XSIAM-Engineer Practice Test 18 — 15 Questions

Question 1

A security architect is planning a Cortex XSIAM deployment for a large enterprise. The organization wants to minimize the number of publicly exposed services and centralize log ingestion from remote sites. Which component should the architect deploy at each remote site to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cortex XSIAM Broker VM. The Broker VM is specifically designed for distributed log collection, allowing remote sites to forward logs to Cortex XSIAM without exposing additional public services. It acts as a secure intermediary, supports multiple ingestion methods, and reduces firewall complexity. Deploying Broker VMs at each site aligns with best practices for scalable, secure XSIAM deployments.

Answer

Cortex XDR agent

Answer

Cortex XSOAR appliance

Answer

Cortex XSIAM Engine

Question 2

An engineer is planning the installation of Cortex XDR agents on endpoints as part of a Cortex XSIAM deployment. The organization wants to minimize the risk of a bad agent version affecting all endpoints simultaneously. Which deployment strategy should the engineer use?

Accepted Answer

Use upgrade rings to stage the agent deployment across groups of endpoints.. Upgrade rings provide a controlled, phased rollout by deploying the agent to a small pilot group first and then expanding to broader groups after validation. This minimizes the risk of a defective version affecting the entire fleet. Deploying to all endpoints at once, manual per-endpoint installation, or excluding endpoints entirely do not achieve the balance of protection and risk mitigation required.

Answer

Disable automatic updates and manually install the agent on each endpoint.

Answer

Deploy the agent only to servers and leave endpoints unprotected.

Answer

Deploy the agent to all endpoints at once to ensure uniform protection.

Question 3

An administrator is configuring a new syslog data source in XSIAM to ingest logs from a third-party firewall. Which component must be deployed on-premises to securely receive and forward these logs to the XSIAM tenant?

Accepted Answer

Palo Alto Networks Broker VM. The Palo Alto Networks Broker VM is the on-premises component deployed in XSIAM environments to receive syslog and other data from internal sources (firewalls, proxies, endpoints) and securely forward it to the Cortex XSIAM tenant over an encrypted channel. It acts as the bridge between the customer's network and the cloud-based XSIAM backend, handling parsing, buffering, and forwarding. Without a Broker VM, on-premises syslog sources cannot be ingested into XSIAM.

Answer

Panorama Virtual Appliance

Answer

Cortex XDR Agent

Answer

XSIAM Management Server

Question 4

A security analyst wants to manually run a specific automation script from the Cortex XSIAM incident War Room to enrich an indicator. The script is already uploaded and available in the tenant. Which action should the analyst take to execute the script directly from the War Room command line?

Accepted Answer

Type the script name followed by any required arguments in the War Room command line and press Enter.. The War Room command line is the correct interface for manually executing automation scripts on demand. It supports running any available script or integration command with arguments, and displays the output directly in the incident's War Room. This allows analysts to perform quick enrichment or testing without creating playbooks or scheduled jobs. The other options involve unnecessary overhead or are not designed for immediate, incident-scoped execution.

Answer

Navigate to the Playbooks page, create a new playbook, add the script as a task, and run the playbook.

Answer

Use the Scripts page to open the script, then click the 'Run' button and provide arguments in the dialog.

Answer

Configure a scheduled job that runs the script every minute and wait for the next execution.

Question 5

You are writing a custom XQL query to filter logs, but you find that the field names are inconsistent across your data sources. How can you standardize these fields for your automation?

Accepted Answer

Ensure proper XDM mapping is applied to the ingestion source.. XDM (eXtendable Data Model) mapping ensures that logs from different sources are normalized into common field names, making queries more robust.

Answer

Rely on the raw log field names and map them manually in the playbook.

Answer

Use the 'Rename' function in every XQL query.

Answer

Use an external script to rewrite the logs before they reach XSIAM.

Question 6

A Cortex XSIAM administrator is preparing to deploy a Broker VM in a demilitarized zone (DMZ) to collect logs from internet-facing devices. The security policy requires that the Broker VM only initiate outbound connections to the Cortex XSIAM tenant and not accept any inbound connections from the internet. Which configuration should the administrator implement?

