XSIAM-Engineer Practice Questions 1 — 50 Questions

Question 1

An administrator wants to configure automated email notifications to be sent to external stakeholders whenever a Critical severity incident is created. Which feature should be configured?

Accepted Answer

Configure an Incident Notification profile or webhook integration under Settings > Integrations / Notifications.. Cortex XSIAM provides Incident Notification profiles and webhook integrations under Settings that allow administrators to define rules (e.g., severity = Critical) and send email notifications to external stakeholders. This is the native, supported way to automate email alerts for incidents. It can also integrate with ticketing systems and SIEM/SOAR tools via webhooks.

Answer

Enable Auto-Isolation rules on all endpoints.

Answer

Modify the Log Forwarding profile to send raw JSON syslog packets to the stakeholder's email address.

Answer

Set up a scheduled XQL query that emails CSV attachments every minute.

Question 2

An administrator is setting up custom Role-Based Access Control (RBAC) folders and permissions in Cortex XSIAM to segregate data access between regional security teams. Which TWO configuration steps are required when creating a new custom role and assigning data scopes? (Choose two)

Accepted Answer

Define the specific functional permissions (such as incident viewing, response actions, or configuration management) assigned to the role.. Option A is correct because a custom RBAC role in Cortex XSIAM must explicitly define its functional permissions, i.e., which actions members can perform such as viewing incidents, executing response actions, or managing configuration, since permissions are granted by the role and not inherited implicitly. Option D is correct because data scopes are the mechanism that restricts which incidents, alerts, or datasets a role can access, typically based on tags or criteria, which is exactly what is needed to segregate data between regional security teams. The other options do not belong: B is wrong because roles are created through the Cortex XSIAM management console or supported APIs, not by manually compiling source code into a JSON manifest; C is wrong because authorization is enforced centrally by the Cortex XSIAM platform, not by XSOAR engines on analyst workstations; and E is wrong because Broker VMs and log collectors handle data ingestion and forwarding, and rebooting them is not part of propagating role definitions.

Answer

Manually compile the source code of the role policy into a JSON manifest and push it via the REST API.

Answer

Install an additional XSOAR engine on each analyst workstation to enforce local authorization checks.

Answer

Reboot all Broker VMs in the region to propagate the new role definitions to local log collectors.

Question 3

During the infrastructure readiness assessment for Cortex XSIAM deployment, which outbound network connectivity requirement must be verified for the Broker VM to ensure proper communication with the XSIAM tenant?

Accepted Answer

Outbound TCP port 443 to the assigned Cortex XSIAM tenant URL and services.. The Broker VM must be able to reach the assigned Cortex XSIAM tenant URL and associated services over outbound TCP port 443. This TLS-based connectivity is how the Broker VM registers with the tenant, pulls configuration, and forwards collected telemetry to the XSIAM cloud.

Answer

Inbound TCP port 22 and TCP port 80 for remote SSH administration and unencrypted web traffic.

Answer

Bidirectional UDP port 514 for unencrypted syslog tunneling across the WAN.

Answer

Outbound TCP port 3389 for remote desktop management of the appliance.

Question 4

Which TWO components or methods are valid options for ingesting third-party log data into XSIAM? (Choose two)

Accepted Answer

Palo Alto Networks Broker VM log collectors. Option B is correct because the Palo Alto Networks Broker VM is the on-premises component that hosts log collectors and forwards third-party log data into XSIAM when direct cloud ingestion isn't possible. Option D is correct because XSIAM supports cloud-native data ingestion through integrations such as AWS SQS and Azure Event Hubs, which pull logs from cloud services into the platform. Option A is incorrect because XSIAM does not ingest third-party logs via manual CSV uploads on a user profile page. Option C is incorrect because XSIAM does not use direct SQL Server database replication as an ingestion method. Option E is incorrect because there is no physical serial cable connection to an XSIAM tenant gateway for log ingestion.

Answer

Manual CSV file upload via the user profile page

Answer

Direct database replication via SQL Server Management Studio

Answer

Physical serial cable connection to the XSIAM tenant gateway

Question 5

A security architect is designing a Cortex XSIAM deployment for an organization with a primary data center and a disaster recovery site. The organization requires that if the primary site fails, the Cortex XSIAM tenant remains accessible and ingestion continues with minimal data loss. Which deployment approach should the architect recommend?

