XSIAM-Engineer Practice Test 4 — 25 Questions

Question 1

An administrator is configuring data collection settings and incident rules in Cortex XSIAM. Which TWO configuration steps are required to ensure proper data parsing and alert generation for a newly added third-party firewall log source? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensuring the corresponding vendor content pack is installed and active to correctly parse and normalize logs into the XSIAM schema. Adding a new log source requires configuring the collection mechanism (e.g., Broker VM syslog receiver) and ensuring the correct parsing/content pack is active to normalize the data into the XSIAM schema.

Answer

Recompiling the Cortex XDR agent kernel extension on all endpoints

Answer

Flushing the browser cache of all SOC analysts

Answer

Manually modifying the cloud data lake kernel source code via SSH

Question 2

An administrator is verifying that firewall rules at the corporate perimeter permit outbound communication from Cortex XDR agents. Which destination criteria must be allowed for agent communication?

Accepted Answer

Outbound TCP port 443 to Palo Alto Networks XSIAM cloud FQDNs. Cortex XDR agents require outbound HTTPS (TCP 443) access to Palo Alto Networks cloud infrastructure and specific regional FQDNs.

Answer

Inbound TCP port 22 and 3389 for remote diagnostics

Answer

Outbound UDP port 514 for direct syslog streaming to the cloud

Answer

Inbound and outbound TCP port 80 for unencrypted configuration checks

Question 3

An administrator is reviewing the prerequisites for deploying Cortex XDR agents across virtual desktop infrastructure (VDI) environments. Which TWO best practices should be considered for VDI golden image preparation? (Choose two)

Accepted Answer

Installing the agent as the final step in the golden image creation process before sealing the disk. VDI deployments require specific agent configurations, such as enabling VDI mode to prevent duplicate endpoint entries and managing golden image persistence properly.

Answer

Removing all network adapters from the virtual machine template

Answer

Disabling all security tamper protection permanently on the master image

Answer

Configuring the VDI master image with a static, hardcoded endpoint UUID that never changes

Question 4

During the sizing phase of a Cortex XSIAM deployment, an architect needs to estimate the required IOPS and storage retention footprint for endpoint telemetry. Which factor has the most direct impact on the raw ingestion volume calculation?

Accepted Answer

The frequency and depth of endpoint behavioral event generation and process telemetry. Event frequency and diversity of process, network, and file system telemetry generated per endpoint dictate the raw log volume.

Answer

The configured frequency of Cortex XSOAR automated playbook execution

Answer

The total number of active directory user accounts synchronized via User-ID

Answer

The number of active firewall security rules enforced by Panorama

Question 5

An administrator is deploying Cortex XDR agents to a fleet of macOS endpoints using a Mobile Device Management (MDM) solution like Jamf Pro. What is required to ensure the agent has full disk access and system extension approvals on modern macOS versions without user prompting?

Accepted Answer

Deploying MDM configuration profiles containing System Extension and Full Disk Access payloads. Modern macOS versions require MDM configuration profiles (Payloads) to pre-approve System Extensions and grant Full Disk Access to security software like Cortex XDR.

Answer

Manually running sudo commands via SSH on every Mac workstation

Answer

Disabling the macOS Gatekeeper security feature globally via terminal

Answer

Configuring an internal Broker VM to proxy macOS system calls

Question 6

An organization requires high availability for its on-premises log ingestion architecture using Broker VMs. Which THREE architectural elements contribute to building a resilient log collection tier? (Choose three)

Accepted Answer

Configuring local log caching and queuing on Broker VMs to handle temporary cloud connectivity interruptions. Resilient log collection relies on deploying multiple Broker VMs, using load balancers or DNS/IP failover for syslog streams, and monitoring appliance resource health.

Answer

Disabling all network encryption to maximize packet forwarding speed

Answer

Routing all log traffic through a single unmanaged home router

Question 7

An enterprise environment has strict network segmentation where log sources in a secure DMZ cannot communicate directly with the primary Broker VM located in the corporate network. How should an architect design the log collection architecture to feed data into Cortex XSIAM?

Accepted Answer

Deploy a secondary Broker VM within the DMZ configured to forward logs securely to the primary Broker VM or directly to the XSIAM tenant.. Deploying a dedicated Broker VM inside the DMZ zone allows local log collection from DMZ sources while securely forwarding normalized logs to the XSIAM backend or through authorized firewalls.

Answer

Configure a port-mirroring session on the core firewall to duplicate all DMZ traffic to the Broker VM via local loopback.

