XSIAM-Engineer Practice Questions 2 — 50 Questions

Question 1

An administrator needs to deploy a custom content pack containing specialized dashboards, parsers, and rules across multiple child tenants in a multi-tenant XSIAM environment. Where should the content pack be managed and distributed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Content Management / Marketplace to package and distribute custom content across tenants.. Content packs and shared content across multi-tenant or enterprise architectures can be managed and distributed via the Content Management / Marketplace features within XSIAM.

Answer

Deploy the files via USB drives to every Broker VM in the organization.

Answer

Modify the global DNS records to point to the new content repository.

Answer

Manually copy and paste JSON configuration files into each user's local browser cache.

Question 2

When planning an enterprise-wide rollout of Cortex XDR agents, administrators often utilize 'Upgrade Rings'. What is the primary purpose of an upgrade ring in Cortex XSIAM deployment strategy?

Accepted Answer

To stage and test new agent versions on pilot endpoint groups before broad production rollout. Upgrade rings allow administrators to test new agent versions on a small pilot group of endpoints before deploying them broadly across the organization.

Answer

To automatically rotate encryption keys for network proxies every 24 hours

Answer

To segment firewall log ingestion by geographic region

Answer

To load-balance syslog traffic across multiple Broker VMs

Question 3

An engineer is preparing the network prerequisites for a new Cortex XSIAM deployment. The security team must allow outbound connectivity from the Broker VM to the Cortex XSIAM cloud tenant. Which destination port must be permitted for the Broker VM to establish and maintain its connection?

Accepted Answer

TCP 443. The Broker VM maintains an outbound connection to the Cortex XSIAM tenant over TCP 443. This port carries registration, heartbeats, configuration, and forwarded log data, so it must be permitted through the perimeter firewall. SSH, syslog, and alternative HTTPS ports serve different purposes and do not provide the required tenant connectivity.

Answer

TCP 8443

Answer

TCP 22

Answer

UDP 514

Question 4

During the planning of a Cortex XSIAM deployment in an environment utilizing strict network segmentation, an administrator must ensure that communication between the Broker VM and local log sources (such as firewalls and SIEM forwarders) uses supported protocols. Which protocol combination is natively supported by Broker VM collectors for incoming log ingestion?

Accepted Answer

Syslog (TCP/UDP), Syslog-TLS, and HTTPS/API collection. Broker VMs support standard ingestion protocols including Syslog (TCP/UDP), Syslog-TLS, HTTP/HTTPS API collection, and secure file polling mechanisms.

Answer

Direct SMB file shares, RDP clipboard sharing, and NetBIOS name resolution

Answer

IPsec VPN encapsulation and GRE tunneling directly to the agent kernel

Answer

SNMP v1 read-only polling and Telnet terminal scraping

Question 5

An administrator is setting up a new Broker VM in an isolated network zone that requires all outbound HTTPS traffic to traverse an explicit corporate proxy server. Where must the proxy configuration be applied for the Broker VM to communicate with XSIAM?

Accepted Answer

Configure the proxy settings during the Broker VM setup or within its configuration parameters so it can reach the XSIAM cloud.. Broker VM proxy settings are configured during deployment or via the Broker VM configuration interface to ensure all cloud communications traverse the designated proxy.

Answer

Apply the proxy configuration via the Cortex XDR Agent installation profile.

Answer

Configure the proxy settings inside the Windows registry of the local administrator's workstation.

Answer

Modify the XQL search query headers to include proxy authentication tokens.

Question 6

An automation engineer is writing a custom Python script for an XSIAM automation task and needs to query XSIAM incident data. Which integration library or command standard must be used to execute commands against the Cortex XSOAR/XSIAM engine?

Accepted Answer

The demisto Python library. Custom Python scripts in XSIAM automation use the demisto class library to interact with the system context and execute commands.

Answer

The paloalto_xsiam SDK

Answer

The pan-os-python library

Answer

The requests module with direct tenant URL authentication

Question 7

An administrator is setting up an integration with a third-party threat intelligence platform using Cortex XSOAR capabilities embedded within XSIAM. The integration instance requires periodic polling to fetch newly published Indicators of Compromise (IoCs). Where should the administrator configure the fetch interval?