Accepted Answer

Rely on the built-in high availability and redundancy of the Cortex XSIAM cloud service and deploy redundant Broker VMs at each site for local collection.. Cortex XSIAM is a cloud-delivered service, so tenant availability and redundancy are provided by Palo Alto Networks. Resilience for ingestion is achieved by placing redundant Broker VMs at each site so local collection continues during a site outage. Customer-managed second tenants, on-premises Engine failover, and standby appliances are not supported architectures for tenant high availability.

Answer

Deploy a Cortex XSIAM Engine on-premises at the disaster recovery site and configure it to take over ingestion during a primary site outage.

Answer

Configure a site-to-site VPN between the primary and disaster recovery sites and replicate all logs to a standby Cortex XSIAM appliance.

Answer

Deploy a second Cortex XSIAM tenant in the disaster recovery site and manually switch DNS records during failover.

Question 6

An operations team needs to ensure that inactive user accounts are automatically locked out after 90 days of inactivity. Where is this security policy managed?

Accepted Answer

Go to Settings > Access Management > Authentication / Security settings to configure password and account inactivity policies.. Account inactivity lockout policies in Cortex XSIAM are managed under Settings > Access Management > Authentication / Security settings, where password policies and account inactivity thresholds are configured. This is where administrators define how long an account can remain inactive before being locked. It is the correct location for enforcing a 90-day inactivity lockout.

Answer

Configure an Agent Protection policy under Endpoint Management.

Answer

Set up an automated correlation rule to detect inactive login tokens.

Answer

Modify the Log Forwarding rule timeout threshold.

Question 7

An administrator is verifying that firewall rules at the corporate perimeter permit outbound communication from Cortex XDR agents. Which destination criteria must be allowed for agent communication?

Accepted Answer

Outbound TCP port 443 to Palo Alto Networks XSIAM cloud FQDNs. Cortex XDR agents communicate with the Cortex XSIAM cloud over outbound TCP 443 to Palo Alto Networks cloud FQDNs. This encrypted channel carries telemetry, policy updates, and management traffic, so perimeter firewall rules must allow outbound 443 to those destinations.

Answer

Inbound TCP port 22 and 3389 for remote diagnostics

Answer

Outbound UDP port 514 for direct syslog streaming to the cloud

Answer

Inbound and outbound TCP port 80 for unencrypted configuration checks

Question 8

An analyst wants to export a list of active incidents to a CSV file for offline reporting. Which feature in the Incident view should be used?

Accepted Answer

Use the export option in the Incident view toolbar to download incidents as a CSV file.. The Incident view includes export options that allow exporting selected or all incident data into CSV format.

Answer

Run an automated ransomware remediation script.

Answer

Configure a Log Forwarding profile to dump CSV files to a local printer.

Answer

Open the Endpoint Management view and select Export Agents.

Question 9

An administrator is configuring data collection policies in Cortex XSIAM to optimize storage and ingestion costs. The organization wishes to exclude verbose, non-security-relevant informational logs from a specific firewall source. Which mechanism should the administrator configure?

Accepted Answer

Data Ingestion Filters / Drop Rules. Data Ingestion Filters (also called Drop Rules) in Cortex XSIAM allow administrators to filter or drop specific log types, fields, or sources before they are stored, reducing ingestion volume and cost without affecting detection coverage for security-relevant events. This is the correct mechanism to exclude verbose informational logs from a specific firewall source.

Answer

Endpoint isolation policies

Answer

XQL scheduled queries with automated table deletion

Answer

Agent upgrade rings

Question 10

A security architect is planning the network requirements for a new Cortex XSIAM tenant. The organization wants to ensure that the on-premises Broker VM can securely communicate with the Cortex XSIAM cloud services. Which outbound port must be allowed from the Broker VM to the Cortex XSIAM cloud for management and data plane traffic?

Accepted Answer

TCP 443. The Broker VM must be able to reach the Cortex XSIAM cloud over the internet. All communication is encrypted and uses standard HTTPS on TCP 443. This port is required for both management and data plane traffic, including log forwarding and policy updates. Without outbound TCP 443, the Broker VM cannot register or send data to the tenant.

