XSIAM-Engineer Practice Test 2 — 25 Questions

Question 1

When setting up administrative access to Cortex XSIAM, what is the best practice regarding the use of the initial built-in superuser account?

Accepted Answer

Use the superuser account for initial tenant configuration and setup of IdP federation, then transition to individual RBAC accounts.. The initial superuser account should be used sparingly, primarily for bootstrapping the tenant, configuring IdP/SAML, and creating role-assigned administrative accounts adhering to the principle of least privilege.

Answer

Use the built-in superuser account for all daily Tier-1 SOC alert triage and incident response workflows.

Answer

Disable the built-in superuser account immediately before performing any initial configuration tasks.

Answer

Share the superuser credentials among all SOC analysts to ensure shift-change continuity.

Question 2

An enterprise has multiple distinct business units, and the security operations team wants to ensure that analysts from Business Unit A can only investigate incidents assigned to their own unit, while global administrators can view everything. Which feature enables this multi-tenant or partitioned operational structure within a single XSIAM tenant?

Accepted Answer

Configure Security Domains / Data Partitioning to restrict incident visibility by organizational boundaries.. Security Domains (also called data partitioning) in XSIAM allow administrators to define organizational boundaries and assign users to domains, so analysts only see incidents, alerts, and assets within their domain. Global administrators can be granted access to all domains, satisfying the requirement for cross-unit visibility.

Answer

Deploy separate Broker VMs for each business unit without configuring user roles.

Answer

Create separate correlation rules with identical logic for each user.

Answer

Set up independent data retention periods for each analyst account.

Question 3

A Cortex XSIAM engineer deploys a new custom integration that calls an internal ticketing API. The integration works when tested from the engineer's workstation but fails inside XSIAM with connection errors, and the API requires a client certificate that the engineer generated locally. What should the engineer configure to let the integration present that certificate?

Accepted Answer

Upload the client certificate and its private key to the integration instance's certificate configuration.. The API enforces mutual TLS, so the integration must present a client certificate and its private key when connecting. Storing that material in the integration instance's certificate configuration makes it available to the runtime environment, which is why the call succeeds there while failing when the credential is only present on the workstation.

Answer

Paste the certificate's public portion into the integration's API key parameter field.

Answer

Copy the certificate file to the engineer's workstation trust store and re-run the test.

Answer

Add the API hostname to the integration's proxy exclusion list so the call bypasses the proxy.

Question 4

An administrator needs to configure automated incident assignment so that all incidents originating from network firewall logs are automatically routed to the Network Security SOC team. Which XSIAM feature accomplishes this?

Accepted Answer

Configure Incident Assignment Rules based on source data categories or alert types.. Incident assignment rules and automation routing rules can be configured in XSIAM to automatically assign incoming incidents based on data sources, severity, or categories.

Answer

Modify the global tenant retention policy to isolate firewall logs.

Answer

Enable Auto-Isolation profiles on all network gateways.

Answer

Set up a Log Forwarding profile targeting the Network Security team's email addresses.

Question 5

An engineer is deploying a Cortex XSIAM Broker VM on a VMware ESXi host. After importing the OVA, the engineer needs to assign a static IP address to the Broker VM. Which method should the engineer use to configure the network settings?

Accepted Answer

Use the console of the VM to run the network configuration wizard. The Broker VM's initial network configuration is performed through its local console using a text-based wizard. This wizard allows setting a static IP address, subnet mask, default gateway, and DNS servers. This method ensures the VM has network connectivity before any web-based management is possible. Editing VM files or using DHCP does not meet the static IP requirement.