Accepted Answer

Inside the specific integration instance configuration settings. In Cortex XSOAR integration instances, the fetch interval determines how often the integration queries the external source for new data and is configured directly inside the integration instance configuration settings.

Answer

Inside the automated playbook task parameters

Answer

Via the Server Configuration (Settings > About > Server Configuration) global key-value pair

Answer

Within the Threat Intelligence module feeds mapping rules

Question 8

An administrator notices that logs from a specific firewall are not appearing in Cortex XSIAM. The firewall is configured to send syslog to the Broker VM. Where should the administrator check first to determine if the Broker VM is receiving the raw syslog packets?

Accepted Answer

The Broker VM collector status and troubleshooting logs within the Cortex XSIAM management console.. The Broker VM is the component that receives syslog from firewalls and forwards it to Cortex XSIAM. To verify whether raw syslog packets are arriving, the administrator should check the Broker VM collector status and troubleshooting logs in the XSIAM management console, which show ingestion health and errors. This directly answers whether the Broker VM is receiving the data before it is parsed or forwarded.

Answer

The XSIAM tenant billing dashboard to verify license usage.

Answer

The active firewall security policy rulebase.

Answer

The endpoint cytool diagnostic utility on managed servers.

Question 9

A security architect is designing the network flow for a Cortex XSIAM deployment that will ingest logs from on-premises firewalls. The firewalls cannot send logs directly to the internet. The architect plans to deploy a Broker VM in the DMZ. Which outbound connectivity requirement must be met for the Broker VM to forward logs to the Cortex XSIAM tenant?

Accepted Answer

The Broker VM must allow outbound TCP 443 to the tenant's specific fully qualified domain name (FQDN) or IP address range.. The Broker VM forwards logs to the Cortex XSIAM tenant over a secure HTTPS connection on TCP 443. During planning, firewall rules must allow outbound traffic from the Broker VM to the tenant's FQDN or published IP ranges. Other ports like UDP 514 are for inbound log reception, while TCP 22 and 8080 are not used for this communication.

Answer

The Broker VM must allow outbound TCP 8080 to the tenant's FQDN for proxy communication.

Answer

The Broker VM must allow outbound TCP 22 to the tenant's FQDN for secure shell (SSH) tunneling.

Answer

The Broker VM must allow outbound UDP 514 to the tenant's FQDN to forward syslog messages.

Question 10

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux servers. Which THREE tasks should be performed during the planning and deployment phase? (Choose three)

Accepted Answer

Establish phased rollout groups to monitor stability and prevent widespread issues.. Option B is correct because a phased rollout (pilot rings/groups) lets the administrator validate agent stability, performance, and compatibility on a small subset before broad deployment, limiting blast radius if a version causes issues. Option D is correct because existing endpoint security software (e.g., other AV/EDR, or OS-native tools like Windows Defender or SELinux) can conflict with the Cortex XDR agent's kernel-level components, so defining exclusions prevents installation failures, performance degradation, or false positives. Option E is correct because Cortex XDR provides separate agent installers and profiles per platform—Windows (.msi/.exe), macOS (.pkg/.dmg), and Linux (.rpm/.deb)—so OS-specific packages and profiles are required for a mixed environment. Option A is not needed because agent deployment is done via software distribution, GPO, SCCM, or scripts over the network, not serial consoles. Option C is wrong because disabling firewall rules on the XSIAM/Cortex cloud tenant is neither required nor advisable for agent deployment and would weaken security.

Answer

Manually connect a serial console cable to every server in the data center.

Answer

Disable all firewall rules on the XSIAM cloud tenant.

Question 11

An administrator is configuring data ingestion in XSIAM and needs to ensure that logs from a custom internal application are correctly normalized. Which THREE components are essential parts of the XSIAM log ingestion and normalization pipeline? (Choose three)

Accepted Answer

XSIAM Data Lake schema targets. Option E (Log Collector such as Broker VM or Agent) is essential because logs must first be received and forwarded into XSIAM; the Broker VM or endpoint agent provides the ingestion transport that delivers raw events to the platform. Option D (Parsing Rules / Normalization mapping) is correct because XSIAM uses parsing and normalization rules to extract fields from raw logs and map them to the common Cortex Data Model (CDM), which is exactly what is needed to correctly normalize a custom application's logs. Option C (XSIAM Data Lake schema targets) is correct because normalized events must be written into the Data Lake against defined schema targets, ensuring the parsed fields conform to the expected dataset structure for querying and detection. Option A is incorrect because physical network firewall bypass rules are a network-security concept unrelated to log parsing or normalization. Option B is incorrect because XSIAM does not require manually executed SQL queries for every incoming log packet; ingestion and normalization are handled automatically by collectors, parsers, and schema mapping.

