XSIAM-Engineer Practice Test 17 — 15 Questions

Question 1

A security architect is planning the initial deployment of Cortex XSIAM for a company with three geographically separated data centers. The architect wants to ensure that if the primary Cortex XSIAM tenant becomes unavailable, log ingestion continues without data loss. Which deployment model should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A single Cortex XSIAM tenant with Broker VM high availability and local buffering at each data center.. The correct design uses Broker VM high availability with local buffering to maintain log ingestion during cloud outages. Cortex XSIAM is a SaaS platform, so on-premises or multi-tenant active-active options are not valid. Broker VMs act as the collection layer and can store logs temporarily if the tenant is unreachable.

Answer

Cortex XSIAM on-premises installation with redundant management servers and shared storage.

Answer

Cortex XSIAM tenant replication to a warm standby tenant in a different region using built-in replication.

Answer

Cortex XSIAM High Availability (HA) cluster with two tenants in active-active mode across data centers.

Question 2

An enterprise is undergoing a security audit and requires proof of XSIAM system resilience and data integrity. Which THREE operational artifacts or features should the administrator provide to the auditors? (Choose three)

Accepted Answer

Role-Based Access Control (RBAC) documentation and user role assignments.. Option B is correct because Role-Based Access Control (RBAC) documentation and user role assignments demonstrate that access to the XSIAM platform is restricted according to least-privilege principles, which auditors need to verify system resilience against unauthorized access. Option D is correct because the XSIAM Audit Trail logs capture administrative actions and configuration changes, providing an immutable record that proves data integrity and accountability for system modifications. Option E is correct because configured Data Retention policies show that the organization adheres to data lifecycle regulations, ensuring that security data is preserved or purged according to legal and compliance requirements. Options A and C are incorrect because personal social media profiles and cafeteria menu schedules are irrelevant to XSIAM system resilience, data integrity, or any security audit control.

Answer

Personal social media profiles of the SOC analysts.

Answer

Local employee cafeteria menu schedules.

Question 3

An administrator configured a Microsoft Graph API integration to pull security alerts into XSIAM. The connection status shows 'Active', but no alerts are being pulled. Reviewing the integration instance configuration, which common misconfiguration typically causes this behavior while keeping the authentication valid?

Accepted Answer

Incorrect fetch query parameters or time filters excluding existing alerts. When a Microsoft Graph API integration shows 'Active' but pulls no alerts, the most common misconfiguration is incorrect fetch query parameters or time filters that exclude existing alerts. The authentication can be valid (hence 'Active'), but if the fetch query filters on a time window that has no matching alerts or uses an incorrect filter syntax, the integration will return zero results.

Answer

Exceeding the Broker VM CPU capacity

Answer

Failure to install the Cortex XDR Agent on the Microsoft Graph server

Answer

Missing XQL parsing rules for Microsoft XDM mapping

Question 4

An engineer is writing a custom Python integration for XSIAM that enriches indicators by querying an internal threat-intelligence API. The API returns a JSON body with a nested 'data.attributes' object, and the engineer wants each nested field exposed as a separate command output that analysts can reference in playbook context paths. Which approach should the engineer take in the integration code?

Accepted Answer

Use the CommandResults object with a readable output and a separate outputs dictionary keyed by context path. The idiomatic way to expose structured data from an XSIAM integration command is the CommandResults object, which carries a readable output plus an outputs dictionary. Each dictionary key maps to a context path, so nested API attributes become individually addressable in playbooks and layouts. Raw strings, container files, and log entries all fail to provide discrete, directly referenceable context keys.

Answer

Return the raw JSON string and instruct analysts to parse it with a transformer in each playbook

Answer

Emit each attribute as a separate log entry so analysts can search for it in the XSIAM query console

Answer

Write the nested attributes to a file in the integration's container and reference the file path in playbooks

Question 5

An enterprise environment requires high availability and scalability for log collection. Which TWO architectural best practices should an engineer follow when deploying Broker VMs for large-scale log ingestion? (Choose two)

Accepted Answer

Deploy multiple Broker VMs grouped behind a load balancer to distribute incoming syslog and HTTP traffic.. Option D is correct because deploying multiple Broker VMs behind a load balancer provides horizontal scalability and eliminates the single point of failure, allowing syslog (UDP/TCP 514) and HTTP (TCP 80/443) log traffic to be distributed across brokers for high availability. Option E is correct because sizing Broker VMs per Palo Alto Networks reference architecture guidelines ensures adequate CPU, RAM, and storage to handle the expected log ingestion rate and retention, preventing performance degradation or dropped logs at scale. Option A is wrong because storing raw logs only on ephemeral local storage without forwarding risks data loss on VM failure and does not meet enterprise retention or availability requirements. Option B is wrong because disabling logging on Broker VMs defeats their purpose as log collection infrastructure. Option C is wrong because funneling all traffic through a single Broker VM creates a bottleneck and a single point of failure, contradicting high availability and scalability goals.

