XSIAM-Engineer Practice Exam 4 — 20 Questions

Question 1

An administrator is configuring data ingestion in XSIAM and needs to ensure that logs from a custom internal application are correctly normalized. Which THREE components are essential parts of the XSIAM log ingestion and normalization pipeline? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

XSIAM Data Lake schema targets. Option E (Log Collector such as Broker VM or Agent) is essential because logs must first be received and forwarded into XSIAM; the Broker VM or endpoint agent provides the ingestion transport that delivers raw events to the platform. Option D (Parsing Rules / Normalization mapping) is correct because XSIAM uses parsing and normalization rules to extract fields from raw logs and map them to the common Cortex Data Model (CDM), which is exactly what is needed to correctly normalize a custom application's logs. Option C (XSIAM Data Lake schema targets) is correct because normalized events must be written into the Data Lake against defined schema targets, ensuring the parsed fields conform to the expected dataset structure for querying and detection. Option A is incorrect because physical network firewall bypass rules are a network-security concept unrelated to log parsing or normalization. Option B is incorrect because XSIAM does not require manually executed SQL queries for every incoming log packet; ingestion and normalization are handled automatically by collectors, parsers, and schema mapping.

Answer

Physical network firewall bypass rules

Answer

Manually executed SQL queries for every incoming log packet

Question 2

An administrator needs to update the Cortex XDR agent installation package across 5,000 endpoints without causing network saturation. Which feature should be utilized to manage this rollout effectively?

Accepted Answer

Configure an Agent Upgrade schedule and phased deployment profile within Endpoint Management > Agent Settings.. Agent software updates can be controlled using Agent Settings and deployment profiles where administrators can set distribution rules, throttling, and phased rollouts.

Answer

Manually push the MSI package via Active Directory Group Policy Objects using an external script.

Answer

Execute an XQL remediation action with the `upgrade_agent` command across all active sessions.

Answer

Set up a global Log Forwarding profile to broadcast the binary over syslog.

Question 3

An administrator is reviewing infrastructure readiness for deploying Cortex XSIAM engines on-premises. Which TWO prerequisites must be validated on the host infrastructure before engine installation? (Choose two)

Accepted Answer

Outbound TCP port 443 connectivity to the Cortex XSIAM cloud environment.. Option A is correct because Cortex XSIAM engines must maintain outbound TCP 443 connectivity to the Cortex XSIAM cloud environment for management, telemetry, and updates, so this must be validated before installation. Option B is correct because engine hosts require adequate CPU, RAM, and disk sizing to handle the anticipated query and parsing workloads; undersized resources will cause performance and ingestion problems. Option C is incorrect because no physical motherboard access or hardware crypto-accelerator card installation is a prerequisite for XSIAM engine deployment. Option D is incorrect because disabling all host firewalls and SELinux entirely is not a requirement and would be a poor security practice. Option E is incorrect because the host does not need to run an Active Directory Domain Controller role to install a Cortex XSIAM engine.

Answer

Direct physical access to the server motherboard to install a hardware crypto-accelerator card.

Answer

Disabling all host system firewalls and SELinux entirely across the corporate datacenter.

Answer

Active Directory Domain Controller role installed on the same host operating system.

Question 4

An administrator wants to ensure high availability and disaster recovery readiness for an XSIAM deployment relying on Broker VMs and cloud ingestion. Which THREE operational practices should be implemented? (Choose three)

Accepted Answer

Configure redundant Broker VM instances behind a load balancer for syslog ingestion.. Option A is correct because deploying redundant Broker VM instances behind a load balancer eliminates a single point of failure for syslog ingestion, allowing traffic to fail over if one Broker VM becomes unavailable, which directly supports high availability. Option D is correct because maintaining current documentation and configuration backups of custom parsers and integration settings ensures that, in a disaster recovery scenario, the XSIAM tenant can be rebuilt or migrated quickly without losing bespoke parsing logic or connector configuration. Option E is correct because regularly monitoring ingestion pipeline health dashboards allows administrators to detect dropped logs, stalled connectors, or degraded Broker VM performance early, enabling remediation before data gaps compromise detection and response. Option B is incorrect because storing raw logs exclusively on local Broker VM drives without cloud replication creates a single point of failure and violates disaster recovery readiness, since local disk loss would permanently destroy the logs. Option C is incorrect because disabling automated correlation rules to conserve bandwidth would severely degrade detection capabilities and does not constitute a valid high availability or disaster recovery practice.

