XSIAM-Engineer Practice Test 15 — 15 Questions

Question 1

An organization is updating its internal Certificate Authority (CA). The administrator needs to update the trusted CA certificates used by the Broker VMs for secure syslog ingestion. Where must this certificate update be performed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Manage and update trusted CA certificates within the Broker VM configuration settings in the XSIAM console.. Trusted CA certificates for Broker VM secure syslog ingestion must be managed and updated within the Broker VM configuration settings in the XSIAM console. This centralized approach ensures all Broker VMs trust the new CA for TLS connections. It is the supported and scalable method for certificate updates.

Answer

Modify the global tenant license key to include custom CA extensions.

Answer

Upload the certificate directly into the browser's local trusted root store.

Answer

Run the `certmgr /add` command on every managed Windows endpoint.

Question 2

An organization requires strict adherence to data governance policies. Which TWO configurations help ensure that sensitive data is handled properly within XSIAM? (Choose two)

Accepted Answer

Configure Role-Based Access Control (RBAC) to limit who can view sensitive datasets.. Option A is correct because configuring Role-Based Access Control (RBAC) in XSIAM restricts dataset visibility to only authorized users, directly enforcing least-privilege access to sensitive data as required by governance policies. Option C is correct because Data Retention policies let the organization define how long data is stored and automatically purge it to meet regulatory and compliance requirements. Option B is wrong because sharing global administrator credentials destroys accountability and violates least-privilege and audit principles. Option D is wrong because storing raw logs on public unsecured FTP servers exposes sensitive data to unauthorized access and interception. Option E is wrong because disabling encryption in transit weakens data protection and violates governance and compliance mandates.

Answer

Share global administrator credentials among all employees.

Answer

Store raw logs on public unsecured FTP servers.

Answer

Disable all data ingestion encryption in transit to speed up parsing.

Question 3

An administrator needs to configure secure log forwarding from an on-premises syslog source into Cortex XSIAM using a Broker VM. Which specific Broker VM app must be enabled and configured to receive these syslog messages?

Accepted Answer

Syslog App. The Syslog App on the Broker VM is the specific component that listens for incoming syslog messages (typically on UDP/TCP 514 or custom ports), parses them, and forwards them securely to the Cortex XSIAM tenant. It must be enabled and configured with the correct port, protocol, and parser for the source firewall.

Answer

PAN-OS Collector App

Answer

Active Directory App

Answer

Agent Proxy App

Question 4

An architect is planning the deployment prerequisites for a Broker VM in a customer environment. Which TWO infrastructure requirements must be verified before deploying the OVA template? (Choose two)

Accepted Answer

Outbound TCP port 443 connectivity to the Cortex XSIAM tenant cloud FQDNs. Option A is correct because the Broker VM must reach the Cortex XSIAM tenant over outbound TCP 443 to the cloud FQDNs so it can register, receive policy, and forward logs/telemetry to the tenant. Option D is correct because the OVA must be deployed on a supported hypervisor (e.g., VMware ESXi or Microsoft Hyper-V) with adequate CPU and RAM resources allocated to run the Broker VM reliably. Option B is incorrect because the Broker VM does not require an Active Directory Domain Controller role installed inside it; AD integration is not a deployment prerequisite for the appliance itself. Option C is incorrect because the Broker VM is administered through its management interface and does not require a local GUI desktop environment. Option E is incorrect because the Broker VM does not require a dedicated physical Fibre Channel storage array attached directly to the appliance.

Answer

An active Microsoft Active Directory Domain Controller role installed inside the VM

Answer

A local graphical user interface (GUI) desktop environment enabled for administrative troubleshooting

Answer

A dedicated physical fiber channel storage array attached directly to the appliance

Question 5

An administrator needs to restrict access to sensitive XSIAM incident data to specific compliance officers. Which TWO actions accomplish this requirement? (Choose two)

Accepted Answer

Create a custom User Role with permissions restricted only to the designated compliance incident queues.. Option C is correct because creating a custom User Role in XSIAM (Cortex XSIAM RBAC) lets the administrator scope permissions to only the designated compliance incident queues, so those officers can access just the sensitive incident data they are authorized to see. Option E is correct because role-based access in XSIAM is enforced by assigning users to a User Group that is bound to that restricted role; putting the compliance officers in a dedicated group ensures the least-privilege role is applied to exactly the right accounts. The remaining options do not satisfy the requirement: setting global log retention to zero days (A) destroys or prevents retention of data rather than restricting access, deploying a separate Broker VM per officer (B) is an architecture/scalability change that does not control incident-data permissions, and disabling MFA (D) weakens authentication security instead of restricting authorization to sensitive incident data.

Answer

Set the global log retention period to zero days.

Answer

Deploy a separate Broker VM for each compliance officer.

Answer

Disable multi-factor authentication for all compliance user accounts.

