XSIAM-Engineer Practice Exam 2 — 20 Questions

Question 1

A Cortex XSIAM administrator needs to grant a new SOC analyst the ability to view incidents and run playbooks but not modify system configurations. Which built-in role should the administrator assign?

Accepted Answer

SOC Analyst. The SOC Analyst role in Cortex XSIAM provides the necessary permissions to view incidents and run playbooks while preventing changes to system configurations. It embodies least privilege for a SOC analyst. Security Admin and Instance Admin are too permissive, and Read-Only Analyst lacks playbook execution rights, making SOC Analyst the correct choice.

Answer

Read-Only Analyst

Answer

Instance Admin

Answer

Security Admin

Question 2

You need to ensure that a specific integration uses a dedicated proxy server to communicate with the cloud. Where is this proxy configuration defined?

Accepted Answer

The Integration Instance configuration settings.. Proxy settings for individual integrations are managed within the specific Integration Instance configuration panel.

Answer

Data Management > Collector Group settings.

Answer

The XQL Query Builder Advanced tab.

Answer

Global Settings > Network > Proxy.

Question 3

An administrator needs to verify whether a newly deployed Broker VM is successfully forwarding logs to the Cortex XSIAM tenant. Which tool or menu within the XSIAM console allows the administrator to view real-time incoming log counts and ingestion rates?

Accepted Answer

Dashboards > Data Ingestion (or Settings > Data Collection). The Dashboards > Data Ingestion view (also accessible via Settings > Data Collection) is the dedicated monitoring surface in Cortex XSIAM for tracking log flow from Brokers and other collectors into the tenant. It displays real-time incoming log counts, ingestion rates (events per second), and per-source breakdowns, allowing an administrator to confirm that a newly deployed Broker VM is actively forwarding data. This is the only option that surfaces ingestion telemetry rather than query, identity, or alerting data.

Answer

XQL Search > Incident Explorer

Answer

Cloud Identity > Users > Audit Trail

Answer

Incidents > Active Alerts

Question 4

An automation engineer is building a custom Python integration in Cortex XSIAM that must retrieve a list of indicators from an external threat intelligence platform. The platform's API returns a JSON object with a nested array under the key 'data'. The engineer wants the integration command to output a clean list of indicators that can be used in subsequent playbook tasks. Which approach should the engineer take to parse the API response and return the indicators?

Accepted Answer

Use the return_outputs() function to return a human-readable table and a separate context entry containing the 'data' array extracted using Python's json module.. The correct approach is to use return_outputs() to provide a human-readable table and a context entry containing the extracted 'data' array. This allows playbook tasks to easily reference the list of indicators via context keys. Parsing the JSON within the integration ensures the command is self-contained and reusable, following Cortex XSIAM integration development best practices.

Answer

Use the demisto.executeCommand() function to call a built-in transformer that parses JSON and returns the 'data' array as a list of indicators.

Answer

Use the demisto.results() function to return the entire JSON response as a single entry, and then use a playbook task with a transformer to extract the 'data' array.

Answer

Use the demisto.createIndicators() function to directly create indicators from the API response, bypassing the need to return a list.

Question 5

Which THREE of the following are benefits of using the XDM (eXtendable Data Model) in Cortex XSIAM?

Accepted Answer

Improved performance and speed of XQL queries.. Option B is correct because XDM maps ingested data into a consistent, indexed schema, which lets XQL queries run against normalized fields and datasets more efficiently, improving query performance and speed. Option C is correct because XDM provides a common vocabulary and unified fields (for example, shared actor, causality, and alert fields) that make it possible to correlate alerts and events from many different vendors rather than treating each source's proprietary format separately. Option D is correct because the core purpose of the Cortex XSIAM eXtendable Data Model is to normalize disparate data sources—endpoint, network, cloud, identity, and third-party logs—into a single common schema so they can be searched and analyzed uniformly. Option A is not a benefit of XDM; API keys for third-party integrations are created through configuration/integration settings, not by the data model. Option E is also not a benefit of XDM; the model normalizes field structure and semantics, but it does not automatically translate all log content into English.

