XSIAM-Engineer Practice Test 19 — 15 Questions

Question 1

An administrator is troubleshooting a Broker VM that has lost connectivity to the XSIAM management plane. After checking network routing and firewalls, the administrator suspects local Docker container network corruption on the Broker VM host. Which administrative utility script on the Broker VM can be used to restart and reset the container networking stack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access the Broker VM administrative console CLI to execute service restart and network reset utilities.. The Broker VM administrative console CLI provides service restart and network reset utilities specifically designed to recover from local Docker container network corruption. Administrators can access this console directly on the Broker VM (via SSH or local console) and execute commands to restart the Docker services and reset the container networking stack, restoring connectivity to the XSIAM management plane. This is the correct tool for host-level container network troubleshooting.

Answer

Modify the global tenant encryption keys under General Settings.

Answer

Execute an XQL query with the `reset_broker` command.

Answer

Run the `xdrctl uninstall` command on every managed Windows endpoint.

Question 2

A Cortex XSIAM engineer is building a playbook that must wait for an external SOC analyst to approve a high-risk containment action before proceeding. The playbook should pause execution and resume only after the analyst submits a response through a form link. Which task type should the engineer add to the playbook to accomplish this?

Accepted Answer

A 'Data Collection' task that sends a form and waits for the analyst's reply. Human-in-the-loop approvals in XSIAM playbooks are implemented with the Data Collection task, which sends a form to a designated recipient and suspends execution until a reply is received. The submitted answers become context data that downstream conditional logic can evaluate. Neither conditional branching, War Room manual tasks, nor API polling can both prompt an external analyst and pause the playbook for that response.

Answer

A 'Generic Polling' task that repeatedly queries the ticketing system for approval status

Answer

A 'Conditional' task that evaluates a variable set by the analyst

Answer

A 'Manual' task that requires the engineer to click 'Complete' in the War Room

Question 3

You are troubleshooting a parsing error where logs from a custom application are not being mapped correctly to the XDM schema. What is the recommended approach to debug the transformation process?

Accepted Answer

Use the XDM Parsing tool to test the log sample against the existing parser and view validation errors.. The XDM Parsing tool is the recommended approach to debug parsing errors because it allows you to test a log sample against the existing parser and view validation errors. This helps identify where the mapping to the XDM schema is failing. It provides a sandbox for troubleshooting without affecting production data.

Answer

Create a new playbook to manually map the fields in the alert.

Answer

Modify the ingestion configuration to change the vendor product type.

Answer

Update the Data Collector version on the server.

Question 4

An administrator is preparing the infrastructure readiness assessment for integrating various log sources into Cortex XSIAM. Which THREE log collection methods or mechanisms are natively supported by the Broker VM architecture? (Choose three)

Accepted Answer

API-based log polling integrations for cloud services and SaaS applications.. The Broker VM architecture natively supports API-based log polling integrations (B), which allow Cortex XSIAM to pull logs from cloud services and SaaS applications via their REST APIs on a scheduled or streaming basis. It also supports Syslog over UDP and TCP (D), the standard mechanism for receiving event data from network devices, firewalls, and security appliances. Additionally, HTTP/HTTPS log ingestion collectors (E) are supported so custom applications can POST their log streams directly to the Broker VM. Options A and C are incorrect because a Broker VM is a software appliance that does not interface with a fiber-optic tap at the PCI bus level for inline packet decoding, nor does it mount raw magnetic tape drives for legacy mainframe ingestion; neither is a native log collection method in this architecture.

Answer

Direct fiber-optic tap connection into the Broker VM PCI bus for inline packet decoding.

Answer

Raw magnetic tape drive mounting for legacy mainframe log ingestion.

Question 5

An administrator is setting up external log forwarding from XSIAM to a third-party SIEM. Which TWO protocols are natively supported for log forwarding destinations? (Choose two)

Accepted Answer

Syslog (TCP or UDP). Option C is correct because XSIAM natively supports forwarding logs to external destinations over Syslog using either TCP or UDP transport, which is a standard protocol for SIEM-to-SIEM log ingestion. Option D is correct because XSIAM also natively supports HTTP/HTTPS forwarding, delivering JSON-formatted payloads via webhooks to third-party SIEM endpoints. Option A is incorrect because FTP upload of raw database blocks is not a supported log-forwarding method and does not represent structured event delivery. Option B is incorrect because direct SMB mapping to XSIAM cloud backend storage is not exposed or supported for external log forwarding. Option E is incorrect because Bluetooth serial connections are not a supported transport for XSIAM log forwarding.

