XSIAM-Engineer Practice Test 20 — 15 Questions

Question 1

An XSIAM administrator notices that the Cortex XDR agent on a critical server is not reporting to the console. The administrator verifies that the server has network connectivity to the XSIAM tenant and that the agent service is running. Which log should the administrator check first on the endpoint to diagnose the communication issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cortex XDR agent log (traps.log). The Cortex XDR agent log (traps.log) is the primary source for diagnosing agent communication issues. It records connection attempts, errors, and heartbeats, providing direct insight into why the agent is not reporting. Other logs like Windows Event Log, firewall logs, or the tenant audit log may offer peripheral information but lack the specific agent-level details needed for efficient troubleshooting.

Answer

Network firewall logs

Answer

Windows Event Log (Application)

Answer

XSIAM tenant audit log

Question 2

A security engineer is preparing to install a Broker VM in a Demilitarized Zone (DMZ) to collect logs from internet-facing devices. The engineer needs to ensure the Broker VM can receive syslog data. Which configuration should be applied on the firewall?

Accepted Answer

Allow inbound UDP port 514 from the internet-facing devices to the Broker VM.. The Broker VM listens for syslog on UDP port 514 by default. To collect logs from internet-facing devices, the firewall must allow inbound UDP 514 from those devices to the Broker VM. The Broker VM then forwards the data to the Cortex XSIAM tenant over outbound TCP 443. Outbound rules, TCP 514, or inbound TCP 443 are not correct for this purpose. This configuration ensures that syslog data reaches the Broker VM securely.

Answer

Allow inbound TCP port 514 from the internet-facing devices to the Broker VM.

Answer

Allow inbound TCP port 443 from the internet-facing devices to the Broker VM.

Answer

Allow outbound UDP port 514 from the Broker VM to the internet-facing devices.

Question 3

An architect is planning a large Cortex XSIAM deployment where the Broker VM will collect high-volume syslog from dozens of network devices. The architect must size the Broker VM appropriately. Which resource is most critical to evaluate when determining the Broker VM's ability to handle sustained log ingestion without dropping data?

Accepted Answer

Disk space and I/O. When the Broker VM handles high-volume syslog, it must buffer incoming messages locally, so disk space and I/O are the most critical sizing factors. Adequate storage lets the appliance queue logs during outages and forward them reliably. GPU, monitor, and USB characteristics do not influence ingestion throughput or buffering capacity in this scenario.

Answer

GPU capacity

Answer

USB controller version

Answer

Monitor resolution

Question 4

A security architect is designing a Cortex XSIAM deployment for a company with a primary data center and a disaster recovery site. The company requires that the Cortex XSIAM tenant remains operational even if the primary data center becomes unavailable. Which deployment model should the architect choose to meet this requirement?

Accepted Answer

Deploy Cortex XSIAM as a cloud-hosted tenant, leveraging the built-in high availability and disaster recovery provided by the Cortex XSIAM cloud service.. Cortex XSIAM is a cloud-native platform where the tenant is hosted and managed by Palo Alto Networks. High availability and disaster recovery are inherent to the service, so customers do not need to design failover for the tenant itself. The correct choice recognizes that the cloud service provides the required resilience, while other options incorrectly place the tenant on-premises or assume unsupported multi-region failover.

Answer

Deploy Cortex XSIAM with Cortex XDR agents reporting to a Broker VM in the primary data center and a second Broker VM in the disaster recovery site, configured for high availability.

Answer

Deploy Cortex XSIAM with a single tenant in the primary data center and rely on manual failover to the disaster recovery site.

Answer

Deploy Cortex XSIAM with a multi-region tenant configuration, ensuring data replication and automatic failover between regions.

Question 5

An administrator needs to modify the display name and description of a custom data collector instance. Where can this configuration be edited?

Accepted Answer

Navigate to Settings > Configurations > Data Collection > Collectors, select the instance, and edit its configuration.. Data collector instances and their metadata can be edited under Settings > Configurations > Data Collection > Collectors.

Answer

Modify the global DNS zone file on the primary nameserver.

Answer

Open the Endpoint Management > Agent Details screen.

Answer

Run an XQL update command against the `collector_metadata` system table.

Question 6

Which TWO prerequisites must be validated before deploying a Cortex XSIAM Broker VM in a VMware ESXi environment? (Choose two)

Accepted Answer

Network access allowing outbound HTTPS communication to the Cortex XSIAM cloud tenant. Option A is correct because the Broker VM must reach the Cortex XSIAM cloud tenant over outbound HTTPS (TCP 443) to register, receive configuration, and forward collected data, so validating that network path is a prerequisite. Option B is correct because the Broker VM is deployed as a virtual appliance on ESXi and must be given adequate CPU, RAM, and disk resources per Palo Alto's sizing guidelines to support its log collection and forwarding workload. Option C is wrong because the Broker VM is a standalone appliance and does not require a Cortex XSOAR Server instance on the same VM. Option D is wrong because the Broker VM does not need a local physical Fibre Channel attachment; it uses standard virtualized storage and network connectivity. Option E is wrong because the Broker VM is not an Active Directory domain controller and does not host that role.

