XSIAM-Engineer Practice Test 21 — 15 Questions

Question 1

An administrator notices that a particular correlation rule is generating a high volume of false positive incidents. What is the recommended operational step to refine the rule without disabling it entirely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Edit the correlation rule definition in Analytics / Correlation Rules to add exclusion filters for known benign entities.. The recommended operational step is to refine the correlation rule itself by adding exclusion filters (also called rule exceptions or whitelists) for known benign entities such as specific hostnames, users, or IP ranges. This preserves detection coverage for genuine threats while suppressing the false positives, and it is done in the Analytics / Correlation Rules section of XSIAM.

Answer

Purge the Cortex Data Lake table associated with the alert ID.

Answer

Delete the default data parser associated with the event source to block the noisy logs entirely.

Answer

Change the tenant status from Active to Evaluation mode to suppress notifications.

Question 2

When defining custom user roles and permissions in Cortex XSIAM, which TWO granular access controls can an administrator assign? (Choose two)

Accepted Answer

Dataset-level access restrictions and query scopes. Option C is correct because Cortex XSIAM role-based access control (RBAC) lets administrators scope what data an analyst can see and query, so dataset-level restrictions and query scopes are assignable granular controls. Option D is correct because XSIAM roles can include administrative permissions covering user management, integration/broker configuration, and tenant-level settings, which are exactly the kind of privileged actions RBAC governs. Options A, B, and E are incorrect because the physical location of a workstation, a local BIOS password, and firewall brand/model are endpoint or hardware attributes, not identity/permission constructs that XSIAM custom roles can assign.

Answer

The physical geographic location of the analyst's workstation hardware

Answer

The local BIOS password of the analyst's endpoint device

Answer

The brand and model of the corporate firewall protecting the analyst

Question 3

An administrator wants to customize the fields displayed in the Incident table view to better align with the SOC's operational workflow. How should this be accomplished?

Accepted Answer

Use the column customization settings within the Incident view to add, remove, or reorder displayed fields.. Administrators can customize column visibility, order, and layout directly within the Incident view UI using the column selection / customization options.

Answer

Reinstall the Cortex XDR management extension pack.

Answer

Rewrite the underlying XQL query for the default dashboard using API calls.

Answer

Modify the global database schema JSON file via the Admin CLI.

Question 4

An automation engineer wants a playbook to send a notification to a Slack channel only when a critical incident is created. The playbook is triggered by an incident creation event. Which XSIAM playbook task type should be used to conditionally execute the Slack notification task?

Accepted Answer

A conditional task that evaluates the incident severity field and routes to the Slack task only if severity equals 'Critical'.. The correct approach is to use a conditional task that evaluates the incident severity and only routes to the Slack notification when the severity is 'Critical'. This ensures the notification is sent exclusively for critical incidents, aligning with the requirement to notify only on critical incident creation. Other task types either require manual intervention, lack conditional logic, or do not enforce the severity check.

Answer

A manual task that requires an analyst to approve sending the Slack notification before it executes.

Answer

A script task that runs a Python script to directly post to Slack without evaluating any conditions.

Answer

A data collection task that gathers incident fields and then automatically executes all subsequent tasks regardless of severity.

Question 5

An engineer is planning the initial deployment of Cortex XSIAM for a large enterprise that uses an on-premises data center with strict change control. The security team requires that no inbound firewall ports be opened to the internet. Which deployment component must be deployed to allow outbound-only communication from the data center to the Cortex XSIAM tenant?

Accepted Answer

Broker VM. The Broker VM is the on-premises component that establishes outbound-only connections to the Cortex XSIAM tenant, enabling log and data forwarding without inbound firewall rules. The Cortex XDR agent is endpoint software, Cortex Data Lake is a cloud service, and no component named XSIAM Collector exists in this architecture, so none of them fulfills the outbound-relay requirement.

Answer

Cortex Data Lake

Answer

XSIAM Collector

Answer

Cortex XDR agent

Question 6

An engineer is planning to deploy Cortex XDR agents to endpoints as part of a Cortex XSIAM rollout. The organization has a strict change management policy that requires a phased rollout with the ability to roll back if issues arise. Which Cortex XSIAM feature should the engineer use to control the agent version and rollout pace?

