XSIAM-Engineer Practice Test 2 — 30 Questions

Question 1

During routine maintenance, an administrator notices that a custom parser is dropping incoming events from a newly integrated security appliance. Where should the administrator check to debug syntax and grok pattern failures in real time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Navigate to Settings > Configurations > Data Collection > Parsers, select the custom parser, and use the Test Parser feature with sample raw logs.. The Log Forwarding and Log ingestion troubleshooting within XSIAM includes a parser testing utility where sample log lines can be pasted and tested against custom parsers to debug grok patterns and extraction rules.

Answer

SSH into the Cortex XSIAM management cluster master node and check the /var/log/parser.log file.

Answer

Open the Cortex XDR Agent console on the local machine and export the Agent Log Collector bundle.

Answer

Review the Incident Graph to trace dropped packets from the ingestion pipeline.

Question 2

You are configuring a new ingestion integration for a cloud provider via API. You notice that data is not arriving in Cortex XSIAM despite the integration being marked as 'Active'. Where should you first verify the ingestion status and potential API credential errors?

Accepted Answer

View the 'Data Ingestion' tab under 'Settings' > 'Data Management' to inspect ingestion status and logs.. The Data Ingestion status page provides specific health metrics and error logs for individual ingestion points.

Answer

Navigate to 'Marketplace' and restart the integration instance.

Answer

Check the 'Playbooks' execution logs to see if the collector is failing.

Answer

Examine the 'Alerts' dashboard for 'Ingestion Failure' alerts.

Question 3

When managing integrations in XSIAM, what is the purpose of the 'Test' button found in the integration instance configuration?

Accepted Answer

It verifies connectivity and credentials with the third-party service.. The test button validates the connectivity and authentication credentials against the target service.

Answer

It updates the integration plugin to the latest version.

Answer

It triggers a full synchronization of all historical data.

Answer

It pushes a sample alert to the third-party system.

Question 4

An organization requires all audit logs generated within XSIAM to be exported to an external SIEM for long-term archiving. Which feature should the administrator configure?

Accepted Answer

Configure a Log Forwarding profile under Settings > Configurations > Data Collection > Log Forwarding.. External log forwarding rules can be configured in XSIAM to stream logs, including audit and security events, to third-party destinations via standard protocols like syslog or HTTP.

Answer

Enable Cortex XSOAR playbook automation to execute a daily database backup.

Answer

Set up a BIOC alert rule to email CSV exports every 24 hours.

Answer

Modify the Data Retention profile to replicate raw blocks to an external S3 bucket automatically.

Question 5

Which TWO of the following actions can be performed within the Cortex XSIAM Marketplace?

Accepted Answer

Install and manage integration plugins.. The Marketplace is used for installing integrations and managing content packs.

Answer

Directly edit the source code of the underlying XSIAM engine.

Answer

Configure individual log forwarding destinations.

Answer

Provision new physical server hardware for collectors.

Question 6

An administrator is setting up a new Broker VM in an isolated network zone that requires all outbound HTTPS traffic to traverse an explicit corporate proxy server. Where must the proxy configuration be applied for the Broker VM to communicate with XSIAM?

Accepted Answer

Configure the proxy settings during the Broker VM setup or within its configuration parameters so it can reach the XSIAM cloud.. Broker VM proxy settings are configured during deployment or via the Broker VM configuration interface to ensure all cloud communications traverse the designated proxy.

Answer

Apply the proxy configuration via the Cortex XDR Agent installation profile.

Answer

Configure the proxy settings inside the Windows registry of the local administrator's workstation.

Answer

Modify the XQL search query headers to include proxy authentication tokens.

Question 7

An analyst wants to export a list of active incidents to a CSV file for offline reporting. Which feature in the Incident view should be used?

Accepted Answer

Use the export option in the Incident view toolbar to download incidents as a CSV file.. The Incident view includes export options that allow exporting selected or all incident data into CSV format.

Answer

Run an automated ransomware remediation script.

Answer

Configure a Log Forwarding profile to dump CSV files to a local printer.

Answer

Open the Endpoint Management view and select Export Agents.

Question 8

An administrator needs to verify whether a newly created Correlation Rule is actively evaluating incoming telemetry. Where should the administrator check the rule's operational status and recent execution statistics?

Accepted Answer

Check the Correlation Rules / Analytics page where rule status, hit counts, and last execution details are displayed.. Correlation rules and analytics rules display their operational status, hit counts, and execution metrics within the Analytics or Correlation Rules management page.

Answer

Inspect the Cortex XDR Agent installation directory for rule cache files.

Answer

Review the Windows Event Viewer on the primary Domain Controller.

Answer

Examine the Firewall Traffic logs for outgoing rule-check packets.

Question 9

You are writing a custom XQL query to filter logs, but you find that the field names are inconsistent across your data sources. How can you standardize these fields for your automation?

Accepted Answer

Ensure proper XDM mapping is applied to the ingestion source.. XDM (eXtendable Data Model) mapping ensures that logs from different sources are normalized into common field names, making queries more robust.

Answer

Rely on the raw log field names and map them manually in the playbook.

Answer

Use the 'Rename' function in every XQL query.

Answer

Use an external script to rewrite the logs before they reach XSIAM.

Question 10

An administrator is setting up external log forwarding from XSIAM to a third-party SIEM. Which TWO protocols are natively supported for log forwarding destinations? (Choose two)

Accepted Answer

Syslog (TCP or UDP). XSIAM log forwarding profiles support industry standard streaming protocols such as Syslog and HTTP/HTTPS (Webhooks).