Answer

Physical network firewall bypass rules

Answer

Manually executed SQL queries for every incoming log packet

Question 12

An administrator needs to update the Cortex XDR agent installation package across 5,000 endpoints without causing network saturation. Which feature should be utilized to manage this rollout effectively?

Accepted Answer

Configure an Agent Upgrade schedule and phased deployment profile within Endpoint Management > Agent Settings.. Agent software updates can be controlled using Agent Settings and deployment profiles where administrators can set distribution rules, throttling, and phased rollouts.

Answer

Manually push the MSI package via Active Directory Group Policy Objects using an external script.

Answer

Execute an XQL remediation action with the `upgrade_agent` command across all active sessions.

Answer

Set up a global Log Forwarding profile to broadcast the binary over syslog.

Question 13

An administrator is reviewing infrastructure readiness for deploying Cortex XSIAM engines on-premises. Which TWO prerequisites must be validated on the host infrastructure before engine installation? (Choose two)

Accepted Answer

Outbound TCP port 443 connectivity to the Cortex XSIAM cloud environment.. Option A is correct because Cortex XSIAM engines must maintain outbound TCP 443 connectivity to the Cortex XSIAM cloud environment for management, telemetry, and updates, so this must be validated before installation. Option B is correct because engine hosts require adequate CPU, RAM, and disk sizing to handle the anticipated query and parsing workloads; undersized resources will cause performance and ingestion problems. Option C is incorrect because no physical motherboard access or hardware crypto-accelerator card installation is a prerequisite for XSIAM engine deployment. Option D is incorrect because disabling all host firewalls and SELinux entirely is not a requirement and would be a poor security practice. Option E is incorrect because the host does not need to run an Active Directory Domain Controller role to install a Cortex XSIAM engine.

Answer

Direct physical access to the server motherboard to install a hardware crypto-accelerator card.

Answer

Disabling all host system firewalls and SELinux entirely across the corporate datacenter.

Answer

Active Directory Domain Controller role installed on the same host operating system.

Question 14

An administrator wants to ensure high availability and disaster recovery readiness for an XSIAM deployment relying on Broker VMs and cloud ingestion. Which THREE operational practices should be implemented? (Choose three)

Accepted Answer

Configure redundant Broker VM instances behind a load balancer for syslog ingestion.. Option A is correct because deploying redundant Broker VM instances behind a load balancer eliminates a single point of failure for syslog ingestion, allowing traffic to fail over if one Broker VM becomes unavailable, which directly supports high availability. Option D is correct because maintaining current documentation and configuration backups of custom parsers and integration settings ensures that, in a disaster recovery scenario, the XSIAM tenant can be rebuilt or migrated quickly without losing bespoke parsing logic or connector configuration. Option E is correct because regularly monitoring ingestion pipeline health dashboards allows administrators to detect dropped logs, stalled connectors, or degraded Broker VM performance early, enabling remediation before data gaps compromise detection and response. Option B is incorrect because storing raw logs exclusively on local Broker VM drives without cloud replication creates a single point of failure and violates disaster recovery readiness, since local disk loss would permanently destroy the logs. Option C is incorrect because disabling automated correlation rules to conserve bandwidth would severely degrade detection capabilities and does not constitute a valid high availability or disaster recovery practice.

Answer

Store all raw logs exclusively on local Broker VM hard drives without cloud replication.

Answer

Disable all automated correlation rules to conserve disaster recovery bandwidth.

Question 15

An administrator needs to verify whether a newly created Correlation Rule is actively evaluating incoming telemetry. Where should the administrator check the rule's operational status and recent execution statistics?

