XSIAM-Engineer Integration And Automation Practice Test 3 — 15 Questions

Question 1

An engineer needs to ingest custom JSON-formatted logs from an internal application using an HTTP API. Which XSIAM feature should be configured to receive these incoming webhook payloads?

Accepted Answer

Broker VM HTTP API Collector. The HTTP API log collector on the Broker VM allows external applications to push JSON payloads directly into XSIAM.

Answer

Cortex XDR REST API direct ingestion

Answer

Syslog over TCP/UDP Collector

Answer

XPANSE Attack Surface Management feed

Question 2

An administrator is configuring a new syslog data source in XSIAM to ingest logs from a third-party firewall. Which component must be deployed on-premises to securely receive and forward these logs to the XSIAM tenant?

Accepted Answer

Palo Alto Networks Broker VM. The Palo Alto Networks Broker VM is the on-premises component deployed in XSIAM environments to receive syslog and other data from internal sources (firewalls, proxies, endpoints) and securely forward it to the Cortex XSIAM tenant over an encrypted channel. It acts as the bridge between the customer's network and the cloud-based XSIAM backend, handling parsing, buffering, and forwarding. Without a Broker VM, on-premises syslog sources cannot be ingested into XSIAM.

Answer

Panorama Virtual Appliance

Answer

Cortex XDR Agent

Answer

XSIAM Management Server

Question 3

An XSIAM engineer is troubleshooting a newly configured AWS CloudTrail integration. Log data is not appearing in the XSIAM query builder. Which log collection method is natively utilized by XSIAM to pull AWS CloudTrail logs?

Accepted Answer

Amazon SQS queue polling via an integration instance. XSIAM uses the SQS-based architecture where AWS services push notifications to an SQS queue, and the integration pulls from that queue.

Answer

Direct Syslog forwarding from AWS VPC to Broker VM

Answer

Scheduled SCP file transfer to a Broker VM SFTP directory

Answer

Cortex XDR Agent polling AWS metadata

Question 4

An administrator wants to install a new integration pack to automate ticket creation in ServiceNow. Where in the XSIAM interface should the administrator navigate to find and install this pack?

Accepted Answer

Marketplace. In Cortex XSIAM, integration packs (including the ServiceNow pack for automated ticket creation) are installed from the Marketplace, accessible via the XSIAM navigation menu. The Marketplace is the centralized catalog for content packs, integrations, and playbooks. Navigating there lets the administrator browse, install, and configure the ServiceNow integration.

Answer

Administration > Updates > Packs

Answer

Incident Response > Automation > Store

Answer

Settings > Configurations > Data Sources

Question 5

An engineer is configuring a webhook integration to forward XSIAM alerts to an external ticketing platform. The external system requires custom HTTP headers for authentication. Where can these custom headers be configured within the integration instance?

Accepted Answer

In the integration instance configuration parameter fields. Integration instances in XSIAM often include instance configuration parameters where custom headers, credentials, and API keys are specified.

Answer

Within the Broker VM local firewall rules

Answer

Inside the incident layout designer

Answer

In the XSIAM Global Server proxy configuration file

Question 6

An enterprise environment requires all outbound API traffic from XSIAM integrations to pass through an explicit corporate proxy server. Where is the global proxy configuration specified for integration instances?

Accepted Answer

Settings > Configurations > Integrations > Server Configurations. Global proxy settings for integrations are managed under Settings > Configurations > Integrations > Servers and Services or global integration settings.

Answer

Incident Response > Automation > Global Variables

Answer

XSIAM User Preferences > Network Profile

Answer

Data Collection > Broker VM > Network Settings

Question 7

An engineer is mapping a non-standard third-party security log source into the XSIAM Common Data Model (XDM). Which tool within XSIAM should be used to define custom parsing rules and field mappings?

Accepted Answer

Parsing Rules. Parsing Rules in XSIAM (Cortex XSIAM) are the mechanism for defining custom log parsing logic and mapping fields from non-standard sources into the XDM schema. Engineers use the parsing rules editor to write regex or pattern-based extraction and assign fields to XDM attributes so the data becomes queryable and usable by analytics.

Answer

Data Masking Policy Engine

Answer

Incident Classifier Builder

Answer

XSIAM Query Language (XQL) Sandbox

Question 8

Which protocol is natively supported by the Broker VM Syslog collector for receiving log streams from network devices?

Accepted Answer

Syslog over TCP and UDP. Broker VM Syslog collectors support standard syslog streaming over both TCP and UDP protocols.

Answer

Netflow v9 and IPFIX only

Answer

SNMP Trap v2c and v3

Answer

WMI and RPC protocols

Question 9

An XSIAM administrator is configuring automated log ingestion filtering to drop high-volume, low-value informational events before they consume license quota. Which feature enables this capability?

Accepted Answer

Ingestion Filtering Rules. Log filtering and dropping rules can be configured using ingestion filtering policies in XSIAM data collection settings.

Answer

XQL Query Scheduled Rules

Answer

Incident Enrichment Playbooks

Answer

Data Masking Policies

Question 10

An administrator configured a Microsoft Graph API integration to pull security alerts into XSIAM. The connection status shows 'Active', but no alerts are being pulled. Reviewing the integration instance configuration, which common misconfiguration typically causes this behavior while keeping the authentication valid?