Answer

Automatic creation of API keys for third-party tools.

Answer

Automatic translation of all log content into English.

Question 6

When setting up administrative access to Cortex XSIAM, what is the best practice regarding the use of the initial built-in superuser account?

Accepted Answer

Use the superuser account for initial tenant configuration and setup of IdP federation, then transition to individual RBAC accounts.. The initial superuser account should be used sparingly, primarily for bootstrapping the tenant, configuring IdP/SAML, and creating role-assigned administrative accounts adhering to the principle of least privilege.

Answer

Use the built-in superuser account for all daily Tier-1 SOC alert triage and incident response workflows.

Answer

Disable the built-in superuser account immediately before performing any initial configuration tasks.

Answer

Share the superuser credentials among all SOC analysts to ensure shift-change continuity.

Question 7

An enterprise has multiple distinct business units, and the security operations team wants to ensure that analysts from Business Unit A can only investigate incidents assigned to their own unit, while global administrators can view everything. Which feature enables this multi-tenant or partitioned operational structure within a single XSIAM tenant?

Accepted Answer

Configure Security Domains / Data Partitioning to restrict incident visibility by organizational boundaries.. Security Domains (also called data partitioning) in XSIAM allow administrators to define organizational boundaries and assign users to domains, so analysts only see incidents, alerts, and assets within their domain. Global administrators can be granted access to all domains, satisfying the requirement for cross-unit visibility.

Answer

Deploy separate Broker VMs for each business unit without configuring user roles.

Answer

Create separate correlation rules with identical logic for each user.

Answer

Set up independent data retention periods for each analyst account.

Question 8

A Cortex XSIAM engineer deploys a new custom integration that calls an internal ticketing API. The integration works when tested from the engineer's workstation but fails inside XSIAM with connection errors, and the API requires a client certificate that the engineer generated locally. What should the engineer configure to let the integration present that certificate?

Accepted Answer

Upload the client certificate and its private key to the integration instance's certificate configuration.. The API enforces mutual TLS, so the integration must present a client certificate and its private key when connecting. Storing that material in the integration instance's certificate configuration makes it available to the runtime environment, which is why the call succeeds there while failing when the credential is only present on the workstation.

Answer

Paste the certificate's public portion into the integration's API key parameter field.

Answer

Copy the certificate file to the engineer's workstation trust store and re-run the test.

Answer

Add the API hostname to the integration's proxy exclusion list so the call bypasses the proxy.

Question 9

An administrator needs to configure automated incident assignment so that all incidents originating from network firewall logs are automatically routed to the Network Security SOC team. Which XSIAM feature accomplishes this?

Accepted Answer

Configure Incident Assignment Rules based on source data categories or alert types.. Incident assignment rules and automation routing rules can be configured in XSIAM to automatically assign incoming incidents based on data sources, severity, or categories.

Answer

Modify the global tenant retention policy to isolate firewall logs.

Answer

Enable Auto-Isolation profiles on all network gateways.

Answer

Set up a Log Forwarding profile targeting the Network Security team's email addresses.

Question 10

An engineer is deploying a Cortex XSIAM Broker VM on a VMware ESXi host. After importing the OVA, the engineer needs to assign a static IP address to the Broker VM. Which method should the engineer use to configure the network settings?

Accepted Answer

Use the console of the VM to run the network configuration wizard. The Broker VM's initial network configuration is performed through its local console using a text-based wizard. This wizard allows setting a static IP address, subnet mask, default gateway, and DNS servers. This method ensures the VM has network connectivity before any web-based management is possible. Editing VM files or using DHCP does not meet the static IP requirement.

