XSIAM-Engineer Practice Exam 3 — 20 Questions

Question 1

An administrator is deploying the Broker VM via an OVA template on an ESXi hypervisor. After deployment, the administrator cannot access the Broker VM management web interface. Which initial configuration step must be performed via the hypervisor console to enable remote network access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Log into the hypervisor console and configure the management IP address, netmask, gateway, and DNS settings via the initial setup CLI wizard.. When a Broker VM is deployed from an OVA on ESXi, it boots without a configured management IP, so the web UI is unreachable until the initial setup CLI wizard is run from the hypervisor console. That wizard prompts for management IP, netmask, gateway, and DNS, which are required for remote network access. Only after these values are set can the administrator reach the Broker VM management web interface.

Answer

Access the BIOS settings of the ESXi host to enable virtualization extensions for the Broker VM container engine.

Answer

Run the automated DHCP client script from an external USB drive plugged into the hypervisor.

Answer

Connect a physical serial cable to the ESXi host to provision the Broker VM routing tables.

Question 2

You are configuring a custom integration that requires sending an HTTP POST request to a legacy internal system. Which feature allows you to securely manage the connection credentials?

Accepted Answer

Use the 'Credentials' module in the integration instance settings to store and reference the secret.. The 'Credentials' module in the integration instance settings is designed to securely store and manage credentials such as usernames, passwords, API keys, and certificates. It allows the integration to reference these secrets without hardcoding them, and they are encrypted at rest. This is the recommended secure method for managing connection credentials.

Answer

Hardcode the credentials in the Python script of the custom integration.

Answer

Set up a global environment variable in the Data Collector configuration.

Answer

Add the credentials as plain text in the playbook input fields.

Question 3

An administrator wants to install a new integration pack to automate ticket creation in ServiceNow. Where in the XSIAM interface should the administrator navigate to find and install this pack?

Accepted Answer

Marketplace. In Cortex XSIAM, integration packs (including the ServiceNow pack for automated ticket creation) are installed from the Marketplace, accessible via the XSIAM navigation menu. The Marketplace is the centralized catalog for content packs, integrations, and playbooks. Navigating there lets the administrator browse, install, and configure the ServiceNow integration.

Answer

Administration > Updates > Packs

Answer

Incident Response > Automation > Store

Answer

Settings > Configurations > Data Sources

Question 4

When managing integrations in XSIAM, what is the purpose of the 'Test' button found in the integration instance configuration?

Accepted Answer

It verifies connectivity and credentials with the third-party service.. The test button validates the connectivity and authentication credentials against the target service.

Answer

It updates the integration plugin to the latest version.

Answer

It triggers a full synchronization of all historical data.

Answer

It pushes a sample alert to the third-party system.

Question 5

An engineer is tasked with reviewing the health and status of data collectors deployed across various remote sites. Within the Cortex XSIAM management console, which navigation path provides a consolidated view of all Broker VMs and their current operational status?

Accepted Answer

Settings > Configurations > Data Collection > Broker VM. In Cortex XSIAM, Broker VMs are managed under Settings > Configurations > Data Collection > Broker VM. This path provides a consolidated dashboard showing all deployed Broker VMs, their connectivity status, version, and health metrics. It is the central location for monitoring and troubleshooting data collection infrastructure.

Answer

Cloud Identity > Integrations > Status

Answer

Dashboards > Incident Management > Overview

Answer

Investigate > Endpoint Security > Collectors

Question 6

An administrator is configuring data collection settings and incident rules in Cortex XSIAM. Which TWO configuration steps are required to ensure proper data parsing and alert generation for a newly added third-party firewall log source? (Choose two)