Accepted Answer

Deploy the Broker VM with a private IP address and configure it to establish outbound connections to the Cortex XSIAM tenant over TCP port 443.. The Broker VM is designed to initiate outbound connections to the Cortex XSIAM tenant, typically over TCP 443, which avoids the need for inbound firewall rules. By using a private IP and only outbound communication, the Broker VM remains protected from internet-initiated attacks while still being able to forward logs and receive updates. This is the recommended deployment for DMZ environments.

Answer

Configure the Broker VM to use a site-to-site VPN with the Cortex XSIAM tenant, allowing bidirectional communication.

Answer

Configure the Broker VM to listen on a public IP address and allow inbound connections only from the Cortex XSIAM tenant IP range.

Answer

Place the Broker VM behind a reverse proxy that forwards incoming requests from the Cortex XSIAM tenant to the Broker VM.

Question 7

A deployment team is planning the rollout of Cortex XSIAM agents across a heterogeneous environment containing Windows, macOS, and Linux endpoints. Which core architectural component must be provisioned and accessible from all endpoints to ensure successful agent registration and policy synchronization?

Accepted Answer

Cortex XSIAM Broker VM. The Cortex XSIAM Broker VM is the core architectural component that endpoints must reach for agent registration, policy synchronization, and telemetry forwarding. It acts as the on-premises bridge between endpoints and the XSIAM cloud tenant, and it must be provisioned and network-accessible from all endpoint OS platforms.

Answer

Prisma Access Remote Network

Answer

Panorama Management Server

Answer

Cortex XSOAR Engine Cluster

Question 8

Which THREE configuration steps are typically required when setting up a new Broker VM instance in XSIAM? (Choose three)

Accepted Answer

Deploy the OVA image on an on-premises hypervisor (e.g., VMware ESXi). Option A is correct because a new Broker VM in XSIAM is deployed by importing the provided OVA image onto an on-premises hypervisor such as VMware ESXi, which creates the virtual appliance that hosts the broker services. Option C is correct because the Broker VM must be registered to the tenant using a registration token generated from the XSIAM console, which authenticates and binds the appliance to the correct tenant. Option E is correct because during initial setup the Broker VM requires network configuration (IP address, gateway, DNS) and optional proxy parameters so it can reach the XSIAM cloud and any internal resources. Option B is not required because the Broker VM ships as a prebuilt Linux appliance and no kernel compilation is performed. Option D is not required because the Cortex XDR Agent is not installed on the Broker VM host machine as part of Broker VM setup.

Answer

Manually compile the Linux kernel on the Broker VM

Answer

Install the Cortex XDR Agent on the Broker VM host machine

Question 9

A security engineer is planning the network requirements for a new Cortex XSIAM deployment. The organization uses a strict egress firewall policy. The engineer must ensure that the Broker VM can communicate with the Cortex XSIAM tenant. Which outbound connectivity requirement must be met?

Accepted Answer

The Broker VM must be able to reach the Cortex XSIAM tenant over TCP port 443.. The Broker VM initiates outbound connections to the Cortex XSIAM tenant using HTTPS on TCP port 443. This is the only required outbound port for data ingestion and management traffic. No inbound ports are needed from the internet to the Broker VM, which simplifies firewall configuration and enhances security. Other ports like UDP 514, TCP 22, or TCP 8080 are not used for this communication and would not satisfy the requirement.

Answer

The Broker VM must be able to reach the Cortex XSIAM tenant over TCP port 22.

Answer

The Broker VM must be able to reach the Cortex XSIAM tenant over TCP port 8080.

Answer

The Broker VM must be able to reach the Cortex XSIAM tenant over UDP port 514.

Question 10

An administrator is deploying a Broker VM on a VMware ESXi hypervisor. After deploying the OVA template, the administrator notices the Broker VM cannot reach the NTP server and fails activation. Which initial configuration step was likely missed?

Accepted Answer

Configuring the static IP address, subnet mask, default gateway, and DNS servers in the Broker VM console interface.. The Broker VM OVA deploys with no network configuration by default, so the administrator must open the VM console and manually set a static IP address, subnet mask, default gateway, and DNS servers before the appliance can reach external services like NTP. Without a valid gateway and DNS, the Broker VM cannot resolve or route to the NTP server, which blocks the activation handshake with the Cortex XSIAM tenant. This console-level network setup is a mandatory first-boot step in the Broker VM deployment workflow.

