XSIAM-Engineer Practice Test 9 — 10 Questions

Question 1

An organization requires high availability for its on-premises log ingestion architecture using Broker VMs. Which THREE architectural elements contribute to building a resilient log collection tier? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configuring local log caching and queuing on Broker VMs to handle temporary cloud connectivity interruptions. Resilient log collection relies on deploying multiple Broker VMs, using load balancers or DNS/IP failover for syslog streams, and monitoring appliance resource health.

Answer

Disabling all network encryption to maximize packet forwarding speed

Answer

Routing all log traffic through a single unmanaged home router

Question 2

An enterprise environment has strict network segmentation where log sources in a secure DMZ cannot communicate directly with the primary Broker VM located in the corporate network. How should an architect design the log collection architecture to feed data into Cortex XSIAM?

Accepted Answer

Deploy a secondary Broker VM within the DMZ configured to forward logs securely to the primary Broker VM or directly to the XSIAM tenant.. Deploying a dedicated Broker VM inside the DMZ zone allows local log collection from DMZ sources while securely forwarding normalized logs to the XSIAM backend or through authorized firewalls.

Answer

Configure a port-mirroring session on the core firewall to duplicate all DMZ traffic to the Broker VM via local loopback.

Answer

Install the Cortex XDR agent on all network routers and switches in the DMZ to capture syslog locally.

Answer

Open bidirectional UDP port 514 across the internal corporate firewall to allow DMZ devices to stream raw syslog directly.

Question 3

An administrator is planning the deployment of Broker VMs in a high-availability configuration. What is the recommended approach for handling Broker VM redundancy?

Accepted Answer

Deploy multiple Broker VMs in a clustered group or behind a network load balancer to ensure seamless failover and load distribution.. Deploying multiple Broker VMs behind a load balancer or as a logical cluster ensures high availability and failover capabilities for agent check-ins and log forwarding.

Answer

Install two instances of the Broker VM software on the exact same virtual machine instance.

Answer

Configure the Cortex XDR agents with a single hardcoded IP address and rely on BGP Anycast for failover.

Answer

Configure active-passive clustering using Microsoft Windows Failover Clustering inside the Broker VM guest OS.

Question 4

An architect is designing an automated log forwarding pipeline where Cortex XSIAM forwards specific enriched telemetry or incidents to an external destination (such as a third-party SIEM or data lake). Which THREE mechanisms or integrations are available for exporting data out of XSIAM? (Choose three)

Accepted Answer

Syslog forwarding profiles configured on Broker VMs to transmit logs to external SIEMs. Data export out of Cortex XSIAM can be achieved using the Cortex Data Exporter, SIEM integrations (Syslog forwarding via Broker VM), and webhook-based API integrations.

Answer

Direct physical tape backup drives attached to the cloud data lake backend storage nodes

Answer

Manual FTP file dumps of the entire raw database executed via root SSH commands

Question 5

When planning identity and access management integration for Cortex XSIAM administration, which THREE authentication or directory methods are natively supported? (Choose three)

Accepted Answer

Local administrator accounts managed directly within the Cortex XSIAM platform. Cortex XSIAM supports standard enterprise identity providers using SAML 2.0 as well as local user management and API keys.

Answer

Direct Kerberos ticket-granting ticket (TGT) exchange without an intermediary IdP

Answer

Legacy Windows NT LAN Manager (NTLMv1) direct challenge-response authentication

Question 6

An engineer is deploying a Cortex XSIAM Engine on-premises to support high-throughput log parsing and query execution. During setup, the engine fails to register with the cloud tenant. Upon checking the engine logs, the engineer sees TLS certificate validation errors. What is the most likely root cause?

Accepted Answer

The engine host is missing the root Certificate Authority (CA) certificate required to trust the SSL inspection proxy or tenant endpoint.. Engine-to-cloud communication relies on mutual TLS (mTLS) and valid certificate trust chains. If an SSL inspection proxy or corporate firewall is intercepting TLS traffic without proper root certificate installation on the engine host, registration fails.

Answer

UDP port 514 is blocked by the local host firewall, preventing certificate handshake packets.

Answer

The Broker VM has exceeded its maximum concurrent engine connection limit.

Answer

The engine software version is newer than the Cortex XSIAM tenant cloud version.

Question 7

When planning an initial Cortex XSIAM deployment, an administrator must configure organizational settings. Which TWO configurations are typically established during the initial tenant setup phase? (Choose two)

Accepted Answer

Defining initial administrator user accounts and assigning baseline roles. Initial tenant setup includes configuring identity providers (SSO/SAML), defining initial administrative user roles, and setting regional parameters.

Answer

Writing custom Linux kernel modules for client workstations

Answer

Configuring analog modem dial-up backup connections for alert notifications

Answer

Manually soldering hardware security modules (HSMs) into tenant cloud racks

Question 8

An organization requires strict data residency compliance, ensuring that all log data collected by Cortex XSIAM remains within the European Union. During tenant initialization, how must the administrator satisfy this requirement?

Accepted Answer

Select the appropriate EU-based cloud region during initial tenant provisioning and activation. Tenant region and data residency are determined at the time of initial tenant provisioning and selection by Palo Alto Networks support/activation.

Answer

Deploy an on-premises Hadoop data lake and configure XSIAM to forward all raw logs via API

Answer

Configure log forwarding profiles within the Cortex XSOAR settings menu

Answer

Modify the Broker VM local storage configuration file to encrypt data using EU-specific keys

Question 9

During an assessment of infrastructure readiness for Cortex XSIAM, an engineer calculates the required daily log ingestion volume and determines it exceeds the licensed capacity. What architectural feature or mechanism within XSIAM can the administrator configure to optimize data ingestion without losing critical security telemetry?

Accepted Answer

Configure log filtering and drop rules on the Broker VM collectors to exclude unneeded verbose log events before they reach the XSIAM cloud.. XSIAM allows administrators to configure log parsing and filtering rules on the Broker VM or ingestion pipeline to drop redundant or low-value logs before ingestion, optimizing licensed capacity.

Answer

Increase the retention period in the data lake storage settings from 90 days to 365 days.

Answer

Enable automatic data compression on the Cortex XDR agent to reduce network packet size by 90%.

Answer

Deploy secondary XSIAM tenants in different geographic regions to split the log parsing load.

Question 10

When configuring integrations in Cortex XSIAM via Content Hub, which TWO actions can an administrator perform after installing an integration pack? (Choose two)

Accepted Answer

Test the connection to ensure valid communication between XSIAM and the external service. After installing an integration content pack, an administrator must create and configure integration instances and map their data collection or action parameters.

Answer

Manually solder USB encryption keys into Broker VM motherboards

Answer

Physically rewire the cloud data center rack power supplies

Answer

Delete all underlying system databases to force a clean slate