Accepted Answer

Ensuring the corresponding vendor content pack is installed and active to correctly parse and normalize logs into the XSIAM schema. Option C is correct because Cortex XSIAM relies on vendor-specific content packs (parsers and data models) to correctly parse and normalize third-party firewall logs into the XSIAM schema, which is a prerequisite for meaningful alert generation. Option D is correct because logs must first be ingested through the proper collection mechanism — a Broker VM receiver (e.g., Syslog/CEF receiver) or an API integration instance — before parsing and alerting can occur. Option A is incorrect because recompiling the Cortex XDR agent kernel extension relates to endpoint agent functionality, not to ingesting or parsing third-party firewall logs. Option B is incorrect because flushing SOC analysts' browser caches has no effect on data collection, parsing, or incident rule evaluation. Option E is incorrect because the cloud data lake is a managed service; manually modifying its kernel source via SSH is neither supported nor required for log onboarding.

Answer

Recompiling the Cortex XDR agent kernel extension on all endpoints

Answer

Flushing the browser cache of all SOC analysts

Answer

Manually modifying the cloud data lake kernel source code via SSH

Question 7

An XSIAM engineer is preparing to onboard a new Cortex XSIAM tenant for a large enterprise. The customer wants to understand which component is responsible for parsing and normalizing raw logs into the Cortex XSIAM data model before they are stored and made searchable. Which component should the engineer identify?

Accepted Answer

The Cortex XSIAM cloud data pipeline parses and normalizes raw logs into the Cortex XSIAM data model.. Cortex XSIAM ingests raw logs into its cloud data pipeline, which parses and normalizes them into the Cortex XSIAM data model using built-in and custom parsers. The normalized data is then stored and searchable via XQL. Broker VMs collect and forward, agents collect endpoint telemetry, and Engines provide local processing, but the cloud pipeline is the component responsible for normalization.

Answer

The Broker VM performs parsing and normalization of raw logs before forwarding them to the tenant.

Answer

The Cortex XSIAM Engine on-premises parses and normalizes all logs before they are sent to the cloud tenant.

Answer

The Cortex XDR agent on each endpoint parses logs from all network devices and normalizes them before upload.

Question 8

A security administrator is planning the initial installation of Cortex XSIAM and needs to register a new Broker VM with the tenant. Which action must be performed first to allow the Broker VM to authenticate and establish a connection?

Accepted Answer

Generate a registration token in the Cortex XSIAM console. Generating a registration token in the Cortex XSIAM console is the prerequisite for Broker VM registration. The token is entered during the Broker VM setup to authenticate and bind it to the tenant. Other options are either not required for registration or describe incorrect steps, such as inbound firewall rules or agent installation.

Answer

Open inbound TCP 443 on the perimeter firewall

Answer

Configure a static IP address on the Broker VM

Answer

Install the Cortex XDR agent on the Broker VM

Question 9

An administrator is configuring log collection from a cloud storage bucket (e.g., AWS S3) into XSIAM. Which TWO configuration steps are required to establish this ingestion pipeline? (Choose two)

Accepted Answer

Specify the target bucket name and region in the XSIAM Data Collection configuration.. Cloud storage bucket ingestion requires setting up cloud integration credentials (IAM roles/keys) and configuring the data collection instance in XSIAM specifying the bucket details.

Answer

Deploy a physical hardware appliance in every AWS Availability Zone.

Answer

Configure the local Windows registry on the administrator workstation to route AWS traffic.

Answer

Manually install the Cortex XDR Agent on the AWS S3 root server.

Question 10

An administrator is investigating a data discrepancy where certain security logs ingested via a Broker VM do not match the raw source timestamps. Where can timezone and timestamp normalization settings be reviewed or adjusted?

Accepted Answer

Review and adjust parser extraction rules and timezone configurations in Settings > Configurations > Data Collection > Parsers.. Timestamp parsing and normalization rules can be reviewed and adjusted within custom parser definitions or ingestion settings in XSIAM.

Answer

Change the system clock on the local administrator workstation.

Answer

Reinstall the Cortex XDR Agent on all network switches.

Answer

Purge the entire Cortex Data Lake to reset cloud time servers.

