XSIAM-Engineer Practice Test 5 — 25 Questions

Question 1

A Cortex XSIAM engineer is troubleshooting a sudden drop in ingested endpoint telemetry. The Broker VM shows healthy connectivity, but the XSIAM console reports that the endpoint dataset is not receiving new events. Which action should the engineer take first to determine whether the issue is a parsing or a collection problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run a query against the endpoint telemetry dataset to see whether recent events exist and examine their parsed fields.. Directly querying the endpoint telemetry dataset is the most precise first step because it reveals both presence and parsed field quality. If events are missing, collection or forwarding is at fault; if events exist but fields are empty, parsing is at fault. Dashboard and local log checks provide indirect evidence, while restarting services is a disruptive remediation that does not localize the failure.

Answer

Restart the Broker VM service and re-register the endpoint agents to force a fresh connection.

Answer

Use the Data Ingestion dashboard to check the ingestion rate and error counts for the endpoint telemetry dataset.

Answer

Open the Broker VM's local log viewer and inspect the raw payload arriving from the endpoint agents.

Question 2

A security administrator is planning to deploy Cortex XSIAM agents to endpoints across multiple operating systems. They need to ensure that the agents can communicate with the Cortex XSIAM tenant. Which statement accurately describes the agent communication requirement?

Accepted Answer

Agents must communicate with the Cortex XSIAM tenant over outbound TCP port 443.. Cortex XSIAM agents initiate outbound connections to the Cortex XSIAM tenant using HTTPS on TCP port 443. This is the standard and required configuration for agent communication. No inbound ports are needed on the endpoint. This outbound-only design simplifies firewall rules and enhances security by not exposing endpoints to inbound traffic from the internet. Other ports or protocols are not used for this purpose.

Answer

Agents must communicate with the Cortex XSIAM tenant over inbound TCP port 443.

Answer

Agents must communicate with the Cortex XSIAM tenant over outbound TCP port 8443.

Answer

Agents must communicate with the Cortex XSIAM tenant over outbound UDP port 443.

Question 3

An XSIAM administrator needs to ensure that the platform can correlate events from multiple data sources to detect sophisticated attacks. Which TWO actions are required to enable this correlation? (Choose two.)

Accepted Answer

Create correlation rules that define the attack patterns.. To enable effective correlation, XSIAM requires that data from various sources be normalized to a common schema and that correlation rules be defined to detect attack patterns. Normalization ensures events are comparable, and rules specify what patterns to look for. The Correlation Engine is always active, and no additional on-premises server or UBA enablement is necessary for basic correlation.

Answer

Enable the Correlation Engine in the XSIAM settings.

Answer

Enable User Behavior Analytics (UBA) for all users.

Answer

Install a separate correlation server on-premises.

Question 4

An architect is planning a Cortex XSIAM deployment for a company with strict change management. The company wants to validate the deployment in a non-production environment before rolling out to production endpoints. Which approach best supports this requirement while aligning with Cortex XSIAM deployment best practices?

Accepted Answer

Use a phased rollout starting with a small pilot group of endpoints and Broker VM sources. A phased rollout beginning with a pilot group allows validation of agents, log ingestion, and detection content on a limited scope before expanding. This limits risk and satisfies change management requirements. Separate tenants, disabled detections, and simultaneous full deployment do not provide the controlled validation the architect needs.

Answer

Disable all detection rules until the full rollout is complete

Answer

Deploy a separate Cortex XSIAM tenant for testing and later migrate all data to production

Answer

Deploy agents to all production endpoints simultaneously to gather the most data quickly

Question 5

A security administrator is preparing to install a Broker VM in a VMware environment. The administrator needs to ensure the virtual appliance meets the network requirements for communicating with the Cortex XSIAM tenant. Which network setting must be configured on the Broker VM to allow it to resolve the Cortex XSIAM cloud FQDN?

Accepted Answer

Configure a DNS server that can resolve public FQDNs. For the Broker VM to communicate with Cortex XSIAM, it must resolve the cloud FQDN to an IP address. This requires configuring a DNS server that can resolve public domain names. Without DNS, the Broker VM cannot locate the Cortex XSIAM cloud, and all communication will fail. This is a critical network prerequisite during installation.