Answer

Direct FTP file upload of raw database blocks

Answer

Direct SMB file share mapping to the XSIAM cloud backend storage

Answer

Local Bluetooth serial cable connection

Question 6

An XSIAM engineer needs to create a playbook that automatically enriches IP addresses from an incident by querying a threat intelligence integration. The enrichment should only occur if the incident contains at least one IP address. Which playbook task should be used to extract the IP addresses from the incident for further processing?

Accepted Answer

A 'Extract Indicators' task that parses the incident fields and extracts IP addresses into context.. The 'Extract Indicators' task is the correct choice because it automatically parses incident data to extract IP addresses and other indicators into the playbook context. This enables subsequent enrichment tasks to use those IPs. It can be configured to run only when indicators are present, satisfying the conditional requirement without custom scripting.

Answer

A 'Data Collection' task that gathers all incident fields into a structured format for analysis.

Answer

A 'Conditional' task that checks if the incident has an IP address field and then proceeds.

Answer

A 'Run Script' task that manually parses the incident description using regular expressions to find IP addresses.

Question 7

A security administrator is planning the installation of a Broker VM in a data center that uses a proxy for internet access. The administrator needs to ensure that the Broker VM can communicate with the Cortex XSIAM tenant through the proxy. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Configure the Broker VM to use the proxy by specifying the proxy server address and port in the Broker VM settings.. To enable Broker VM communication through a proxy, the administrator must configure the proxy address and port in the Broker VM settings and ensure the proxy allows outbound TCP 443 to the Cortex XSIAM tenant FQDN. These two steps are essential. Other options are either not required or represent general best practices that are not specific to proxy communication.

Answer

Install a client certificate on the Broker VM for proxy authentication.

Answer

Open inbound TCP 443 on the Broker VM to allow the proxy to initiate connections.

Answer

Configure the Broker VM to use a static IP address and DNS server.

Question 8

Which THREE of the following are critical components required for a successful data ingestion integration in XSIAM?

Accepted Answer

A defined XDM parser to normalize the incoming data.. Option A is correct because XSIAM requires a defined XDM (XSIAM Data Model) parser to map and normalize raw incoming data fields into the standardized schema so that XQL queries, analytics, and detections can operate consistently across sources. Option C is correct because every ingestion integration must authenticate to the source or broker using valid API credentials, keys, or authentication tokens; without them the integration cannot pull or receive data. Option D is correct because an active and healthy Data Collector group is the component that actually receives, buffers, and forwards data into XSIAM, so a broken or unregistered collector group halts ingestion. Option B is not required, since XQL dashboards are for visualization and investigation, not for the ingestion pipeline itself, and not every integration needs its own dashboard. Option E is not required, as firewall rules are environment-specific and only needed when network paths demand them; they are not a critical component of the ingestion integration itself.

Answer

A dedicated XQL dashboard for every integration.

Answer

A pre-configured firewall rule for all internal traffic.

Question 9

A security architect is planning a Cortex XSIAM deployment and must determine the minimum compute and storage resources needed for the Cortex XSIAM Engine to handle an expected ingest rate of 50,000 events per second (EPS). Which of the following is the correct sizing approach for the Engine?

Accepted Answer

Use the Cortex XSIAM sizing tool to calculate required vCPUs, memory, and storage based on the expected EPS and data retention period.. The Cortex XSIAM Engine must be sized according to expected event throughput and retention needs. The official sizing tool incorporates EPS and retention to recommend appropriate vCPU, RAM, and storage. Relying on agent count or maximum specs without analysis can result in poor performance or unnecessary cost.

Answer

Deploy a single Engine with 32 vCPUs and 128 GB RAM, as this is the maximum configuration supported and guarantees performance.

Answer

Size the Engine based on the number of Cortex XDR agents deployed, allocating 1 vCPU per 100 agents.

Answer

Allocate storage based solely on the number of days of log retention, ignoring EPS, because storage is the only constrained resource.

Question 10

An XSIAM engineer is troubleshooting a newly configured AWS CloudTrail integration. Log data is not appearing in the XSIAM query builder. Which log collection method is natively utilized by XSIAM to pull AWS CloudTrail logs?

Accepted Answer

Amazon SQS queue polling via an integration instance. XSIAM uses the SQS-based architecture where AWS services push notifications to an SQS queue, and the integration pulls from that queue.