Answer

Edit the VM's .vmx file to include the IP address

Answer

Use the Broker VM's web console to set the IP address

Answer

Configure a DHCP reservation on the DHCP server

Question 11

An administrator is deploying Cortex XSIAM agents on a fleet of corporate servers and needs to ensure proper installation parameters and operational readiness. Which TWO methods are valid for deploying or managing agent installations in XSIAM? (Choose two)

Accepted Answer

Configuring automated agent upgrade profiles and installation packages directly from the Cortex XSIAM management console.. Option A is correct because the Cortex XSIAM management console provides built-in agent management capabilities, including creating installation packages and configuring automated upgrade profiles that push new agent versions to endpoints without manual intervention. Option E is correct because XSIAM agents can be deployed through third-party software distribution tools such as Microsoft SCCM or Jamf, where the installer package is executed with an installation token parameter that authenticates the endpoint to the XSIAM tenant during registration. Option B is incorrect because telnet on port 23 is an insecure legacy remote-shell protocol and is not a supported mechanism for triggering any XSIAM agent installer service. Option C is incorrect because XSIAM agents are user-space endpoint software, not BIOS-embedded kernel drivers, and firmware flashing is not a deployment method. Option D is incorrect because XSIAM does not use a physical USB-delivered master cryptographic key; agent authentication relies on installation tokens and tenant-issued credentials.

Answer

Manually telnetting into port 23 of every server to trigger the built-in operating system agent installer service.

Answer

Flashing the server BIOS with a specialized firmware image that contains the embedded XSIAM kernel driver.

Answer

Physically connecting a USB thumb drive containing the master cryptographic key to each server's motherboard.

Question 12

An engineer is mapping a non-standard third-party security log source into the XSIAM Common Data Model (XDM). Which tool within XSIAM should be used to define custom parsing rules and field mappings?

Accepted Answer

Parsing Rules. Parsing Rules in XSIAM (Cortex XSIAM) are the mechanism for defining custom log parsing logic and mapping fields from non-standard sources into the XDM schema. Engineers use the parsing rules editor to write regex or pattern-based extraction and assign fields to XDM attributes so the data becomes queryable and usable by analytics.

Answer

Data Masking Policy Engine

Answer

Incident Classifier Builder

Answer

XSIAM Query Language (XQL) Sandbox

Question 13

An XSIAM administrator needs to ensure that a critical correlation rule triggers an alert only when a specific user account is involved in a security event. The rule currently triggers for all users. What is the most efficient way to modify the rule to meet this requirement?

Accepted Answer

Add a filter condition to the rule that checks if the username field matches the specific account.. The most efficient method is to add a filter condition within the correlation rule itself. This directly narrows the rule's scope to the specific user account, ensuring only relevant events trigger alerts. It is a native capability that improves detection accuracy without additional processing overhead.

Answer

Create a separate exception list containing the specific user account and apply it to the rule.

Answer

Modify the rule's schedule to run only when the specific user is logged in.

Answer

Use a playbook to filter alerts after they are generated by the rule.

Question 14

An analyst wants to quickly search across all ingested logs for a specific IP address without writing a complex query from scratch. Which feature in XSIAM provides a rapid, centralized search interface?

Accepted Answer

Use the XQL Search interface to execute quick queries across all datasets.. The Query Library or Query Center (XQL Search) provides an intuitive interface for searching across all ingested datasets using XQL.

Answer

Open the Endpoint Management > Search Host wizard.

Answer

Navigate to Settings > Configurations > Data Collection > Search.

Answer

Check the Incident Graph search filter.

Question 15

A security engineer has created a custom correlation rule in XSIAM that triggers an alert when a specific process is executed on an endpoint. After saving the rule, the engineer notices that the alert is not appearing in the incident queue, even though the process was executed. The rule is enabled and the process event is being ingested. What is the most likely cause?

Accepted Answer

The correlation rule requires a deployment step after saving to become active in the XSIAM environment.. After creating or editing a correlation rule in XSIAM, it must be deployed to become active. The deployment process compiles the rule and pushes it to the relevant engines. Without this step, the rule remains in a draft state and will not generate alerts, even if all conditions are met. Therefore, the missing deployment is the most likely cause of the missing alert.

Answer

The rule's severity is set to 'Informational', so alerts are suppressed by default.

Answer

The rule's time window is set to a past period, so it only evaluates historical data and not new events.

Answer

The process event is not being parsed correctly by the XSIAM data model, so the rule cannot evaluate it.

Question 16

An administrator wants to view a chronological list of recent software updates and content pack releases applied to the XSIAM tenant. Where can this release history be checked?

