premises installation.

Answer

Marketplace > Content Hub > Broker VM Management

Answer

Incidents > Response > Integrations > Broker VM

Answer

Dashboards > System Status > Virtual Appliances

Question 9

During an assessment of infrastructure readiness for Cortex XSIAM, an engineer calculates the required daily log ingestion volume and determines it exceeds the licensed capacity. What architectural feature or mechanism within XSIAM can the administrator configure to optimize data ingestion without losing critical security telemetry?

Accepted Answer

Configure log filtering and drop rules on the Broker VM collectors to exclude unneeded verbose log events before they reach the XSIAM cloud.. Broker VM collectors support log filtering and drop rules that remove low-value or verbose events at the source before they are forwarded to the XSIAM cloud tenant. This reduces licensed ingestion volume while preserving high-fidelity security telemetry such as endpoint alerts, authentication events, and network anomalies. It is the architecturally correct way to stay within license limits without losing critical detection coverage.

Answer

Increase the retention period in the data lake storage settings from 90 days to 365 days.

Answer

Enable automatic data compression on the Cortex XDR agent to reduce network packet size by 90%.

Answer

Deploy secondary XSIAM tenants in different geographic regions to split the log parsing load.

Question 10

A security architect is aligning deployment objectives with Cortex XSIAM architecture for an organization migrating from a legacy SIEM. The organization requires continuous ingestion of custom application logs using HTTP. Which XSIAM architectural component should be configured to ingest these logs securely?

Accepted Answer

Broker VM with an enabled HTTP/HTTPS Collector service.. To ingest custom application logs over HTTP into Cortex XSIAM, the architect should configure a Broker VM with the HTTP/HTTPS Collector service enabled. The Broker VM acts as a secure on-premises ingestion point that receives HTTP/HTTPS POST requests from application servers and forwards the data to the XSIAM tenant.

Answer

Palo Alto Networks Next-Gen Firewall configured as a syslog relay.

Answer

Cortex XDR Agent running in 'Collector Mode' on every application server.

Answer

Direct API integration from the application servers to the Cortex XSIAM query service without intermediary gateways.

Question 11

When configuring integrations in Cortex XSIAM via Content Hub, which TWO actions can an administrator perform after installing an integration pack? (Choose two)

Accepted Answer

Test the connection to ensure valid communication between XSIAM and the external service. Option A is correct because after installing an integration pack from Content Hub, the administrator can run a connection test (the "Test" button on the integration instance) to verify that XSIAM can successfully reach and authenticate with the external service before relying on it in playbooks. Option C is correct because installed packs expose integration instances that the administrator must configure and enable, supplying required parameters such as API keys, usernames/passwords, and endpoint URLs, and toggling the instance to enabled so its commands become usable. The remaining options are not valid administrative actions in this context: B and D describe physical hardware tampering (soldering USB encryption keys into Broker VM motherboards, rewiring rack power supplies) that is neither a Content Hub task nor a supported procedure, and E describes deleting underlying system databases, which is a destructive action unrelated to configuring integrations and would not be performed to set up a pack.

Answer

Manually solder USB encryption keys into Broker VM motherboards

Answer

Physically rewire the cloud data center rack power supplies

Answer

Delete all underlying system databases to force a clean slate

Question 12

A Cortex XSIAM engineer is validating the network requirements before deploying a new Broker VM in a DMZ segment. The security team wants to confirm which outbound destinations and protocols the Broker VM requires to function correctly. Which TWO statements accurately describe the required outbound connectivity for a Cortex XSIAM Broker VM? (Choose two.)

Accepted Answer

The Broker VM requires outbound TCP 443 to the Cortex XSIAM tenant endpoints for registration and management communication.. A Broker VM must be able to initiate outbound TCP 443 to the Cortex XSIAM tenant for registration and management, and it must resolve tenant hostnames via DNS. These two outbound requirements are essential for the Broker VM to join the tenant and remain manageable. Inbound connections from the internet and protocols such as RDP or NTP to the tenant are not part of the required connectivity model.

Answer

The Broker VM requires outbound UDP 123 to the tenant for time synchronization as part of the management channel.

Answer

The Broker VM requires inbound TCP 443 from the internet so the Cortex XSIAM tenant can initiate management sessions.

Answer

The Broker VM requires outbound TCP 3389 to the tenant for remote management by Cortex XSIAM support engineers.

Question 13

An organization wants to ensure that all sensitive personally identifiable information (PII) fields within ingested log datasets are automatically masked or hashed before being stored in the Cortex Data Lake. Which XSIAM capability should be configured?

Accepted Answer

Configure Log Redaction / Masking rules under Data Collection settings to sanitize PII fields during ingestion.. Log masking, hashing, or filtering rules can be configured in XSIAM to redact sensitive data during ingestion.

Answer

Set the global data retention period to zero.

Answer

Deploy an Endpoint Agent exclusion profile to block logging on endpoints.

Answer

Enable Auto-Quarantine rules on all database servers.

Question 14

An XSIAM administrator is configuring a new API-based integration to ingest threat intelligence feeds. During configuration, what credential type is most commonly required by modern token-based REST API integrations?

Accepted Answer

API Key or OAuth2 credentials. Most modern cloud-native REST API integrations in XSIAM utilize API keys or OAuth2 tokens provided securely within the integration instance configuration.

Answer

SNMP v1 Community strings

Answer

Local Windows Administrator account passwords

Answer

Interactive SSH private keys

Question 15

An engineer is configuring a webhook integration to forward XSIAM alerts to an external ticketing platform. The external system requires custom HTTP headers for authentication. Where can these custom headers be configured within the integration instance?

Accepted Answer

In the integration instance configuration parameter fields. Integration instances in XSIAM often include instance configuration parameters where custom headers, credentials, and API keys are specified.

Answer

Within the Broker VM local firewall rules

Answer

Inside the incident layout designer

Answer

In the XSIAM Global Server proxy configuration file