Answer

Direct Syslog forwarding from AWS VPC to Broker VM

Answer

Scheduled SCP file transfer to a Broker VM SFTP directory

Answer

Cortex XDR Agent polling AWS metadata

Question 11

A Cortex XSIAM administrator needs to ensure that the platform automatically creates an incident when a specific correlation rule is triggered by multiple high-severity alerts within a 5-minute window. Which component should be configured to achieve this?

Accepted Answer

Create a new correlation rule in the Correlation Rules section with a time-based condition and an incident creation action.. Correlation rules are the correct component because they can evaluate multiple alerts over a specified time window and trigger actions such as incident creation. This provides the necessary automation to aggregate high-severity alerts within 5 minutes and generate a single incident. Other options either lack correlation capabilities or would produce multiple incidents instead of one consolidated incident.

Answer

Configure a scheduled report that runs every 5 minutes and creates an incident if high-severity alerts are present.

Answer

Set up a playbook that triggers on each high-severity alert and uses a timer to wait 5 minutes before creating an incident.

Answer

Modify the alert deduplication settings to group high-severity alerts and automatically promote the group to an incident.

Question 12

An organization is setting up Cortex XSIAM and wishes to restrict administrative access so that specific Tier-2 analysts can modify prevention policies but cannot create new user accounts or modify RBAC settings. How should this be configured?

Accepted Answer

Create a custom role with 'Policy Management' permissions enabled and 'User Management' permissions disabled.. The requirement is a split of privileges: allow policy modification but deny user/RBAC administration. Cortex XSIAM supports this through a custom role where 'Policy Management' is enabled and 'User Management' (account/RBAC) permissions are disabled. This enforces least privilege and separation of duties without granting broad admin rights.

Answer

Grant full administrator access and use audit logs to monitor unauthorized changes.

Answer

Assign the built-in 'Power User' role and rely on organizational policy guidelines.

Answer

Use Active Directory group mapping to restrict menu items via CSS injection.

Question 13

An administrator is planning the deployment of Broker VMs in a high-availability configuration. What is the recommended approach for handling Broker VM redundancy?

Accepted Answer

Deploy multiple Broker VMs in a clustered group or behind a network load balancer to ensure seamless failover and load distribution.. Broker VMs are the on-premises relay components that proxy traffic between Cortex XDR/XSIAM agents and the cloud tenant. Because agents must always reach a Broker, redundancy is achieved by deploying multiple Broker VMs as a cluster or placing them behind a network load balancer, which provides both failover and horizontal load distribution. This is the documented HA pattern for Broker VM deployments.

Answer

Install two instances of the Broker VM software on the exact same virtual machine instance.

Answer

Configure the Cortex XDR agents with a single hardcoded IP address and rely on BGP Anycast for failover.

Answer

Configure active-passive clustering using Microsoft Windows Failover Clustering inside the Broker VM guest OS.

Question 14

What is the recommended method for upgrading Broker VMs in a Cortex XSIAM deployment?

Accepted Answer

Initiating the upgrade directly from the Cortex XSIAM web management console under Broker VM settings.. Broker VMs in Cortex XSIAM are managed appliances, and upgrades are orchestrated centrally from the Cortex XSIAM web console under Broker VM settings. This ensures version compatibility, coordinated rollout, and proper integration with the XSIAM tenant. Manual OS-level commands or re-deploying OVAs bypass the supported upgrade path and can break the broker's communication with the platform.

Answer

Executing an 'apt-get upgrade' command via SSH on every Broker VM instance.

Answer

Manually downloading ISO images from the Palo Alto Networks Customer Support Portal and burning them to physical media.

Answer

Re-deploying a brand-new OVA template for every minor software release.

Question 15

A security engineer needs to create a custom automation script in Cortex XSIAM that will be used across multiple playbooks. The script must be able to call other integrations and process results. Which type of automation should the engineer create?

Accepted Answer

An automation script written in Python and added to the XSIAM automation library.. In XSIAM, reusable custom automation is created as Python scripts in the automation library. These scripts can be called from any playbook and can use demisto APIs to interact with integrations and process data. Playbook tasks, integration instances, and jobs are not standalone custom scripts, so they do not meet the requirement for cross-playbook reusable automation.

Answer

A playbook task that runs a built-in command.

Answer

A new integration instance configured with custom parameters.

Answer

A job that schedules the automation to run at intervals.