XSIAM-Engineer Practice Test 4 — 25 Questions

Question 1

An organization has multiple business units sharing a single Cortex XSIAM tenant. Leadership requires that security analysts in Business Unit A can only view alerts and endpoints associated with their specific department, while global administrators retain full visibility. How must the deployment engineer configure access control to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure custom roles combined with folder-based access control, ensuring Business Unit A users are assigned to a role scoped exclusively to their designated folders.. The correct configuration is to use custom roles combined with folder-based access control, assigning Business Unit A users to a role scoped exclusively to their designated folders. Cortex XSIAM supports folder-based RBAC, which allows administrators to segment data visibility by business unit, ensuring analysts only see alerts and endpoints associated with their department. This satisfies the requirement for granular access control while allowing global administrators to retain full visibility.

Answer

Utilize XSOAR playbooks to automatically hide incidents belonging to Business Unit B from analysts' UI views.

Answer

Create separate Cortex XSIAM tenants for each business unit and interconnect them using cross-tenant log forwarding.

Answer

Modify the Broker VM configuration file to filter out logs from Business Unit B before sending them to the cloud.

Question 2

An administrator needs to check the status of scheduled background reports and export tasks in XSIAM. Where can this task history be reviewed?

Accepted Answer

Navigate to Reporting > Scheduled Reports to view job execution history and status.. Scheduled background reports and export tasks in Cortex XSIAM are managed and monitored under the Reporting section, specifically the Scheduled Reports interface. This area shows job execution history, status (success, failure, in-progress), timestamps, and any error details for each scheduled report or export job.

Answer

Inspect the raw storage blocks in the Data Lake Explorer.

Answer

Review the Incident Response playbook execution logs in Cortex XSOAR.

Answer

Check the Endpoint Management > Task Management tab.

Question 3

An organization requires that certain sensitive datasets ingested into Cortex XSIAM be automatically purged after a specific retention period shorter than the default tier. Where can an administrator configure custom retention policies for specific datasets?

Accepted Answer

Settings > Configurations > Data Management > Retentions. Cortex XSIAM exposes dataset-level retention configuration under Settings > Configurations > Data Management > Retentions, where administrators can define custom retention periods per dataset that override the default tier. This allows sensitive datasets to be purged sooner than the standard retention window without affecting other data.

Answer

Marketplace > Content Hub > Retention Pack

Answer

Endpoint Security > Profiles > Storage Settings

Answer

Investigate > XQL Search > Retention Command

Question 4

A security architect is planning the network requirements for a new Cortex XSIAM deployment. The organization uses an explicit forward proxy for all outbound internet traffic. Which configuration must be applied to the Broker VM to ensure it can reach the Cortex XSIAM tenant through the proxy?

Accepted Answer

Set the proxy address and port in the Broker VM network settings.. In environments that mandate an explicit forward proxy, the Broker VM must be configured with the proxy address and port so that its outbound connections to the Cortex XSIAM tenant are sent through the proxy. Static routes, PAC files on the tenant, and NAT reflection do not provide the required proxy configuration and would leave the Broker VM unable to communicate through the mandated path.

Answer

Enable NAT reflection on the perimeter firewall for Broker VM traffic.

Answer

Configure the Broker VM with a static route to the proxy and enable transparent interception.

Answer

Install a PAC file on the Cortex XSIAM tenant to redirect Broker VM traffic.

Question 5

An architect is planning the deployment of Cortex XSIAM in a large enterprise with multiple data centers. The architect must ensure high availability and scalability for log collection. Which TWO design considerations are critical for the Broker VM deployment? (Choose two.)

Accepted Answer

Ensure that each Broker VM has outbound connectivity to the Cortex XSIAM tenant.. For high availability and scalability, deploying multiple Broker VMs across data centers distributes the load and provides redundancy. Each Broker VM must also have outbound connectivity to the Cortex XSIAM tenant to forward logs. Together, these considerations ensure that log collection continues even if one site or Broker VM fails, and that the system can scale with increasing log volumes.

Answer

Use the same Broker VM to collect logs from all data centers over the WAN.

Answer

Deploy a single Broker VM with a load balancer to handle all log sources.

Answer

Configure each Broker VM with identical resource specifications to simplify management.