Answer

Store all raw logs exclusively on local Broker VM hard drives without cloud replication.

Answer

Disable all automated correlation rules to conserve disaster recovery bandwidth.

Question 5

An administrator needs to verify whether a newly created Correlation Rule is actively evaluating incoming telemetry. Where should the administrator check the rule's operational status and recent execution statistics?

Accepted Answer

Check the Correlation Rules / Analytics page where rule status, hit counts, and last execution details are displayed.. Correlation rules and analytics rules display their operational status, hit counts, and execution metrics within the Analytics or Correlation Rules management page.

Answer

Inspect the Cortex XDR Agent installation directory for rule cache files.

Answer

Review the Windows Event Viewer on the primary Domain Controller.

Answer

Examine the Firewall Traffic logs for outgoing rule-check packets.

Question 6

An organization plans to ingest cloud audit logs from Amazon Web Services (AWS) into Cortex XSIAM using an automated collector architecture. Which native AWS service integration mechanism is typically recommended and supported by XSIAM for scalable log collection?

Accepted Answer

AWS S3 bucket ingestion leveraging SQS notifications and IAM role authentication. XSIAM's recommended scalable AWS log-collection architecture uses S3 bucket ingestion: AWS services write audit/cloud logs to an S3 bucket, S3 event notifications publish to an SQS queue, and XSIAM's collector polls the queue and pulls the objects using IAM role authentication. This decouples ingestion from the log source, scales horizontally, and avoids exposing credentials. It is the standard, supported pattern for high-volume AWS audit log ingestion.

Answer

Direct SNMP traps forwarded from AWS EC2 metadata service

Answer

Syslog forwarding from the AWS Root Account login page

Answer

Local Cortex XDR agent installation on AWS RDS database instances

Question 7

A security architect is planning a Cortex XSIAM deployment for a company with a single data center and no existing Cortex products. The company wants to forward syslog from 40 network devices to Cortex XSIAM. Which component is required to receive and forward these logs to the Cortex XSIAM tenant?

Accepted Answer

Broker VM deployed in the data center. The Broker VM is the dedicated on-premises log collection component for Cortex XSIAM. It receives syslog and other data from local sources and forwards it to the Cortex XSIAM tenant. Without a Broker VM, the network devices cannot send their syslog directly to the cloud tenant in a supported manner. Therefore, deploying a Broker VM in the data center is the correct planning step.

Answer

Cortex XSOAR engine installed on a management server

Answer

Cortex Data Lake instance provisioned in the data center

Answer

Cortex XDR agent installed on each network device

Question 8

An administrator needs to configure granular access control so that junior SOC analysts can view incidents and run XQL queries, but cannot modify tenant settings or install integrations. Where should the administrator configure these permissions?

Accepted Answer

Settings > Configurations > Access Control > Roles. In Cortex XSIAM, role-based access control (RBAC) is configured under Settings > Configurations > Access Control > Roles, where administrators define roles with granular permissions for incidents, XQL queries, integrations, and tenant settings. Assigning junior SOC analysts a role that grants view/query permissions but denies configuration and integration management enforces least privilege. This is the centralized location for all RBAC configuration in XSIAM.

Answer

Endpoints > Policy > Access Control List

Answer

Investigate > Analysts > Permissions Manager

Answer

Marketplace > Content Hub > User Security Pack

Question 9

An organization wants to integrate XSIAM user authentication with an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is Single Sign-On (SSO) configured?

Accepted Answer

Configure SAML settings under Settings > Access Management > SSO / Authentication.. SAML and SSO authentication settings for XSIAM console users are configured under Settings > Access Management > SSO / Authentication.

Answer

Modify the global agent installation package configuration.

Answer

Set up a Log Forwarding profile with SAML parameters.

Answer

Deploy a Broker VM with an Active Directory LDAP connector.

Question 10

A Cortex XSIAM engineer needs an automation to run every time a new alert is created, before any analyst reviews it, so that enrichment and severity scoring happen automatically. The engineer wants the automation to execute based on the alert's attributes without a human starting it. Which trigger mechanism should be used?

Accepted Answer

An alert-based automation rule that fires the playbook when a new alert matches defined conditions.. The scenario calls for automatic, condition-driven execution at alert creation with no human involvement. An alert-based automation rule evaluates each new alert against defined conditions and launches the playbook immediately, delivering enrichment and severity scoring before an analyst begins review.

Answer

A webhook receiver that the external alert source calls after pushing the alert into XSIAM.