Accepted Answer

Check the Correlation Rules / Analytics page where rule status, hit counts, and last execution details are displayed.. Correlation rules and analytics rules display their operational status, hit counts, and execution metrics within the Analytics or Correlation Rules management page.

Answer

Inspect the Cortex XDR Agent installation directory for rule cache files.

Answer

Review the Windows Event Viewer on the primary Domain Controller.

Answer

Examine the Firewall Traffic logs for outgoing rule-check packets.

Question 16

An organization plans to ingest cloud audit logs from Amazon Web Services (AWS) into Cortex XSIAM using an automated collector architecture. Which native AWS service integration mechanism is typically recommended and supported by XSIAM for scalable log collection?

Accepted Answer

AWS S3 bucket ingestion leveraging SQS notifications and IAM role authentication. XSIAM's recommended scalable AWS log-collection architecture uses S3 bucket ingestion: AWS services write audit/cloud logs to an S3 bucket, S3 event notifications publish to an SQS queue, and XSIAM's collector polls the queue and pulls the objects using IAM role authentication. This decouples ingestion from the log source, scales horizontally, and avoids exposing credentials. It is the standard, supported pattern for high-volume AWS audit log ingestion.

Answer

Direct SNMP traps forwarded from AWS EC2 metadata service

Answer

Syslog forwarding from the AWS Root Account login page

Answer

Local Cortex XDR agent installation on AWS RDS database instances

Question 17

A security architect is planning a Cortex XSIAM deployment for a company with a single data center and no existing Cortex products. The company wants to forward syslog from 40 network devices to Cortex XSIAM. Which component is required to receive and forward these logs to the Cortex XSIAM tenant?

Accepted Answer

Broker VM deployed in the data center. The Broker VM is the dedicated on-premises log collection component for Cortex XSIAM. It receives syslog and other data from local sources and forwards it to the Cortex XSIAM tenant. Without a Broker VM, the network devices cannot send their syslog directly to the cloud tenant in a supported manner. Therefore, deploying a Broker VM in the data center is the correct planning step.

Answer

Cortex XSOAR engine installed on a management server

Answer

Cortex Data Lake instance provisioned in the data center

Answer

Cortex XDR agent installed on each network device

Question 18

An administrator needs to configure granular access control so that junior SOC analysts can view incidents and run XQL queries, but cannot modify tenant settings or install integrations. Where should the administrator configure these permissions?

Accepted Answer

Settings > Configurations > Access Control > Roles. In Cortex XSIAM, role-based access control (RBAC) is configured under Settings > Configurations > Access Control > Roles, where administrators define roles with granular permissions for incidents, XQL queries, integrations, and tenant settings. Assigning junior SOC analysts a role that grants view/query permissions but denies configuration and integration management enforces least privilege. This is the centralized location for all RBAC configuration in XSIAM.

Answer

Endpoints > Policy > Access Control List

Answer

Investigate > Analysts > Permissions Manager

Answer

Marketplace > Content Hub > User Security Pack

Question 19

An organization wants to integrate XSIAM user authentication with an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is Single Sign-On (SSO) configured?

Accepted Answer

Configure SAML settings under Settings > Access Management > SSO / Authentication.. SAML and SSO authentication settings for XSIAM console users are configured under Settings > Access Management > SSO / Authentication.

Answer

Modify the global agent installation package configuration.

Answer

Set up a Log Forwarding profile with SAML parameters.

Answer

Deploy a Broker VM with an Active Directory LDAP connector.

Question 20

A Cortex XSIAM engineer needs an automation to run every time a new alert is created, before any analyst reviews it, so that enrichment and severity scoring happen automatically. The engineer wants the automation to execute based on the alert's attributes without a human starting it. Which trigger mechanism should be used?

Accepted Answer

An alert-based automation rule that fires the playbook when a new alert matches defined conditions.. The scenario calls for automatic, condition-driven execution at alert creation with no human involvement. An alert-based automation rule evaluates each new alert against defined conditions and launches the playbook immediately, delivering enrichment and severity scoring before an analyst begins review.

Answer

A webhook receiver that the external alert source calls after pushing the alert into XSIAM.

Answer

A manual trigger that an analyst selects from the alert's action menu when they begin triage.

Answer

A scheduled job that runs the enrichment playbook every five minutes against all open alerts.