XSIAM-Engineer Practice Test 8 — 10 Questions

Question 1

An enterprise environment has strict network segmentation where log sources in a secure DMZ cannot communicate directly with the primary Broker VM located in the corporate network. How should an architect design the log collection architecture to feed data into Cortex XSIAM?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a secondary Broker VM within the DMZ configured to forward logs securely to the primary Broker VM or directly to the XSIAM tenant.. When DMZ log sources cannot communicate directly with the primary Broker VM in the corporate network due to segmentation, the correct design is to deploy a secondary Broker VM inside the DMZ. This DMZ Broker collects logs locally and forwards them securely (typically over TCP/TLS) to the primary Broker VM or directly to the XSIAM tenant, respecting the segmentation boundary while ensuring logs reach XSIAM.

Answer

Configure a port-mirroring session on the core firewall to duplicate all DMZ traffic to the Broker VM via local loopback.

Answer

Install the Cortex XDR agent on all network routers and switches in the DMZ to capture syslog locally.

Answer

Open bidirectional UDP port 514 across the internal corporate firewall to allow DMZ devices to stream raw syslog directly.

Question 2

What is the primary purpose of the Cortex XSIAM Content Hub?

Accepted Answer

To download and install pre-built integrations, parsers, dashboards, and content packs.. The Cortex XSIAM Content Hub is the marketplace/catalog where administrators browse, download, and install pre-built content such as integrations, log parsers, dashboards, playbooks, and content packs. It accelerates onboarding of new data sources and use cases without building everything from scratch. Content is versioned and can be updated as vendors release new packs.

Answer

To store encrypted backups of the Broker VM virtual hard disks.

Answer

To configure hardware load balancers for incoming syslog streams.

Answer

To manage endpoint operating system patches and third-party software updates.

Question 3

When establishing Role-Based Access Control (RBAC) in Cortex XSIAM, what is the purpose of assigning 'Folder' scopes to a custom role?

Accepted Answer

To limit visibility and management capabilities to specific subsets of endpoints and data sources organized within the folder hierarchy.. In Cortex XSIAM RBAC, Folder scopes define which portions of the endpoint and data-source hierarchy a custom role can see and manage. Assigning a folder scope to a role restricts that role's visibility and actions to the endpoints, datasets, and configurations contained within the selected folder and its children. This lets large SOCs delegate management of business units, regions, or subsidiaries without exposing the entire tenant.

Answer

To specify the directory path where agent installation logs are written on endpoints.

Answer

To restrict which log files are stored on the local Broker VM disk storage.

Answer

To determine which software packages can be downloaded from the Cortex XSIAM Marketplace.

Question 4

A Cortex XSIAM engineer is asked to ensure that when an incident is closed, a follow-up review task is automatically created for the SOC manager if the incident severity is Critical. Which mechanism should the engineer use to implement this automation?

Accepted Answer

Create a playbook with a conditional task that triggers on incident closure and checks the severity field.. Playbooks are the correct native automation mechanism because they can be triggered by incident closure events and include conditional logic on severity. A conditional task can then create a follow-up review task for the SOC manager only for Critical incidents. The other options either provide reporting, modify fields without creating tasks, or require external polling, all of which fail to deliver automatic task creation.

Answer

Configure a scheduled query in the Query Center that runs every hour and generates a report of closed Critical incidents.

Answer

Set up an incident field rule that changes the assignee to the SOC manager whenever severity is Critical.

Answer

Use the Cortex XSIAM API to poll for closed Critical incidents and create tasks via an external script.

Question 5

A deployment engineer is sizing a Broker VM for a large enterprise environment with 20,000 Cortex XDR agents and multiple log collection sources. During the initial deployment, the administrator notices high CPU and memory utilization on the single Broker VM. What is the recommended architectural remedy for this scenario?

Accepted Answer

Deploy an additional Broker VM and group them logically to distribute agent check-ins and log forwarding workloads.. When a single Broker VM is saturated by 20,000 agents plus multiple log sources, the correct architectural remedy is horizontal scaling: deploy additional Broker VMs and group them so agent check-ins and log forwarding distribute across nodes. This preserves supported sizing limits and provides redundancy. Vertical scaling beyond the documented maximum is not supported and does not solve the architectural bottleneck.

Answer

Configure the Cortex XDR agents to bypass the Broker VM and report directly to the Cortex XSIAM tenant cloud.

