XSIAM-Engineer Practice Test 8 — 10 Questions

Question 1

An administrator needs to configure granular access control so that junior SOC analysts can view incidents and run XQL queries, but cannot modify tenant settings or install integrations. Where should the administrator configure these permissions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Settings > Configurations > Access Control > Roles. Role-Based Access Control (RBAC) in Cortex XSIAM is configured under Settings > Configurations > Access Control > Roles.

Answer

Endpoints > Policy > Access Control List

Answer

Investigate > Analysts > Permissions Manager

Answer

Marketplace > Content Hub > User Security Pack

Question 2

An organization is deploying Cortex XSIAM in an environment with strict data residency requirements. The tenant is provisioned in the European Union (EU) region. During the deployment of Broker VMs and API integrations, what must the architect ensure regarding endpoint and collector configurations?

Accepted Answer

All Broker VMs and API data sources must be configured with the specific regional tenant FQDN matching the EU data center. In multi-region architectures, data residency mandates that all collectors, agents, and API integrations point strictly to the regional tenant FQDN corresponding to the provisioned EU data center to prevent cross-border data leakage.

Answer

Broker VMs must be deployed on physical hardware residing inside Palo Alto Networks headquarters in Santa Clara

Answer

Global tenant URLs automatically re-route data across regions based on latency without compliance impact

Answer

Agents must use local DNS poisoning to bypass regional routing restrictions

Question 3

An administrator wants to verify agent health and operational status across endpoints in Cortex XSIAM. Which TWO metrics or statuses can be viewed in the Endpoints inventory view? (Choose two)

Accepted Answer

Agent connection status (connected vs. disconnected) and software version. The Endpoints inventory in Cortex XSIAM displays agent version, connection status, operating system, and protection module status.

Answer

The local power grid frequency supplying the endpoint's AC adapter

Answer

The physical room temperature and humidity of the workstation's office

Answer

The personal browsing history and banking credentials of the user

Question 4

During a high-availability planning session for an on-premises Broker VM deployment, an architect considers deploying multiple Broker VMs behind a load balancer to handle syslog collection from thousands of network devices. What is a critical architectural limitation or consideration when placing Broker VMs behind a load balancer for syslog collection?

Accepted Answer

Load balancing TCP or UDP syslog streams requires careful session persistence and source IP retention to ensure parser context is maintained. When configuring UDP syslog load balancing, statefulness and IP persistence must be carefully managed, and TCP syslog requires persistent connections or proper session handling to prevent log interleaving and parsing corruption.

Answer

Broker VMs cannot accept syslog data if they are registered to the same XSIAM tenant token

Answer

Load balancers prevent the Broker VM from communicating with the Cortex XSIAM cloud backend via port 443

Answer

Broker VMs automatically sync local log queues across the load balancer using BGP routing

Question 5

An administrator is troubleshooting a newly configured API-based integration that is failing to ingest logs into Cortex XSIAM. The test connection fails with an authentication error, despite valid API credentials being entered. What is a common architectural oversight that causes this failure?

Accepted Answer

The API user account lacks the necessary permissions on the target platform, or network egress is blocked. API integrations often fail authentication if the API key lacks the required permissions/roles within the source platform or if network firewalls block outbound/inbound HTTPS requests to the vendor's API endpoint.

Answer

The Broker VM requires a manual firmware downgrade to support legacy API protocols

Answer

The Cortex XDR agent service on endpoints has stopped responding

Answer

The XQL query builder cache is corrupted and requires a database purge

Question 6

An administrator is configuring data collection settings and incident rules in Cortex XSIAM. Which TWO configuration steps are required to ensure proper data parsing and alert generation for a newly added third-party firewall log source? (Choose two)

Accepted Answer

Ensuring the corresponding vendor content pack is installed and active to correctly parse and normalize logs into the XSIAM schema. Adding a new log source requires configuring the collection mechanism (e.g., Broker VM syslog receiver) and ensuring the correct parsing/content pack is active to normalize the data into the XSIAM schema.

Answer

Recompiling the Cortex XDR agent kernel extension on all endpoints

Answer

Flushing the browser cache of all SOC analysts

Answer

Manually modifying the cloud data lake kernel source code via SSH

Question 7

An administrator is verifying that firewall rules at the corporate perimeter permit outbound communication from Cortex XDR agents. Which destination criteria must be allowed for agent communication?

Accepted Answer

Outbound TCP port 443 to Palo Alto Networks XSIAM cloud FQDNs. Cortex XDR agents require outbound HTTPS (TCP 443) access to Palo Alto Networks cloud infrastructure and specific regional FQDNs.

Answer

Inbound TCP port 22 and 3389 for remote diagnostics

Answer

Outbound UDP port 514 for direct syslog streaming to the cloud

Answer

Inbound and outbound TCP port 80 for unencrypted configuration checks

Question 8

An administrator is reviewing the prerequisites for deploying Cortex XDR agents across virtual desktop infrastructure (VDI) environments. Which TWO best practices should be considered for VDI golden image preparation? (Choose two)

Accepted Answer

Installing the agent as the final step in the golden image creation process before sealing the disk. VDI deployments require specific agent configurations, such as enabling VDI mode to prevent duplicate endpoint entries and managing golden image persistence properly.

Answer

Removing all network adapters from the virtual machine template

Answer

Disabling all security tamper protection permanently on the master image

Answer

Configuring the VDI master image with a static, hardcoded endpoint UUID that never changes

Question 9

During the sizing phase of a Cortex XSIAM deployment, an architect needs to estimate the required IOPS and storage retention footprint for endpoint telemetry. Which factor has the most direct impact on the raw ingestion volume calculation?

Accepted Answer

The frequency and depth of endpoint behavioral event generation and process telemetry. Event frequency and diversity of process, network, and file system telemetry generated per endpoint dictate the raw log volume.

Answer

The configured frequency of Cortex XSOAR automated playbook execution

Answer

The total number of active directory user accounts synchronized via User-ID

Answer

The number of active firewall security rules enforced by Panorama

Question 10

An administrator is deploying Cortex XDR agents to a fleet of macOS endpoints using a Mobile Device Management (MDM) solution like Jamf Pro. What is required to ensure the agent has full disk access and system extension approvals on modern macOS versions without user prompting?

Accepted Answer

Deploying MDM configuration profiles containing System Extension and Full Disk Access payloads. Modern macOS versions require MDM configuration profiles (Payloads) to pre-approve System Extensions and grant Full Disk Access to security software like Cortex XDR.

Answer

Manually running sudo commands via SSH on every Mac workstation

Answer

Disabling the macOS Gatekeeper security feature globally via terminal

Answer

Configuring an internal Broker VM to proxy macOS system calls