XSIAM-Engineer Practice Test 9 — 10 Questions

Question 1

An administrator is planning the deployment of Broker VMs to support data ingestion across multiple isolated network segments. Which TWO considerations are critical for proper Broker VM architecture and sizing? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The expected Events Per Second (EPS) volume traversing the specific Broker VM instance. Option C is correct because Broker VM sizing is driven primarily by the Events Per Second (EPS) throughput that will traverse each individual Broker instance; CPU, RAM, and disk must be provisioned based on that per-Broker ingestion load, so the expected EPS volume is a critical architectural consideration. Option E is correct because each Broker VM must be able to reach the XSIAM tenant URL outbound over HTTPS on TCP port 443 to register, receive configuration, and forward collected data to the cloud tenant; without this outbound connectivity the Broker cannot function. Option A is incorrect because Brokers collect data via syslog, agent, or API-based ingestion and do not require local administrative write access to network switches. Option B is incorrect because Broker VMs are not designed to host a local XSOAR database with 50 TB of persistence; data is forwarded to the XSIAM tenant rather than stored locally at that scale. Option D is incorrect because deploying a Windows Active Directory domain controller on each Broker VM is unrelated to Broker architecture and would add unnecessary complexity and attack surface.

Answer

Ensuring the Broker VM has local administrative write access to all ingested network switches

Answer

Configuring local XSOAR database persistence exceeding 50 Terabytes on the Broker VM

Answer

Deploying a separate Windows Active Directory domain controller on each Broker VM

Question 2

A security administrator is planning the deployment of Cortex XSIAM and needs to integrate it with an existing SIEM for data enrichment. The administrator wants to query external threat intelligence sources from within Cortex XSIAM. Which component should be used to enable this integration?

Accepted Answer

Cortex XSIAM integrations. Cortex XSIAM integrations provide pre-built connectors to external systems, including threat intelligence providers. They allow the platform to query external sources and enrich data automatically. This is the intended method for integrating with existing security tools and services. The other components serve different roles, such as log collection or automation execution, and do not provide the required integration framework.

Answer

Broker VM

Answer

Cortex XSIAM API

Answer

Cortex XSOAR engine

Question 3

An automation playbook fails because the JSON response from an API call contains nested objects that are not being parsed correctly. What is the best way to handle this in a playbook?

Accepted Answer

Use transformation steps in the playbook to parse nested JSON fields.. Using the 'Extract' or 'JSON transform' steps within a playbook allows for the parsing of nested structures for downstream processing.

Answer

Change the integration to use XML instead of JSON.

Answer

Increase the timeout setting for the integration.

Answer

Delete the integration and reinstall it.

Question 4

An engineer is planning the deployment of Cortex XSIAM in a hybrid environment where on-premises logs need to be ingested. The engineer must ensure that the on-premises components can communicate with the Cortex XSIAM tenant in the cloud. Which of the following is a required component for this communication?

Accepted Answer

Cortex XSIAM Broker VM deployed on-premises.. The Cortex XSIAM Broker VM is specifically designed to bridge on-premises environments with the cloud tenant. It collects logs from local sources, buffers them, and forwards them securely over outbound HTTPS to Cortex XSIAM. This architecture avoids inbound firewall rules and simplifies deployment. Other components like Engines or XDR agents serve different purposes and are not the primary communication bridge for on-premises log ingestion.

Answer

Direct VPN tunnel between on-premises network and Cortex XSIAM cloud.

Answer

Cortex XSIAM Engine deployed on-premises.

Answer

Cortex XDR agent installed on all endpoints.

Question 5

An architect is designing an enterprise deployment strategy for Cortex XSIAM in an environment with strict change management windows. Which THREE planning considerations are critical for a successful rollout? (Choose three)

Accepted Answer

Defining data ingestion scopes and filtering rules to manage storage quotas and costs. Option A is correct because defining data ingestion scopes and filtering rules directly controls how much telemetry is parsed, indexed, and retained in Cortex XSIAM, which governs storage quota consumption and licensing costs in an enterprise rollout. Option B is correct because establishing pilot testing groups (upgrade rings) lets the organization validate agent versions and content pack updates in a limited cohort before broad deployment, which is essential when changes must fit strict change management windows. Option D is correct because XSIAM agents and brokers must reach Cortex XSIAM service endpoints over outbound TCP 443, so firewall and proxy egress rules must be updated to allow the required XSIAM FQDNs or endpoints will fail to register and report. Option C is not a legitimate planning consideration because rewriting local OS kernels is neither required nor supported by Cortex XSIAM and is unrelated to deployment strategy. Option E is also incorrect because replacing physical network switches with fiber-optic hubs is not a XSIAM deployment requirement and hubs are obsolete, collision-prone devices that would degrade rather than enable the rollout.