Question 11

An administrator needs to deploy a custom content pack containing specialized dashboards, parsers, and rules across multiple child tenants in a multi-tenant XSIAM environment. Where should the content pack be managed and distributed?

Accepted Answer

Use Content Management / Marketplace to package and distribute custom content across tenants.. Content packs and shared content across multi-tenant or enterprise architectures can be managed and distributed via the Content Management / Marketplace features within XSIAM.

Answer

Deploy the files via USB drives to every Broker VM in the organization.

Answer

Modify the global DNS records to point to the new content repository.

Answer

Manually copy and paste JSON configuration files into each user's local browser cache.

Question 12

When planning an enterprise-wide rollout of Cortex XDR agents, administrators often utilize 'Upgrade Rings'. What is the primary purpose of an upgrade ring in Cortex XSIAM deployment strategy?

Accepted Answer

To stage and test new agent versions on pilot endpoint groups before broad production rollout. Upgrade rings allow administrators to test new agent versions on a small pilot group of endpoints before deploying them broadly across the organization.

Answer

To automatically rotate encryption keys for network proxies every 24 hours

Answer

To segment firewall log ingestion by geographic region

Answer

To load-balance syslog traffic across multiple Broker VMs

Question 13

An engineer is preparing the network prerequisites for a new Cortex XSIAM deployment. The security team must allow outbound connectivity from the Broker VM to the Cortex XSIAM cloud tenant. Which destination port must be permitted for the Broker VM to establish and maintain its connection?

Accepted Answer

TCP 443. The Broker VM maintains an outbound connection to the Cortex XSIAM tenant over TCP 443. This port carries registration, heartbeats, configuration, and forwarded log data, so it must be permitted through the perimeter firewall. SSH, syslog, and alternative HTTPS ports serve different purposes and do not provide the required tenant connectivity.

Answer

TCP 8443

Answer

TCP 22

Answer

UDP 514

Question 14

During the planning of a Cortex XSIAM deployment in an environment utilizing strict network segmentation, an administrator must ensure that communication between the Broker VM and local log sources (such as firewalls and SIEM forwarders) uses supported protocols. Which protocol combination is natively supported by Broker VM collectors for incoming log ingestion?

Accepted Answer

Syslog (TCP/UDP), Syslog-TLS, and HTTPS/API collection. Broker VMs support standard ingestion protocols including Syslog (TCP/UDP), Syslog-TLS, HTTP/HTTPS API collection, and secure file polling mechanisms.

Answer

Direct SMB file shares, RDP clipboard sharing, and NetBIOS name resolution

Answer

IPsec VPN encapsulation and GRE tunneling directly to the agent kernel

Answer

SNMP v1 read-only polling and Telnet terminal scraping

Question 15

An administrator is setting up a new Broker VM in an isolated network zone that requires all outbound HTTPS traffic to traverse an explicit corporate proxy server. Where must the proxy configuration be applied for the Broker VM to communicate with XSIAM?

Accepted Answer

Configure the proxy settings during the Broker VM setup or within its configuration parameters so it can reach the XSIAM cloud.. Broker VM proxy settings are configured during deployment or via the Broker VM configuration interface to ensure all cloud communications traverse the designated proxy.

Answer

Apply the proxy configuration via the Cortex XDR Agent installation profile.

Answer

Configure the proxy settings inside the Windows registry of the local administrator's workstation.

Answer

Modify the XQL search query headers to include proxy authentication tokens.

Question 16

An automation engineer is writing a custom Python script for an XSIAM automation task and needs to query XSIAM incident data. Which integration library or command standard must be used to execute commands against the Cortex XSOAR/XSIAM engine?

Accepted Answer

The demisto Python library. Custom Python scripts in XSIAM automation use the demisto class library to interact with the system context and execute commands.