Answer

An installed Cortex XSOAR Server instance running on the same virtual machine

Answer

A local physical Fibre Channel storage attachment for high-speed raw log archiving

Answer

An active Microsoft Active Directory domain controller role installed directly on the Broker VM appliance

Question 7

An XSIAM administrator is troubleshooting an integration instance that is failing to connect to an external ticketing system. The administrator needs to verify whether the underlying API calls are failing due to invalid credentials or network timeouts. Where should the administrator review detailed debug logs for this specific integration instance?

Accepted Answer

The integration instance execution logs / War Room / Docker container logs available via troubleshooting settings. Integration instance execution logs — accessible through the War Room, the instance's troubleshooting settings, or the underlying Docker container logs — capture the actual API request/response payloads, HTTP status codes, and error messages emitted by the integration. This is the only place where authentication failures (401/403) versus network timeouts (connection refused, DNS failure, socket timeout) can be distinguished at the integration level.

Answer

The Data Stitching execution summary report

Answer

The Endpoint Agent audit trail under Cortex XDR > Agents

Answer

The Broker VM system log file (/var/log/broker/broker.log)

Question 8

An administrator wants to verify agent health and operational status across endpoints in Cortex XSIAM. Which TWO metrics or statuses can be viewed in the Endpoints inventory view? (Choose two)

Accepted Answer

Agent connection status (connected vs. disconnected) and software version. Option A is correct because the Endpoints inventory view in Cortex XSIAM displays each endpoint's agent connection status (connected vs. disconnected) along with the installed agent software version, which are core indicators of agent health and operational status. Option C is correct because the same inventory view shows the endpoint's operating system type and its assigned Endpoint Group membership, which help administrators confirm proper grouping and platform coverage. Options B, D, and E are incorrect because power grid frequency, room temperature/humidity, and personal browsing history or banking credentials are not telemetry fields exposed in the Endpoints inventory view; they are either environmental data outside the product's scope or sensitive user data unrelated to agent health.

Answer

The local power grid frequency supplying the endpoint's AC adapter

Answer

The physical room temperature and humidity of the workstation's office

Answer

The personal browsing history and banking credentials of the user

Question 9

An administrator is planning the initial onboarding of data sources into a new Cortex XSIAM tenant. When configuring a Broker VM to collect logs from on-premises sources, which TWO tasks are required to make the appliance operational and able to forward data to the tenant? (Choose two.)

Accepted Answer

Assign a static IP address or DHCP reservation to the Broker VM. To make a Broker VM operational, it must be registered with the tenant using an installation token, which establishes trust and enables configuration and data flow. It also needs stable network addressing so log sources can reach it and administrators can manage it. Inbound internet exposure, endpoint agents, and premature redundancy are not required onboarding steps.

Answer

Install the Cortex XDR agent on the Broker VM

Answer

Configure the Broker VM's local firewall to allow inbound TCP 443 from the internet

Answer

Deploy a second Broker VM for load balancing before any logs are collected

Question 10

An engineer is deploying Cortex XSIAM in a high-availability configuration with two Cortex XSIAM Engines behind a load balancer. During testing, the engineer notices that logs are being duplicated in the tenant. What is the most likely cause of this duplication?

Accepted Answer

The Broker VM is configured to send logs to both Engines simultaneously instead of to the load balancer.. In a high-availability setup with a load balancer, log sources should send data to the load balancer, which then distributes it to one Engine. If a Broker VM is configured to send logs directly to both Engines, each Engine will forward the same logs to the tenant, causing duplication. The engineer should reconfigure the Broker VM to send logs only to the load balancer's virtual IP address.

Answer

The Cortex XSIAM tenant is configured to ingest logs from multiple sources without deduplication enabled.

Answer

Both Engines are configured to listen on the same IP address and port, causing them to receive and process the same log stream.

Answer

The load balancer is configured to distribute traffic using a round-robin algorithm without session persistence.