Accepted Answer

Agent Upgrade Rings. Agent Upgrade Rings are the designated feature for phased agent rollouts. They let you assign endpoints to rings and schedule upgrades per ring, enabling a controlled deployment with rollback capabilities. Other features like policy groups or HA are unrelated to agent version management.

Answer

Endpoint Policy Groups

Answer

Tenant Data Retention Settings

Answer

Broker VM High Availability

Question 7

A security engineer is preparing to deploy Cortex XSIAM in a new environment. The engineer needs to ensure that the Cortex XSIAM tenant can receive data from the Broker VM. Which outbound connectivity requirement must be met from the Broker VM?

Accepted Answer

The Broker VM must be able to reach the Cortex XSIAM tenant over outbound TCP 443.. The Broker VM establishes outbound connections to the Cortex XSIAM tenant over TCP 443. This design avoids the need for inbound firewall rules and ensures that data is transmitted securely. Planning must verify that the Broker VM's network segment allows outbound traffic to the tenant's cloud endpoints. Without this connectivity, log forwarding will fail.

Answer

The Broker VM must allow inbound TCP 443 from the Cortex XSIAM tenant.

Answer

The Broker VM must have a public IP address and allow inbound UDP 514.

Answer

The Broker VM must connect to the tenant using outbound TCP 22 for secure shell.

Question 8

An administrator needs to review all administrative actions (such as user logins, configuration changes, and role modifications) performed within the XSIAM tenant over the last 30 days. Where is this audit data located?

Accepted Answer

Navigate to Settings > Audit Trail to review administrator activities and configuration changes.. Cortex XSIAM records all administrative activity — logins, configuration changes, role modifications, and API actions — in the Audit Trail, accessible under Settings. This is the centralized location for compliance and forensic review of who did what and when within the tenant.

Answer

Open the Endpoint Management > Audit Log view.

Answer

Check the Incident Management dashboard filtered by user severity.

Answer

Run an XQL query on the `host_boot` dataset.

Question 9

An engineer is designing an XSIAM playbook that must delete a malicious file from an endpoint and then verify the deletion succeeded before closing the incident. The vendor's endpoint integration exposes separate 'isolate', 'delete file', and 'list files' commands. Which design approach best ensures the verification step reflects the true post-deletion state?

Accepted Answer

Run the delete command, then call the list files command and branch on whether the target path still appears. Verification of a remediation action must come from reading the system state after the action, not from the action's own acknowledgement. Deleting the file and then listing files to confirm the path is gone implements a read-after-write check. Immediate closure, isolation-based assumptions, and duplicate deletes all fail to provide evidence that the malicious file was actually removed.

Answer

Run the isolate command first, then assume deletion succeeded because the endpoint is contained

Answer

Run the delete command and immediately close the incident if the command returns success

Answer

Run the delete command twice in parallel to increase the probability of success

Question 10

An XSIAM engineer needs to ensure that a specific set of indicators of compromise (IOCs) is automatically blocked on all endpoints managed by XSIAM. The IOCs are provided in a CSV file and are updated daily. What is the most efficient and maintainable way to achieve this?

Accepted Answer

Use the IOC Lists feature to import the CSV file and configure a policy to block matching IOCs on endpoints.. The IOC Lists feature in XSIAM is purpose-built for managing sets of indicators and enforcing them across endpoints. By importing the CSV into an IOC list and attaching a blocking policy, the engineer ensures that all endpoints receive and enforce the IOCs. This approach supports regular updates by simply refreshing the list, making it the most efficient and maintainable solution.

Answer

Configure a threat intelligence feed integration that automatically retrieves and blocks the IOCs.

Answer

Create a new correlation rule that triggers on the IOCs and configure a response action to block them.

Answer

Write a script that parses the CSV and uses the XSIAM API to add each IOC to the endpoint blocklist individually.

Question 11

A Cortex XSIAM administrator is configuring a new external syslog source to send logs to a Broker VM. The administrator wants to ensure that the logs are parsed correctly and mapped to the appropriate Cortex XSIAM data model. Which step must be taken after configuring the syslog source on the Broker VM?

