XSIAM-Engineer Integration And Automation Practice Test 2 — 15 Questions

Question 1

An enterprise security team wants to ensure that all data ingested from a specific untrusted data source is automatically tagged with a specific tag for downstream analytics. Where can this automatic tagging rule be applied during integration setup?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Collection source configuration tags. Ingestion rules and source tagging can be configured in the data collection settings where streams are tagged upon entry.

Answer

Incident Layout custom fields

Answer

XQL Query Builder template parameters

Answer

Global Dashboard filter properties

Question 2

An XSIAM administrator wants to test connectivity to an external REST API integration without running a full playbook. Which feature in XSIAM allows direct testing of integration commands?

Accepted Answer

The XSIAM CLI (Command Line Interface) in the Incident Response view. The CLI (Command Line Interface) within the XSIAM incident response module allows administrators to execute integration commands directly.

Answer

Settings > Configurations > API Keys > Test button

Answer

The XQL Sandbox query execution button

Answer

Marketplace instance verification utility

Question 3

Which TWO components or methods are valid options for ingesting third-party log data into XSIAM? (Choose two)

Accepted Answer

Palo Alto Networks Broker VM log collectors. XSIAM supports log ingestion primarily through Broker VM collectors (such as Syslog and HTTP API) and cloud-native integrations (such as AWS SQS or Azure Event Hubs).

Answer

Manual CSV file upload via the user profile page

Answer

Direct database replication via SQL Server Management Studio

Answer

Physical serial cable connection to the XSIAM tenant gateway

Question 4

Which TWO actions can an administrator perform when managing integration instances within XSIAM? (Choose two)

Accepted Answer

Test the integration instance connection. Administrators can test integration connectivity and enable or disable specific integration instances.

Answer

Change the global XSIAM database schema

Answer

Modify the core source code of the vendor integration pack

Answer

Directly patch the underlying operating system of the cloud tenant backend

Question 5

Which THREE configuration steps are typically required when setting up a new Broker VM instance in XSIAM? (Choose three)

Accepted Answer

Deploy the OVA image on an on-premises hypervisor (e.g., VMware ESXi). Setting up a Broker VM involves generating a registration token, deploying the OVA image to a hypervisor, and configuring the network and proxy settings.

Answer

Manually compile the Linux kernel on the Broker VM

Answer

Install the Cortex XDR Agent on the Broker VM host machine

Question 6

Which THREE parameters can be configured when setting up a log ingestion parsing rule in XSIAM? (Choose three)

Accepted Answer

Target vendor and product mapping. Parsing rules allow specifying the target vendor/product, defining transformation logic to XDM, and applying rules to specific log streams or data streams.

Answer

Broker VM hardware CPU allocation limits

Answer

Automatic remediation playbook execution ID

Question 7

When troubleshooting a failing integration instance in XSIAM, which THREE tools or logs are most useful for diagnosing the root cause? (Choose three)

Accepted Answer

System Audit logs for administrative actions. Troubleshooting integrations involves checking the Audit logs, the Automation Debug / Integration logs, and testing connectivity via CLI.

Answer

Cortex XDR Agent endpoint quarantine logs

Answer

The local BIOS event log of the client workstation

Question 8

Which THREE best practices should be followed when designing custom automation integrations and playbooks in XSIAM? (Choose three)

Accepted Answer

Design modular sub-playbooks for reusable automation tasks. Best practices include handling errors gracefully, using credentials securely via integration parameters, and designing modular playbooks.

Answer

Hardcode admin service account passwords directly into Python automation scripts

Answer

Execute all integration commands synchronously on the main UI thread without timeout limits

Question 9

Which TWO methods are supported in XSIAM for forwarding alerts or incident details to external SIEM or ticketing systems? (Choose two)

Accepted Answer

Using native SIEM forwarding integration packs (e.g., Splunk, ServiceNow). XSIAM supports forwarding incidents and alerts using outbound webhook integrations and native SIEM forwarding connectors.

