XSIAM-Engineer Practice Exam 3 — 20 Questions

Question 1

An administrator is troubleshooting an API integration that has stopped collecting data. Which THREE diagnostic steps should be performed? (Choose three)

Accepted Answer

Verify if the API key, token, or credentials have expired or been revoked.. Troubleshooting API integrations involves checking API credential validity, reviewing integration execution logs for error codes, and verifying network connectivity between the integration poller and the target service.

Answer

Reinstall the local printer drivers on the administrator's laptop.

Answer

Format the Broker VM Docker container storage volumes.

Question 2

An organization requires that all API access tokens used for programmatic interaction with XSIAM expire every 90 days. Where can API key expiration policies be configured?

Accepted Answer

Manage API key creation, expiration, and revocation under Settings > Integrations > API Keys.. API key lifecycles and generation policies are managed under Settings > Integrations > API Keys or Access Management.

Answer

Configure the Agent Software Upgrade schedule under Endpoint Management.

Answer

Adjust the Broker VM Docker container memory limit.

Answer

Modify the XQL query timeout threshold.

Question 3

An administrator needs to configure automated incident assignment so that all incidents originating from network firewall logs are automatically routed to the Network Security SOC team. Which XSIAM feature accomplishes this?

Accepted Answer

Configure Incident Assignment Rules based on source data categories or alert types.. Incident assignment rules and automation routing rules can be configured in XSIAM to automatically assign incoming incidents based on data sources, severity, or categories.

Answer

Modify the global tenant retention policy to isolate firewall logs.

Answer

Enable Auto-Isolation profiles on all network gateways.

Answer

Set up a Log Forwarding profile targeting the Network Security team's email addresses.

Question 4

An administrator wants to create a custom dashboard displaying key SOC metrics such as open incidents by severity and top alerted hosts. Which section of XSIAM should the administrator use to build this dashboard?

Accepted Answer

Navigate to Dashboards > Create Dashboard to add widgets based on XQL queries.. Custom dashboards can be created and managed under the Dashboards section of the XSIAM navigation menu using widgets powered by XQL queries.

Answer

Use the Report Builder to schedule weekly PDF summaries.

Answer

Go to Settings > Configurations > Data Collection > Dashboards.

Answer

Open the Incident Graph and click Export as Dashboard.

Question 5

An administrator is configuring log collection from a cloud storage bucket (e.g., AWS S3) into XSIAM. Which TWO configuration steps are required to establish this ingestion pipeline? (Choose two)

Accepted Answer

Specify the target bucket name and region in the XSIAM Data Collection configuration.. Cloud storage bucket ingestion requires setting up cloud integration credentials (IAM roles/keys) and configuring the data collection instance in XSIAM specifying the bucket details.

Answer

Deploy a physical hardware appliance in every AWS Availability Zone.

Answer

Configure the local Windows registry on the administrator workstation to route AWS traffic.

Answer

Manually install the Cortex XDR Agent on the AWS S3 root server.

Question 6

An administrator is reviewing the health of endpoint agents across the enterprise. Which TWO statuses or metrics can be monitored in the Endpoint Management view? (Choose two)

Accepted Answer

Installed agent software version and content version. Endpoint Management tracks agent connectivity status, software versions, operational module statuses, and content versions.

Answer

Local printer ink levels on managed workstations

Answer

Individual employee Wi-Fi password history

Answer

Personal email login credentials stored in browser caches

Question 7

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux servers. Which THREE tasks should be performed during the planning and deployment phase? (Choose three)

Accepted Answer

Establish phased rollout groups to monitor stability and prevent widespread issues.. Agent deployment planning includes creating OS-specific installation packages/profiles, verifying prerequisites and exclusion lists, and defining upgrade schedules.

Answer

Manually connect a serial console cable to every server in the data center.

Answer

Disable all firewall rules on the XSIAM cloud tenant.