Answer

Edit the VM's .vmx file to include the IP address

Answer

Use the Broker VM's web console to set the IP address

Answer

Configure a DHCP reservation on the DHCP server

Question 6

An administrator is deploying Cortex XSIAM agents on a fleet of corporate servers and needs to ensure proper installation parameters and operational readiness. Which TWO methods are valid for deploying or managing agent installations in XSIAM? (Choose two)

Accepted Answer

Configuring automated agent upgrade profiles and installation packages directly from the Cortex XSIAM management console.. Option A is correct because the Cortex XSIAM management console provides built-in agent management capabilities, including creating installation packages and configuring automated upgrade profiles that push new agent versions to endpoints without manual intervention. Option E is correct because XSIAM agents can be deployed through third-party software distribution tools such as Microsoft SCCM or Jamf, where the installer package is executed with an installation token parameter that authenticates the endpoint to the XSIAM tenant during registration. Option B is incorrect because telnet on port 23 is an insecure legacy remote-shell protocol and is not a supported mechanism for triggering any XSIAM agent installer service. Option C is incorrect because XSIAM agents are user-space endpoint software, not BIOS-embedded kernel drivers, and firmware flashing is not a deployment method. Option D is incorrect because XSIAM does not use a physical USB-delivered master cryptographic key; agent authentication relies on installation tokens and tenant-issued credentials.

Answer

Manually telnetting into port 23 of every server to trigger the built-in operating system agent installer service.

Answer

Flashing the server BIOS with a specialized firmware image that contains the embedded XSIAM kernel driver.

Answer

Physically connecting a USB thumb drive containing the master cryptographic key to each server's motherboard.

Question 7

An engineer is mapping a non-standard third-party security log source into the XSIAM Common Data Model (XDM). Which tool within XSIAM should be used to define custom parsing rules and field mappings?

Accepted Answer

Parsing Rules. Parsing Rules in XSIAM (Cortex XSIAM) are the mechanism for defining custom log parsing logic and mapping fields from non-standard sources into the XDM schema. Engineers use the parsing rules editor to write regex or pattern-based extraction and assign fields to XDM attributes so the data becomes queryable and usable by analytics.

Answer

Data Masking Policy Engine

Answer

Incident Classifier Builder

Answer

XSIAM Query Language (XQL) Sandbox

Question 8

An XSIAM administrator needs to ensure that a critical correlation rule triggers an alert only when a specific user account is involved in a security event. The rule currently triggers for all users. What is the most efficient way to modify the rule to meet this requirement?

Accepted Answer

Add a filter condition to the rule that checks if the username field matches the specific account.. The most efficient method is to add a filter condition within the correlation rule itself. This directly narrows the rule's scope to the specific user account, ensuring only relevant events trigger alerts. It is a native capability that improves detection accuracy without additional processing overhead.

Answer

Create a separate exception list containing the specific user account and apply it to the rule.

Answer

Modify the rule's schedule to run only when the specific user is logged in.

Answer

Use a playbook to filter alerts after they are generated by the rule.

Question 9

An analyst wants to quickly search across all ingested logs for a specific IP address without writing a complex query from scratch. Which feature in XSIAM provides a rapid, centralized search interface?

Accepted Answer

Use the XQL Search interface to execute quick queries across all datasets.. The Query Library or Query Center (XQL Search) provides an intuitive interface for searching across all ingested datasets using XQL.

Answer

Open the Endpoint Management > Search Host wizard.

Answer

Navigate to Settings > Configurations > Data Collection > Search.

Answer

Check the Incident Graph search filter.

Question 10

A security engineer has created a custom correlation rule in XSIAM that triggers an alert when a specific process is executed on an endpoint. After saving the rule, the engineer notices that the alert is not appearing in the incident queue, even though the process was executed. The rule is enabled and the process event is being ingested. What is the most likely cause?

Accepted Answer

The correlation rule requires a deployment step after saving to become active in the XSIAM environment.. After creating or editing a correlation rule in XSIAM, it must be deployed to become active. The deployment process compiles the rule and pushes it to the relevant engines. Without this step, the rule remains in a draft state and will not generate alerts, even if all conditions are met. Therefore, the missing deployment is the most likely cause of the missing alert.

Answer

The rule's severity is set to 'Informational', so alerts are suppressed by default.

