XSIAM-Engineer Practice Test 2 — 10 Questions

Question 1

An administrator needs to troubleshoot why a Broker VM is failing to ingest logs from an internal syslog source. Which diagnostic utility available on the Broker VM console should the administrator use first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access the Broker VM management console to check service status, connectivity test tools, and container logs.. Broker VMs include management interfaces and troubleshooting utilities (such as system status checks, service health monitoring, and log collection tools) accessible via its local administrative CLI or web interface.

Answer

Run the `xdrctl troubleshoot` command from any managed Windows endpoint agent console.

Answer

Reset the cloud tenant encryption keys under General Settings.

Answer

Open the XSIAM Incident Graph to view packet captures from the Broker VM IP.

Question 2

An administrator is deploying the Cortex XSIAM agent via Microsoft Intune and needs to ensure that kernel-level extensions on macOS endpoints do not block the installation. Which preliminary step must be completed?

Accepted Answer

Pre-approve system extensions and network filters using an MDM configuration profile. On macOS, Cortex XSIAM agent installation requires kernel-level system extensions and network filters, which macOS blocks unless they are pre-approved via an MDM configuration profile. When deploying through Microsoft Intune, the administrator must push a configuration profile that pre-approves the XSIAM system extension and network filter identifiers before the agent package is installed.

Answer

Convert all macOS file systems to legacy HFS+ format

Answer

Disable SIP (System Integrity Protection) on all target macOS endpoints

Answer

Install the XSIAM agent manually using an interactive terminal session

Question 3

An administrator wants to optimize XQL search performance across large log datasets. Which TWO best practices should be applied when writing queries? (Choose two)

Accepted Answer

Specify the dataset early in the query using the `dataset = ...` clause to narrow the search scope.. Option A is correct because specifying the dataset early with the `dataset = ...` clause restricts the XQL search to only the relevant data, reducing the volume of records scanned and improving query performance. Option E is correct because limiting the time range to the smallest necessary window minimizes the amount of historical data processed, which is a core optimization for large log datasets. Options B and C are incorrect because querying all historical data without time limits and avoiding filters both increase the data scanned and degrade performance. Option D is incorrect because raw regex parsing on unparsed datasets is expensive and less efficient than using parsed fields and structured filters.

Answer

Always query all historical datasets without time limits to ensure completeness.

Answer

Avoid using any filters and sort by random strings.

Answer

Execute all searches using raw regex parsing on unparsed datasets.

Question 4

An XSIAM engineer wants to test a new automation script that parses indicators from an external threat feed. The script should run automatically every hour. Which XSIAM feature should be used to schedule this script?

Accepted Answer

Automation Engine scheduled task. The Automation Engine scheduled task is designed to run scripts or playbooks on a recurring schedule using cron expressions. It provides a centralized way to manage and monitor scheduled executions, making it the correct choice for running a script every hour. Other features like playbook triggers or incident timers are not intended for standalone script scheduling.

Answer

War Room CLI command '!schedule' with a script name

Answer

Playbook trigger with 'scheduled' type

Answer

Incident type 'timer' with a script action

Question 5

When setting up a new Data Collector, you need to ensure high availability for log collection from a remote site. What is the best practice for deploying the collectors?

Accepted Answer

Install multiple collectors and assign them to the same Collector Group.. Grouping collectors allows for load balancing and fault tolerance within the XSIAM architecture.

Answer

Create separate ingestion instances for every collector.

Answer

Install one large collector and increase its CPU allocation.

Answer

Configure log forwarding to a single collector and use a load balancer at the network layer.

Question 6

An administrator needs to ensure that custom dashboards created by SOC analysts are backed up or migrated between environments. Which TWO options are available for content portability in XSIAM? (Choose two)

Accepted Answer

Export dashboard definitions to JSON format for migration across tenants.. Option C is correct because XSIAM allows dashboard definitions to be exported as JSON, which preserves the dashboard structure, widgets, and queries so they can be imported into another tenant or environment. Option D is correct because the Content Management feature supports packaging custom dashboards and widgets into a content pack, enabling controlled backup and migration of content between environments. Option A is incorrect because browser cookies only maintain a user's authenticated session and contain no portable dashboard definitions. Option B is incorrect because paper printouts are static and cannot be reimported or migrated as functional content. Option E is incorrect because manually retyping XQL queries is error-prone and does not constitute a supported content portability mechanism.

