XSIAM-Engineer Practice Test 16 — 15 Questions

Question 1

An administrator is troubleshooting a Broker VM that is showing a 'Disconnected' status in the Cortex XSIAM console. After verifying network routing and outbound HTTPS connectivity, the administrator checks the Broker VM system logs and discovers a system time synchronization failure. Why would a time sync failure cause disconnection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Cortex XSIAM cloud backend rejects TLS connections when time drift between the client and server exceeds allowable security thresholds.. TLS certificate validation relies heavily on accurate system clocks. If the Broker VM time drifts significantly out of sync with the Cortex XSIAM cloud backend, certificate validity checks fail, breaking the secure session.

Answer

The Broker VM operating system automatically shuts down all network interfaces after 10 minutes of clock discrepancy.

Answer

Log collection collectors stop accepting UDP packets if the system time is set to UTC instead of local time.

Answer

The XSIAM licensing server revokes the Broker VM activation token if NTP is not reachable every 60 seconds.

Question 2

An administrator needs to check the remaining license capacity and expiration date of the XSIAM subscription. Where should the administrator look?

Accepted Answer

Navigate to Settings > License Management to view subscription status and capacity.. Subscription details, license capacity, and expiration dates are located in XSIAM under Settings > License Management.

Answer

Check the Incident Graph summary panel.

Answer

Review the XQL query execution history log.

Answer

Open the Endpoint Management > Agent Status tab.

Question 3

An administrator is troubleshooting a Broker VM that is showing a 'Disconnected' status in the Cortex XSIAM console. After verifying network routing and outbound HTTPS connectivity, the administrator checks the Broker VM system logs and discovers a system time synchronization failure. Why would a time sync failure cause disconnection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access the Broker VM administrative console CLI to execute service restart and network reset utilities.. Broker VMs provide administrative utility scripts and management menus (accessible via CLI) to restart services, reset networking, and manage container states.

Answer

Modify the global tenant encryption keys under General Settings.

Answer

Execute an XQL query with the `reset_broker` command.

Answer

Run the `xdrctl uninstall` command on every managed Windows endpoint.

Question 4

An administrator is configuring a Broker VM in a secured DMZ zone to collect logs from on-premises security devices. The network security team requires strict verification of outbound ports to the Cortex XSIAM tenant. Which exact combination of destination ports must be permitted outbound from the Broker VM to ensure proper operation and cloud communication?

Accepted Answer

TCP 443 outbound for cloud communication and log ingestion APIs. Broker VMs communicate securely with the Cortex XSIAM cloud backend primarily over TCP port 443 (HTTPS) for API calls, management, and log ingestion.

Answer

TCP 443 and TCP 22 for secure tunneling and remote management

Answer

TCP 6514 and UDP 514 for syslog relay directly to the tenant database

Answer

TCP 8443 and UDP 123 for internal heartbeat synchronization

Question 5

An architect is designing a multi-tenant XSIAM data ingestion pipeline where distinct business units must have isolated visibility and role-based access control over their respective log sources. Which XSIAM architectural construct should be configured to ensure strict data segregation between business units?

Accepted Answer

Dataset-level Role-Based Access Control (RBAC) and Query Scopes. Data Access granularity and partitioning in XSIAM are managed via custom roles mapped to specific query scopes and dataset filters, or multi-tenant structures depending on the tenant architecture.

Answer

Broker VM interface bonding configurations

Answer

Agent Installation Packages with embedded proxy exclusions

Answer

Log Collector Profiles with dedicated forwarding keys

Question 6

An engineer is tasked with reviewing the health and status of data collectors deployed across various remote sites. Within the Cortex XSIAM management console, which navigation path provides a consolidated view of all Broker VMs and their current operational status?

Accepted Answer

Settings > Configurations > Data Collection > Broker VM. Broker VM health and status are monitored under Settings > Configurations > Data Collection > Broker VM.

Answer

Cloud Identity > Integrations > Status

Answer

Dashboards > Incident Management > Overview

Answer

Investigate > Endpoint Security > Collectors

Question 7

An administrator is planning network changes for an environment where endpoints communicate through a corporate HTTP proxy. To ensure Cortex XDR agents maintain continuous connectivity to the XSIAM tenant, what must the administrator verify regarding the proxy configuration?

Accepted Answer

The proxy must allow outbound HTTPS traffic to XSIAM FQDNs and support websocket connections without SSL inspection. Cortex XDR agents must be configured with the correct proxy settings (either via installer properties or agent settings) and the proxy must allow outbound HTTPS traffic to the required XSIAM FQDNs without SSL decryption interference.