Accepted Answer

Check Content Management or Help > Release Notes to review recent updates and content pack releases.. Content updates, content pack releases, and platform version histories can be viewed under Content Management or Help > Release Notes.

Answer

Inspect the Broker VM Docker container logs via SSH.

Answer

Review the Incident Graph timeline.

Answer

Open the Endpoint Management > Agent Version log.

Question 17

An administrator is troubleshooting a custom BIOC (Behavioral Indicator of Compromise) rule that is not triggering alerts even though matching logs are present in the Cortex Data Lake. What is the most effective operational step to debug the rule?

Accepted Answer

Use the BIOC rule test / simulation feature in the Analytics section to validate the rule logic against historical event data.. BIOC rules can be tested and debugged using the rule testing and simulation features within the Analytics configuration menu to verify syntax and matching logic against sample events.

Answer

Change the tenant license key to an enterprise tier.

Answer

Reboot the XSIAM management cloud cluster master node via SSH.

Answer

Disable the default Cortex XDR agent prevention modules.

Question 18

An administrator is troubleshooting an API integration that has stopped collecting data. Which THREE diagnostic steps should be performed? (Choose three)

Accepted Answer

Verify if the API key, token, or credentials have expired or been revoked.. Option A is correct because API integrations commonly fail when the API key, OAuth token, or service account credentials have expired, been rotated, or been revoked, and verifying their validity is a fundamental first diagnostic step. Option D is correct because the integration poller must be able to reach the external API endpoint over the required ports; firewall rules, proxy settings, DNS resolution, or routing changes can silently block outbound HTTPS (TCP 443) traffic and halt data collection. Option E is correct because the XSIAM integration execution logs surface specific HTTP status codes (e.g., 401 Unauthorized, 403 Forbidden, 429 Too Many Requests) and error messages that pinpoint whether the failure is authentication, rate limiting, or endpoint-related. Option B is incorrect because reinstalling printer drivers on the administrator's laptop has no bearing on a server-side API integration and is unrelated to data collection. Option C is incorrect because formatting the Broker VM Docker container storage volumes would destroy the broker's configuration and data rather than diagnose the integration failure, and is not a valid troubleshooting step.

Answer

Reinstall the local printer drivers on the administrator's laptop.

Answer

Format the Broker VM Docker container storage volumes.

Question 19

During the sizing phase of a Cortex XSIAM deployment, an architect needs to estimate the required IOPS and storage retention footprint for endpoint telemetry. Which factor has the most direct impact on the raw ingestion volume calculation?

Accepted Answer

The frequency and depth of endpoint behavioral event generation and process telemetry. Raw ingestion volume for endpoint telemetry is driven primarily by how often endpoints generate behavioral events and process telemetry, and how deep that telemetry goes. More frequent and detailed event generation produces more data, which directly increases IOPS and storage retention requirements.

Answer

The configured frequency of Cortex XSOAR automated playbook execution

Answer

The total number of active directory user accounts synchronized via User-ID

Answer

The number of active firewall security rules enforced by Panorama

Question 20

A Cortex XSIAM engineer is designing the deployment for a multinational company with offices in North America, Europe, and Asia. Each region has its own security operations team, and the company wants to minimize cross-region latency for log ingestion while maintaining a single global tenant for centralized detection and response. Which deployment approach best meets these requirements?

Accepted Answer

Deploy Broker VMs in each region so logs are collected locally, while all regions report to a single Cortex XSIAM tenant for centralized analytics.. The optimal design for a global organization with a single tenant is to distribute log collection via regional Broker VMs while keeping analytics and management centralized in Cortex XSIAM. Local Broker VMs reduce latency and bandwidth for log ingestion, and the single tenant preserves unified detection, correlation, and response across all regions. This matches the platform's supported architecture for multinational deployments.

Answer

Deploy a single Broker VM in the North America data center and have all regions forward logs to it over the corporate WAN.

Answer

Deploy separate Cortex XSIAM tenants in each region and federate them using the Global Tenant feature.

Answer

Deploy Cortex XSIAM Engines in each region and configure them to synchronize detection rules peer-to-peer without a central tenant.