XSIAM-Engineer Practice Test 16 — 15 Questions

Question 1

An administrator needs to configure secure access to the Cortex XSIAM web console for remote administrators. Which TWO security controls should be implemented? (Choose two)

Accepted Answer

Configure IP allowlisting policies or conditional access rules via the IdP/SAML configuration.. Option A is correct because configuring IP allowlisting policies or conditional access rules through the IdP/SAML configuration restricts console access to trusted networks or verified identity-provider conditions, adding a strong network- and identity-based control for remote administrators. Option C is correct because enforcing MFA for all administrator accounts adds a critical authentication factor, ensuring that stolen or guessed credentials alone cannot grant access to the Cortex XSIAM web console. Option B is wrong because disabling TLS encryption would expose credentials and session data to interception, directly undermining secure access. Option D is wrong because publishing credentials in plaintext violates basic credential-handling and confidentiality principles. Option E is wrong because granting guest accounts unrestricted superuser privileges violates least privilege and would create a severe access-control risk.

Answer

Disable all TLS encryption on the admin portal to speed up login times.

Answer

Publish administrator credentials in plaintext on the internal corporate wiki for easy team reference.

Answer

Configure guest accounts with unrestricted superuser privileges for external auditors.

Question 2

An administrator is preparing to deploy the Cortex XDR agent on Windows workstations via an Active Directory Group Policy Object (GPO). Which file format must the administrator download from the XSIAM console for this deployment method?

Accepted Answer

.msi. For GPO-based deployment on Windows, the Cortex XDR agent must be distributed as an .msi package, which Group Policy Software Installation can deploy silently and manage via Active Directory. The .msi format supports command-line properties and centralized installation.

Answer

.exe

Answer

.tar.gz

Answer

.ova

Question 3

Which TWO of the following features help maintain data security during the integration process?

Accepted Answer

Encrypted credential vaulting for API keys.. Option C is correct because encrypted credential vaulting for API keys ensures that sensitive authentication secrets used by integrations are stored in an encrypted, access-controlled repository rather than in plaintext configuration files, reducing the risk of credential theft or leakage during data exchange. Option D is correct because RBAC for integration management enforces least-privilege access, ensuring that only authorized roles can configure, modify, or view integration components, which limits the blast radius of a compromised account and prevents unauthorized changes to data flows. Options A, B, and E do not belong: automatically assigning a public IP to every collector unnecessarily exposes collectors to the internet and enlarges the attack surface; granting full administrative rights to every integration service account violates least privilege and magnifies the impact of any compromise; and disabling all logs for third-party integrations removes the audit trail needed to detect and investigate security incidents.

Answer

Automatic public IP assignment for every collector.

Answer

Full administrative rights for every integration service account.

Answer

Disabling all logs for third-party integrations.

Question 4

An organization requires that specific security analysts can run advanced XQL (XSIAM Query Language) queries across all datasets except for Human Resources (HR) log categories, which contain PII. How should the administrator configure this restriction in Cortex XSIAM?

Accepted Answer

Create a Data Access Control rule that excludes the HR dataset from the queries executed by the analysts' assigned role.. Data Access Control (DAC) rules in Cortex XSIAM allow administrators to restrict XQL query access and dataset visibility based on roles or user groups to protect sensitive data categories like HR logs.

Answer

Modify the Broker VM configuration file to drop HR logs before they are written to the XSIAM data lake.

Answer

Revoke XQL query execution rights entirely for all analysts across the entire tenant.

Answer

Configure XSOAR to automatically redact PII strings from results after the query finishes executing.

Question 5

An administrator is preparing to deploy the Cortex XSIAM agent across a corporate network of Windows endpoints. Which infrastructure component must be successfully installed and registered first to facilitate secure communication and act as the local aggregator for agent logs before they reach the Cortex XSIAM tenant?

Accepted Answer

Broker VM. The Broker VM acts as the local intermediary and aggregator in the customer environment for agent communication, log forwarding, and threat intelligence ingestion when direct cloud connectivity is restricted or for local services.