Accepted Answer

Create a new data source in Cortex XSIAM and select the appropriate log type and parser.. Creating a data source in Cortex XSIAM is essential after setting up the syslog source on the Broker VM. The data source specifies the log type and parser, which enables the platform to normalize and map the logs to its data model. Without this, logs may be collected but remain unparsed and unusable for analytics. Other options do not achieve the required parsing and mapping.

Answer

Enable auto-discovery of log sources in the Broker VM settings.

Answer

Install a Cortex XDR agent on the syslog source to forward logs directly to the tenant.

Answer

Configure a correlation rule to parse the syslog messages.

Question 12

An administrator is planning the deployment of Cortex XSIAM for an organization with strict data residency requirements. The organization must ensure that all log data remains within a specific geographic region. Which deployment option should the administrator choose?

Accepted Answer

Cortex XSIAM SaaS hosted in the required region. Cortex XSIAM is a cloud-delivered service, and data residency is achieved by selecting a SaaS region that aligns with the required geography. The administrator should choose the appropriate region during tenant provisioning. On-premises or private cloud deployments of the full platform are not available, and hybrid models still rely on the cloud tenant for storage and processing.

Answer

Cortex XSIAM on-premises deployment

Answer

Cortex XSIAM hybrid deployment with local data storage

Answer

Cortex XSIAM deployed on a private cloud within the organization's data center

Question 13

When planning log collection and ingestion strategies in Cortex XSIAM, an architect can ingest data from multiple sources. Which THREE log sources are natively supported for direct or Broker VM-mediated ingestion? (Choose three)

Accepted Answer

Cloud provider audit logs (such as AWS CloudTrail and Azure Activity Logs). Option C is correct because Cortex XSIAM natively supports ingesting cloud audit and activity logs, including AWS CloudTrail and Azure Activity Logs, through built-in cloud integrations and data sources. Option D is correct because standard Syslog streams from third-party security devices and network switches are a core supported ingestion method, typically collected directly or via a Broker VM acting as a Syslog receiver. Option E is correct because Palo Alto Networks Next-Generation Firewalls running PAN-OS are first-party sources whose logs (traffic, threat, URL, etc.) are natively ingested into Cortex XSIAM directly or through Broker VM log forwarding. Option A does not belong because analog audio streams from telephone switchboards are not a supported log source type in XSIAM. Option B does not belong because SNMP v1 printer ink level broadcasts are not a natively supported log ingestion source for Cortex XSIAM.

Answer

Direct analog audio streams from corporate telephone switchboards

Answer

Local printer ink level status notifications via SNMP v1 broadcast

Question 14

A Cortex XSIAM engineer writes a custom Python automation that must return a structured result to the playbook so a later conditional task can branch on a specific field. The engineer wants the returned data to be accessible as a named output rather than only as raw command output. Which action should the script take to expose the value?

Accepted Answer

Return the value as a key in the script's structured output object so it is exposed as a named context entry.. To let a later conditional task branch on a specific field, the custom automation must surface that value as a named entry in the playbook context. Returning it inside the script's structured output object accomplishes this, giving downstream tasks a stable, addressable name to reference.

Answer

Write the value into a global variable from within the script for the conditional task to read.

Answer

Print the value to standard output and let the playbook parse the raw text of the command result.

Answer

Append the value to the incident's custom fields so the conditional task can read it from the incident object.

Question 15

A Cortex XSIAM administrator needs to ensure that audit logs for all user actions are retained for 365 days to meet compliance requirements. The tenant is currently configured with the default retention period. Where should the administrator modify this setting?

Accepted Answer

Settings > Configurations > Data Retention > Audit Logs. Audit log retention in Cortex XSIAM is configured under Settings > Configurations > Data Retention > Audit Logs. This setting controls how long audit records are kept in the tenant. Modifying it to 365 days satisfies the compliance requirement without altering retention for other data types. Other paths either do not exist, affect all data unnecessarily, or relate to forwarding rather than local retention.

Answer

Settings > System > Audit Logs > Retention Policy

Answer

Settings > Configurations > Data Retention > All Data

Answer

Settings > Integrations > Audit Log Forwarding > Retention