XSIAM-Engineer Practice Test 3 — 10 Questions

Question 1

A Cortex XSIAM administrator needs to grant a new SOC analyst the ability to view incidents and run playbooks but not modify system configurations. Which built-in role should the administrator assign?

Accepted Answer

SOC Analyst. The SOC Analyst role in Cortex XSIAM provides the necessary permissions to view incidents and run playbooks while preventing changes to system configurations. It embodies least privilege for a SOC analyst. Security Admin and Instance Admin are too permissive, and Read-Only Analyst lacks playbook execution rights, making SOC Analyst the correct choice.

Answer

Read-Only Analyst

Answer

Instance Admin

Answer

Security Admin

Question 2

You need to ensure that a specific integration uses a dedicated proxy server to communicate with the cloud. Where is this proxy configuration defined?

Accepted Answer

The Integration Instance configuration settings.. Proxy settings for individual integrations are managed within the specific Integration Instance configuration panel.

Answer

Data Management > Collector Group settings.

Answer

The XQL Query Builder Advanced tab.

Answer

Global Settings > Network > Proxy.

Question 3

An administrator needs to verify whether a newly deployed Broker VM is successfully forwarding logs to the Cortex XSIAM tenant. Which tool or menu within the XSIAM console allows the administrator to view real-time incoming log counts and ingestion rates?

Accepted Answer

Dashboards > Data Ingestion (or Settings > Data Collection). The Dashboards > Data Ingestion view (also accessible via Settings > Data Collection) is the dedicated monitoring surface in Cortex XSIAM for tracking log flow from Brokers and other collectors into the tenant. It displays real-time incoming log counts, ingestion rates (events per second), and per-source breakdowns, allowing an administrator to confirm that a newly deployed Broker VM is actively forwarding data. This is the only option that surfaces ingestion telemetry rather than query, identity, or alerting data.

Answer

XQL Search > Incident Explorer

Answer

Cloud Identity > Users > Audit Trail

Answer

Incidents > Active Alerts

Question 4

An automation engineer is building a custom Python integration in Cortex XSIAM that must retrieve a list of indicators from an external threat intelligence platform. The platform's API returns a JSON object with a nested array under the key 'data'. The engineer wants the integration command to output a clean list of indicators that can be used in subsequent playbook tasks. Which approach should the engineer take to parse the API response and return the indicators?

Accepted Answer

Use the return_outputs() function to return a human-readable table and a separate context entry containing the 'data' array extracted using Python's json module.. The correct approach is to use return_outputs() to provide a human-readable table and a context entry containing the extracted 'data' array. This allows playbook tasks to easily reference the list of indicators via context keys. Parsing the JSON within the integration ensures the command is self-contained and reusable, following Cortex XSIAM integration development best practices.

Answer

Use the demisto.executeCommand() function to call a built-in transformer that parses JSON and returns the 'data' array as a list of indicators.

Answer

Use the demisto.results() function to return the entire JSON response as a single entry, and then use a playbook task with a transformer to extract the 'data' array.

Answer

Use the demisto.createIndicators() function to directly create indicators from the API response, bypassing the need to return a list.

Question 5

Which THREE of the following are benefits of using the XDM (eXtendable Data Model) in Cortex XSIAM?

Accepted Answer

Improved performance and speed of XQL queries.. Option B is correct because XDM maps ingested data into a consistent, indexed schema, which lets XQL queries run against normalized fields and datasets more efficiently, improving query performance and speed. Option C is correct because XDM provides a common vocabulary and unified fields (for example, shared actor, causality, and alert fields) that make it possible to correlate alerts and events from many different vendors rather than treating each source's proprietary format separately. Option D is correct because the core purpose of the Cortex XSIAM eXtendable Data Model is to normalize disparate data sources—endpoint, network, cloud, identity, and third-party logs—into a single common schema so they can be searched and analyzed uniformly. Option A is not a benefit of XDM; API keys for third-party integrations are created through configuration/integration settings, not by the data model. Option E is also not a benefit of XDM; the model normalizes field structure and semantics, but it does not automatically translate all log content into English.