Answer

Requiring all end users to manually rewrite their local operating system kernels

Answer

Replacing all physical network switches with fiber-optic hubs

Question 6

An XSIAM administrator is configuring automated log ingestion filtering to drop high-volume, low-value informational events before they consume license quota. Which feature enables this capability?

Accepted Answer

Ingestion Filtering Rules. Log filtering and dropping rules can be configured using ingestion filtering policies in XSIAM data collection settings.

Answer

XQL Query Scheduled Rules

Answer

Incident Enrichment Playbooks

Answer

Data Masking Policies

Question 7

When planning a Cortex XSIAM deployment, what is the primary purpose of conducting an infrastructure readiness assessment?

Accepted Answer

To evaluate network bandwidth, firewall rules, log volumes, and endpoint system requirements prior to deployment.. The infrastructure readiness assessment evaluates whether the existing environment can support Cortex XSIAM deployment by examining network bandwidth, firewall rules, log volumes, and endpoint system requirements. This assessment identifies gaps that must be addressed before deployment to ensure successful integration and performance. It is a planning exercise, not an automated provisioning or pricing activity.

Answer

To automatically generate XSOAR playbooks based on existing network architecture diagrams.

Answer

To determine the exact pricing discount negotiated with Palo Alto Networks sales representatives.

Answer

To provision cloud storage buckets in AWS or Azure for long-term data archiving.

Question 8

An administrator is reviewing the health of endpoint agents across the enterprise. Which TWO statuses or metrics can be monitored in the Endpoint Management view? (Choose two)

Accepted Answer

Installed agent software version and content version. Option A is correct because the Endpoint Management view exposes the installed agent software version and the content version (e.g., signature/definition updates) for each managed endpoint, which are core health metrics for verifying agents are current. Option C is correct because agent connection status (Connected / Disconnected) is a primary health indicator shown in Endpoint Management, allowing administrators to identify endpoints that have lost communication with the management server. Option B is incorrect because printer ink levels are hardware consumable data unrelated to endpoint agent health and are not reported by the agent management console. Option D is incorrect because Wi-Fi password history is user credential data that is neither collected nor displayed for endpoint health monitoring. Option E is incorrect because browser-stored personal email credentials are private user data outside the scope of agent status and content version monitoring.

Answer

Local printer ink levels on managed workstations

Answer

Individual employee Wi-Fi password history

Answer

Personal email login credentials stored in browser caches

Question 9

Which THREE parameters can be configured when setting up a log ingestion parsing rule in XSIAM? (Choose three)

Accepted Answer

Target vendor and product mapping. Option C is correct because a parsing rule must identify the log source by mapping it to the target vendor and product, which determines how the incoming raw logs are recognized and parsed. Option D is correct because the core of a parsing rule is defining XDM (Extended Data Model) field mappings and transformations that convert raw log fields into normalized XSIAM schema fields. Option E is correct because parsing rules support filtering conditions that restrict the rule to specific log subsets, so only matching events are parsed by that rule. Option A is not correct because Broker VM hardware CPU allocation is an infrastructure/appliance sizing setting, not a parameter of a log parsing rule. Option B is not correct because automatic remediation playbook execution is configured in playbooks or automation rules, not within the log ingestion parsing rule itself.

Answer

Broker VM hardware CPU allocation limits

Answer

Automatic remediation playbook execution ID

Question 10

An enterprise is deploying Cortex XSIAM in an isolated environment that requires all outgoing traffic to traverse an explicit forward proxy requiring authentication (Kerberos/NTLM). How must the Broker VM be configured to support this network topology?

Accepted Answer

Configure the proxy settings during the initial Broker VM network setup or configuration menu, providing necessary proxy credentials. Broker VM supports explicit forward proxy configuration with authentication (including Kerberos/NTLM) during the initial network setup or via the Broker VM configuration menu. The administrator supplies the proxy address, port, and credentials so all outbound Broker traffic to the XSIAM cloud traverses the authenticated proxy.

Answer

Convert all syslog streams to ICMP tunneling packets to bypass proxy authentication

Answer

Install an external NTLM relay daemon directly onto the XSIAM cloud backend

Answer

Broker VMs do not support forward proxies and require a direct internet connection at all times