XSIAM-Engineer Practice Test 7 — 10 Questions

Question 1

An administrator is configuring data ingestion in XSIAM and needs to ensure that logs from a custom internal application are correctly normalized. Which THREE components are essential parts of the XSIAM log ingestion and normalization pipeline? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

XSIAM Data Lake schema targets. Option E (Log Collector such as Broker VM or Agent) is essential because logs must first be received and forwarded into XSIAM; the Broker VM or endpoint agent provides the ingestion transport that delivers raw events to the platform. Option D (Parsing Rules / Normalization mapping) is correct because XSIAM uses parsing and normalization rules to extract fields from raw logs and map them to the common Cortex Data Model (CDM), which is exactly what is needed to correctly normalize a custom application's logs. Option C (XSIAM Data Lake schema targets) is correct because normalized events must be written into the Data Lake against defined schema targets, ensuring the parsed fields conform to the expected dataset structure for querying and detection. Option A is incorrect because physical network firewall bypass rules are a network-security concept unrelated to log parsing or normalization. Option B is incorrect because XSIAM does not require manually executed SQL queries for every incoming log packet; ingestion and normalization are handled automatically by collectors, parsers, and schema mapping.

Answer

Physical network firewall bypass rules

Answer

Manually executed SQL queries for every incoming log packet

Question 2

An administrator needs to update the Cortex XDR agent installation package across 5,000 endpoints without causing network saturation. Which feature should be utilized to manage this rollout effectively?

Accepted Answer

Configure an Agent Upgrade schedule and phased deployment profile within Endpoint Management > Agent Settings.. Agent software updates can be controlled using Agent Settings and deployment profiles where administrators can set distribution rules, throttling, and phased rollouts.

Answer

Manually push the MSI package via Active Directory Group Policy Objects using an external script.

Answer

Execute an XQL remediation action with the `upgrade_agent` command across all active sessions.

Answer

Set up a global Log Forwarding profile to broadcast the binary over syslog.

Question 3

An administrator is reviewing infrastructure readiness for deploying Cortex XSIAM engines on-premises. Which TWO prerequisites must be validated on the host infrastructure before engine installation? (Choose two)

Accepted Answer

Outbound TCP port 443 connectivity to the Cortex XSIAM cloud environment.. Option A is correct because Cortex XSIAM engines must maintain outbound TCP 443 connectivity to the Cortex XSIAM cloud environment for management, telemetry, and updates, so this must be validated before installation. Option B is correct because engine hosts require adequate CPU, RAM, and disk sizing to handle the anticipated query and parsing workloads; undersized resources will cause performance and ingestion problems. Option C is incorrect because no physical motherboard access or hardware crypto-accelerator card installation is a prerequisite for XSIAM engine deployment. Option D is incorrect because disabling all host firewalls and SELinux entirely is not a requirement and would be a poor security practice. Option E is incorrect because the host does not need to run an Active Directory Domain Controller role to install a Cortex XSIAM engine.

Answer

Direct physical access to the server motherboard to install a hardware crypto-accelerator card.

Answer

Disabling all host system firewalls and SELinux entirely across the corporate datacenter.

Answer

Active Directory Domain Controller role installed on the same host operating system.

Question 4

An administrator wants to ensure high availability and disaster recovery readiness for an XSIAM deployment relying on Broker VMs and cloud ingestion. Which THREE operational practices should be implemented? (Choose three)

Accepted Answer

Configure redundant Broker VM instances behind a load balancer for syslog ingestion.. Option A is correct because deploying redundant Broker VM instances behind a load balancer eliminates a single point of failure for syslog ingestion, allowing traffic to fail over if one Broker VM becomes unavailable, which directly supports high availability. Option D is correct because maintaining current documentation and configuration backups of custom parsers and integration settings ensures that, in a disaster recovery scenario, the XSIAM tenant can be rebuilt or migrated quickly without losing bespoke parsing logic or connector configuration. Option E is correct because regularly monitoring ingestion pipeline health dashboards allows administrators to detect dropped logs, stalled connectors, or degraded Broker VM performance early, enabling remediation before data gaps compromise detection and response. Option B is incorrect because storing raw logs exclusively on local Broker VM drives without cloud replication creates a single point of failure and violates disaster recovery readiness, since local disk loss would permanently destroy the logs. Option C is incorrect because disabling automated correlation rules to conserve bandwidth would severely degrade detection capabilities and does not constitute a valid high availability or disaster recovery practice.

Answer

Store all raw logs exclusively on local Broker VM hard drives without cloud replication.

