XSIAM-Engineer Practice Test 22 — 15 Questions

Question 1

Which TWO methods are supported in XSIAM for forwarding alerts or incident details to external SIEM or ticketing systems? (Choose two)

Accepted Answer

Using native SIEM forwarding integration packs (e.g., Splunk, ServiceNow). Option A is correct because XSIAM supports native integration packs (content packs) for external SIEM and ticketing platforms such as Splunk and ServiceNow, which are configured as integration instances and used in playbooks or automation rules to forward alert and incident data. Option D is correct because XSIAM allows outbound webhook integration instances, which send HTTP POST payloads containing alert or incident details to external endpoints, enabling custom forwarding to arbitrary SIEM or ticketing systems. Option B is incorrect because the Cortex XDR Agent performs endpoint telemetry collection and enforcement, not network traffic mirroring to external collectors. Option C is incorrect because XSIAM's cloud storage is not exposed for on-premises NFS mounting. Option E is incorrect because XSIAM does not permit direct SQL database queries from local clients; data access is via APIs, integrations, and the console.

Answer

Using the Cortex XDR Agent to mirror network traffic to external collectors

Answer

Directly mounting the XSIAM cloud storage bucket via NFS on-premises

Answer

Installing a local database client to query the multi-tenant XSIAM SQL database directly

Question 2

A security architect is planning the deployment of Cortex XSIAM for a large enterprise. The organization has strict data residency requirements and wants to minimize egress costs by keeping as much log data on-premises as possible. They will ingest high volumes of logs from various sources. Which component should the architect deploy to meet these requirements while ensuring efficient data ingestion and processing?

Accepted Answer

Broker VM. Broker VM is the on-premises component that collects, processes, and forwards logs to Cortex XSIAM. It enables local parsing and filtering, reducing cloud egress and supporting data residency by keeping raw logs on-premises. The other components either operate in the cloud or are endpoint-focused, and do not meet the on-premises log processing requirement.

Answer

Cortex Data Lake

Answer

Cortex XDR agent

Answer

Cortex XSIAM Engine

Question 3

An XSIAM engineer is configuring an integration instance for a third-party threat intelligence platform. The integration requires authentication and the engineer wants to ensure that the credentials are handled securely and that the instance can be used by playbooks. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Set the integration instance to 'Active' and test the connection to verify credentials.. To securely configure an integration instance, the engineer should store the API key as a password-type parameter and then activate and test the instance. These actions ensure the credential is encrypted and that the instance is functional for playbooks. Hardcoding, plain text files, and embedding keys in tasks are insecure and do not leverage XSIAM's credential management.

Answer

Store the API key in a plain text file on the XSIAM server for easy access.

Answer

Hardcode the API key in the integration's Python code to simplify distribution.

Answer

Embed the API key in each playbook task that calls the integration.

Question 4

An engineer is building a Cortex XSIAM automation that must call an external REST API. The API requires a static API key that must never appear in playbook exports, task inputs, or the war room. The key must also be usable by multiple playbooks and be rotatable without editing any playbook. Which mechanism should the engineer use to store and reference the API key?

Accepted Answer

Create a credential in the XSIAM Credentials store and reference it in the integration instance and playbook tasks by its credential name.. The XSIAM Credentials store is designed to hold secrets such as API keys, passwords, and tokens separately from content. Referencing a credential by name keeps the plaintext out of playbook definitions, task inputs, war room entries, and content exports, and it lets multiple playbooks and integration instances share one secret. Rotating the credential updates every reference at once, matching all constraints in the scenario.

Answer

Store the API key in a list named api_keys and read it with the GetList automation in each task that calls the API.

Answer

Hardcode the API key in the integration's custom Python code and protect the integration with role-based access control.

Answer

Define the API key as a playbook input and pass it from the incident or alert when the playbook is triggered.

Question 5

An XSIAM engineer is planning the network requirements for a new Cortex XSIAM deployment that includes Broker VMs in a restricted DMZ. The security team requires that the Broker VMs initiate all connections outbound and that no inbound firewall rules be opened. Which statement correctly describes the connectivity model the engineer should document?

Accepted Answer

Broker VMs initiate outbound connections to Cortex XSIAM over TCP 443 and do not require any inbound firewall rules.. Cortex XSIAM Broker VMs communicate with the cloud tenant by initiating outbound TLS connections on TCP 443 for registration, configuration retrieval, and data forwarding. No inbound firewall rules are required for the Broker VM itself. Internal syslog sources deliver logs to the Broker within the local network, so the documented model is outbound-only, which matches the DMZ security policy.