Answer

The rule's time window is set to a past period, so it only evaluates historical data and not new events.

Answer

The process event is not being parsed correctly by the XSIAM data model, so the rule cannot evaluate it.

Question 11

An administrator wants to view a chronological list of recent software updates and content pack releases applied to the XSIAM tenant. Where can this release history be checked?

Accepted Answer

Check Content Management or Help > Release Notes to review recent updates and content pack releases.. Content updates, content pack releases, and platform version histories can be viewed under Content Management or Help > Release Notes.

Answer

Inspect the Broker VM Docker container logs via SSH.

Answer

Review the Incident Graph timeline.

Answer

Open the Endpoint Management > Agent Version log.

Question 12

An administrator is troubleshooting a custom BIOC (Behavioral Indicator of Compromise) rule that is not triggering alerts even though matching logs are present in the Cortex Data Lake. What is the most effective operational step to debug the rule?

Accepted Answer

Use the BIOC rule test / simulation feature in the Analytics section to validate the rule logic against historical event data.. BIOC rules can be tested and debugged using the rule testing and simulation features within the Analytics configuration menu to verify syntax and matching logic against sample events.

Answer

Change the tenant license key to an enterprise tier.

Answer

Reboot the XSIAM management cloud cluster master node via SSH.

Answer

Disable the default Cortex XDR agent prevention modules.

Question 13

An administrator is troubleshooting an API integration that has stopped collecting data. Which THREE diagnostic steps should be performed? (Choose three)

Accepted Answer

Verify if the API key, token, or credentials have expired or been revoked.. Option A is correct because API integrations commonly fail when the API key, OAuth token, or service account credentials have expired, been rotated, or been revoked, and verifying their validity is a fundamental first diagnostic step. Option D is correct because the integration poller must be able to reach the external API endpoint over the required ports; firewall rules, proxy settings, DNS resolution, or routing changes can silently block outbound HTTPS (TCP 443) traffic and halt data collection. Option E is correct because the XSIAM integration execution logs surface specific HTTP status codes (e.g., 401 Unauthorized, 403 Forbidden, 429 Too Many Requests) and error messages that pinpoint whether the failure is authentication, rate limiting, or endpoint-related. Option B is incorrect because reinstalling printer drivers on the administrator's laptop has no bearing on a server-side API integration and is unrelated to data collection. Option C is incorrect because formatting the Broker VM Docker container storage volumes would destroy the broker's configuration and data rather than diagnose the integration failure, and is not a valid troubleshooting step.

Answer

Reinstall the local printer drivers on the administrator's laptop.

Answer

Format the Broker VM Docker container storage volumes.

Question 14

During the sizing phase of a Cortex XSIAM deployment, an architect needs to estimate the required IOPS and storage retention footprint for endpoint telemetry. Which factor has the most direct impact on the raw ingestion volume calculation?

Accepted Answer

The frequency and depth of endpoint behavioral event generation and process telemetry. Raw ingestion volume for endpoint telemetry is driven primarily by how often endpoints generate behavioral events and process telemetry, and how deep that telemetry goes. More frequent and detailed event generation produces more data, which directly increases IOPS and storage retention requirements.

Answer

The configured frequency of Cortex XSOAR automated playbook execution

Answer

The total number of active directory user accounts synchronized via User-ID

Answer

The number of active firewall security rules enforced by Panorama

Question 15

A Cortex XSIAM engineer is designing the deployment for a multinational company with offices in North America, Europe, and Asia. Each region has its own security operations team, and the company wants to minimize cross-region latency for log ingestion while maintaining a single global tenant for centralized detection and response. Which deployment approach best meets these requirements?

Accepted Answer

Deploy Broker VMs in each region so logs are collected locally, while all regions report to a single Cortex XSIAM tenant for centralized analytics.. The optimal design for a global organization with a single tenant is to distribute log collection via regional Broker VMs while keeping analytics and management centralized in Cortex XSIAM. Local Broker VMs reduce latency and bandwidth for log ingestion, and the single tenant preserves unified detection, correlation, and response across all regions. This matches the platform's supported architecture for multinational deployments.