Answer

Install the Cortex XDR agent on all network routers and switches in the DMZ to capture syslog locally.

Answer

Open bidirectional UDP port 514 across the internal corporate firewall to allow DMZ devices to stream raw syslog directly.

Question 8

An administrator is planning the deployment of Broker VMs in a high-availability configuration. What is the recommended approach for handling Broker VM redundancy?

Accepted Answer

Deploy multiple Broker VMs in a clustered group or behind a network load balancer to ensure seamless failover and load distribution.. Deploying multiple Broker VMs behind a load balancer or as a logical cluster ensures high availability and failover capabilities for agent check-ins and log forwarding.

Answer

Install two instances of the Broker VM software on the exact same virtual machine instance.

Answer

Configure the Cortex XDR agents with a single hardcoded IP address and rely on BGP Anycast for failover.

Answer

Configure active-passive clustering using Microsoft Windows Failover Clustering inside the Broker VM guest OS.

Question 9

An architect is designing an automated log forwarding pipeline where Cortex XSIAM forwards specific enriched telemetry or incidents to an external destination (such as a third-party SIEM or data lake). Which THREE mechanisms or integrations are available for exporting data out of XSIAM? (Choose three)

Accepted Answer

Syslog forwarding profiles configured on Broker VMs to transmit logs to external SIEMs. Data export out of Cortex XSIAM can be achieved using the Cortex Data Exporter, SIEM integrations (Syslog forwarding via Broker VM), and webhook-based API integrations.

Answer

Direct physical tape backup drives attached to the cloud data lake backend storage nodes

Answer

Manual FTP file dumps of the entire raw database executed via root SSH commands

Question 10

When planning identity and access management integration for Cortex XSIAM administration, which THREE authentication or directory methods are natively supported? (Choose three)

Accepted Answer

Local administrator accounts managed directly within the Cortex XSIAM platform. Cortex XSIAM supports standard enterprise identity providers using SAML 2.0 as well as local user management and API keys.

Answer

Direct Kerberos ticket-granting ticket (TGT) exchange without an intermediary IdP

Answer

Legacy Windows NT LAN Manager (NTLMv1) direct challenge-response authentication

Question 11

An engineer is deploying a Cortex XSIAM Engine on-premises to support high-throughput log parsing and query execution. During setup, the engine fails to register with the cloud tenant. Upon checking the engine logs, the engineer sees TLS certificate validation errors. What is the most likely root cause?

Accepted Answer

The engine host is missing the root Certificate Authority (CA) certificate required to trust the SSL inspection proxy or tenant endpoint.. Engine-to-cloud communication relies on mutual TLS (mTLS) and valid certificate trust chains. If an SSL inspection proxy or corporate firewall is intercepting TLS traffic without proper root certificate installation on the engine host, registration fails.

Answer

UDP port 514 is blocked by the local host firewall, preventing certificate handshake packets.

Answer

The Broker VM has exceeded its maximum concurrent engine connection limit.

Answer

The engine software version is newer than the Cortex XSIAM tenant cloud version.

Question 12

When planning an initial Cortex XSIAM deployment, an administrator must configure organizational settings. Which TWO configurations are typically established during the initial tenant setup phase? (Choose two)

Accepted Answer

Defining initial administrator user accounts and assigning baseline roles. Initial tenant setup includes configuring identity providers (SSO/SAML), defining initial administrative user roles, and setting regional parameters.

Answer

Writing custom Linux kernel modules for client workstations

Answer

Configuring analog modem dial-up backup connections for alert notifications

Answer

Manually soldering hardware security modules (HSMs) into tenant cloud racks

Question 13

An organization requires strict data residency compliance, ensuring that all log data collected by Cortex XSIAM remains within the European Union. During tenant initialization, how must the administrator satisfy this requirement?

Accepted Answer

Select the appropriate EU-based cloud region during initial tenant provisioning and activation. Tenant region and data residency are determined at the time of initial tenant provisioning and selection by Palo Alto Networks support/activation.

Answer

Deploy an on-premises Hadoop data lake and configure XSIAM to forward all raw logs via API

Answer

Configure log forwarding profiles within the Cortex XSOAR settings menu

Answer

Modify the Broker VM local storage configuration file to encrypt data using EU-specific keys

Question 14

During an assessment of infrastructure readiness for Cortex XSIAM, an engineer calculates the required daily log ingestion volume and determines it exceeds the licensed capacity. What architectural feature or mechanism within XSIAM can the administrator configure to optimize data ingestion without losing critical security telemetry?