Answer

Configure Broker VMs to store all raw logs locally on ephemeral storage for eternity without cloud forwarding.

Answer

Disable all logging on the Broker VMs to maximize CPU cycles for network packet forwarding.

Answer

Route all enterprise log traffic through a single Broker VM to simplify network troubleshooting.

Question 6

A Cortex XSIAM engineer needs to create a new automation script that will be used across multiple playbooks. The script must accept an input argument called 'incident_id' and return the incident's severity as a string. Which step is required to make the script available for use in playbooks?

Accepted Answer

Create the script in the 'Automation' section of Cortex XSIAM and ensure it is enabled.. Custom automation scripts in Cortex XSIAM are created in the 'Automation' section. After creating and enabling the script, it can be selected as a task in any playbook. The script can accept input arguments like 'incident_id' and return outputs that can be used in subsequent tasks. This method ensures the script is centrally managed and reusable across playbooks.

Answer

Add the script to the 'Scripts' section in the Cortex XSIAM marketplace and install it.

Answer

Define the script as a playbook task and then export it as a reusable script.

Answer

Upload the script as a Python file to the Cortex XSIAM server via SSH and register it using the command line.

Question 7

An administrator is troubleshooting a scenario where custom parsers are failing to correctly extract fields because the incoming log format changed slightly. What operational step should be taken to update the parser without disrupting active data ingestion?

Accepted Answer

Edit the parser definition in Settings > Configurations > Data Collection > Parsers, update the grok pattern, and test with sample logs before saving.. Custom parsers can be edited and tested in real-time within the Parsers configuration page, allowing administrators to refine grok patterns and save the updated parser version safely.

Answer

Stop the entire XSIAM tenant, wipe the database, and re-import all log sources from scratch.

Answer

Disable data ingestion globally while rewriting the SQL database schema.

Answer

Deploy a local text-editor plugin to every Broker VM via SSH to modify underlying regex config files.

Question 8

An XSIAM administrator has created a custom parsing rule using Logstash-like syntax within XSIAM to normalize a non-standard application log format. After saving and enabling the parsing rule, incoming logs still appear unparsed under the 'Default' vendor product type. What is the most likely reason for this behavior?

Accepted Answer

The matching criteria or vendor/product identifiers in the parsing rule do not align with the incoming log header fields.. The most likely reason is that the parsing rule's matching criteria—specifically the vendor and product identifiers—do not align with the incoming log header fields, so the rule never matches and logs fall through to the 'Default' vendor product type. XSIAM parsing rules are applied based on these header fields, and a mismatch means the custom parser is bypassed. Correcting the vendor/product values in the rule to match the actual log metadata resolves the issue.

Answer

Parsing rules can only be applied to logs ingested via HTTP API, not Broker VM inputs.

Answer

Custom parsing rules require a mandatory XSOAR playbook to trigger the parsing pipeline.

Answer

The Broker VM service must be completely restarted for parsing rules to take effect.

Question 9

A Cortex XSIAM administrator needs to grant a new SOC analyst read-only access to incidents and alerts but prevent any modifications. Which role should be assigned to the analyst?

Accepted Answer

Viewer. The Viewer role provides read-only access to incidents and alerts, ensuring the analyst can monitor but not modify data. Instance Administrator, Analyst, and SOC Engineer roles all include modification capabilities, making them unsuitable. Assigning Viewer adheres to the principle of least privilege and satisfies the requirement.

Answer

Analyst

Answer

SOC Engineer

Answer

Instance Administrator

Question 10

An operations team is planning a routine maintenance window for Broker VMs. Which THREE best practices should be followed to ensure operational continuity? (Choose three)

Accepted Answer

Back up Broker VM configuration settings and snapshots before applying software upgrades.. Broker VM maintenance best practices include ensuring high availability/clustering, verifying network connectivity before updates, and backing up configuration parameters.

Answer

Manually delete all historical data in the Cortex Data Lake to free up buffer space.

