XSIAM-Engineer Practice Test 14 — 15 Questions

Question 1

An administrator configured a Microsoft Graph API integration to pull security alerts into XSIAM. The connection status shows 'Active', but no alerts are being pulled. Reviewing the integration instance configuration, which common misconfiguration typically causes this behavior while keeping the authentication valid?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incorrect fetch query parameters or time filters excluding existing alerts. Fetching starts from a specific timestamp or incident ID; if misconfigured or if lookback parameters are incorrect, no historical data is retrieved. Alternatively, filtering parameters might exclude all alerts.

Answer

Exceeding the Broker VM CPU capacity

Answer

Failure to install the Cortex XDR Agent on the Microsoft Graph server

Answer

Missing XQL parsing rules for Microsoft XDM mapping

Question 2

An XSIAM administrator is configuring a new syslog data source to ingest security logs from an on-premises Linux firewall. Which Collector component must be deployed within the network perimeter to securely forward these logs to the XSIAM tenant?

Accepted Answer

Broker VM. The Cortex XDR Collector (or Broker VM) acts as an intermediary agent deployed within the customer's network to ingest logs via syslog and securely forward them to the XSIAM cloud backend.

Answer

Panorama Forwarder

Answer

XSOAR Engine

Answer

Cortex XDR Agent

Question 3

An administrator configured a new API data collector to ingest threat intelligence feeds, but no data is appearing in XSIAM. Upon checking the Integration page, the status shows an authentication failure. What is the most likely cause and correct remediation?

Accepted Answer

The API key or credentials have expired or are incorrect; update the integration instance configuration with valid credentials under Settings > Configurations > Data Collection > Integrations.. API-based integrations in XSIAM require valid credentials, API keys, or OAuth tokens. If authentication fails, the administrator must update the integration configuration with valid, unexpired credentials.

Answer

The XQL query syntax used by the integration is malformed and requires rewriting the SQL statement.

Answer

The local firewall on the Cortex XDR agent is blocking outbound HTTPS requests to the threat intel feed.

Answer

The Broker VM container needs to be restarted via SSH to reload the routing table.

Question 4

An administrator is configuring data collection policies in Cortex XSIAM to optimize storage and ingestion costs. The organization wishes to exclude verbose, non-security-relevant informational logs from a specific firewall source. Which mechanism should the administrator configure?

Accepted Answer

Data Ingestion Filters / Drop Rules. Data filters or ingestion rules in XSIAM allow administrators to drop, filter, or retain specific log subsets before they consume indexed storage quotas.

Answer

Endpoint isolation policies

Answer

XQL scheduled queries with automated table deletion

Answer

Agent upgrade rings

Question 5

An administrator needs to configure secure log forwarding from an on-premises syslog source into Cortex XSIAM using a Broker VM. Which specific Broker VM app must be enabled and configured to receive these syslog messages?

Accepted Answer

Syslog App. The Syslog app on the Broker VM must be configured to ingest syslog data from external log sources and forward it to the Cortex XSIAM tenant.

Answer

PAN-OS Collector App

Answer

Active Directory App

Answer

Agent Proxy App

Question 6

An organization requires that all log data ingested from a specific cloud service provider be enriched with asset metadata before being evaluated by XSIAM correlation rules. Which XSIAM feature should be configured to accomplish this data enrichment during the ingestion pipeline?

Accepted Answer

Lookup Tables and Enrichment rules. Lookup tables or Enrichment rules in XSIAM allow administrators to map ingested log fields against reference datasets or threat intel feeds to enrich logs during processing.

Answer

Data Retention Policies

Answer

XSOAR Incident Layouts

Answer

Agent Upgrade Profiles

Question 7

An analyst wants to trigger an automated playbook in XSIAM immediately whenever a specific high-severity alert is generated by the Analytics engine. Where should the analyst configure this automated linkage?

Accepted Answer

Within the Correlation Rule or Analytics Rule definition under the Incident Handling or Automated Playbook section. In XSIAM, automated responses to alerts generated by analytics or correlation rules are configured via Incident/Alert Trigger rules or Automation configurations tied to the Alert Rule settings, rather than manual playbook runs.

Answer

Via the Data Stitching rules configuration page

Answer

By modifying the global XSOAR integration instance mapping parameters

Answer

Inside the Broker VM configuration file under the 'triggers' YAML block

Question 8

An organization mandates that specific log datasets must be retained for 400 days, exceeding the default retention period. Where should the administrator configure extended data retention rules?

Accepted Answer

Go to Settings > Configurations > Data Retention to configure custom retention periods for specific datasets.. Data retention settings and storage tiers can be managed in XSIAM under Settings > Configurations > Data Retention to adjust retention policies for specific datasets.