Answer

Copy the browser cookies of the analyst's session.

Answer

Print physical paper copies of the dashboard screens.

Answer

Manually retype every XQL query into a notepad file on a local workstation without export tools.

Question 7

An administrator is troubleshooting an issue where a Broker VM fails to download content updates from the Cortex XSIAM cloud. The Broker VM has outbound internet access via an enterprise web proxy. Where must the proxy settings be configured on the Broker VM?

Accepted Answer

In the Broker VM appliance management console configuration settings for proxy parameters.. Proxy settings for the Broker VM must be configured in the Broker VM appliance management console, which is the local management interface where network parameters including proxy host, port, and credentials are defined. This is the supported method for routing Broker VM content update traffic through an enterprise web proxy. The tenant UI does not push proxy configuration down to the Broker VM.

Answer

In the Cortex XSIAM tenant UI under Incident Response settings.

Answer

By editing the local firewall rules using iptables to forward port 80 to port 3128.

Answer

By modifying the Windows Registry on the underlying host operating system.

Question 8

An engineer is planning the initial deployment of a Cortex XSIAM tenant in a region where the corporate security policy requires all log data to remain within the country. The organization operates primarily in Germany and wants to minimize latency for data ingestion. Which deployment consideration should the engineer prioritize?

Accepted Answer

Deploy the tenant in the Europe (Frankfurt) region to meet data residency requirements and reduce ingestion latency.. Cortex XSIAM offers regional cloud tenants to address data residency and latency. For a German organization with strict in-country data storage policies, selecting the Europe (Frankfurt) region is the correct planning step. It ensures compliance and optimizes performance by keeping data close to the source. Other regions either violate policy or introduce unnecessary complexity.

Answer

Deploy the tenant in the Asia Pacific (Singapore) region and configure a local Broker VM in Germany to cache logs temporarily.

Answer

Deploy the tenant in the United States (Oregon) region and use a VPN to tunnel all log data back to Germany for storage.

Answer

Deploy the tenant in the Europe (Frankfurt) region but disable all cloud-based analytics to ensure data never leaves the local Broker VM.

Question 9

An administrator is troubleshooting a Broker VM that is showing a 'Disconnected' status in the Cortex XSIAM console. After verifying network routing and outbound HTTPS connectivity, the administrator checks the Broker VM system logs and discovers a system time synchronization failure. Why would a time sync failure cause disconnection?

Accepted Answer

The Cortex XSIAM cloud backend rejects TLS connections when time drift between the client and server exceeds allowable security thresholds.. TLS certificate validation depends on the client clock being within the certificate's validity period and within the server's acceptable drift tolerance. If the Broker VM's system time drifts too far, the TLS handshake to the XSIAM cloud fails, and the broker shows 'Disconnected' even though routing and port 443 are fine. Correcting NTP restores the handshake.

Answer

The Broker VM operating system automatically shuts down all network interfaces after 10 minutes of clock discrepancy.

Answer

Log collection collectors stop accepting UDP packets if the system time is set to UTC instead of local time.

Answer

The XSIAM licensing server revokes the Broker VM activation token if NTP is not reachable every 60 seconds.

Question 10

An architect is planning the installation of Cortex XSIAM in a hybrid environment where some log sources are in the cloud and some are on-premises. The architect wants to ensure that all log sources can be onboarded efficiently. Which statement about log source onboarding in Cortex XSIAM is correct?

Accepted Answer

Cloud-based log sources can send logs directly to the Cortex XSIAM tenant using the tenant's ingestion API, while on-premises sources require a Broker VM.. Cortex XSIAM supports direct ingestion from cloud sources via API and requires Broker VM for on-premises sources that cannot directly reach the tenant. This hybrid model provides flexibility and efficiency, allowing cloud sources to onboard quickly while on-premises sources use Broker VM for collection and forwarding.

Answer

All log sources, whether cloud or on-premises, must forward logs through a Broker VM to ensure data normalization.

Answer

On-premises log sources can send logs directly to the Cortex XSIAM tenant if they have outbound TCP 443 access, eliminating the need for a Broker VM.

Answer

Cloud log sources must be configured with a site-to-site VPN to the Cortex XSIAM tenant to ensure secure ingestion.