Answer

Using the Cortex XDR Agent to mirror network traffic to external collectors

Answer

Directly mounting the XSIAM cloud storage bucket via NFS on-premises

Answer

Installing a local database client to query the multi-tenant XSIAM SQL database directly

Question 10

Which THREE security considerations are critical when configuring third-party integrations and API keys in XSIAM? (Choose three)

Accepted Answer

Restricting API key usage by source IP addresses where supported by the third-party service. Security considerations include following the principle of least privilege for API accounts, rotating secrets regularly, and restricting API key network access where applicable.

Answer

Sharing master administrator API keys across all integration instances for simplicity

Answer

Disabling SSL verification globally to bypass certificate expiration issues

Question 11

An XSIAM administrator is configuring a new syslog data source to ingest security logs from an on-premises Linux firewall. Which Collector component must be deployed within the network perimeter to securely forward these logs to the XSIAM tenant?

Accepted Answer

Broker VM. The Cortex XDR Collector (or Broker VM) acts as an intermediary agent deployed within the customer's network to ingest logs via syslog and securely forward them to the XSIAM cloud backend.

Answer

Panorama Forwarder

Answer

XSOAR Engine

Answer

Cortex XDR Agent

Question 12

An XSIAM administrator has created a custom parsing rule using Logstash-like syntax within XSIAM to normalize a non-standard application log format. After saving and enabling the parsing rule, incoming logs still appear unparsed under the 'Default' vendor product type. What is the most likely reason for this behavior?

Accepted Answer

The matching criteria or vendor/product identifiers in the parsing rule do not align with the incoming log header fields.. Custom parsing rules in XSIAM require proper vendor and product identifier matching criteria (such as matching header keys or regex patterns) to hook incoming logs correctly. If the conditions do not match the incoming log structure, the parser is bypassed.

Answer

Parsing rules can only be applied to logs ingested via HTTP API, not Broker VM inputs.

Answer

Custom parsing rules require a mandatory XSOAR playbook to trigger the parsing pipeline.

Answer

The Broker VM service must be completely restarted for parsing rules to take effect.

Question 13

An administrator is setting up an integration with a third-party threat intelligence platform using Cortex XSOAR capabilities embedded within XSIAM. The integration instance requires periodic polling to fetch newly published Indicators of Compromise (IoCs). Where should the administrator configure the fetch interval?

Accepted Answer

Inside the specific integration instance configuration settings. In Cortex XSOAR integration instances, the fetch interval determines how often the integration queries the external source for new data and is configured directly inside the integration instance configuration settings.

Answer

Inside the automated playbook task parameters

Answer

Via the Server Configuration (Settings > About > Server Configuration) global key-value pair

Answer

Within the Threat Intelligence module feeds mapping rules

Question 14

An XSIAM administrator is configuring a new API-based integration to ingest threat intelligence feeds. During configuration, what credential type is most commonly required by modern token-based REST API integrations?

Accepted Answer

API Key or OAuth2 credentials. Most modern cloud-native REST API integrations in XSIAM utilize API keys or OAuth2 tokens provided securely within the integration instance configuration.

Answer

SNMP v1 Community strings

Answer

Local Windows Administrator account passwords

Answer

Interactive SSH private keys

Question 15

An analyst wants to trigger an automated playbook in XSIAM immediately whenever a specific high-severity alert is generated by the Analytics engine. Where should the analyst configure this automated linkage?

Accepted Answer

Within the Correlation Rule or Analytics Rule definition under the Incident Handling or Automated Playbook section. In XSIAM, automated responses to alerts generated by analytics or correlation rules are configured via Incident/Alert Trigger rules or Automation configurations tied to the Alert Rule settings, rather than manual playbook runs.

Answer

Via the Data Stitching rules configuration page

Answer

By modifying the global XSOAR integration instance mapping parameters

Answer

Inside the Broker VM configuration file under the 'triggers' YAML block