Answer

Enable NAT on the Broker VM

Answer

Set a static IP address for the Broker VM

Answer

Configure a proxy server for outbound connections

Question 6

An architect is planning the installation of a Broker VM in a high-security environment. The security policy requires that all outbound traffic from the Broker VM be inspected and that the Broker VM not initiate connections to arbitrary internet destinations. Which Cortex XSIAM configuration should the architect use to meet these requirements?

Accepted Answer

Configure the Broker VM to use a forward proxy for all outbound connections.. Using a forward proxy for the Broker VM's outbound connections enables the organization to inspect and control all traffic. The proxy can enforce policies that only permit connections to the Cortex XSIAM tenant, satisfying the security requirement. This approach is supported and maintains the outbound-only communication model. Other options either disable necessary connectivity or misapply components.

Answer

Deploy the Broker VM in a network segment with no internet access and use offline updates.

Answer

Enable inbound firewall rules to allow the tenant to push updates to the Broker VM.

Answer

Install a Cortex XDR agent on the Broker VM to monitor its outbound connections.

Question 7

A Cortex XSIAM engineer is designing a playbook that must handle a high volume of alerts. The playbook includes a task that calls an external enrichment integration which can be slow or unresponsive. The engineer wants to ensure that a failure in this enrichment task does not halt the entire playbook and that the playbook continues to the next task. Which task configuration should the engineer apply?

Accepted Answer

Set the task to 'Continue on error' and configure a timeout value for the integration command.. To prevent a slow or failing enrichment task from halting a playbook, the task should be configured to continue on error and have a timeout set. This allows the playbook to proceed even if the integration does not respond in time, preserving automation flow for high-volume alerts. Other options either pause, retry excessively, or skip the enrichment entirely, which do not satisfy the requirement.

Answer

Set the task to 'Manual review' so an analyst can decide whether to proceed after the enrichment.

Answer

Set the task to 'Retry on error' with a high number of retries to eventually succeed.

Answer

Set the task to 'Skip' so it is bypassed entirely and the playbook moves to the next task.

Question 8

A Cortex XSIAM engineer is troubleshooting a sudden drop in ingested endpoint telemetry. The Broker VM shows healthy connectivity, but the XSIAM console reports that the endpoint dataset is not receiving new events. Which action should the engineer take first to determine whether the issue is a parsing or a collection problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the task's timeout value in the playbook task configuration. Intermittent timeouts from an external API are best handled by making the caller tolerant of transient failures. Retrying with exponential backoff recovers from brief outages and throttling, while a longer task timeout accommodates legitimately slow responses. Together these changes harden the script without touching the external service. Suppressing errors, rescheduling the call, or swapping languages does not improve resilience.

Answer

Move the API call to a separate playbook that runs on a schedule instead of on demand

Answer

Convert the script from Python to PowerShell to change its network stack

Answer

Disable the playbook's error handling so failures are silently ignored

Question 9

An engineer is planning the network requirements for a new Cortex XSIAM deployment. The company uses a strict firewall policy that only allows outbound traffic on specific ports. Which outbound port must be open to allow Cortex XDR agents to communicate with the Cortex XSIAM tenant?

Accepted Answer

TCP 443. Cortex XDR agents use HTTPS over TCP 443 to communicate with the Cortex XSIAM tenant. This port must be allowed outbound from endpoints to the internet or to a Broker VM if used for proxying. Other ports listed are either used for different services or not used at all. Ensuring TCP 443 is open is a fundamental network requirement for XSIAM deployment.

Answer

TCP 8443

Answer

UDP 514

Answer

TCP 22

Question 10

An administrator is deploying Cortex XDR agents to a fleet of macOS endpoints using a Mobile Device Management (MDM) solution like Jamf Pro. What is required to ensure the agent has full disk access and system extension approvals on modern macOS versions without user prompting?

Accepted Answer

Deploying MDM configuration profiles containing System Extension and Full Disk Access payloads. On modern macOS (Catalina and later), kernel extensions are deprecated in favor of system extensions, and Full Disk Access (FDA) is a TCC (Transparency, Consent, and Control) permission that cannot be granted silently without MDM. Deploying MDM configuration profiles that include System Extension and Full Disk Access payloads allows the Cortex XDR agent to be approved and granted FDA without user interaction. This is the only supported method for zero-touch deployment at scale.