Question 6

An administrator is planning the deployment of Broker VMs to support data ingestion across multiple isolated network segments. Which TWO considerations are critical for proper Broker VM architecture and sizing? (Choose two)

Accepted Answer

The expected Events Per Second (EPS) volume traversing the specific Broker VM instance. Option C is correct because Broker VM sizing is driven primarily by the Events Per Second (EPS) throughput that will traverse each individual Broker instance; CPU, RAM, and disk must be provisioned based on that per-Broker ingestion load, so the expected EPS volume is a critical architectural consideration. Option E is correct because each Broker VM must be able to reach the XSIAM tenant URL outbound over HTTPS on TCP port 443 to register, receive configuration, and forward collected data to the cloud tenant; without this outbound connectivity the Broker cannot function. Option A is incorrect because Brokers collect data via syslog, agent, or API-based ingestion and do not require local administrative write access to network switches. Option B is incorrect because Broker VMs are not designed to host a local XSOAR database with 50 TB of persistence; data is forwarded to the XSIAM tenant rather than stored locally at that scale. Option D is incorrect because deploying a Windows Active Directory domain controller on each Broker VM is unrelated to Broker architecture and would add unnecessary complexity and attack surface.

Answer

Ensuring the Broker VM has local administrative write access to all ingested network switches

Answer

Configuring local XSOAR database persistence exceeding 50 Terabytes on the Broker VM

Answer

Deploying a separate Windows Active Directory domain controller on each Broker VM

Question 7

A security administrator is planning the deployment of Cortex XSIAM and needs to integrate it with an existing SIEM for data enrichment. The administrator wants to query external threat intelligence sources from within Cortex XSIAM. Which component should be used to enable this integration?

Accepted Answer

Cortex XSIAM integrations. Cortex XSIAM integrations provide pre-built connectors to external systems, including threat intelligence providers. They allow the platform to query external sources and enrich data automatically. This is the intended method for integrating with existing security tools and services. The other components serve different roles, such as log collection or automation execution, and do not provide the required integration framework.

Answer

Broker VM

Answer

Cortex XSIAM API

Answer

Cortex XSOAR engine

Question 8

An automation playbook fails because the JSON response from an API call contains nested objects that are not being parsed correctly. What is the best way to handle this in a playbook?

Accepted Answer

Use transformation steps in the playbook to parse nested JSON fields.. Using the 'Extract' or 'JSON transform' steps within a playbook allows for the parsing of nested structures for downstream processing.

Answer

Change the integration to use XML instead of JSON.

Answer

Increase the timeout setting for the integration.

Answer

Delete the integration and reinstall it.

Question 9

An engineer is planning the deployment of Cortex XSIAM in a hybrid environment where on-premises logs need to be ingested. The engineer must ensure that the on-premises components can communicate with the Cortex XSIAM tenant in the cloud. Which of the following is a required component for this communication?

Accepted Answer

Cortex XSIAM Broker VM deployed on-premises.. The Cortex XSIAM Broker VM is specifically designed to bridge on-premises environments with the cloud tenant. It collects logs from local sources, buffers them, and forwards them securely over outbound HTTPS to Cortex XSIAM. This architecture avoids inbound firewall rules and simplifies deployment. Other components like Engines or XDR agents serve different purposes and are not the primary communication bridge for on-premises log ingestion.

Answer

Direct VPN tunnel between on-premises network and Cortex XSIAM cloud.

Answer

Cortex XSIAM Engine deployed on-premises.

Answer

Cortex XDR agent installed on all endpoints.

Question 10

An architect is designing an enterprise deployment strategy for Cortex XSIAM in an environment with strict change management windows. Which THREE planning considerations are critical for a successful rollout? (Choose three)

Accepted Answer

Defining data ingestion scopes and filtering rules to manage storage quotas and costs. Option A is correct because defining data ingestion scopes and filtering rules directly controls how much telemetry is parsed, indexed, and retained in Cortex XSIAM, which governs storage quota consumption and licensing costs in an enterprise rollout. Option B is correct because establishing pilot testing groups (upgrade rings) lets the organization validate agent versions and content pack updates in a limited cohort before broad deployment, which is essential when changes must fit strict change management windows. Option D is correct because XSIAM agents and brokers must reach Cortex XSIAM service endpoints over outbound TCP 443, so firewall and proxy egress rules must be updated to allow the required XSIAM FQDNs or endpoints will fail to register and report. Option C is not a legitimate planning consideration because rewriting local OS kernels is neither required nor supported by Cortex XSIAM and is unrelated to deployment strategy. Option E is also incorrect because replacing physical network switches with fiber-optic hubs is not a XSIAM deployment requirement and hubs are obsolete, collision-prone devices that would degrade rather than enable the rollout.

