XSIAM-Engineer Integration And Automation Practice Test 5 — 15 Questions

Question 1

You are troubleshooting a parsing error where logs from a custom application are not being mapped correctly to the XDM schema. What is the recommended approach to debug the transformation process?

Accepted Answer

Use the XDM Parsing tool to test the log sample against the existing parser and view validation errors.. The XDM Parsing tool is the recommended approach to debug parsing errors because it allows you to test a log sample against the existing parser and view validation errors. This helps identify where the mapping to the XDM schema is failing. It provides a sandbox for troubleshooting without affecting production data.

Answer

Create a new playbook to manually map the fields in the alert.

Answer

Modify the ingestion configuration to change the vendor product type.

Answer

Update the Data Collector version on the server.

Question 2

You are configuring a custom integration that requires sending an HTTP POST request to a legacy internal system. Which feature allows you to securely manage the connection credentials?

Accepted Answer

Use the 'Credentials' module in the integration instance settings to store and reference the secret.. The 'Credentials' module in the integration instance settings is designed to securely store and manage credentials such as usernames, passwords, API keys, and certificates. It allows the integration to reference these secrets without hardcoding them, and they are encrypted at rest. This is the recommended secure method for managing connection credentials.

Answer

Hardcode the credentials in the Python script of the custom integration.

Answer

Set up a global environment variable in the Data Collector configuration.

Answer

Add the credentials as plain text in the playbook input fields.

Question 3

You need to ensure that a specific integration uses a dedicated proxy server to communicate with the cloud. Where is this proxy configuration defined?

Accepted Answer

The Integration Instance configuration settings.. Proxy settings for individual integrations are managed within the specific Integration Instance configuration panel.

Answer

Data Management > Collector Group settings.

Answer

The XQL Query Builder Advanced tab.

Answer

Global Settings > Network > Proxy.

Question 4

When managing integrations in XSIAM, what is the purpose of the 'Test' button found in the integration instance configuration?

Accepted Answer

It verifies connectivity and credentials with the third-party service.. The test button validates the connectivity and authentication credentials against the target service.

Answer

It updates the integration plugin to the latest version.

Answer

It triggers a full synchronization of all historical data.

Answer

It pushes a sample alert to the third-party system.

Question 5

An automation playbook fails because the JSON response from an API call contains nested objects that are not being parsed correctly. What is the best way to handle this in a playbook?

Accepted Answer

Use transformation steps in the playbook to parse nested JSON fields.. Using the 'Extract' or 'JSON transform' steps within a playbook allows for the parsing of nested structures for downstream processing.

Answer

Change the integration to use XML instead of JSON.

Answer

Increase the timeout setting for the integration.

Answer

Delete the integration and reinstall it.

Question 6

You are writing a custom XQL query to filter logs, but you find that the field names are inconsistent across your data sources. How can you standardize these fields for your automation?

Accepted Answer

Ensure proper XDM mapping is applied to the ingestion source.. XDM (eXtendable Data Model) mapping ensures that logs from different sources are normalized into common field names, making queries more robust.

Answer

Rely on the raw log field names and map them manually in the playbook.

Answer

Use the 'Rename' function in every XQL query.

Answer

Use an external script to rewrite the logs before they reach XSIAM.

Question 7

Which THREE of the following are critical components required for a successful data ingestion integration in XSIAM?

Accepted Answer

A defined XDM parser to normalize the incoming data.. Option A is correct because XSIAM requires a defined XDM (XSIAM Data Model) parser to map and normalize raw incoming data fields into the standardized schema so that XQL queries, analytics, and detections can operate consistently across sources. Option C is correct because every ingestion integration must authenticate to the source or broker using valid API credentials, keys, or authentication tokens; without them the integration cannot pull or receive data. Option D is correct because an active and healthy Data Collector group is the component that actually receives, buffers, and forwards data into XSIAM, so a broken or unregistered collector group halts ingestion. Option B is not required, since XQL dashboards are for visualization and investigation, not for the ingestion pipeline itself, and not every integration needs its own dashboard. Option E is not required, as firewall rules are environment-specific and only needed when network paths demand them; they are not a critical component of the ingestion integration itself.

Answer

A dedicated XQL dashboard for every integration.

Answer

A pre-configured firewall rule for all internal traffic.

Question 8

Which TWO of the following features help maintain data security during the integration process?

Accepted Answer

Encrypted credential vaulting for API keys.. Option C is correct because encrypted credential vaulting for API keys ensures that sensitive authentication secrets used by integrations are stored in an encrypted, access-controlled repository rather than in plaintext configuration files, reducing the risk of credential theft or leakage during data exchange. Option D is correct because RBAC for integration management enforces least-privilege access, ensuring that only authorized roles can configure, modify, or view integration components, which limits the blast radius of a compromised account and prevents unauthorized changes to data flows. Options A, B, and E do not belong: automatically assigning a public IP to every collector unnecessarily exposes collectors to the internet and enlarges the attack surface; granting full administrative rights to every integration service account violates least privilege and magnifies the impact of any compromise; and disabling all logs for third-party integrations removes the audit trail needed to detect and investigate security incidents.

Answer

Automatic public IP assignment for every collector.

Answer

Full administrative rights for every integration service account.

Answer

Disabling all logs for third-party integrations.