Answer

Automatic creation of API keys for third-party tools.

Answer

Automatic translation of all log content into English.

Question 6

When setting up administrative access to Cortex XSIAM, what is the best practice regarding the use of the initial built-in superuser account?

Accepted Answer

Use the superuser account for initial tenant configuration and setup of IdP federation, then transition to individual RBAC accounts.. The initial superuser account should be used sparingly, primarily for bootstrapping the tenant, configuring IdP/SAML, and creating role-assigned administrative accounts adhering to the principle of least privilege.

Answer

Use the built-in superuser account for all daily Tier-1 SOC alert triage and incident response workflows.

Answer

Disable the built-in superuser account immediately before performing any initial configuration tasks.

Answer

Share the superuser credentials among all SOC analysts to ensure shift-change continuity.

Question 7

An enterprise has multiple distinct business units, and the security operations team wants to ensure that analysts from Business Unit A can only investigate incidents assigned to their own unit, while global administrators can view everything. Which feature enables this multi-tenant or partitioned operational structure within a single XSIAM tenant?

Accepted Answer

Configure Security Domains / Data Partitioning to restrict incident visibility by organizational boundaries.. Security Domains (also called data partitioning) in XSIAM allow administrators to define organizational boundaries and assign users to domains, so analysts only see incidents, alerts, and assets within their domain. Global administrators can be granted access to all domains, satisfying the requirement for cross-unit visibility.

Answer

Deploy separate Broker VMs for each business unit without configuring user roles.

Answer

Create separate correlation rules with identical logic for each user.

Answer

Set up independent data retention periods for each analyst account.

Question 8

A Cortex XSIAM engineer deploys a new custom integration that calls an internal ticketing API. The integration works when tested from the engineer's workstation but fails inside XSIAM with connection errors, and the API requires a client certificate that the engineer generated locally. What should the engineer configure to let the integration present that certificate?

Accepted Answer

Upload the client certificate and its private key to the integration instance's certificate configuration.. The API enforces mutual TLS, so the integration must present a client certificate and its private key when connecting. Storing that material in the integration instance's certificate configuration makes it available to the runtime environment, which is why the call succeeds there while failing when the credential is only present on the workstation.

Answer

Paste the certificate's public portion into the integration's API key parameter field.

Answer

Copy the certificate file to the engineer's workstation trust store and re-run the test.

Answer

Add the API hostname to the integration's proxy exclusion list so the call bypasses the proxy.

Question 9

An administrator needs to configure automated incident assignment so that all incidents originating from network firewall logs are automatically routed to the Network Security SOC team. Which XSIAM feature accomplishes this?

Accepted Answer

Configure Incident Assignment Rules based on source data categories or alert types.. Incident assignment rules and automation routing rules can be configured in XSIAM to automatically assign incoming incidents based on data sources, severity, or categories.

Answer

Modify the global tenant retention policy to isolate firewall logs.

Answer

Enable Auto-Isolation profiles on all network gateways.

Answer

Set up a Log Forwarding profile targeting the Network Security team's email addresses.

Question 10

An engineer is deploying a Cortex XSIAM Broker VM on a VMware ESXi host. After importing the OVA, the engineer needs to assign a static IP address to the Broker VM. Which method should the engineer use to configure the network settings?

Accepted Answer

Use the console of the VM to run the network configuration wizard. The Broker VM's initial network configuration is performed through its local console using a text-based wizard. This wizard allows setting a static IP address, subnet mask, default gateway, and DNS servers. This method ensures the VM has network connectivity before any web-based management is possible. Editing VM files or using DHCP does not meet the static IP requirement.

Answer

Edit the VM's .vmx file to include the IP address

Answer

Use the Broker VM's web console to set the IP address

Answer

Configure a DHCP reservation on the DHCP server