Answer

Upgrade the underlying hypervisor memory allocation for the single Broker VM beyond the maximum supported limit of 64GB.

Answer

Install a dedicated syslog forwarder daemon directly on every individual endpoint to reduce Broker VM processing overhead.

Question 6

An organization has multiple business units sharing a single Cortex XSIAM tenant. Leadership requires that security analysts in Business Unit A can only view alerts and endpoints associated with their specific department, while global administrators retain full visibility. How must the deployment engineer configure access control to achieve this?

Accepted Answer

Configure custom roles combined with folder-based access control, ensuring Business Unit A users are assigned to a role scoped exclusively to their designated folders.. The correct configuration is to use custom roles combined with folder-based access control, assigning Business Unit A users to a role scoped exclusively to their designated folders. Cortex XSIAM supports folder-based RBAC, which allows administrators to segment data visibility by business unit, ensuring analysts only see alerts and endpoints associated with their department. This satisfies the requirement for granular access control while allowing global administrators to retain full visibility.

Answer

Utilize XSOAR playbooks to automatically hide incidents belonging to Business Unit B from analysts' UI views.

Answer

Create separate Cortex XSIAM tenants for each business unit and interconnect them using cross-tenant log forwarding.

Answer

Modify the Broker VM configuration file to filter out logs from Business Unit B before sending them to the cloud.

Question 7

An administrator needs to check the status of scheduled background reports and export tasks in XSIAM. Where can this task history be reviewed?

Accepted Answer

Navigate to Reporting > Scheduled Reports to view job execution history and status.. Scheduled background reports and export tasks in Cortex XSIAM are managed and monitored under the Reporting section, specifically the Scheduled Reports interface. This area shows job execution history, status (success, failure, in-progress), timestamps, and any error details for each scheduled report or export job.

Answer

Inspect the raw storage blocks in the Data Lake Explorer.

Answer

Review the Incident Response playbook execution logs in Cortex XSOAR.

Answer

Check the Endpoint Management > Task Management tab.

Question 8

An organization requires that certain sensitive datasets ingested into Cortex XSIAM be automatically purged after a specific retention period shorter than the default tier. Where can an administrator configure custom retention policies for specific datasets?

Accepted Answer

Settings > Configurations > Data Management > Retentions. Cortex XSIAM exposes dataset-level retention configuration under Settings > Configurations > Data Management > Retentions, where administrators can define custom retention periods per dataset that override the default tier. This allows sensitive datasets to be purged sooner than the standard retention window without affecting other data.

Answer

Marketplace > Content Hub > Retention Pack

Answer

Endpoint Security > Profiles > Storage Settings

Answer

Investigate > XQL Search > Retention Command

Question 9

A security architect is planning the network requirements for a new Cortex XSIAM deployment. The organization uses an explicit forward proxy for all outbound internet traffic. Which configuration must be applied to the Broker VM to ensure it can reach the Cortex XSIAM tenant through the proxy?

Accepted Answer

Set the proxy address and port in the Broker VM network settings.. In environments that mandate an explicit forward proxy, the Broker VM must be configured with the proxy address and port so that its outbound connections to the Cortex XSIAM tenant are sent through the proxy. Static routes, PAC files on the tenant, and NAT reflection do not provide the required proxy configuration and would leave the Broker VM unable to communicate through the mandated path.

Answer

Enable NAT reflection on the perimeter firewall for Broker VM traffic.

Answer

Configure the Broker VM with a static route to the proxy and enable transparent interception.

Answer

Install a PAC file on the Cortex XSIAM tenant to redirect Broker VM traffic.

Question 10

An architect is planning the deployment of Cortex XSIAM in a large enterprise with multiple data centers. The architect must ensure high availability and scalability for log collection. Which TWO design considerations are critical for the Broker VM deployment? (Choose two.)

Accepted Answer

Ensure that each Broker VM has outbound connectivity to the Cortex XSIAM tenant.. For high availability and scalability, deploying multiple Broker VMs across data centers distributes the load and provides redundancy. Each Broker VM must also have outbound connectivity to the Cortex XSIAM tenant to forward logs. Together, these considerations ensure that log collection continues even if one site or Broker VM fails, and that the system can scale with increasing log volumes.

Answer

Use the same Broker VM to collect logs from all data centers over the WAN.

Answer

Deploy a single Broker VM with a load balancer to handle all log sources.

Answer

Configure each Broker VM with identical resource specifications to simplify management.