Answer

Deploy a single Broker VM in the North America data center and have all regions forward logs to it over the corporate WAN.

Answer

Deploy separate Cortex XSIAM tenants in each region and federate them using the Global Tenant feature.

Answer

Deploy Cortex XSIAM Engines in each region and configure them to synchronize detection rules peer-to-peer without a central tenant.

Question 16

An administrator is deploying the Broker VM via an OVA template on an ESXi hypervisor. After deployment, the administrator cannot access the Broker VM management web interface. Which initial configuration step must be performed via the hypervisor console to enable remote network access?

Accepted Answer

Log into the hypervisor console and configure the management IP address, netmask, gateway, and DNS settings via the initial setup CLI wizard.. When a Broker VM is deployed from an OVA on ESXi, it boots without a configured management IP, so the web UI is unreachable until the initial setup CLI wizard is run from the hypervisor console. That wizard prompts for management IP, netmask, gateway, and DNS, which are required for remote network access. Only after these values are set can the administrator reach the Broker VM management web interface.

Answer

Access the BIOS settings of the ESXi host to enable virtualization extensions for the Broker VM container engine.

Answer

Run the automated DHCP client script from an external USB drive plugged into the hypervisor.

Answer

Connect a physical serial cable to the ESXi host to provision the Broker VM routing tables.

Question 17

You are configuring a custom integration that requires sending an HTTP POST request to a legacy internal system. Which feature allows you to securely manage the connection credentials?

Accepted Answer

Use the 'Credentials' module in the integration instance settings to store and reference the secret.. The 'Credentials' module in the integration instance settings is designed to securely store and manage credentials such as usernames, passwords, API keys, and certificates. It allows the integration to reference these secrets without hardcoding them, and they are encrypted at rest. This is the recommended secure method for managing connection credentials.

Answer

Hardcode the credentials in the Python script of the custom integration.

Answer

Set up a global environment variable in the Data Collector configuration.

Answer

Add the credentials as plain text in the playbook input fields.

Question 18

An administrator wants to install a new integration pack to automate ticket creation in ServiceNow. Where in the XSIAM interface should the administrator navigate to find and install this pack?

Accepted Answer

Marketplace. In Cortex XSIAM, integration packs (including the ServiceNow pack for automated ticket creation) are installed from the Marketplace, accessible via the XSIAM navigation menu. The Marketplace is the centralized catalog for content packs, integrations, and playbooks. Navigating there lets the administrator browse, install, and configure the ServiceNow integration.

Answer

Administration > Updates > Packs

Answer

Incident Response > Automation > Store

Answer

Settings > Configurations > Data Sources

Question 19

When managing integrations in XSIAM, what is the purpose of the 'Test' button found in the integration instance configuration?

Accepted Answer

It verifies connectivity and credentials with the third-party service.. The test button validates the connectivity and authentication credentials against the target service.

Answer

It updates the integration plugin to the latest version.

Answer

It triggers a full synchronization of all historical data.

Answer

It pushes a sample alert to the third-party system.

Question 20

An engineer is tasked with reviewing the health and status of data collectors deployed across various remote sites. Within the Cortex XSIAM management console, which navigation path provides a consolidated view of all Broker VMs and their current operational status?

Accepted Answer

Settings > Configurations > Data Collection > Broker VM. In Cortex XSIAM, Broker VMs are managed under Settings > Configurations > Data Collection > Broker VM. This path provides a consolidated dashboard showing all deployed Broker VMs, their connectivity status, version, and health metrics. It is the central location for monitoring and troubleshooting data collection infrastructure.

Answer

Cloud Identity > Integrations > Status

Answer

Dashboards > Incident Management > Overview

Answer

Investigate > Endpoint Security > Collectors