Answer

Disable all automated correlation rules to conserve disaster recovery bandwidth.

Question 5

An administrator needs to verify whether a newly created Correlation Rule is actively evaluating incoming telemetry. Where should the administrator check the rule's operational status and recent execution statistics?

Accepted Answer

Check the Correlation Rules / Analytics page where rule status, hit counts, and last execution details are displayed.. Correlation rules and analytics rules display their operational status, hit counts, and execution metrics within the Analytics or Correlation Rules management page.

Answer

Inspect the Cortex XDR Agent installation directory for rule cache files.

Answer

Review the Windows Event Viewer on the primary Domain Controller.

Answer

Examine the Firewall Traffic logs for outgoing rule-check packets.

Question 6

An organization plans to ingest cloud audit logs from Amazon Web Services (AWS) into Cortex XSIAM using an automated collector architecture. Which native AWS service integration mechanism is typically recommended and supported by XSIAM for scalable log collection?

Accepted Answer

AWS S3 bucket ingestion leveraging SQS notifications and IAM role authentication. XSIAM's recommended scalable AWS log-collection architecture uses S3 bucket ingestion: AWS services write audit/cloud logs to an S3 bucket, S3 event notifications publish to an SQS queue, and XSIAM's collector polls the queue and pulls the objects using IAM role authentication. This decouples ingestion from the log source, scales horizontally, and avoids exposing credentials. It is the standard, supported pattern for high-volume AWS audit log ingestion.

Answer

Direct SNMP traps forwarded from AWS EC2 metadata service

Answer

Syslog forwarding from the AWS Root Account login page

Answer

Local Cortex XDR agent installation on AWS RDS database instances

Question 7

A security architect is planning a Cortex XSIAM deployment for a company with a single data center and no existing Cortex products. The company wants to forward syslog from 40 network devices to Cortex XSIAM. Which component is required to receive and forward these logs to the Cortex XSIAM tenant?

Accepted Answer

Broker VM deployed in the data center. The Broker VM is the dedicated on-premises log collection component for Cortex XSIAM. It receives syslog and other data from local sources and forwards it to the Cortex XSIAM tenant. Without a Broker VM, the network devices cannot send their syslog directly to the cloud tenant in a supported manner. Therefore, deploying a Broker VM in the data center is the correct planning step.

Answer

Cortex XSOAR engine installed on a management server

Answer

Cortex Data Lake instance provisioned in the data center

Answer

Cortex XDR agent installed on each network device

Question 8

An administrator needs to configure granular access control so that junior SOC analysts can view incidents and run XQL queries, but cannot modify tenant settings or install integrations. Where should the administrator configure these permissions?

Accepted Answer

Settings > Configurations > Access Control > Roles. In Cortex XSIAM, role-based access control (RBAC) is configured under Settings > Configurations > Access Control > Roles, where administrators define roles with granular permissions for incidents, XQL queries, integrations, and tenant settings. Assigning junior SOC analysts a role that grants view/query permissions but denies configuration and integration management enforces least privilege. This is the centralized location for all RBAC configuration in XSIAM.

Answer

Endpoints > Policy > Access Control List

Answer

Investigate > Analysts > Permissions Manager

Answer

Marketplace > Content Hub > User Security Pack

Question 9

An organization wants to integrate XSIAM user authentication with an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is Single Sign-On (SSO) configured?

Accepted Answer

Configure SAML settings under Settings > Access Management > SSO / Authentication.. SAML and SSO authentication settings for XSIAM console users are configured under Settings > Access Management > SSO / Authentication.

Answer

Modify the global agent installation package configuration.

Answer

Set up a Log Forwarding profile with SAML parameters.

Answer

Deploy a Broker VM with an Active Directory LDAP connector.

Question 10

A Cortex XSIAM engineer needs an automation to run every time a new alert is created, before any analyst reviews it, so that enrichment and severity scoring happen automatically. The engineer wants the automation to execute based on the alert's attributes without a human starting it. Which trigger mechanism should be used?

Accepted Answer

An alert-based automation rule that fires the playbook when a new alert matches defined conditions.. The scenario calls for automatic, condition-driven execution at alert creation with no human involvement. An alert-based automation rule evaluates each new alert against defined conditions and launches the playbook immediately, delivering enrichment and severity scoring before an analyst begins review.

Answer

A webhook receiver that the external alert source calls after pushing the alert into XSIAM.

Answer

A manual trigger that an analyst selects from the alert's action menu when they begin triage.

Answer

A scheduled job that runs the enrichment playbook every five minutes against all open alerts.