Answer

Set up a local cron job on each Broker VM to archive logs to local hard drives.

Answer

Modify the global license key string to unlock extended storage capacities.

Answer

Create an automated XSOAR playbook to export raw logs to local USB drives daily.

Question 9

An administrator needs to verify whether a newly deployed Broker VM is successfully forwarding logs to the Cortex XSIAM tenant. Which tool or menu within the XSIAM console allows the administrator to view real-time incoming log counts and ingestion rates?

Accepted Answer

Dashboards > Data Ingestion (or Settings > Data Collection). Ingestion rates and telemetry volumes can be monitored using the Data Ingestion or System Health dashboards within Cortex XSIAM.

Answer

XQL Search > Incident Explorer

Answer

Cloud Identity > Users > Audit Trail

Answer

Incidents > Active Alerts

Question 10

You are troubleshooting a parsing error where logs from a custom application are not being mapped correctly to the XDM schema. What is the recommended approach to debug the transformation process?

Accepted Answer

Use the XDM Parsing tool to test the log sample against the existing parser and view validation errors.. The XDM parsing tool allows for testing log samples against parser definitions to identify mapping failures.

Answer

Create a new playbook to manually map the fields in the alert.

Answer

Modify the ingestion configuration to change the vendor product type.

Answer

Update the Data Collector version on the server.

Question 11

When planning log collection and ingestion strategies in Cortex XSIAM, an architect can ingest data from multiple sources. Which THREE log sources are natively supported for direct or Broker VM-mediated ingestion? (Choose three)

Accepted Answer

Cloud provider audit logs (such as AWS CloudTrail and Azure Activity Logs). Cortex XSIAM ingests diverse telemetry including firewall logs, cloud audit logs, and endpoint telemetry.

Answer

Direct analog audio streams from corporate telephone switchboards

Answer

Local printer ink level status notifications via SNMP v1 broadcast

Question 12

An administrator is configuring Active Directory synchronization within Cortex XSIAM using a Broker VM. Which prerequisite must be met on the domain controller and Broker VM to ensure successful user and group mapping ingestion?

Accepted Answer

The Broker VM must have the Active Directory App enabled and network connectivity established over LDAP/LDAPS ports to the domain controllers.. Secure LDAP (LDAPS) or standard LDAP connectivity must be established between the Broker VM and the Domain Controller using valid credentials and appropriate network access.

Answer

The XSIAM cloud tenant must be granted Domain Administrator credentials via an Azure ExpressRoute connection.

Answer

The administrator must manually export CSV files of user lists daily and upload them via the XSIAM web console.

Answer

The Domain Controller must have the Cortex XSIAM agent installed directly on NTDS.dit.

Question 13

An administrator needs to check the status of scheduled background reports and export tasks in XSIAM. Where can this task history be reviewed?

Accepted Answer

Navigate to Reporting > Scheduled Reports to view job execution history and status.. Scheduled reports, PDF exports, and background job statuses can be tracked and managed under the Reporting section of the XSIAM navigation menu.

Answer

Inspect the raw storage blocks in the Data Lake Explorer.

Answer

Review the Incident Response playbook execution logs in Cortex XSOAR.

Answer

Check the Endpoint Management > Task Management tab.

Question 14

When planning the installation of Cortex XSIAM content packs from the Marketplace, what prerequisite check must an administrator perform to ensure successful installation and utilization?

Accepted Answer

Verify that the administrator account has Content Administrator or equivalent privileges and check license entitlements. Administrators must verify that the user account holds the necessary administrative role permissions (such as Superuser or Content Administrator) and that the tenant has sufficient licensing entitlement.

Answer

Manually compile source code files using the XQL command line

Answer

Reboot all deployed Broker VMs simultaneously

Answer

Disable all active endpoint security policies temporarily

Question 15

A security architect is aligning deployment objectives with Cortex XSIAM architecture for an organization migrating from a legacy SIEM. The organization requires continuous ingestion of custom application logs using HTTP. Which XSIAM architectural component should be configured to ingest these logs securely?

Accepted Answer

Broker VM with an enabled HTTP/HTTPS Collector service.. The Broker VM supports HTTP/HTTPS log collection collectors (such as HTTP Collector or Generic HTTP syslog endpoints) to ingest custom log streams securely into XSIAM.

Answer

Palo Alto Networks Next-Gen Firewall configured as a syslog relay.

Answer

Cortex XDR Agent running in 'Collector Mode' on every application server.

Answer

Direct API integration from the application servers to the Cortex XSIAM query service without intermediary gateways.