Answer

Broker VMs must be placed behind a reverse proxy that accepts inbound connections from Cortex XSIAM and forwards them to the Broker.

Answer

Broker VMs require inbound UDP 514 to receive syslog from internal sources, so an inbound rule must be opened.

Answer

Broker VMs require inbound TCP 443 from the Cortex XSIAM tenant to receive configuration updates.

Question 6

A Cortex XSIAM engineer is asked to reduce the volume of duplicate alerts generated when the same endpoint triggers the same behavioral BIOC repeatedly within a short window. The engineer wants to group these into a single alert while preserving the original event details for investigation. Which feature should be configured?

Accepted Answer

Alert grouping / deduplication settings on the BIOC or correlation rule. Grouping and deduplication settings on the detection or correlation rule are the intended mechanism for collapsing repeated hits from the same source into a single investigative alert while retaining the raw events. Severity changes, exclusions, and endpoint-wide suppression all either remove evidence or alter detection behavior, neither of which satisfies the need to preserve original event details for investigation.

Answer

Alert exclusion rules in the Cortex XSIAM alert configuration

Answer

Configuring a suppression rule that mutes the endpoint for 24 hours

Answer

Increasing the severity threshold of the behavioral BIOC

Question 7

A Cortex XSIAM engineer must configure a playbook so that a containment action only executes after an analyst has reviewed the alert and explicitly approved it, and so that the playbook resumes from that point once approval is granted. Which two components should be used to implement this? (Choose two.)

Accepted Answer

A manual task in the playbook that assigns the approval decision to a queue or analyst. An approval gate in a Cortex XSIAM playbook is built from a manual task that waits for a human decision plus a conditional task that evaluates that decision and branches to containment only on approval. The manual task suspends execution without ending it, and the conditional routes the resumed flow, together enforcing review-before-action.

Answer

A task that closes the alert immediately to release the playbook lock

Answer

A scheduled task set to poll the alert status every five minutes

Answer

An exclusion rule that prevents the playbook from running on the alert

Question 8

An XSIAM engineer is developing a custom integration that must process a large volume of events. The integration uses a Python script that makes an API call to an external service for each event. The engineer notices that the integration is slow and sometimes times out. The external API supports batch requests, allowing up to 100 events per request. What should the engineer do to improve performance?

Accepted Answer

Modify the integration to collect events into batches of up to 100 and send a single API request per batch.. Batching events into groups of up to 100 and sending a single API request per batch is the most effective way to improve performance because it reduces the number of API calls and leverages the external API's batch capability. This minimizes overhead and network latency, directly addressing the slowness and timeouts.

Answer

Increase the integration's timeout value in the integration settings to allow more time for each API call.

Answer

Enable the 'Long Running' option for the integration to allow it to process events asynchronously.

Answer

Use the 'concurrent.futures' module in Python to send multiple API requests in parallel for each event.

Question 9

A Cortex XSIAM engineer needs to give a newly hired tier-1 analyst the ability to view and triage alerts but not to modify playbooks, delete datasets, or change tenant-wide configurations. Which mechanism should the engineer use to enforce these boundaries?

Accepted Answer

Role-based access control with a scoped role assigned to the analyst's account. Role-based access control is the mechanism that maps users to granular permissions in Cortex XSIAM. Assigning a scoped role lets the engineer grant alert viewing and triage while denying playbook editing, dataset deletion, and configuration changes, which satisfies least privilege for a tier-1 analyst without architectural workarounds.

Answer

Disabling the analyst's API access and requiring interactive login only

Answer

Creating a separate tenant for the analyst and syncing alerts to it

Answer

Configuring an IP allowlist that restricts the analyst to the SOC subnet

Question 10

An architect is planning the deployment of Cortex XSIAM for an organization that uses a proxy for all outbound internet traffic. The Broker VM must be configured to use the proxy to reach the Cortex XSIAM tenant. Which configuration step is required during the Broker VM setup?

Accepted Answer

Configure the Broker VM to use a proxy by specifying the proxy server address and port in the Broker VM settings.. The Broker VM must be configured to use the proxy server to reach Cortex XSIAM. This is done by specifying the proxy address and port in the Broker VM settings. No tenant-side configuration or additional agents are needed. Bypassing the proxy with a VPN is not appropriate given the organization's policy.