Answer

A manual trigger that an analyst selects from the alert's action menu when they begin triage.

Answer

A scheduled job that runs the enrichment playbook every five minutes against all open alerts.

Question 11

An enterprise environment has strict network segmentation where log sources in a secure DMZ cannot communicate directly with the primary Broker VM located in the corporate network. How should an architect design the log collection architecture to feed data into Cortex XSIAM?

Accepted Answer

Deploy a secondary Broker VM within the DMZ configured to forward logs securely to the primary Broker VM or directly to the XSIAM tenant.. When DMZ log sources cannot communicate directly with the primary Broker VM in the corporate network due to segmentation, the correct design is to deploy a secondary Broker VM inside the DMZ. This DMZ Broker collects logs locally and forwards them securely (typically over TCP/TLS) to the primary Broker VM or directly to the XSIAM tenant, respecting the segmentation boundary while ensuring logs reach XSIAM.

Answer

Configure a port-mirroring session on the core firewall to duplicate all DMZ traffic to the Broker VM via local loopback.

Answer

Install the Cortex XDR agent on all network routers and switches in the DMZ to capture syslog locally.

Answer

Open bidirectional UDP port 514 across the internal corporate firewall to allow DMZ devices to stream raw syslog directly.

Question 12

What is the primary purpose of the Cortex XSIAM Content Hub?

Accepted Answer

To download and install pre-built integrations, parsers, dashboards, and content packs.. The Cortex XSIAM Content Hub is the marketplace/catalog where administrators browse, download, and install pre-built content such as integrations, log parsers, dashboards, playbooks, and content packs. It accelerates onboarding of new data sources and use cases without building everything from scratch. Content is versioned and can be updated as vendors release new packs.

Answer

To store encrypted backups of the Broker VM virtual hard disks.

Answer

To configure hardware load balancers for incoming syslog streams.

Answer

To manage endpoint operating system patches and third-party software updates.

Question 13

When establishing Role-Based Access Control (RBAC) in Cortex XSIAM, what is the purpose of assigning 'Folder' scopes to a custom role?

Accepted Answer

To limit visibility and management capabilities to specific subsets of endpoints and data sources organized within the folder hierarchy.. In Cortex XSIAM RBAC, Folder scopes define which portions of the endpoint and data-source hierarchy a custom role can see and manage. Assigning a folder scope to a role restricts that role's visibility and actions to the endpoints, datasets, and configurations contained within the selected folder and its children. This lets large SOCs delegate management of business units, regions, or subsidiaries without exposing the entire tenant.

Answer

To specify the directory path where agent installation logs are written on endpoints.

Answer

To restrict which log files are stored on the local Broker VM disk storage.

Answer

To determine which software packages can be downloaded from the Cortex XSIAM Marketplace.

Question 14

A Cortex XSIAM engineer is asked to ensure that when an incident is closed, a follow-up review task is automatically created for the SOC manager if the incident severity is Critical. Which mechanism should the engineer use to implement this automation?

Accepted Answer

Create a playbook with a conditional task that triggers on incident closure and checks the severity field.. Playbooks are the correct native automation mechanism because they can be triggered by incident closure events and include conditional logic on severity. A conditional task can then create a follow-up review task for the SOC manager only for Critical incidents. The other options either provide reporting, modify fields without creating tasks, or require external polling, all of which fail to deliver automatic task creation.

Answer

Configure a scheduled query in the Query Center that runs every hour and generates a report of closed Critical incidents.

Answer

Set up an incident field rule that changes the assignee to the SOC manager whenever severity is Critical.

Answer

Use the Cortex XSIAM API to poll for closed Critical incidents and create tasks via an external script.

Question 15

A deployment engineer is sizing a Broker VM for a large enterprise environment with 20,000 Cortex XDR agents and multiple log collection sources. During the initial deployment, the administrator notices high CPU and memory utilization on the single Broker VM. What is the recommended architectural remedy for this scenario?

Accepted Answer

Deploy an additional Broker VM and group them logically to distribute agent check-ins and log forwarding workloads.. When a single Broker VM is saturated by 20,000 agents plus multiple log sources, the correct architectural remedy is horizontal scaling: deploy additional Broker VMs and group them so agent check-ins and log forwarding distribute across nodes. This preserves supported sizing limits and provides redundancy. Vertical scaling beyond the documented maximum is not supported and does not solve the architectural bottleneck.

Answer

Configure the Cortex XDR agents to bypass the Broker VM and report directly to the Cortex XSIAM tenant cloud.