Answer

The proxy server must run a local Broker VM instance to cache agent heartbeat signals

Answer

The proxy must translate all UDP syslog packets into TCP streams before forwarding

Answer

The proxy must perform full SSL decryption on all agent-to-cloud traffic to inspect security payloads

Question 8

An enterprise environment is planning to ingest threat intelligence feeds into Cortex XSIAM. Which THREE threat intelligence formats or integration methods are natively supported by XSIAM content packs? (Choose three)

Accepted Answer

Direct file uploads of CSV or IOC list files via marketplace integration content packs. Cortex XSIAM supports various threat intelligence ingestion methods, including TAXII servers, STIX feeds, and custom API-based threat intelligence integrations.

Answer

Broadcasting IOCs over analog radio frequency (RF) channels

Answer

Manual entry of indicators carved onto physical punch cards

Question 9

An organization plans to ingest cloud audit logs from Amazon Web Services (AWS) into Cortex XSIAM using an automated collector architecture. Which native AWS service integration mechanism is typically recommended and supported by XSIAM for scalable log collection?

Accepted Answer

AWS S3 bucket ingestion leveraging SQS notifications and IAM role authentication. AWS log integration into Cortex XSIAM commonly leverages AWS S3 buckets populated by CloudTrail or VPC flow logs, accessed via SQS and IAM roles through an AWS integrations content pack or Broker VM AWS collector.

Answer

Direct SNMP traps forwarded from AWS EC2 metadata service

Answer

Syslog forwarding from the AWS Root Account login page

Answer

Local Cortex XDR agent installation on AWS RDS database instances

Question 10

When establishing Role-Based Access Control (RBAC) in Cortex XSIAM, what is the purpose of assigning 'Folder' scopes to a custom role?

Accepted Answer

To limit visibility and management capabilities to specific subsets of endpoints and data sources organized within the folder hierarchy.. Folder scopes allow organizations to delegate administrative or analyst permissions based on logical asset groupings, ensuring users only see data and endpoints relevant to their assigned business unit or geographic region.

Answer

To specify the directory path where agent installation logs are written on endpoints.

Answer

To restrict which log files are stored on the local Broker VM disk storage.

Answer

To determine which software packages can be downloaded from the Cortex XSIAM Marketplace.

Question 11

An engineer wants to verify the version and resource utilization of a running Broker VM. Where in the Cortex XSIAM user interface can this operational metric be inspected?

Accepted Answer

Settings > Configurations > Data Collection > Broker VM. Broker VM resource utilization (CPU, memory, disk) and version details are visible under Settings > Configurations > Data Collection > Broker VM.

Answer

Investigate > Alerts > System Events

Answer

XQL Search > Run > sys_resources

Answer

Dashboards > Threat Intelligence > Overview

Question 12

An organization requires that certain sensitive datasets ingested into Cortex XSIAM be automatically purged after a specific retention period shorter than the default tier. Where can an administrator configure custom retention policies for specific datasets?

Accepted Answer

Settings > Configurations > Data Management > Retentions. Custom data retention settings and storage tiering policies are managed under the data management and retention settings within the Cortex XSIAM administrative console.

Answer

Marketplace > Content Hub > Retention Pack

Answer

Endpoint Security > Profiles > Storage Settings

Answer

Investigate > XQL Search > Retention Command

Question 13

An administrator is configuring a new Cortex XSIAM tenant and needs to ingest custom syslog data from a third-party firewall. Which component should be configured first to receive and parse this raw syslog data before it reaches the data lake?

Accepted Answer

Broker VM configured with a Syslog collector. A Broker VM with a Syslog collector profile is required to receive and ingest syslog data into Cortex XSIAM.

Answer

Direct API integration with the Cortex XSIAM Query Service

Answer

Cortex XSOAR mail listener integration

Answer

Traps Management Service global proxy

Question 14

When defining custom user roles and permissions in Cortex XSIAM, which TWO granular access controls can an administrator assign? (Choose two)

Accepted Answer

Dataset-level access restrictions and query scopes. RBAC in XSIAM allows administrators to restrict access based on query scopes, dataset permissions, and operational capabilities (e.g., incident response vs. administration).

Answer

The physical geographic location of the analyst's workstation hardware

Answer

The local BIOS password of the analyst's endpoint device

Answer

The brand and model of the corporate firewall protecting the analyst

Question 15

An administrator notices that logs from a specific firewall are not appearing in Cortex XSIAM. The firewall is configured to send syslog to the Broker VM. Where should the administrator check first to determine if the Broker VM is receiving the raw syslog packets?

Accepted Answer

The Broker VM collector status and troubleshooting logs within the Cortex XSIAM management console.. The Broker VM provides diagnostic logs and collector status indicators in the XSIAM web console or local diagnostic tools to verify incoming packet receipt.

Answer

The XSIAM tenant billing dashboard to verify license usage.

Answer

The active firewall security policy rulebase.

Answer

The endpoint cytool diagnostic utility on managed servers.