Answer

Manually running sudo commands via SSH on every Mac workstation

Answer

Disabling the macOS Gatekeeper security feature globally via terminal

Answer

Configuring an internal Broker VM to proxy macOS system calls

Question 11

A Cortex XSIAM engineer is troubleshooting a sudden drop in ingested endpoint telemetry. The Broker VM shows healthy connectivity, but the XSIAM console reports that the endpoint dataset is not receiving new events. Which action should the engineer take first to determine whether the issue is a parsing or a collection problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the Broker VM's syslog listener status and logs. The most efficient first step is to check the Broker VM's syslog listener status and logs. This directly verifies whether the Broker VM is ready to receive logs on the expected port. If the listener is not running, the engineer can start or reconfigure it. Other steps like restarting the source or checking firewall rules are secondary and should be done after confirming the listener state.

Answer

Verify firewall rules between the syslog source and the Broker VM

Answer

Restart the syslog source device

Answer

Re-register the Broker VM with Cortex XSIAM

Question 12

A security architect is deploying Cortex XSIAM in a multi-tenant environment. The organization requires that each tenant's event data be logically isolated and that queries from one tenant cannot access another tenant's data. Which of the following best describes how Cortex XSIAM achieves this isolation?

Accepted Answer

The platform uses a shared data lake with tenant-specific identifiers and access controls to enforce isolation.. Cortex XSIAM is built as a multi-tenant platform where a single instance serves multiple tenants. Data isolation is enforced logically through tenant identifiers and role-based access controls, allowing efficient resource utilization while preventing cross-tenant data access. This design supports scalability and centralized management without requiring separate physical infrastructure for each tenant.

Answer

Each tenant is assigned a dedicated Cortex XSIAM engine that processes and stores data separately.

Answer

Isolation is achieved by deploying separate Cortex XSIAM instances for each tenant in different regions.

Answer

Tenant data is stored in separate physical databases on distinct hardware to ensure complete separation.

Question 13

A security architect is planning the storage layout for a new Cortex XSIAM tenant that will ingest 5 TB of raw logs per day and retain them for 12 months. The organization requires that hot data remain queryable within seconds for the most recent 30 days, while older data can tolerate slower query performance. Which XSIAM storage tier design should the architect implement to meet these requirements while controlling cost?

Accepted Answer

Use the Cortex XSIAM hot storage tier for the most recent 30 days and configure the cold storage tier for data older than 30 days.. Cortex XSIAM uses a tiered storage model where recent data resides in hot storage for fast queries and older data moves to cold storage for cost efficiency. The scenario's 30-day fast-query requirement aligns exactly with the hot tier boundary, while the remaining 11 months can be served from cold storage. This design meets performance needs without paying hot-tier costs for data that does not require sub-second access.

Answer

Deploy an external Amazon S3 bucket as the primary data store and point Cortex XSIAM to it using the S3 data integration.

Answer

Configure the Cortex Data Lake with a single hot tier and rely on Cortex XSIAM's built-in compression to reduce storage costs for all 12 months of data.

Answer

Increase the Broker VM disk size to 20 TB and store all raw logs locally on the Broker VM for the full retention period.

Question 14

An engineer is deploying a Cortex XSIAM Broker VM in a high-security environment where the Broker VM must communicate with the Cortex XSIAM tenant over the internet. The security team requires that all outbound communication from the Broker VM be encrypted and authenticated using mutual TLS. Which component must be installed and configured on the Broker VM to enable this secure channel?

Accepted Answer

The Cortex XSIAM Broker VM app, which establishes a mutual TLS connection to the tenant using an embedded client certificate and tenant-specific configuration.. Cortex XSIAM Broker VMs communicate with the tenant through the Broker VM app, which performs registration and establishes a mutually authenticated TLS session. The app uses tenant-issued credentials and a client certificate, so both sides verify each other's identity. This is the only supported method for Broker-to-tenant communication and directly delivers the mutual TLS requirement described in the scenario.

Answer

An IPsec VPN tunnel between the Broker VM and the Cortex XSIAM cloud gateway, configured with pre-shared keys.

Answer

A forward proxy configured with NTLM authentication to relay Broker VM traffic through the corporate web gateway.

Answer

A reverse proxy certificate signed by the internal certificate authority and bound to the Broker VM's management interface.

Question 15

A Cortex XSIAM administrator is preparing to deploy a new Broker VM to collect logs from a remote data center. The data center firewall team asks which TCP port the Broker VM uses to establish its initial registration and management connection to the Cortex XSIAM tenant. Which port should the administrator provide?