Question 6

An XSIAM administrator is configuring a new syslog data source to ingest security logs from an on-premises Linux firewall. Which Collector component must be deployed within the network perimeter to securely forward these logs to the XSIAM tenant?

Accepted Answer

Broker VM. The Broker VM is the lightweight on-premises collector component in Cortex XSIAM that receives logs from local sources such as syslog, SNMP, and Windows Event Forwarding, then securely forwards them over an encrypted channel to the XSIAM tenant. It is specifically designed to bridge the customer network perimeter and the cloud-hosted XSIAM backend without exposing inbound firewall ports.

Answer

Panorama Forwarder

Answer

XSOAR Engine

Answer

Cortex XDR Agent

Question 7

An organization is integrating Microsoft Entra ID (formerly Azure AD) sign-in logs into Cortex XSIAM. The architect decides to use an Event Hub integration model via a Content Hub pack. What is the architectural role of the Event Hub in this ingestion pipeline?

Accepted Answer

It acts as a scalable streaming buffer that temporarily holds log messages until pulled by the XSIAM integration collector. The Event Hub acts as a scalable, durable streaming buffer in Azure that receives Microsoft Entra ID sign-in logs (typically via diagnostic settings export) and holds them until the XSIAM integration collector pulls them. This decouples the log producer (Entra ID) from the consumer (XSIAM), allowing XSIAM to ingest at its own pace without backpressure on the source. The Content Hub pack provides the connector logic that authenticates to the Event Hub and reads messages from it.

Answer

It replaces the need for SSL certificates by enforcing unencrypted local network pipes

Answer

It translates Azure audit logs directly into native Cortex XDR agent binary commands

Answer

It acts as a local hypervisor running a containerized Broker VM instance in Azure

Question 8

What is the primary function of the Broker VM in a Cortex XSIAM deployment architecture?

Accepted Answer

To serve as an intermediary proxy for agent communications, log collection, and infrastructure integration with Cortex XSIAM.. The Broker VM serves as an intermediary proxy in Cortex XSIAM, handling agent communications, log collection, and infrastructure integration between on-premises resources and the Cortex XSIAM tenant. It enables endpoints and log sources that cannot directly reach the cloud tenant to route traffic through a local appliance. This is essential for environments with restricted internet access or high-volume log ingestion needs.

Answer

To replace the organization's enterprise SIEM storage database for long-term cold storage.

Answer

To act as a localized security orchestration and automated response (XSOAR) execution engine.

Answer

To enforce inline firewall filtering and threat prevention on all internet-bound traffic.

Question 9

An administrator is configuring a new syslog ingestion source on a Broker VM. The syslog messages use TCP with TLS encryption (Reliable Syslog). Where must the corresponding TLS server certificates for the Broker VM be configured?

Accepted Answer

Configure the TLS server certificates and listener ports within the Broker VM configuration settings in the XSIAM console.. Broker VM TLS listener certificates for secure syslog ingestion are configured within the Broker VM configuration settings in the XSIAM management console.

Answer

Upload the certificates into the Cortex XDR Agent policy assigned to workstations.

Answer

Store the certificates in the browser's local storage cache.

Answer

Paste the certificates into the XQL query editor console.

Question 10

An organization requires high availability for its on-premises log ingestion architecture using Broker VMs. Which THREE architectural elements contribute to building a resilient log collection tier? (Choose three)

Accepted Answer

Configuring local log caching and queuing on Broker VMs to handle temporary cloud connectivity interruptions. Option A is correct because local log caching and queuing on the Broker VMs lets them buffer events when cloud connectivity is temporarily lost, preventing data loss and allowing replay once the connection is restored, which is essential for a resilient ingestion tier. Option D is correct because deploying multiple Broker VMs behind a load balancer or DNS failover mechanism distributes syslog streams across brokers and removes the single point of failure, ensuring continued ingestion if one VM fails. Option E is correct because proactive monitoring of Broker VM resource utilization (CPU, memory, disk) and connectivity health dashboards in XSIAM enables early detection of degradation or outages so remediation can occur before ingestion is impacted. Option B is not appropriate because disabling network encryption weakens security and does not meaningfully improve resilience. Option C is not appropriate because routing all log traffic through a single unmanaged home router introduces a single point of failure and is not an enterprise-grade high-availability design.

Answer

Disabling all network encryption to maximize packet forwarding speed

Answer

Routing all log traffic through a single unmanaged home router

Question 11

Which TWO actions can an administrator perform when managing integration instances within XSIAM? (Choose two)

Accepted Answer

Test the integration instance connection. Option C is correct because XSIAM's integration instance management UI includes a built-in "Test" function that validates connectivity and credentials against the target service (for example, by issuing the API call or authentication handshake defined in the integration's test command), letting administrators confirm the instance is configured properly before relying on it in playbooks. Option E is correct because administrators can toggle an integration instance between enabled and disabled states from the Instances page, which controls whether commands from that instance are available to playbooks and automations without deleting the configuration. Options A, B, and D are incorrect because XSIAM is a cloud-delivered platform: tenants cannot alter the global database schema, edit the vendor's sealed integration pack source code, or patch the underlying operating system of the multi-tenant backend, as those layers are managed exclusively by Palo Alto Networks.