Answer

The paloalto_xsiam SDK

Answer

The pan-os-python library

Answer

The requests module with direct tenant URL authentication

Question 17

An administrator is setting up an integration with a third-party threat intelligence platform using Cortex XSOAR capabilities embedded within XSIAM. The integration instance requires periodic polling to fetch newly published Indicators of Compromise (IoCs). Where should the administrator configure the fetch interval?

Accepted Answer

Inside the specific integration instance configuration settings. In Cortex XSOAR integration instances, the fetch interval determines how often the integration queries the external source for new data and is configured directly inside the integration instance configuration settings.

Answer

Inside the automated playbook task parameters

Answer

Via the Server Configuration (Settings > About > Server Configuration) global key-value pair

Answer

Within the Threat Intelligence module feeds mapping rules

Question 18

An administrator notices that logs from a specific firewall are not appearing in Cortex XSIAM. The firewall is configured to send syslog to the Broker VM. Where should the administrator check first to determine if the Broker VM is receiving the raw syslog packets?

Accepted Answer

The Broker VM collector status and troubleshooting logs within the Cortex XSIAM management console.. The Broker VM is the component that receives syslog from firewalls and forwards it to Cortex XSIAM. To verify whether raw syslog packets are arriving, the administrator should check the Broker VM collector status and troubleshooting logs in the XSIAM management console, which show ingestion health and errors. This directly answers whether the Broker VM is receiving the data before it is parsed or forwarded.

Answer

The XSIAM tenant billing dashboard to verify license usage.

Answer

The active firewall security policy rulebase.

Answer

The endpoint cytool diagnostic utility on managed servers.

Question 19

A security architect is designing the network flow for a Cortex XSIAM deployment that will ingest logs from on-premises firewalls. The firewalls cannot send logs directly to the internet. The architect plans to deploy a Broker VM in the DMZ. Which outbound connectivity requirement must be met for the Broker VM to forward logs to the Cortex XSIAM tenant?

Accepted Answer

The Broker VM must allow outbound TCP 443 to the tenant's specific fully qualified domain name (FQDN) or IP address range.. The Broker VM forwards logs to the Cortex XSIAM tenant over a secure HTTPS connection on TCP 443. During planning, firewall rules must allow outbound traffic from the Broker VM to the tenant's FQDN or published IP ranges. Other ports like UDP 514 are for inbound log reception, while TCP 22 and 8080 are not used for this communication.

Answer

The Broker VM must allow outbound TCP 8080 to the tenant's FQDN for proxy communication.

Answer

The Broker VM must allow outbound TCP 22 to the tenant's FQDN for secure shell (SSH) tunneling.

Answer

The Broker VM must allow outbound UDP 514 to the tenant's FQDN to forward syslog messages.

Question 20

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux servers. Which THREE tasks should be performed during the planning and deployment phase? (Choose three)

Accepted Answer

Establish phased rollout groups to monitor stability and prevent widespread issues.. Option B is correct because a phased rollout (pilot rings/groups) lets the administrator validate agent stability, performance, and compatibility on a small subset before broad deployment, limiting blast radius if a version causes issues. Option D is correct because existing endpoint security software (e.g., other AV/EDR, or OS-native tools like Windows Defender or SELinux) can conflict with the Cortex XDR agent's kernel-level components, so defining exclusions prevents installation failures, performance degradation, or false positives. Option E is correct because Cortex XDR provides separate agent installers and profiles per platform—Windows (.msi/.exe), macOS (.pkg/.dmg), and Linux (.rpm/.deb)—so OS-specific packages and profiles are required for a mixed environment. Option A is not needed because agent deployment is done via software distribution, GPO, SCCM, or scripts over the network, not serial consoles. Option C is wrong because disabling firewall rules on the XSIAM/Cortex cloud tenant is neither required nor advisable for agent deployment and would weaken security.

Answer

Manually connect a serial console cable to every server in the data center.

Answer

Disable all firewall rules on the XSIAM cloud tenant.