Accepted Answer

Configure log filtering and drop rules on the Broker VM collectors to exclude unneeded verbose log events before they reach the XSIAM cloud.. XSIAM allows administrators to configure log parsing and filtering rules on the Broker VM or ingestion pipeline to drop redundant or low-value logs before ingestion, optimizing licensed capacity.

Answer

Increase the retention period in the data lake storage settings from 90 days to 365 days.

Answer

Enable automatic data compression on the Cortex XDR agent to reduce network packet size by 90%.

Answer

Deploy secondary XSIAM tenants in different geographic regions to split the log parsing load.

Question 15

When configuring integrations in Cortex XSIAM via Content Hub, which TWO actions can an administrator perform after installing an integration pack? (Choose two)

Accepted Answer

Test the connection to ensure valid communication between XSIAM and the external service. After installing an integration content pack, an administrator must create and configure integration instances and map their data collection or action parameters.

Answer

Manually solder USB encryption keys into Broker VM motherboards

Answer

Physically rewire the cloud data center rack power supplies

Answer

Delete all underlying system databases to force a clean slate

Question 16

An administrator is deploying the Cortex XSIAM agent via Microsoft Intune and needs to ensure that kernel-level extensions on macOS endpoints do not block the installation. Which preliminary step must be completed?

Accepted Answer

Pre-approve system extensions and network filters using an MDM configuration profile. macOS deployments require MDM configuration profiles (such as System Extensions and Network Extensions) to be approved prior to agent rollout.

Answer

Convert all macOS file systems to legacy HFS+ format

Answer

Disable SIP (System Integrity Protection) on all target macOS endpoints

Answer

Install the XSIAM agent manually using an interactive terminal session

Question 17

A security architect is planning agent installation rollouts and needs to ensure that endpoints in a high-security isolated zone can still receive policy updates without direct internet access. What is the recommended deployment pattern?

Accepted Answer

Deploy a local Broker VM within the isolated zone configured as an agent distribution and collection proxy. Deploy a Broker VM locally within the isolated zone to act as an internal distribution and communication proxy.

Answer

Expose the primary Cortex XSIAM cloud tenant public IP directly to the isolated subnet

Answer

Disable cloud updates and rely exclusively on quarterly USB-based manual package updates

Answer

Configure each isolated endpoint with a direct VPN tunnel back to the primary domain controller

Question 18

During the infrastructure readiness assessment for Cortex XSIAM deployment, which outbound network connectivity requirement must be verified for the Broker VM to ensure proper communication with the XSIAM tenant?

Accepted Answer

Outbound TCP port 443 to the assigned Cortex XSIAM tenant URL and services.. Broker VMs require outbound TCP port 443 connectivity to the Cortex XSIAM tenant URL and associated threat intelligence feeds for secure API communication and updates.

Answer

Inbound TCP port 22 and TCP port 80 for remote SSH administration and unencrypted web traffic.

Answer

Bidirectional UDP port 514 for unencrypted syslog tunneling across the WAN.

Answer

Outbound TCP port 3389 for remote desktop management of the appliance.

Question 19

A deployment team is planning the rollout of Cortex XSIAM agents across a heterogeneous environment containing Windows, macOS, and Linux endpoints. Which core architectural component must be provisioned and accessible from all endpoints to ensure successful agent registration and policy synchronization?

Accepted Answer

Cortex XSIAM Broker VM. The Cortex XSIAM Broker VM acts as the intermediary for agent communications, acting as a proxy and distribution point for agents deployed across the network.

Answer

Prisma Access Remote Network

Answer

Panorama Management Server

Answer

Cortex XSOAR Engine Cluster

Question 20

An administrator is deploying a Broker VM on a VMware ESXi hypervisor. After deploying the OVA template, the administrator notices the Broker VM cannot reach the NTP server and fails activation. Which initial configuration step was likely missed?

Accepted Answer

Configuring the static IP address, subnet mask, default gateway, and DNS servers in the Broker VM console interface.. Network settings, including IP addressing, DNS, and gateway configurations, must be properly applied during the initial Broker VM console setup to ensure connectivity.

Answer

Allocating additional virtual CPU sockets to handle cryptographic handshakes.

Answer

Enabling SSH service access in the Cortex XSIAM tenant settings.

Answer

Installing the VMware Tools package inside the guest Linux operating system.