Question 8

An administrator is troubleshooting an issue where an endpoint agent is unable to connect to the XSIAM cloud management console, and local logs indicate certificate pinning verification failure. What is the most likely cause?

Accepted Answer

An intermediate network security device or proxy is performing SSL decryption and re-signing traffic with an untrusted certificate.. Certificate pinning failures on endpoint agents usually indicate an SSL inspection appliance or proxy in the network is re-signing traffic with an untrusted root certificate, causing the agent to reject the connection.

Answer

The Cortex XDR agent version is too new for the cloud tenant and must be downgraded.

Answer

The local firewall is blocking UDP port 514 outbound from the endpoint.

Answer

The XSIAM tenant license has expired, causing all agents to enter a permanent lock state.

Question 9

An administrator is investigating a data discrepancy where certain security logs ingested via a Broker VM do not match the raw source timestamps. Where can timezone and timestamp normalization settings be reviewed or adjusted?

Accepted Answer

Review and adjust parser extraction rules and timezone configurations in Settings > Configurations > Data Collection > Parsers.. Timestamp parsing and normalization rules can be reviewed and adjusted within custom parser definitions or ingestion settings in XSIAM.

Answer

Change the system clock on the local administrator workstation.

Answer

Reinstall the Cortex XDR Agent on all network switches.

Answer

Purge the entire Cortex Data Lake to reset cloud time servers.

Question 10

An administrator notices high resource utilization on a Broker VM. Which THREE diagnostic steps or remediation actions should be taken? (Choose three)

Accepted Answer

Review ingestion volume per data source to identify noisy log senders overwhelming the collector.. Troubleshooting high Broker VM resource utilization involves checking container performance metrics, reviewing log ingestion rates for anomalies, and adjusting resource allocations or scaling out.

Answer

Modify the global tenant encryption keys to flush cache memory.

Answer

Reinstall the Cortex XDR agent on all Windows domain controllers.

Question 11

An administrator needs to modify the display name and description of a custom data collector instance. Where can this configuration be edited?

Accepted Answer

Navigate to Settings > Configurations > Data Collection > Collectors, select the instance, and edit its configuration.. Data collector instances and their metadata can be edited under Settings > Configurations > Data Collection > Collectors.

Answer

Modify the global DNS zone file on the primary nameserver.

Answer

Open the Endpoint Management > Agent Details screen.

Answer

Run an XQL update command against the `collector_metadata` system table.

Question 12

An administrator wants to view a chronological list of recent software updates and content pack releases applied to the XSIAM tenant. Where can this release history be checked?

Accepted Answer

Check Content Management or Help > Release Notes to review recent updates and content pack releases.. Content updates, content pack releases, and platform version histories can be viewed under Content Management or Help > Release Notes.

Answer

Inspect the Broker VM Docker container logs via SSH.

Answer

Review the Incident Graph timeline.

Answer

Open the Endpoint Management > Agent Version log.

Question 13

An administrator is troubleshooting a custom BIOC (Behavioral Indicator of Compromise) rule that is not triggering alerts even though matching logs are present in the Cortex Data Lake. What is the most effective operational step to debug the rule?

Accepted Answer

Use the BIOC rule test / simulation feature in the Analytics section to validate the rule logic against historical event data.. BIOC rules can be tested and debugged using the rule testing and simulation features within the Analytics configuration menu to verify syntax and matching logic against sample events.

Answer

Change the tenant license key to an enterprise tier.

Answer

Reboot the XSIAM management cloud cluster master node via SSH.

Answer

Disable the default Cortex XDR agent prevention modules.

Question 14

An administrator is configuring a new syslog ingestion source on a Broker VM. The syslog messages use TCP with TLS encryption (Reliable Syslog). Where must the corresponding TLS server certificates for the Broker VM be configured?

Accepted Answer

Configure the TLS server certificates and listener ports within the Broker VM configuration settings in the XSIAM console.. Broker VM TLS listener certificates for secure syslog ingestion are configured within the Broker VM configuration settings in the XSIAM management console.

