XSIAM-Engineer Practice Test 5 — 25 Questions

Question 1

An administrator is configuring Role-Based Access Control (RBAC) in Cortex XSIAM and needs to grant a tier-1 SOC analyst the ability to view incidents and execute isolation commands on endpoints, but strictly prohibits them from modifying security policies or viewing sensitive user identity logs. How should this custom role be constructed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom role with 'Incident Response' and 'Endpoint Control' permissions while omitting 'Policy Management' and 'Data Access Control' scopes for identity logs.. RBAC in Cortex XSIAM requires granular permission assignments. Incident viewing and endpoint response actions (like isolation) can be grouped, while policy modification and specific dataset read permissions are withheld.

Answer

Grant 'Power User' access and rely on Cortex XDR profile exclusions to block policy edits.

Answer

Assign the 'App Role' for XSOAR automation and restrict network access via Security Groups.

Answer

Assign the built-in 'Administrator' role and manually remove permissions using the CLI.

Question 2

An administrator needs to deploy Cortex XDR agents to Linux servers that have strict change management controls and cannot be rebooted. Which installation consideration is most critical for Linux deployments?

Accepted Answer

Linux installations do not require a system reboot, but matching kernel headers or supported OS distributions must be verified.. Cortex XDR agent installation on Linux typically does not require a reboot, making it suitable for change-controlled environments, but kernel module or system extension dependencies must be verified.

Answer

Linux installations always require a mandatory full system reboot to load kernel components.

Answer

Linux agents require disabling SELinux and AppArmor permanently across all servers.

Answer

Linux agents must be installed using graphical user interface installers.

Question 3

An administrator is preparing to deploy Cortex XDR agents across a large macOS fleet using a Mobile Device Management (MDM) solution such as Jamf Pro. Which configuration profile component is critical to deploy alongside the agent installation package on modern macOS versions?

Accepted Answer

Transparency, Consent, and Control (TCC) profiles and System Extension pre-authorization configurations.. Modern macOS versions require System Extensions and Full Disk Access permissions to be explicitly pre-approved via MDM configuration profiles for security agents like Cortex XDR to function correctly without user prompts.

Answer

Kernel extension bypass and legacy daemon authorization profiles.

Answer

SSH key exchange profiles and dynamic DNS registration certificates.

Answer

Active Directory domain join credentials and Kerberos ticket-granting tickets.

Question 4

An organization is setting up Cortex XSIAM and wishes to restrict administrative access so that specific Tier-2 analysts can modify prevention policies but cannot create new user accounts or modify RBAC settings. How should this be configured?

Accepted Answer

Create a custom role with 'Policy Management' permissions enabled and 'User Management' permissions disabled.. Custom roles in Cortex XSIAM allow precise selection of permissions, granting policy management rights while withholding user management and RBAC administration privileges.

Answer

Grant full administrator access and use audit logs to monitor unauthorized changes.

Answer

Assign the built-in 'Power User' role and rely on organizational policy guidelines.

Answer

Use Active Directory group mapping to restrict menu items via CSS injection.

Question 5

An administrator is configuring a Broker VM to collect Syslog data from various network devices. Some devices transmit syslog over TCP while others use UDP. How should the Broker VM syslog collector be configured to handle both?

Accepted Answer

Configure the Broker VM Syslog collector instance to listen on the specified port for both TCP and UDP protocols.. The Broker VM Syslog collector can be configured to listen on designated ports for both TCP and UDP protocols simultaneously to ingest logs from mixed device types.

Answer

Configure the Cortex XDR agent on the network devices to encapsulate syslog in TLS packets.

Answer

Deploy two separate Broker VMs, dedicating one exclusively to UDP syslog and the other to TCP syslog.

Answer

Convert all network device syslog traffic to HTTP using an external reverse proxy before it reaches the Broker VM.

Question 6

What is the primary purpose of the Cortex XSIAM Content Hub?

Accepted Answer

To download and install pre-built integrations, parsers, dashboards, and content packs.. The Content Hub (Marketplace) enables administrators to discover, install, and manage integrations, content packs, parsers, and playbooks within Cortex XSIAM.

Answer

To store encrypted backups of the Broker VM virtual hard disks.

Answer

To configure hardware load balancers for incoming syslog streams.

Answer

To manage endpoint operating system patches and third-party software updates.