Answer

Allocating additional virtual CPU sockets to handle cryptographic handshakes.

Answer

Enabling SSH service access in the Cortex XSIAM tenant settings.

Answer

Installing the VMware Tools package inside the guest Linux operating system.

Question 11

An administrator is planning network changes for an environment where endpoints communicate through a corporate HTTP proxy. To ensure Cortex XDR agents maintain continuous connectivity to the XSIAM tenant, what must the administrator verify regarding the proxy configuration?

Accepted Answer

The proxy must allow outbound HTTPS traffic to XSIAM FQDNs and support websocket connections without SSL inspection. Cortex XDR agents communicate with the XSIAM tenant over outbound HTTPS (TCP 443) and use websocket connections for persistent, near-real-time command-and-control and telemetry streaming. When a corporate HTTP proxy sits in the path, it must permit outbound HTTPS to the XSIAM FQDNs and must NOT perform SSL inspection/decryption on that traffic, because breaking the TLS session invalidates the agent's certificate pinning and the websocket upgrade fails. Verifying these proxy allowances is the prerequisite for continuous agent connectivity.

Answer

The proxy server must run a local Broker VM instance to cache agent heartbeat signals

Answer

The proxy must translate all UDP syslog packets into TCP streams before forwarding

Answer

The proxy must perform full SSL decryption on all agent-to-cloud traffic to inspect security payloads

Question 12

An organization requires all audit logs generated within XSIAM to be exported to an external SIEM for long-term archiving. Which feature should the administrator configure?

Accepted Answer

Configure a Log Forwarding profile under Settings > Configurations > Data Collection > Log Forwarding.. External log forwarding rules can be configured in XSIAM to stream logs, including audit and security events, to third-party destinations via standard protocols like syslog or HTTP.

Answer

Enable Cortex XSOAR playbook automation to execute a daily database backup.

Answer

Set up a BIOC alert rule to email CSV exports every 24 hours.

Answer

Modify the Data Retention profile to replicate raw blocks to an external S3 bucket automatically.

Question 13

A security architect is planning a Cortex XSIAM deployment for a large enterprise. The organization wants to minimize the number of publicly exposed services and centralize log ingestion from remote sites. Which component should the architect deploy at each remote site to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Broker VM. The Broker VM is the on-premises component that collects logs from local sources and forwards them to the Cortex XSIAM tenant. It is deployed in the customer environment and acts as the relay for data that cannot be sent directly to the cloud. Endpoint agents, cloud data storage, and the management console do not perform this local collection and forwarding role.

Answer

Cortex Data Lake

Answer

XSIAM management console

Answer

Cortex XDR agent

Question 14

An organization requires strict data residency compliance, ensuring that all log data collected by Cortex XSIAM remains within the European Union. During tenant initialization, how must the administrator satisfy this requirement?

Accepted Answer

Select the appropriate EU-based cloud region during initial tenant provisioning and activation. Cortex XSIAM is delivered as a SaaS platform hosted in multiple regional cloud environments, and data residency is enforced at the tenant level by choosing the region where the tenant is provisioned. Selecting an EU-based region during initial tenant activation ensures all ingested telemetry, storage, and processing remain within EU boundaries. This is a provisioning-time decision that cannot be retroactively changed by local configuration.

Answer

Deploy an on-premises Hadoop data lake and configure XSIAM to forward all raw logs via API

Answer

Configure log forwarding profiles within the Cortex XSOAR settings menu

Answer

Modify the Broker VM local storage configuration file to encrypt data using EU-specific keys

Question 15

An administrator needs to add a new user account to XSIAM and assign appropriate privileges. Where is user account creation and management performed?

Accepted Answer

Navigate to Settings > Access Management > Users to add new user accounts and assign roles.. User account creation and privilege assignment are managed under Settings > Access Management > Users.

Answer

Check the Endpoint Management > Add Device wizard.

Answer

Go to License Management and click Allocate Seat.

Answer

Open the Incident Response dashboard and click New Analyst.