Answer

Change the global XSIAM database schema

Answer

Modify the core source code of the vendor integration pack

Answer

Directly patch the underlying operating system of the cloud tenant backend

Question 12

An organization is enforcing strict segregation of duties within Cortex XSIAM using Role-Based Access Control (RBAC). Which TWO administrative actions can be restricted so that standard security analysts cannot perform them? (Choose two)

Accepted Answer

Creating new user accounts and modifying global Role-Based Access Control (RBAC) assignments.. Option D is correct because creating user accounts and modifying global RBAC role assignments are privileged administrative functions in Cortex XSIAM; restricting them to specific roles (e.g., Account Admin or Instance Admin) enforces segregation of duties so standard analysts cannot escalate privileges or alter access controls. Option E is correct because modifying global tenant settings, integrations, and license configurations requires elevated administrative permissions (such as Instance Admin), and limiting these actions prevents analysts from changing platform-wide security posture, data sources, or licensing. Options A and B are not correct because viewing/triaging incidents in their SOC queue and exporting incident case summaries are routine analyst-level activities typically granted to standard security analyst roles. Option C is not correct because writing and executing custom XQL queries in the Query Center is a normal investigative capability for analysts and is not an administrative action restricted under segregation of duties.

Answer

Viewing active incidents and triaging alerts assigned to their SOC queue.

Answer

Exporting incident case summaries to PDF reports.

Answer

Writing and executing custom XQL queries in the Query Center.

Question 13

An administrator needs to check the remaining license capacity and expiration date of the XSIAM subscription. Where should the administrator look?

Accepted Answer

Navigate to Settings > License Management to view subscription status and capacity.. License capacity and subscription expiration for XSIAM are managed centrally under Settings > License Management, where administrators can view the total license count, consumed licenses, remaining capacity, and the expiration date of the subscription. This is the designated administrative pane for all licensing-related information in the Cortex XSIAM console. Checking here ensures accurate, real-time data directly from the management plane.

Answer

Check the Incident Graph summary panel.

Answer

Review the XQL query execution history log.

Answer

Open the Endpoint Management > Agent Status tab.

Question 14

An administrator is reviewing the prerequisites for deploying Cortex XDR agents across virtual desktop infrastructure (VDI) environments. Which TWO best practices should be considered for VDI golden image preparation? (Choose two)

Accepted Answer

Installing the agent as the final step in the golden image creation process before sealing the disk. Option A is correct because the Cortex XDR agent must be installed as the last step in the golden image creation process, right before sealing the disk, so that the agent captures the finalized system state and does not register stale or duplicate endpoint identities when the image is cloned. Option C is correct because enabling VDI mode (via installation parameters or the agent profile) is specifically designed for non-persistent/ephemeral virtual desktops, allowing the agent to properly handle unique host identification and avoid license or registration conflicts across cloned VMs. Option B is incorrect because removing network adapters from the template would prevent the deployed VMs from communicating with the Cortex XDR management server and receiving policies. Option D is incorrect because permanently disabling tamper protection on the master image weakens endpoint security and is not a supported VDI best practice. Option E is incorrect because hardcoding a static endpoint UUID would cause all cloned VMs to share the same identity, breaking management and reporting in Cortex XDR.

Answer

Removing all network adapters from the virtual machine template

Answer

Disabling all security tamper protection permanently on the master image

Answer

Configuring the VDI master image with a static, hardcoded endpoint UUID that never changes

Question 15

When planning an initial Cortex XSIAM deployment, an administrator must configure organizational settings. Which TWO configurations are typically established during the initial tenant setup phase? (Choose two)

Accepted Answer

Defining initial administrator user accounts and assigning baseline roles. Option C is correct because initial tenant setup in Cortex XSIAM requires creating the first administrator accounts and assigning baseline RBAC roles so that the platform can be administered securely from day one. Option E is correct because configuring SSO with a SAML identity provider is a standard part of organizational/tenant settings, enabling centralized authentication and role mapping for administrative access. Options A, B, and D are not part of XSIAM tenant configuration: writing Linux kernel modules, setting up analog modem dial-up backups, and manually soldering HSMs are not supported or relevant tasks in the initial setup phase.

Answer

Writing custom Linux kernel modules for client workstations

Answer

Configuring analog modem dial-up backup connections for alert notifications

Answer

Manually soldering hardware security modules (HSMs) into tenant cloud racks