Answer

TCP 8443

Answer

TCP 8080

Answer

TCP 22

Question 11

An administrator needs to troubleshoot why a Broker VM is failing to ingest logs from an internal syslog source. Which diagnostic utility available on the Broker VM console should the administrator use first?

Accepted Answer

Access the Broker VM management console to check service status, connectivity test tools, and container logs.. Broker VMs include management interfaces and troubleshooting utilities (such as system status checks, service health monitoring, and log collection tools) accessible via its local administrative CLI or web interface.

Answer

Run the `xdrctl troubleshoot` command from any managed Windows endpoint agent console.

Answer

Reset the cloud tenant encryption keys under General Settings.

Answer

Open the XSIAM Incident Graph to view packet captures from the Broker VM IP.

Question 12

An administrator is deploying the Cortex XSIAM agent via Microsoft Intune and needs to ensure that kernel-level extensions on macOS endpoints do not block the installation. Which preliminary step must be completed?

Accepted Answer

Pre-approve system extensions and network filters using an MDM configuration profile. On macOS, Cortex XSIAM agent installation requires kernel-level system extensions and network filters, which macOS blocks unless they are pre-approved via an MDM configuration profile. When deploying through Microsoft Intune, the administrator must push a configuration profile that pre-approves the XSIAM system extension and network filter identifiers before the agent package is installed.

Answer

Convert all macOS file systems to legacy HFS+ format

Answer

Disable SIP (System Integrity Protection) on all target macOS endpoints

Answer

Install the XSIAM agent manually using an interactive terminal session

Question 13

An administrator wants to optimize XQL search performance across large log datasets. Which TWO best practices should be applied when writing queries? (Choose two)

Accepted Answer

Specify the dataset early in the query using the `dataset = ...` clause to narrow the search scope.. Option A is correct because specifying the dataset early with the `dataset = ...` clause restricts the XQL search to only the relevant data, reducing the volume of records scanned and improving query performance. Option E is correct because limiting the time range to the smallest necessary window minimizes the amount of historical data processed, which is a core optimization for large log datasets. Options B and C are incorrect because querying all historical data without time limits and avoiding filters both increase the data scanned and degrade performance. Option D is incorrect because raw regex parsing on unparsed datasets is expensive and less efficient than using parsed fields and structured filters.

Answer

Always query all historical datasets without time limits to ensure completeness.

Answer

Avoid using any filters and sort by random strings.

Answer

Execute all searches using raw regex parsing on unparsed datasets.

Question 14

An XSIAM engineer wants to test a new automation script that parses indicators from an external threat feed. The script should run automatically every hour. Which XSIAM feature should be used to schedule this script?

Accepted Answer

Automation Engine scheduled task. The Automation Engine scheduled task is designed to run scripts or playbooks on a recurring schedule using cron expressions. It provides a centralized way to manage and monitor scheduled executions, making it the correct choice for running a script every hour. Other features like playbook triggers or incident timers are not intended for standalone script scheduling.

Answer

War Room CLI command '!schedule' with a script name

Answer

Playbook trigger with 'scheduled' type

Answer

Incident type 'timer' with a script action

Question 15

When setting up a new Data Collector, you need to ensure high availability for log collection from a remote site. What is the best practice for deploying the collectors?

Accepted Answer

Install multiple collectors and assign them to the same Collector Group.. Grouping collectors allows for load balancing and fault tolerance within the XSIAM architecture.

Answer

Create separate ingestion instances for every collector.

Answer

Install one large collector and increase its CPU allocation.

Answer

Configure log forwarding to a single collector and use a load balancer at the network layer.

Question 16

An administrator needs to ensure that custom dashboards created by SOC analysts are backed up or migrated between environments. Which TWO options are available for content portability in XSIAM? (Choose two)

Accepted Answer

Export dashboard definitions to JSON format for migration across tenants.. Option C is correct because XSIAM allows dashboard definitions to be exported as JSON, which preserves the dashboard structure, widgets, and queries so they can be imported into another tenant or environment. Option D is correct because the Content Management feature supports packaging custom dashboards and widgets into a content pack, enabling controlled backup and migration of content between environments. Option A is incorrect because browser cookies only maintain a user's authenticated session and contain no portable dashboard definitions. Option B is incorrect because paper printouts are static and cannot be reimported or migrated as functional content. Option E is incorrect because manually retyping XQL queries is error-prone and does not constitute a supported content portability mechanism.