Answer

Requiring all end users to manually rewrite their local operating system kernels

Answer

Replacing all physical network switches with fiber-optic hubs

Question 11

An XSIAM administrator is configuring automated log ingestion filtering to drop high-volume, low-value informational events before they consume license quota. Which feature enables this capability?

Accepted Answer

Ingestion Filtering Rules. Log filtering and dropping rules can be configured using ingestion filtering policies in XSIAM data collection settings.

Answer

XQL Query Scheduled Rules

Answer

Incident Enrichment Playbooks

Answer

Data Masking Policies

Question 12

When planning a Cortex XSIAM deployment, what is the primary purpose of conducting an infrastructure readiness assessment?

Accepted Answer

To evaluate network bandwidth, firewall rules, log volumes, and endpoint system requirements prior to deployment.. The infrastructure readiness assessment evaluates whether the existing environment can support Cortex XSIAM deployment by examining network bandwidth, firewall rules, log volumes, and endpoint system requirements. This assessment identifies gaps that must be addressed before deployment to ensure successful integration and performance. It is a planning exercise, not an automated provisioning or pricing activity.

Answer

To automatically generate XSOAR playbooks based on existing network architecture diagrams.

Answer

To determine the exact pricing discount negotiated with Palo Alto Networks sales representatives.

Answer

To provision cloud storage buckets in AWS or Azure for long-term data archiving.

Question 13

An administrator is reviewing the health of endpoint agents across the enterprise. Which TWO statuses or metrics can be monitored in the Endpoint Management view? (Choose two)

Accepted Answer

Installed agent software version and content version. Option A is correct because the Endpoint Management view exposes the installed agent software version and the content version (e.g., signature/definition updates) for each managed endpoint, which are core health metrics for verifying agents are current. Option C is correct because agent connection status (Connected / Disconnected) is a primary health indicator shown in Endpoint Management, allowing administrators to identify endpoints that have lost communication with the management server. Option B is incorrect because printer ink levels are hardware consumable data unrelated to endpoint agent health and are not reported by the agent management console. Option D is incorrect because Wi-Fi password history is user credential data that is neither collected nor displayed for endpoint health monitoring. Option E is incorrect because browser-stored personal email credentials are private user data outside the scope of agent status and content version monitoring.

Answer

Local printer ink levels on managed workstations

Answer

Individual employee Wi-Fi password history

Answer

Personal email login credentials stored in browser caches

Question 14

Which THREE parameters can be configured when setting up a log ingestion parsing rule in XSIAM? (Choose three)

Accepted Answer

Target vendor and product mapping. Option C is correct because a parsing rule must identify the log source by mapping it to the target vendor and product, which determines how the incoming raw logs are recognized and parsed. Option D is correct because the core of a parsing rule is defining XDM (Extended Data Model) field mappings and transformations that convert raw log fields into normalized XSIAM schema fields. Option E is correct because parsing rules support filtering conditions that restrict the rule to specific log subsets, so only matching events are parsed by that rule. Option A is not correct because Broker VM hardware CPU allocation is an infrastructure/appliance sizing setting, not a parameter of a log parsing rule. Option B is not correct because automatic remediation playbook execution is configured in playbooks or automation rules, not within the log ingestion parsing rule itself.

Answer

Broker VM hardware CPU allocation limits

Answer

Automatic remediation playbook execution ID

Question 15

An enterprise is deploying Cortex XSIAM in an isolated environment that requires all outgoing traffic to traverse an explicit forward proxy requiring authentication (Kerberos/NTLM). How must the Broker VM be configured to support this network topology?

Accepted Answer

Configure the proxy settings during the initial Broker VM network setup or configuration menu, providing necessary proxy credentials. Broker VM supports explicit forward proxy configuration with authentication (including Kerberos/NTLM) during the initial network setup or via the Broker VM configuration menu. The administrator supplies the proxy address, port, and credentials so all outbound Broker traffic to the XSIAM cloud traverses the authenticated proxy.