Accepted Answer

TCP 443. Broker VM registration and ongoing management traffic to the Cortex XSIAM tenant travels over outbound TCP 443. This is consistent with the platform's use of mutual TLS over HTTPS for secure communication. Firewall rules must permit outbound 443 from the Broker VM to the tenant endpoints so that registration succeeds and the management channel remains available.

Answer

TCP 8443

Answer

TCP 22

Answer

TCP 514

Question 16

A Cortex XSIAM administrator needs to ensure that only specific IP addresses can access the Cortex XSIAM tenant's management console. The organization uses a corporate firewall and wants to restrict access to the SOC team's subnet. Which Cortex XSIAM feature should the administrator configure to enforce this restriction?

Accepted Answer

Allowed IP addresses list in the Cortex XSIAM tenant settings.. To restrict management console access by IP, Cortex XSIAM offers an allowed IP addresses list in the tenant settings. This allowlist ensures that only connections from specified IP ranges are accepted, providing a network-level security control. RBAC handles user permissions, SAML handles authentication, and engine firewalls are for engine traffic, so none of those directly enforce IP restrictions on the console.

Answer

Role-Based Access Control (RBAC) with IP-based conditions.

Answer

Cortex XSIAM engine firewall rules on the local host.

Answer

SAML 2.0 identity provider (IdP) with network policies.

Question 17

A Cortex XSIAM administrator needs to integrate an external threat intelligence feed that provides indicators of compromise (IOCs) in STIX format. The feed must be automatically ingested and used to generate alerts when IOCs match events in the tenant. Which component should the administrator configure to achieve this?

Accepted Answer

Cortex XSIAM threat intelligence management module, configured with a STIX/TAXII feed.. The threat intelligence management module in Cortex XSIAM is designed to ingest external feeds in STIX/TAXII format, normalize the indicators, and make them available for correlation against events. Configuring a STIX/TAXII feed in this module enables automatic ingestion and IOC-based alerting, fulfilling the requirement without custom development.

Answer

Cortex XSIAM Broker VM with the Threat Intelligence app installed.

Answer

Cortex XSIAM Engine with a custom parsing rule for STIX data.

Answer

Cortex XSIAM API endpoint that receives STIX data and forwards it to the correlation engine.

Question 18

Which protocol is natively supported by the Broker VM Syslog collector for receiving log streams from network devices?

Accepted Answer

Syslog over TCP and UDP. Broker VM Syslog collectors support standard syslog streaming over both TCP and UDP protocols.

Answer

Netflow v9 and IPFIX only

Answer

SNMP Trap v2c and v3

Answer

WMI and RPC protocols

Question 19

An enterprise security team wants to ensure that all data ingested from a specific untrusted data source is automatically tagged with a specific tag for downstream analytics. Where can this automatic tagging rule be applied during integration setup?

Accepted Answer

Data Collection source configuration tags. The Data Collection source configuration in Cortex XSIAM allows administrators to define tags that are automatically applied to all incoming data from that specific source. This ensures that data from untrusted sources is consistently labeled for downstream analytics, such as XQL queries, dashboards, and correlation rules. Tags applied at the collection point are inherited by all events from that source, providing a scalable and reliable method for data classification.

Answer

Incident Layout custom fields

Answer

XQL Query Builder template parameters

Answer

Global Dashboard filter properties

Question 20

During a high-availability planning session for an on-premises Broker VM deployment, an architect considers deploying multiple Broker VMs behind a load balancer to handle syslog collection from thousands of network devices. What is a critical architectural limitation or consideration when placing Broker VMs behind a load balancer for syslog collection?

Accepted Answer

Load balancing TCP or UDP syslog streams requires careful session persistence and source IP retention to ensure parser context is maintained. When placing multiple Broker VMs behind a load balancer for syslog collection, session persistence (sticky sessions) and source IP retention are critical to ensure that all syslog messages from a given device go to the same Broker VM. This maintains parser context and prevents log parsing errors due to distributed processing.

Answer

Broker VMs cannot accept syslog data if they are registered to the same XSIAM tenant token

Answer

Load balancers prevent the Broker VM from communicating with the Cortex XSIAM cloud backend via port 443

Answer

Broker VMs automatically sync local log queues across the load balancer using BGP routing