Accepted Answer

Incorrect fetch query parameters or time filters excluding existing alerts. When a Microsoft Graph API integration shows 'Active' but pulls no alerts, the most common misconfiguration is incorrect fetch query parameters or time filters that exclude existing alerts. The authentication can be valid (hence 'Active'), but if the fetch query filters on a time window that has no matching alerts or uses an incorrect filter syntax, the integration will return zero results.

Answer

Exceeding the Broker VM CPU capacity

Answer

Failure to install the Cortex XDR Agent on the Microsoft Graph server

Answer

Missing XQL parsing rules for Microsoft XDM mapping

Question 11

An enterprise security team wants to ensure that all data ingested from a specific untrusted data source is automatically tagged with a specific tag for downstream analytics. Where can this automatic tagging rule be applied during integration setup?

Accepted Answer

Data Collection source configuration tags. The Data Collection source configuration in Cortex XSIAM allows administrators to define tags that are automatically applied to all incoming data from that specific source. This ensures that data from untrusted sources is consistently labeled for downstream analytics, such as XQL queries, dashboards, and correlation rules. Tags applied at the collection point are inherited by all events from that source, providing a scalable and reliable method for data classification.

Answer

Incident Layout custom fields

Answer

XQL Query Builder template parameters

Answer

Global Dashboard filter properties

Question 12

Which TWO components or methods are valid options for ingesting third-party log data into XSIAM? (Choose two)

Accepted Answer

Palo Alto Networks Broker VM log collectors. Option B is correct because the Palo Alto Networks Broker VM is the on-premises component that hosts log collectors and forwards third-party log data into XSIAM when direct cloud ingestion isn't possible. Option D is correct because XSIAM supports cloud-native data ingestion through integrations such as AWS SQS and Azure Event Hubs, which pull logs from cloud services into the platform. Option A is incorrect because XSIAM does not ingest third-party logs via manual CSV uploads on a user profile page. Option C is incorrect because XSIAM does not use direct SQL Server database replication as an ingestion method. Option E is incorrect because there is no physical serial cable connection to an XSIAM tenant gateway for log ingestion.

Answer

Manual CSV file upload via the user profile page

Answer

Direct database replication via SQL Server Management Studio

Answer

Physical serial cable connection to the XSIAM tenant gateway

Question 13

Which TWO actions can an administrator perform when managing integration instances within XSIAM? (Choose two)

Accepted Answer

Test the integration instance connection. Option C is correct because XSIAM's integration instance management UI includes a built-in "Test" function that validates connectivity and credentials against the target service (for example, by issuing the API call or authentication handshake defined in the integration's test command), letting administrators confirm the instance is configured properly before relying on it in playbooks. Option E is correct because administrators can toggle an integration instance between enabled and disabled states from the Instances page, which controls whether commands from that instance are available to playbooks and automations without deleting the configuration. Options A, B, and D are incorrect because XSIAM is a cloud-delivered platform: tenants cannot alter the global database schema, edit the vendor's sealed integration pack source code, or patch the underlying operating system of the multi-tenant backend, as those layers are managed exclusively by Palo Alto Networks.

Answer

Change the global XSIAM database schema

Answer

Modify the core source code of the vendor integration pack

Answer

Directly patch the underlying operating system of the cloud tenant backend

Question 14

Which THREE configuration steps are typically required when setting up a new Broker VM instance in XSIAM? (Choose three)

Accepted Answer

Deploy the OVA image on an on-premises hypervisor (e.g., VMware ESXi). Option A is correct because a new Broker VM in XSIAM is deployed by importing the provided OVA image onto an on-premises hypervisor such as VMware ESXi, which creates the virtual appliance that hosts the broker services. Option C is correct because the Broker VM must be registered to the tenant using a registration token generated from the XSIAM console, which authenticates and binds the appliance to the correct tenant. Option E is correct because during initial setup the Broker VM requires network configuration (IP address, gateway, DNS) and optional proxy parameters so it can reach the XSIAM cloud and any internal resources. Option B is not required because the Broker VM ships as a prebuilt Linux appliance and no kernel compilation is performed. Option D is not required because the Cortex XDR Agent is not installed on the Broker VM host machine as part of Broker VM setup.

Answer

Manually compile the Linux kernel on the Broker VM

Answer

Install the Cortex XDR Agent on the Broker VM host machine

Question 15

Which THREE parameters can be configured when setting up a log ingestion parsing rule in XSIAM? (Choose three)

Accepted Answer

Target vendor and product mapping. Option C is correct because a parsing rule must identify the log source by mapping it to the target vendor and product, which determines how the incoming raw logs are recognized and parsed. Option D is correct because the core of a parsing rule is defining XDM (Extended Data Model) field mappings and transformations that convert raw log fields into normalized XSIAM schema fields. Option E is correct because parsing rules support filtering conditions that restrict the rule to specific log subsets, so only matching events are parsed by that rule. Option A is not correct because Broker VM hardware CPU allocation is an infrastructure/appliance sizing setting, not a parameter of a log parsing rule. Option B is not correct because automatic remediation playbook execution is configured in playbooks or automation rules, not within the log ingestion parsing rule itself.

Answer

Broker VM hardware CPU allocation limits

Answer

Automatic remediation playbook execution ID