Answer

Upload the certificates into the Cortex XDR Agent policy assigned to workstations.

Answer

Store the certificates in the browser's local storage cache.

Answer

Paste the certificates into the XQL query editor console.

Question 15

An organization has strict regulatory compliance mandates requiring all data ingested into Cortex XSIAM to be encrypted in transit and at rest using customer-managed encryption keys (CMEK). During the tenant initialization and planning phase, where must the administrator configure the CMEK parameters?

Accepted Answer

During the initial tenant provisioning workflow coordinated with Palo Alto Networks cloud operations and KMS integration. Customer-managed encryption keys (CMEK) integration for Cortex XSIAM is coordinated with Palo Alto Networks support and cloud provider key management services (such as AWS KMS or Azure Key Vault) during the initial tenant provisioning and onboarding workflow.

Answer

Directly inside the XSIAM web UI under Settings > Configurations > Security > Encryption

Answer

Within the Broker VM local hypervisor configuration console via CLI

Answer

Inside the Cortex XDR agent installation wizard command-line parameters

Question 16

An administrator needs to deploy a custom content pack containing specialized dashboards, parsers, and rules across multiple child tenants in a multi-tenant XSIAM environment. Where should the content pack be managed and distributed?

Accepted Answer

Use Content Management / Marketplace to package and distribute custom content across tenants.. Content packs and shared content across multi-tenant or enterprise architectures can be managed and distributed via the Content Management / Marketplace features within XSIAM.

Answer

Deploy the files via USB drives to every Broker VM in the organization.

Answer

Modify the global DNS records to point to the new content repository.

Answer

Manually copy and paste JSON configuration files into each user's local browser cache.

Question 17

An enterprise is undergoing a security audit and requires proof of XSIAM system resilience and data integrity. Which THREE operational artifacts or features should the administrator provide to the auditors? (Choose three)

Accepted Answer

Role-Based Access Control (RBAC) documentation and user role assignments.. Auditors typically review system audit trails, data retention and compliance reports, and RBAC configuration documentation to verify security and data integrity.

Answer

Personal social media profiles of the SOC analysts.

Answer

Local employee cafeteria menu schedules.

Question 18

An architect is designing an automated deployment script for rolling out Cortex XDR agents across thousands of Linux servers using an enterprise configuration management tool (e.g., Ansible). To ensure silent installation and proper initial group assignment, what must be included in the installation command parameters?

Accepted Answer

The silent installation flag along with the correct installation token (ID) and optional group parameters. Linux silent installations require specific command-line arguments, including the installation token (auth-code or customer ID) and optionally the initial group tag to ensure proper onboarding without user prompts.

Answer

A manual SSH key exchange with the Cortex XSIAM cloud backend

Answer

The interactive GUI installer switch combined with root password prompting

Answer

Pre-formatting the Linux root file system with XSIAM-specific journaling

Question 19

An organization wants to integrate XSIAM user authentication with an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is Single Sign-On (SSO) configured?

Accepted Answer

Configure SAML settings under Settings > Access Management > SSO / Authentication.. SAML and SSO authentication settings for XSIAM console users are configured under Settings > Access Management > SSO / Authentication.

Answer

Modify the global agent installation package configuration.

Answer

Set up a Log Forwarding profile with SAML parameters.

Answer

Deploy a Broker VM with an Active Directory LDAP connector.

Question 20

An administrator needs to add a new user account to XSIAM and assign appropriate privileges. Where is user account creation and management performed?

Accepted Answer

Navigate to Settings > Access Management > Users to add new user accounts and assign roles.. User account creation and privilege assignment are managed under Settings > Access Management > Users.

Answer

Check the Endpoint Management > Add Device wizard.

Answer

Go to License Management and click Allocate Seat.

Answer

Open the Incident Response dashboard and click New Analyst.