Question 11

An administrator is troubleshooting network connectivity between a Broker VM and the Cortex XSIAM cloud backend. Which THREE diagnostic checks or network requirements must be verified? (Choose three)

Accepted Answer

Verification that DNS resolution correctly resolves the XSIAM tenant cloud FQDNs. Option B is correct because the Broker VM must resolve the Cortex XSIAM tenant cloud FQDNs (for example, the tenant-specific *.xdr.<region>.paloaltonetworks.com endpoints) so it can locate and connect to the correct backend services; failed or incorrect DNS resolution breaks connectivity even if routing and firewall rules are fine. Option D is correct because Broker VM-to-XSIAM communication uses outbound TLS over TCP 443 to the cloud backend, so all firewalls, proxies, and SSL inspection devices must allow that outbound traffic for telemetry and management channels to work. Option E is correct because TLS certificate validation depends on accurate system time; if NTP synchronization is skewed, the Broker VM may reject the XSIAM backend's certificates as expired or not-yet-valid, causing connection failures. Option A is not required because ICMP ping being disabled on enterprise routers does not prevent the Broker VM's TCP/TLS-based communication with the XSIAM cloud backend. Option C is not required because inbound TCP 22 from the public internet is not a documented requirement for Broker VM telemetry streaming; the Broker VM initiates outbound connections rather than accepting inbound SSH from the internet.

Answer

Verifying that local ICMP ping is disabled across all enterprise routers

Answer

Ensuring inbound TCP port 22 is open to the public internet for continuous remote telemetry streaming

Question 12

An administrator needs to ensure that all XSIAM audit logs are retained for 365 days to meet compliance requirements. Where should the administrator configure the retention period for audit logs?

Accepted Answer

XSIAM Console Settings. Retention policies for audit logs in XSIAM are configured in the XSIAM management console. This centralizes control and ensures that audit logs are retained for the required duration to meet compliance. The console provides options to set retention periods for different data types, including audit logs. Other components like the Broker VM or endpoint agents are involved in data collection or forwarding, not retention management.

Answer

Cortex Data Lake

Answer

Endpoint Agent

Answer

Broker VM

Question 13

An administrator is designing a custom incident triage workflow in XSIAM. Which THREE actions can be automated as part of incident management configuration? (Choose three)

Accepted Answer

Update incident status or severity automatically when specific enrichment data is received.. Option A is correct because XSIAM incident management configuration supports automated field updates, so enrichment results (for example, a verdict from an intelligence source) can drive changes to incident status or severity without manual intervention. Option D is correct because XSIAM lets you define incident categorization and assignment rules that route incidents to specific analyst groups or owners automatically based on fields such as category, type, or severity. Option E is correct because XSIAM integrates with Cortex XSOAR and can automatically trigger playbooks when an incident is created or when its severity matches a defined condition, which is a core part of automating triage. Option B is not appropriate because reformatting hard drives is a destructive, disproportionate action that is not a standard automated incident-management response and would cause data loss. Option C is not appropriate because physically cutting power to endpoints is not a cloud management command; while isolation can be automated, powering off hardware is not a supported or sensible triage automation.

Answer

Automatically reformat the hard drive of every employee in the company upon any alert.

Answer

Physically disconnect the power supply of compromised endpoints via cloud management commands.

Question 14

An XSIAM engineer is deploying Cortex XSIAM for an organization that will collect logs from remote branch offices with limited bandwidth and intermittent connectivity. The engineer must ensure that logs are not lost during connectivity outages and that local collection continues. Which TWO deployment considerations should the engineer apply? (Choose two.)

Accepted Answer

Size the Broker VM storage and memory to accommodate the expected log volume during the longest anticipated outage.. Broker VMs deployed at each branch office collect logs locally and buffer them when the connection to Cortex XSIAM is unavailable, preventing log loss during outages. Sizing Broker VM storage and memory for the longest anticipated outage ensures the buffer does not fill and drop data. Direct cloud sending, firewall compression, and a single centralized Broker do not provide local buffering or resilience for intermittent branch connectivity.

Answer

Configure all branch devices to send logs directly to the Cortex XSIAM cloud tenant over the internet without a local collector.

Answer

Use a single centralized Broker VM at the data center to collect logs from all branch offices over the WAN.

Answer

Enable compression and deduplication on the branch firewall to reduce log volume before forwarding to the Broker VM.

Question 15

An administrator is preparing to deploy Cortex XDR agents across a large macOS fleet using a Mobile Device Management (MDM) solution such as Jamf Pro. Which configuration profile component is critical to deploy alongside the agent installation package on modern macOS versions?

Accepted Answer

Transparency, Consent, and Control (TCC) profiles and System Extension pre-authorization configurations.. On modern macOS (Catalina 10.15+), third-party security agents rely on System Extensions rather than legacy kernel extensions, and macOS enforces Transparency, Consent, and Control (TCC) for access to protected resources like Full Disk Access and network content. Therefore the MDM profile must pre-authorize the system extension and grant the required TCC permissions (e.g., Full Disk Access) so the agent can function without manual user approval. Without these, the agent installs but is crippled by OS privacy controls.

Answer

Kernel extension bypass and legacy daemon authorization profiles.

Answer

SSH key exchange profiles and dynamic DNS registration certificates.

Answer

Active Directory domain join credentials and Kerberos ticket-granting tickets.