Answer

Cortex XSOAR Engine

Answer

Cortex XDR Collector

Answer

Prisma Access Remote Network

Question 6

An enterprise security architect is aligning deployment objectives with Cortex XSIAM architecture. The organization requires low-latency threat detection across endpoints and network sensors. Which architectural component is primarily responsible for real-time analytics and behavioral threat detection in XSIAM?

Accepted Answer

The Cortex XSIAM cloud analytics and correlation engine.. The Cortex XSIAM cloud analytics engine processes normalized telemetry from endpoints, networks, and cloud sources in real-time to perform behavioral analytics and threat detection.

Answer

The local Broker VM processing cache.

Answer

The endpoint's local static signature database.

Answer

The XSOAR incident ticketing database.

Question 7

During a Cortex XSIAM deployment planning meeting, an architect must determine how endpoint telemetry will reach the tenant from a segmented OT network with no direct internet access. Which deployment component is explicitly designed to collect and forward endpoint data from restricted network segments to the Cortex XSIAM cloud?

Accepted Answer

Broker VM deployed in the restricted network segment. Broker VM is the Cortex XSIAM component purpose-built for restricted network segments. It collects endpoint and log data locally and forwards it to the tenant over an outbound connection, enabling visibility without direct internet access from endpoints. The other options describe cloud services or features that do not provide local data collection and forwarding in segmented environments.

Answer

Cortex Data Lake direct ingestion endpoint

Answer

Cortex XDR agent configured with a direct cloud connection

Answer

External dynamic list hosted on the tenant

Question 8

When aligning deployment objectives with Cortex XSIAM architecture, an organization decides to integrate external threat intelligence feeds. Which TWO methods are supported for incorporating threat intelligence into XSIAM? (Choose two)

Accepted Answer

Installing official threat intelligence integration content packs from the Cortex XSIAM Marketplace.. Threat intelligence can be integrated via native Cortex XSIAM Marketplace content packs/integrations and custom API connectors.

Answer

Mailing physical USB hard drives containing threat indicators to the Palo Alto Networks headquarters.

Answer

Writing raw binary machine code directly to the endpoint RAM using debuggers.

Answer

Manually editing the Broker VM BIOS firmware to include malicious IP blacklists.

Question 9

An engineer is planning a Cortex XSIAM deployment and must ensure that the Broker VM can forward logs to the tenant even when the primary internet path is saturated. Which configuration should be verified on the Broker VM to allow it to use an alternate outbound path?

Accepted Answer

Enable proxy settings on the Broker VM for outbound connections. Broker VM supports outbound proxy configuration, which enables it to forward logs through an alternate path when direct connectivity is constrained. This is the supported mechanism for routing traffic via a proxy, ensuring resilience and adherence to network policies. Other options do not provide a functional alternate outbound path for log forwarding.

Answer

Configure the Broker VM to use DNS over HTTPS exclusively

Answer

Bind the Broker VM to a specific MAC address for failover

Answer

Configure a second default gateway on the Broker VM

Question 10

A Cortex XSIAM administrator needs to integrate an external threat intelligence feed that provides indicators of compromise (IOCs) in STIX/TAXII format. The administrator wants the IOCs to be automatically ingested and used for detection. Which component should be configured to achieve this?

Accepted Answer

Cortex XSIAM Threat Intelligence Management. Threat Intelligence Management is the Cortex XSIAM component responsible for ingesting and managing external threat intelligence, including STIX/TAXII feeds. It automates the collection of IOCs and makes them available for detection engines. Other components like Data Sources handle log ingestion, Broker VMs handle local collection, and Correlation Rules define detection logic, but none of these directly ingest threat intelligence feeds.

Answer

Cortex XSIAM Broker VM

Answer

Cortex XSIAM Correlation Rules

Answer

Cortex XSIAM Data Sources

Question 11

An administrator is troubleshooting a newly configured API-based integration that is failing to ingest logs into Cortex XSIAM. The test connection fails with an authentication error, despite valid API credentials being entered. What is a common architectural oversight that causes this failure?