Answer

Reinstall the underlying hypervisor operating system on every managed endpoint.

Question 11

A security team wants a Cortex XSIAM playbook to automatically assign every newly created high-severity incident to the on-call analyst based on the current shift schedule maintained in an external system. Which capability should the engineer use to fetch the on-call user at runtime?

Accepted Answer

A built-in integration command that queries the external scheduling system's API. Dynamic assignment based on a rotating shift schedule requires querying the authoritative external system at playbook runtime. An integration command against the scheduling API returns the current on-call user, whose identifier is then passed to the assignment task. Hardcoded lists, group rules, and emailed rosters all fail to provide accurate, real-time on-call information to the automation.

Answer

A role-based assignment rule that maps high severity to a fixed analyst group

Answer

A hardcoded list of analysts stored in the playbook's task inputs

Answer

A scheduled report that emails the shift roster to the SOC mailbox each morning

Question 12

An XSIAM administrator needs to ensure that a newly created automation script can be executed by playbooks. The script is written in Python and uses the XSIAM automation libraries. What must be done to make the script available for use in playbooks?

Accepted Answer

Add the script to the Scripts library in the XSIAM Automation section.. To make a custom Python script available for playbooks in Cortex XSIAM, the administrator must add it to the Scripts library via the Automation section. This registers the script with the automation engine, allowing it to be selected as a task in playbooks. The script can then be executed with defined inputs and outputs, leveraging XSIAM's built-in Docker infrastructure.

Answer

Upload the script as an integration.

Answer

Place the script file in the /var/lib/xsiam/scripts directory on the server.

Answer

Compile the script into a Docker image and upload it to the XSIAM container registry.

Question 13

An administrator configured a new API data collector to ingest threat intelligence feeds, but no data is appearing in XSIAM. Upon checking the Integration page, the status shows an authentication failure. What is the most likely cause and correct remediation?

Accepted Answer

The API key or credentials have expired or are incorrect; update the integration instance configuration with valid credentials under Settings > Configurations > Data Collection > Integrations.. An authentication failure status on an integration almost always indicates that the API key, token, or service account credentials configured in the integration instance are invalid, expired, or lack the required scopes. The correct remediation is to update the integration instance under Settings > Configurations > Data Collection > Integrations with valid credentials and re-test the connection.

Answer

The XQL query syntax used by the integration is malformed and requires rewriting the SQL statement.

Answer

The local firewall on the Cortex XDR agent is blocking outbound HTTPS requests to the threat intel feed.

Answer

The Broker VM container needs to be restarted via SSH to reload the routing table.

Question 14

An administrator is reviewing log collection options during the initial planning phase of Cortex XSIAM. Which THREE sources can natively send logs to a Cortex XSIAM Broker VM collector profile? (Choose three)

Accepted Answer

Syslog streams from network security devices and servers. The Cortex XSIAM Broker VM collector profile natively supports three ingestion methods: Syslog streams (option A), which receive RFC 3164/5424 syslog from network security devices and servers over UDP/TCP port 514; HTTP/HTTPS JSON payloads (option B), which accept structured JSON from third-party security tools via the Broker VM's HTTP listener; and file-based collection (option C), which monitors local directories or ingests files dropped via SCP/SFTP. These three are the standard, documented collector types configured in a Broker VM collector profile during XSIAM deployment planning. Option D is incorrect because kernel memory dumps from unmanaged hypervisors over raw TCP sockets are not a supported native collector type. Option E is incorrect because BIOS firmware updates over ICMP echo requests are not a log transport mechanism and are not supported by the Broker VM.

Answer

Direct kernel memory dumps from unmanaged hypervisors via raw TCP sockets

Answer

Proprietary BIOS firmware updates streamed over ICMP echo requests

Question 15

An architect is planning the installation of a Broker VM in a high-security environment. The security team requires that all outbound communication from the Broker VM to the Cortex XSIAM tenant be encrypted and mutually authenticated. Which characteristic of the Broker VM's communication satisfies this requirement?

Accepted Answer

It uses TLS with mutual certificate authentication. Broker VM establishes a secure channel to the Cortex XSIAM tenant using TLS with mutual certificate authentication. This ensures encryption and verifies both parties, satisfying the high-security requirement. The other options describe encryption methods that lack mutual authentication or are not used by Broker VM for this purpose.

Answer

It uses HTTPS with server-side certificates only

Answer

It uses IPsec with pre-shared keys

Answer

It uses SSH tunneling with password authentication