Answer

Upgrade the underlying hypervisor memory allocation for the single Broker VM beyond the maximum supported limit of 64GB.

Answer

Install a dedicated syslog forwarder daemon directly on every individual endpoint to reduce Broker VM processing overhead.

Question 16

An organization has multiple business units sharing a single Cortex XSIAM tenant. Leadership requires that security analysts in Business Unit A can only view alerts and endpoints associated with their specific department, while global administrators retain full visibility. How must the deployment engineer configure access control to achieve this?

Accepted Answer

Configure custom roles combined with folder-based access control, ensuring Business Unit A users are assigned to a role scoped exclusively to their designated folders.. The correct configuration is to use custom roles combined with folder-based access control, assigning Business Unit A users to a role scoped exclusively to their designated folders. Cortex XSIAM supports folder-based RBAC, which allows administrators to segment data visibility by business unit, ensuring analysts only see alerts and endpoints associated with their department. This satisfies the requirement for granular access control while allowing global administrators to retain full visibility.

Answer

Utilize XSOAR playbooks to automatically hide incidents belonging to Business Unit B from analysts' UI views.

Answer

Create separate Cortex XSIAM tenants for each business unit and interconnect them using cross-tenant log forwarding.

Answer

Modify the Broker VM configuration file to filter out logs from Business Unit B before sending them to the cloud.

Question 17

An administrator needs to check the status of scheduled background reports and export tasks in XSIAM. Where can this task history be reviewed?

Accepted Answer

Navigate to Reporting > Scheduled Reports to view job execution history and status.. Scheduled background reports and export tasks in Cortex XSIAM are managed and monitored under the Reporting section, specifically the Scheduled Reports interface. This area shows job execution history, status (success, failure, in-progress), timestamps, and any error details for each scheduled report or export job.

Answer

Inspect the raw storage blocks in the Data Lake Explorer.

Answer

Review the Incident Response playbook execution logs in Cortex XSOAR.

Answer

Check the Endpoint Management > Task Management tab.

Question 18

An organization requires that certain sensitive datasets ingested into Cortex XSIAM be automatically purged after a specific retention period shorter than the default tier. Where can an administrator configure custom retention policies for specific datasets?

Accepted Answer

Settings > Configurations > Data Management > Retentions. Cortex XSIAM exposes dataset-level retention configuration under Settings > Configurations > Data Management > Retentions, where administrators can define custom retention periods per dataset that override the default tier. This allows sensitive datasets to be purged sooner than the standard retention window without affecting other data.

Answer

Marketplace > Content Hub > Retention Pack

Answer

Endpoint Security > Profiles > Storage Settings

Answer

Investigate > XQL Search > Retention Command

Question 19

A security architect is planning the network requirements for a new Cortex XSIAM deployment. The organization uses an explicit forward proxy for all outbound internet traffic. Which configuration must be applied to the Broker VM to ensure it can reach the Cortex XSIAM tenant through the proxy?

Accepted Answer

Set the proxy address and port in the Broker VM network settings.. In environments that mandate an explicit forward proxy, the Broker VM must be configured with the proxy address and port so that its outbound connections to the Cortex XSIAM tenant are sent through the proxy. Static routes, PAC files on the tenant, and NAT reflection do not provide the required proxy configuration and would leave the Broker VM unable to communicate through the mandated path.

Answer

Enable NAT reflection on the perimeter firewall for Broker VM traffic.

Answer

Configure the Broker VM with a static route to the proxy and enable transparent interception.

Answer

Install a PAC file on the Cortex XSIAM tenant to redirect Broker VM traffic.

Question 20

An architect is planning the deployment of Cortex XSIAM in a large enterprise with multiple data centers. The architect must ensure high availability and scalability for log collection. Which TWO design considerations are critical for the Broker VM deployment? (Choose two.)

Accepted Answer

Ensure that each Broker VM has outbound connectivity to the Cortex XSIAM tenant.. For high availability and scalability, deploying multiple Broker VMs across data centers distributes the load and provides redundancy. Each Broker VM must also have outbound connectivity to the Cortex XSIAM tenant to forward logs. Together, these considerations ensure that log collection continues even if one site or Broker VM fails, and that the system can scale with increasing log volumes.

Answer

Use the same Broker VM to collect logs from all data centers over the WAN.

Answer

Deploy a single Broker VM with a load balancer to handle all log sources.

Answer

Configure each Broker VM with identical resource specifications to simplify management.