Answer

Configure the Cortex XSIAM tenant to accept connections from the proxy IP address.

Answer

Set up a site-to-site VPN between the Broker VM and Cortex XSIAM to bypass the proxy.

Answer

Install a proxy agent on the Broker VM that intercepts all traffic.

Question 11

A Cortex XSIAM engineer must ensure that a specific high-impact containment playbook cannot be triggered by an automated alert source without oversight, but the same playbook should still be runnable on demand by senior analysts during an active incident. Which configuration best satisfies both requirements?

Accepted Answer

Mark the playbook as manual-only so it executes solely when an analyst launches it. Configuring the playbook as manual-only removes automatic alert-driven triggering while keeping it launchable by authorized analysts, which is the only option that both prevents unsupervised containment and preserves on-demand execution. Threshold changes, ownership limits, and in-run conditionals all leave automatic triggering intact or worsen it.

Answer

Add a conditional task that checks whether the alert came from an automated source

Answer

Restrict the playbook to a single analyst and leave its alert trigger enabled

Answer

Delete the playbook's trigger and recreate it with a lower severity threshold

Question 12

An administrator is planning the installation of a Broker VM in a network segment that has limited outbound internet access. The Broker VM must communicate with the Cortex XSIAM tenant. Which two components must be allowed through the firewall to ensure successful communication? (Choose two.)

Accepted Answer

TCP port 443 to the Cortex XSIAM tenant endpoint. The Broker VM initiates outbound connections to the Cortex XSIAM tenant over TCP 443. It also requires DNS resolution to find the tenant's endpoint. No inbound ports are needed; the Broker VM does not accept connections from the tenant. Thus, allowing TCP 443 and DNS are the two essential components for successful communication.

Answer

UDP port 514 for syslog forwarding from the Broker VM

Answer

TCP port 22 for SSH management from the Cortex XSIAM tenant

Answer

TCP port 4443 for the Broker VM to receive commands

Question 13

A Cortex XSIAM engineer is designing a deployment for a multinational corporation with data residency requirements. The company must ensure that logs from European Union sources are stored and processed within the EU, while logs from other regions can be processed in the US. Which XSIAM deployment model should the engineer choose?

Accepted Answer

Multiple XSIAM tenants, with one tenant deployed in the EU and another in the US, and logs directed to the appropriate tenant based on source region.. To meet data residency requirements, the engineer should deploy separate XSIAM tenants in each region. EU logs are directed to the EU tenant, ensuring storage and processing within the EU, while US logs go to the US tenant. This multi-tenant architecture provides compliance and can be integrated for centralized management if needed.

Answer

A single XSIAM tenant in the US with all logs routed through Broker VMs in each region.

Answer

A single XSIAM tenant in the EU with all logs processed there, and US logs replicated to a read-only instance in the US.

Answer

A single XSIAM tenant with data partitioning enabled to separate EU and US data within the same storage.

Question 14

A security administrator is planning the initial deployment of Cortex XSIAM and needs to ensure that the platform can ingest logs from a variety of sources. Which component is responsible for collecting and forwarding logs from on-premises sources to Cortex XSIAM?

Accepted Answer

Broker VM. The Broker VM is the on-premises component that collects logs from various sources and forwards them to Cortex XSIAM. The Cortex XDR agent is for endpoint data, Cortex Data Lake is the cloud backend, and there is no separate Collector Appliance. Thus, the Broker VM is the correct choice for log collection.

Answer

Cortex XDR agent

Answer

XSIAM Collector Appliance

Answer

Cortex Data Lake

Question 15

A Cortex XSIAM engineer notices that a set of custom correlation rules suddenly stopped generating alerts after a content update, even though the underlying telemetry is still arriving. The engineer wants to confirm whether the rules were modified, disabled, or overwritten by the update. Which source should be reviewed first?

Accepted Answer

The audit log capturing configuration and rule changes in the tenant. The audit log is the authoritative record of configuration and content changes, including rule edits, disabling, and overwrites, with timestamps and actors. Reviewing it lets the engineer correlate the content update with the rules going silent, confirming the cause before remediation, whereas agent, throughput, and query views cannot show rule-state changes.

Answer

The XQL query history for the affected datasets

Answer

The endpoint agent version report for the affected hosts

Answer

The network throughput dashboard for the Broker VM