Answer

Direct FTP file upload of raw database blocks

Answer

Direct SMB file share mapping to the XSIAM cloud backend storage

Answer

Local Bluetooth serial cable connection

Question 11

An administrator is troubleshooting an API integration that has stopped collecting data. Which THREE diagnostic steps should be performed? (Choose three)

Accepted Answer

Verify if the API key, token, or credentials have expired or been revoked.. Troubleshooting API integrations involves checking API credential validity, reviewing integration execution logs for error codes, and verifying network connectivity between the integration poller and the target service.

Answer

Reinstall the local printer drivers on the administrator's laptop.

Answer

Format the Broker VM Docker container storage volumes.

Question 12

An organization requires that all API access tokens used for programmatic interaction with XSIAM expire every 90 days. Where can API key expiration policies be configured?

Accepted Answer

Manage API key creation, expiration, and revocation under Settings > Integrations > API Keys.. API key lifecycles and generation policies are managed under Settings > Integrations > API Keys or Access Management.

Answer

Configure the Agent Software Upgrade schedule under Endpoint Management.

Answer

Adjust the Broker VM Docker container memory limit.

Answer

Modify the XQL query timeout threshold.

Question 13

An administrator needs to configure automated incident assignment so that all incidents originating from network firewall logs are automatically routed to the Network Security SOC team. Which XSIAM feature accomplishes this?

Accepted Answer

Configure Incident Assignment Rules based on source data categories or alert types.. Incident assignment rules and automation routing rules can be configured in XSIAM to automatically assign incoming incidents based on data sources, severity, or categories.

Answer

Modify the global tenant retention policy to isolate firewall logs.

Answer

Enable Auto-Isolation profiles on all network gateways.

Answer

Set up a Log Forwarding profile targeting the Network Security team's email addresses.

Question 14

An administrator wants to create a custom dashboard displaying key SOC metrics such as open incidents by severity and top alerted hosts. Which section of XSIAM should the administrator use to build this dashboard?

Accepted Answer

Navigate to Dashboards > Create Dashboard to add widgets based on XQL queries.. Custom dashboards can be created and managed under the Dashboards section of the XSIAM navigation menu using widgets powered by XQL queries.

Answer

Use the Report Builder to schedule weekly PDF summaries.

Answer

Go to Settings > Configurations > Data Collection > Dashboards.

Answer

Open the Incident Graph and click Export as Dashboard.

Question 15

An administrator is configuring log collection from a cloud storage bucket (e.g., AWS S3) into XSIAM. Which TWO configuration steps are required to establish this ingestion pipeline? (Choose two)

Accepted Answer

Specify the target bucket name and region in the XSIAM Data Collection configuration.. Cloud storage bucket ingestion requires setting up cloud integration credentials (IAM roles/keys) and configuring the data collection instance in XSIAM specifying the bucket details.

Answer

Deploy a physical hardware appliance in every AWS Availability Zone.

Answer

Configure the local Windows registry on the administrator workstation to route AWS traffic.

Answer

Manually install the Cortex XDR Agent on the AWS S3 root server.

Question 16

An administrator is reviewing the health of endpoint agents across the enterprise. Which TWO statuses or metrics can be monitored in the Endpoint Management view? (Choose two)

Accepted Answer

Installed agent software version and content version. Endpoint Management tracks agent connectivity status, software versions, operational module statuses, and content versions.

Answer

Local printer ink levels on managed workstations

Answer

Individual employee Wi-Fi password history

Answer

Personal email login credentials stored in browser caches

Question 17

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux servers. Which THREE tasks should be performed during the planning and deployment phase? (Choose three)

Accepted Answer

Establish phased rollout groups to monitor stability and prevent widespread issues.. Agent deployment planning includes creating OS-specific installation packages/profiles, verifying prerequisites and exclusion lists, and defining upgrade schedules.

Answer

Manually connect a serial console cable to every server in the data center.

Answer

Disable all firewall rules on the XSIAM cloud tenant.

Question 18

An administrator is troubleshooting an issue where an endpoint agent is unable to connect to the XSIAM cloud management console, and local logs indicate certificate pinning verification failure. What is the most likely cause?

Accepted Answer

An intermediate network security device or proxy is performing SSL decryption and re-signing traffic with an untrusted certificate.. Certificate pinning failures on endpoint agents usually indicate an SSL inspection appliance or proxy in the network is re-signing traffic with an untrusted root certificate, causing the agent to reject the connection.

Answer

The Cortex XDR agent version is too new for the cloud tenant and must be downgraded.

Answer

The local firewall is blocking UDP port 514 outbound from the endpoint.

Answer

The XSIAM tenant license has expired, causing all agents to enter a permanent lock state.

Question 19

An administrator is investigating a data discrepancy where certain security logs ingested via a Broker VM do not match the raw source timestamps. Where can timezone and timestamp normalization settings be reviewed or adjusted?

Accepted Answer

Review and adjust parser extraction rules and timezone configurations in Settings > Configurations > Data Collection > Parsers.. Timestamp parsing and normalization rules can be reviewed and adjusted within custom parser definitions or ingestion settings in XSIAM.

Answer

Change the system clock on the local administrator workstation.

Answer

Reinstall the Cortex XDR Agent on all network switches.

Answer

Purge the entire Cortex Data Lake to reset cloud time servers.

Question 20

An administrator notices high resource utilization on a Broker VM. Which THREE diagnostic steps or remediation actions should be taken? (Choose three)

Accepted Answer

Review ingestion volume per data source to identify noisy log senders overwhelming the collector.. Troubleshooting high Broker VM resource utilization involves checking container performance metrics, reviewing log ingestion rates for anomalies, and adjusting resource allocations or scaling out.

Answer

Modify the global tenant encryption keys to flush cache memory.

Answer

Reinstall the Cortex XDR agent on all Windows domain controllers.