Question 7

When setting up authentication and user management in Cortex XSIAM, which TWO features or protocols are supported for administrative access control? (Choose two)

Accepted Answer

Local user accounts with mandatory multi-factor authentication (MFA).. Cortex XSIAM supports SAML 2.0 Identity Provider federation and local user accounts with multi-factor authentication (MFA).

Answer

Legacy Windows NT LAN Manager (NTLMv1) challenge-response authentication.

Answer

Plaintext Telnet authentication over port 23 for administrative CLI access.

Answer

Anonymous guest access tokens for public incident reviewing.

Question 8

When deploying Cortex XDR agents across an enterprise, what is the primary role of an installation token?

Accepted Answer

To uniquely identify the target tenant and securely authenticate the agent during initial registration.. Installation tokens authenticate the agent during registration, tying the endpoint to the correct Cortex XSIAM tenant and profile.

Answer

To license the endpoint for Microsoft Windows Enterprise features.

Answer

To grant the analyst SSH access to the endpoint operating system.

Answer

To encrypt the local endpoint hard drive using BitLocker or FileVault.

Question 9

An organization is enforcing strict segregation of duties within Cortex XSIAM using Role-Based Access Control (RBAC). Which TWO administrative actions can be restricted so that standard security analysts cannot perform them? (Choose two)

Accepted Answer

Creating new user accounts and modifying global Role-Based Access Control (RBAC) assignments.. Standard analysts should be restricted from modifying global tenant configurations, user accounts, and RBAC roles.

Answer

Viewing active incidents and triaging alerts assigned to their SOC queue.

Answer

Exporting incident case summaries to PDF reports.

Answer

Writing and executing custom XQL queries in the Query Center.

Question 10

An administrator is reviewing infrastructure readiness for deploying Cortex XSIAM engines on-premises. Which TWO prerequisites must be validated on the host infrastructure before engine installation? (Choose two)

Accepted Answer

Outbound TCP port 443 connectivity to the Cortex XSIAM cloud environment.. Engines require supported operating system versions, adequate CPU/memory resources, and proper network connectivity (TCP 443) to the cloud tenant.

Answer

Direct physical access to the server motherboard to install a hardware crypto-accelerator card.

Answer

Disabling all host system firewalls and SELinux entirely across the corporate datacenter.

Answer

Active Directory Domain Controller role installed on the same host operating system.

Question 11

An administrator needs to configure secure access to the Cortex XSIAM web console for remote administrators. Which TWO security controls should be implemented? (Choose two)

Accepted Answer

Configure IP allowlisting policies or conditional access rules via the IdP/SAML configuration.. Securing access to the management console involves enforcing Multi-Factor Authentication (MFA) and restricting access via IP allowlisting or SAML SSO policies.

Answer

Disable all TLS encryption on the admin portal to speed up login times.

Answer

Publish administrator credentials in plaintext on the internal corporate wiki for easy team reference.

Answer

Configure guest accounts with unrestricted superuser privileges for external auditors.

Question 12

An administrator is setting up custom Role-Based Access Control (RBAC) folders and permissions in Cortex XSIAM to segregate data access between regional security teams. Which TWO configuration steps are required when creating a new custom role and assigning data scopes? (Choose two)

Accepted Answer

Define the specific functional permissions (such as incident viewing, response actions, or configuration management) assigned to the role.. Creating custom roles involves defining granular permission sets and associating specific data scopes (such as endpoint groups or log datasets) to restrict visibility.

Answer

Manually compile the source code of the role policy into a JSON manifest and push it via the REST API.

Answer

Install an additional XSOAR engine on each analyst workstation to enforce local authorization checks.

Answer

Reboot all Broker VMs in the region to propagate the new role definitions to local log collectors.

Question 13

An administrator is deploying Cortex XSIAM agents on a fleet of corporate servers and needs to ensure proper installation parameters and operational readiness. Which TWO methods are valid for deploying or managing agent installations in XSIAM? (Choose two)

Accepted Answer

Configuring automated agent upgrade profiles and installation packages directly from the Cortex XSIAM management console.. Cortex XSIAM supports multiple deployment mechanisms including scripted command-line installations with installation tokens and cloud-managed upgrade policies.

Answer

Manually telnetting into port 23 of every server to trigger the built-in operating system agent installer service.

Answer

Flashing the server BIOS with a specialized firmware image that contains the embedded XSIAM kernel driver.