Answer

Convert all syslog streams to ICMP tunneling packets to bypass proxy authentication

Answer

Install an external NTLM relay daemon directly onto the XSIAM cloud backend

Answer

Broker VMs do not support forward proxies and require a direct internet connection at all times

Question 16

When planning the installation of Cortex XSIAM content packs from the Marketplace, what prerequisite check must an administrator perform to ensure successful installation and utilization?

Accepted Answer

Verify that the administrator account has Content Administrator or equivalent privileges and check license entitlements. Before installing content packs from the Cortex XSIAM Marketplace, the administrator must verify that their account has Content Administrator or equivalent RBAC privileges and that the tenant's license entitles them to the content being installed. Without proper permissions, the install option is unavailable or fails, and without license entitlement, packs may install but not function.

Answer

Manually compile source code files using the XQL command line

Answer

Reboot all deployed Broker VMs simultaneously

Answer

Disable all active endpoint security policies temporarily

Question 17

An administrator is configuring a new Cortex XSIAM tenant and needs to ingest custom syslog data from a third-party firewall. Which component should be configured first to receive and parse this raw syslog data before it reaches the data lake?

Accepted Answer

Broker VM configured with a Syslog collector. A Broker VM with a Syslog collector is the standard ingestion path for raw syslog from third-party devices into Cortex XSIAM. The Broker VM receives the syslog stream, and the associated parsing rules normalize the events before they are forwarded to the Cortex Data Lake for storage and analytics.

Answer

Direct API integration with the Cortex XSIAM Query Service

Answer

Cortex XSOAR mail listener integration

Answer

Traps Management Service global proxy

Question 18

An engineer wants to verify the version and resource utilization of a running Broker VM. Where in the Cortex XSIAM user interface can this operational metric be inspected?

Accepted Answer

Settings > Configurations > Data Collection > Broker VM. The Broker VM is a customer-deployed component that collects and forwards data to Cortex XSIAM, and its operational state (version, CPU, memory, disk utilization, connectivity) is surfaced in the management UI under Settings > Configurations > Data Collection > Broker VM. This is the designated administrative location for inspecting deployed broker instances and their health metrics. The other locations are investigation, query, or dashboard surfaces that do not expose Broker VM appliance telemetry.

Answer

Investigate > Alerts > System Events

Answer

XQL Search > Run > sys_resources

Answer

Dashboards > Threat Intelligence > Overview

Question 19

An architect is designing the high-availability and disaster recovery (HA/DR) strategy for an on-premises log collection tier utilizing multiple Broker VMs. If Primary Broker VM 'A' fails completely, what happens to the log streams being sent to it from local security devices?

Accepted Answer

Log collection halts unless a network load balancer, DNS failover, or secondary forwarding destination is configured. Broker VMs do not natively cluster or share state, so if Primary Broker VM A fails, the syslog and log streams pointed at its IP address simply stop being received. Log collection resumes only if an external mechanism such as a network load balancer, DNS failover, or a secondary forwarding destination on the source devices redirects traffic to Broker VM B.

Answer

Broker VM 'B' automatically polls the local disk of Broker VM 'A' via SSH to retrieve uncollected logs

Answer

The Cortex XDR agent on endpoints takes over the local syslog listening port

Answer

The XSIAM cloud backend automatically reroutes local syslog streams via cloud-to-premises BGP peering

Question 20

An administrator is configuring Active Directory synchronization within Cortex XSIAM using a Broker VM. Which prerequisite must be met on the domain controller and Broker VM to ensure successful user and group mapping ingestion?

Accepted Answer

The Broker VM must have the Active Directory App enabled and network connectivity established over LDAP/LDAPS ports to the domain controllers.. To synchronize Active Directory users and groups into Cortex XSIAM, the Broker VM must have the Active Directory app enabled and must be able to reach domain controllers over LDAP (port 389) or LDAPS (port 636). This allows the Broker VM to query AD for user and group objects and forward that identity data to the XSIAM tenant for mapping and enrichment.

Answer

The XSIAM cloud tenant must be granted Domain Administrator credentials via an Azure ExpressRoute connection.

Answer

The administrator must manually export CSV files of user lists daily and upload them via the XSIAM web console.

Answer

The Domain Controller must have the Cortex XSIAM agent installed directly on NTDS.dit.