Answer

Copy the browser cookies of the analyst's session.

Answer

Print physical paper copies of the dashboard screens.

Answer

Manually retype every XQL query into a notepad file on a local workstation without export tools.

Question 17

An administrator is troubleshooting an issue where a Broker VM fails to download content updates from the Cortex XSIAM cloud. The Broker VM has outbound internet access via an enterprise web proxy. Where must the proxy settings be configured on the Broker VM?

Accepted Answer

In the Broker VM appliance management console configuration settings for proxy parameters.. Proxy settings for the Broker VM must be configured in the Broker VM appliance management console, which is the local management interface where network parameters including proxy host, port, and credentials are defined. This is the supported method for routing Broker VM content update traffic through an enterprise web proxy. The tenant UI does not push proxy configuration down to the Broker VM.

Answer

In the Cortex XSIAM tenant UI under Incident Response settings.

Answer

By editing the local firewall rules using iptables to forward port 80 to port 3128.

Answer

By modifying the Windows Registry on the underlying host operating system.

Question 18

An engineer is planning the initial deployment of a Cortex XSIAM tenant in a region where the corporate security policy requires all log data to remain within the country. The organization operates primarily in Germany and wants to minimize latency for data ingestion. Which deployment consideration should the engineer prioritize?

Accepted Answer

Deploy the tenant in the Europe (Frankfurt) region to meet data residency requirements and reduce ingestion latency.. Cortex XSIAM offers regional cloud tenants to address data residency and latency. For a German organization with strict in-country data storage policies, selecting the Europe (Frankfurt) region is the correct planning step. It ensures compliance and optimizes performance by keeping data close to the source. Other regions either violate policy or introduce unnecessary complexity.

Answer

Deploy the tenant in the Asia Pacific (Singapore) region and configure a local Broker VM in Germany to cache logs temporarily.

Answer

Deploy the tenant in the United States (Oregon) region and use a VPN to tunnel all log data back to Germany for storage.

Answer

Deploy the tenant in the Europe (Frankfurt) region but disable all cloud-based analytics to ensure data never leaves the local Broker VM.

Question 19

An administrator is troubleshooting a Broker VM that is showing a 'Disconnected' status in the Cortex XSIAM console. After verifying network routing and outbound HTTPS connectivity, the administrator checks the Broker VM system logs and discovers a system time synchronization failure. Why would a time sync failure cause disconnection?

Accepted Answer

The Cortex XSIAM cloud backend rejects TLS connections when time drift between the client and server exceeds allowable security thresholds.. TLS certificate validation depends on the client clock being within the certificate's validity period and within the server's acceptable drift tolerance. If the Broker VM's system time drifts too far, the TLS handshake to the XSIAM cloud fails, and the broker shows 'Disconnected' even though routing and port 443 are fine. Correcting NTP restores the handshake.

Answer

The Broker VM operating system automatically shuts down all network interfaces after 10 minutes of clock discrepancy.

Answer

Log collection collectors stop accepting UDP packets if the system time is set to UTC instead of local time.

Answer

The XSIAM licensing server revokes the Broker VM activation token if NTP is not reachable every 60 seconds.

Question 20

An architect is planning the installation of Cortex XSIAM in a hybrid environment where some log sources are in the cloud and some are on-premises. The architect wants to ensure that all log sources can be onboarded efficiently. Which statement about log source onboarding in Cortex XSIAM is correct?

Accepted Answer

Cloud-based log sources can send logs directly to the Cortex XSIAM tenant using the tenant's ingestion API, while on-premises sources require a Broker VM.. Cortex XSIAM supports direct ingestion from cloud sources via API and requires Broker VM for on-premises sources that cannot directly reach the tenant. This hybrid model provides flexibility and efficiency, allowing cloud sources to onboard quickly while on-premises sources use Broker VM for collection and forwarding.

Answer

All log sources, whether cloud or on-premises, must forward logs through a Broker VM to ensure data normalization.

Answer

On-premises log sources can send logs directly to the Cortex XSIAM tenant if they have outbound TCP 443 access, eliminating the need for a Broker VM.

Answer

Cloud log sources must be configured with a site-to-site VPN to the Cortex XSIAM tenant to ensure secure ingestion.