Answer

Physically connecting a USB thumb drive containing the master cryptographic key to each server's motherboard.

Question 14

An enterprise is evaluating infrastructure readiness for Cortex XSIAM and plans to ingest massive volumes of NetFlow and VPC flow logs. The deployment architect decides to route these streams through Broker VMs rather than sending them directly from cloud VPCs to the XSIAM cloud. What is the primary architectural advantage of using Broker VMs for this ingestion path?

Accepted Answer

Broker VMs perform local log normalization, compression, and buffering to optimize WAN bandwidth utilization and handle temporary cloud connectivity outages.. Broker VMs act as local collectors that can perform preprocessing, buffering, and secure batch forwarding, reducing direct cloud exposure and optimizing bandwidth.

Answer

Broker VMs replace the requirement for Cortex XSIAM parser configuration by dynamically guessing schema definitions.

Answer

Broker VMs eliminate the need for any firewall rules or security group configurations in the cloud environment.

Answer

Broker VMs automatically convert all raw NetFlow packets into custom Python playbooks for instant XSOAR execution.

Question 15

An administrator is deploying the Broker VM via an OVA template on an ESXi hypervisor. After deployment, the administrator cannot access the Broker VM management web interface. Which initial configuration step must be performed via the hypervisor console to enable remote network access?

Accepted Answer

Log into the hypervisor console and configure the management IP address, netmask, gateway, and DNS settings via the initial setup CLI wizard.. Initial network configuration such as setting a static IP address, netmask, default gateway, and DNS servers must be completed directly via the hypervisor console CLI before web management is accessible.

Answer

Access the BIOS settings of the ESXi host to enable virtualization extensions for the Broker VM container engine.

Answer

Run the automated DHCP client script from an external USB drive plugged into the hypervisor.

Answer

Connect a physical serial cable to the ESXi host to provision the Broker VM routing tables.

Question 16

When troubleshooting a failing integration instance in XSIAM, which THREE tools or logs are most useful for diagnosing the root cause? (Choose three)

Accepted Answer

System Audit logs for administrative actions. Troubleshooting integrations involves checking the Audit logs, the Automation Debug / Integration logs, and testing connectivity via CLI.

Answer

Cortex XDR Agent endpoint quarantine logs

Answer

The local BIOS event log of the client workstation

Question 17

Which THREE best practices should be followed when designing custom automation integrations and playbooks in XSIAM? (Choose three)

Accepted Answer

Design modular sub-playbooks for reusable automation tasks. Best practices include handling errors gracefully, using credentials securely via integration parameters, and designing modular playbooks.

Answer

Hardcode admin service account passwords directly into Python automation scripts

Answer

Execute all integration commands synchronously on the main UI thread without timeout limits

Question 18

An enterprise has multiple distinct business units, and the security operations team wants to ensure that analysts from Business Unit A can only investigate incidents assigned to their own unit, while global administrators can view everything. Which feature enables this multi-tenant or partitioned operational structure within a single XSIAM tenant?

Accepted Answer

Configure Security Domains / Data Partitioning to restrict incident visibility by organizational boundaries.. Custom Security Domains or tenant partitioning features in XSIAM allow segregating data and incidents by organizational units using granular access controls.

Answer

Deploy separate Broker VMs for each business unit without configuring user roles.

Answer

Create separate correlation rules with identical logic for each user.

Answer

Set up independent data retention periods for each analyst account.

Question 19

An administrator is preparing to deploy the Cortex XDR agent on Windows workstations via an Active Directory Group Policy Object (GPO). Which file format must the administrator download from the XSIAM console for this deployment method?

Accepted Answer

.msi. Active Directory GPO software installation deployments require an MSI (Microsoft Installer) package format.

Answer

.exe

Answer

.tar.gz

Answer

.ova

Question 20

An administrator needs to ensure that custom dashboards created by SOC analysts are backed up or migrated between environments. Which TWO options are available for content portability in XSIAM? (Choose two)

Accepted Answer

Export dashboard definitions to JSON format for migration across tenants.. Dashboards and custom content can be exported and imported as content packs or JSON definitions through Content Management features.

Answer

Copy the browser cookies of the analyst's session.

Answer

Print physical paper copies of the dashboard screens.

Answer

Manually retype every XQL query into a notepad file on a local workstation without export tools.