Accepted Answer

The API user account lacks the necessary permissions on the target platform, or network egress is blocked. Authentication failures in API-based integrations are most often caused by authorization or connectivity problems rather than the credentials themselves. Even with a valid API key, the account must have the correct scopes/roles on the target platform, and the Broker VM or integration host must be able to reach the API endpoint over the required ports. Blocked egress or insufficient permissions will surface as an authentication error in the test connection.

Answer

The Broker VM requires a manual firmware downgrade to support legacy API protocols

Answer

The Cortex XDR agent service on endpoints has stopped responding

Answer

The XQL query builder cache is corrupted and requires a database purge

Question 12

An analyst wants to trigger an automated playbook in XSIAM immediately whenever a specific high-severity alert is generated by the Analytics engine. Where should the analyst configure this automated linkage?

Accepted Answer

Within the Correlation Rule or Analytics Rule definition under the Incident Handling or Automated Playbook section. The correct place to configure an automated playbook trigger for a specific alert is within the Correlation Rule or Analytics Rule definition, under the Incident Handling or Automated Playbook section. This allows the rule to directly invoke a playbook when the alert is generated, ensuring immediate response. This is the native mechanism in XSIAM for linking analytics to automation.

Answer

Via the Data Stitching rules configuration page

Answer

By modifying the global XSOAR integration instance mapping parameters

Answer

Inside the Broker VM configuration file under the 'triggers' YAML block

Question 13

An XSIAM engineer needs to store a sensitive API key that will be used by multiple playbooks. The key must be encrypted and accessible only to specific playbooks. Which XSIAM feature should be used?

Accepted Answer

Cortex XSIAM 'Credentials' store with restricted access. The Credentials store is specifically designed for securely storing and managing secrets like API keys. It provides encryption, access control, and the ability to reference credentials in playbooks without hardcoding them. This meets the requirement of a centralized, encrypted store accessible to multiple playbooks with restricted access.

Answer

Playbook inputs with 'encrypted' flag

Answer

Incident fields with 'sensitive' attribute

Answer

Integration instance parameters marked as 'credential'

Question 14

An architect is planning the installation of Cortex XSIAM in a regulated environment that requires all data to be stored within the country. The architect must ensure that the Cortex XSIAM tenant is deployed in the correct region. Which factor determines the data residency of the Cortex XSIAM tenant?

Accepted Answer

The region selected during the Cortex XSIAM tenant provisioning process in the Customer Support Portal.. Data residency for Cortex XSIAM is determined by the region selected when the tenant is provisioned in the Customer Support Portal. The region cannot be changed later, so it must be chosen carefully to comply with regulations. Broker VM location, DNS, and license type do not influence where tenant data is stored.

Answer

The license type purchased, such as Cortex XSIAM Enterprise or Cortex XSIAM Pro.

Answer

The physical location of the Broker VM that forwards the logs to the tenant.

Answer

The configuration of the DNS server that resolves the Cortex XSIAM tenant FQDN.

Question 15

An engineer is planning the deployment of multiple Broker VMs in a large environment with several network segments. The goal is to ensure high availability and local log collection without requiring inbound firewall rules. Which TWO design considerations are valid for this deployment? (Choose two.)

Accepted Answer

Broker VMs can be deployed in different network segments to collect logs locally and forward them to the tenant.. Valid design considerations include ensuring each Broker VM can initiate outbound connections to the tenant and deploying them across network segments for local collection and resilience. A single Broker VM cannot scale indefinitely, inbound rules are not required, and shared-VIP clustering is not the high-availability model used by Broker VMs, so those options are incorrect.

Answer

Broker VMs require inbound firewall rules from the Cortex XSIAM tenant to function.

Answer

Broker VMs must be clustered using a shared virtual IP for failover.

Answer

A single Broker VM can manage unlimited log sources across all segments without performance impact.