Question 9

Which TWO of the following actions can be performed within the Cortex XSIAM Marketplace?

Accepted Answer

Install and manage integration plugins.. The Marketplace is used for installing integrations and managing content packs.

Answer

Directly edit the source code of the underlying XSIAM engine.

Answer

Configure individual log forwarding destinations.

Answer

Provision new physical server hardware for collectors.

Question 10

Which THREE of the following are benefits of using the XDM (eXtendable Data Model) in Cortex XSIAM?

Accepted Answer

Improved performance and speed of XQL queries.. Option B is correct because XDM maps ingested data into a consistent, indexed schema, which lets XQL queries run against normalized fields and datasets more efficiently, improving query performance and speed. Option C is correct because XDM provides a common vocabulary and unified fields (for example, shared actor, causality, and alert fields) that make it possible to correlate alerts and events from many different vendors rather than treating each source's proprietary format separately. Option D is correct because the core purpose of the Cortex XSIAM eXtendable Data Model is to normalize disparate data sources—endpoint, network, cloud, identity, and third-party logs—into a single common schema so they can be searched and analyzed uniformly. Option A is not a benefit of XDM; API keys for third-party integrations are created through configuration/integration settings, not by the data model. Option E is also not a benefit of XDM; the model normalizes field structure and semantics, but it does not automatically translate all log content into English.

Answer

Automatic creation of API keys for third-party tools.

Answer

Automatic translation of all log content into English.

Question 11

An engineer is building a Cortex XSIAM automation that must call an external REST API. The API requires a static API key that must never appear in playbook exports, task inputs, or the war room. The key must also be usable by multiple playbooks and be rotatable without editing any playbook. Which mechanism should the engineer use to store and reference the API key?

Accepted Answer

Create a credential in the XSIAM Credentials store and reference it in the integration instance and playbook tasks by its credential name.. The XSIAM Credentials store is designed to hold secrets such as API keys, passwords, and tokens separately from content. Referencing a credential by name keeps the plaintext out of playbook definitions, task inputs, war room entries, and content exports, and it lets multiple playbooks and integration instances share one secret. Rotating the credential updates every reference at once, matching all constraints in the scenario.

Answer

Store the API key in a list named api_keys and read it with the GetList automation in each task that calls the API.

Answer

Hardcode the API key in the integration's custom Python code and protect the integration with role-based access control.

Answer

Define the API key as a playbook input and pass it from the incident or alert when the playbook is triggered.

Question 12

An engineer has a Cortex XSIAM playbook that enriches alerts by querying an internal CMDB through a REST API integration. The integration instance is configured and passes connectivity tests, but during playbook execution the enrichment task returns an authentication error only when the playbook is triggered by an alert from a specific data source. The same task succeeds on every other trigger. What is the most likely cause?

Accepted Answer

The playbook task is using an incident-level credential scope, and the affected data source's incidents have no credential attached to that scope.. Credential scope determines where a playbook task looks up a secret. System-scoped credentials are available everywhere, while incident-scoped credentials are resolved from the triggering incident. If the affected data source does not populate the expected incident credential, only incidents from that source will fail authentication, which exactly matches the selective failure pattern described. Changing the task to a system-scoped credential or ensuring the source attaches the credential resolves the issue.

Answer

The integration instance is disabled for the tenant that owns the affected data source.

Answer

The affected data source's alert contains a field value that overrides the credential used by the integration, such as a malformed authorization header mapped from the alert.

Answer

The REST API integration is being rate-limited by the CMDB, and the affected data source generates a burst of alerts that exhausts the quota.

Question 13

An automation engineer wants a playbook to send a notification to a Slack channel only when a critical incident is created. The playbook is triggered by an incident creation event. Which XSIAM playbook task type should be used to conditionally execute the Slack notification task?

Accepted Answer

A conditional task that evaluates the incident severity field and routes to the Slack task only if severity equals 'Critical'.. The correct approach is to use a conditional task that evaluates the incident severity and only routes to the Slack notification when the severity is 'Critical'. This ensures the notification is sent exclusively for critical incidents, aligning with the requirement to notify only on critical incident creation. Other task types either require manual intervention, lack conditional logic, or do not enforce the severity check.

Answer

A manual task that requires an analyst to approve sending the Slack notification before it executes.

Answer

A script task that runs a Python script to directly post to Slack without evaluating any conditions.

Answer

A data collection task that gathers incident fields and then automatically executes all subsequent tasks regardless of severity.

Question 14

An XSIAM engineer needs to create a playbook that automatically enriches IP addresses from an incident by querying a threat intelligence integration. The enrichment should only occur if the incident contains at least one IP address. Which playbook task should be used to extract the IP addresses from the incident for further processing?

Accepted Answer

A 'Extract Indicators' task that parses the incident fields and extracts IP addresses into context.. The 'Extract Indicators' task is the correct choice because it automatically parses incident data to extract IP addresses and other indicators into the playbook context. This enables subsequent enrichment tasks to use those IPs. It can be configured to run only when indicators are present, satisfying the conditional requirement without custom scripting.

Answer

A 'Data Collection' task that gathers all incident fields into a structured format for analysis.

Answer

A 'Conditional' task that checks if the incident has an IP address field and then proceeds.

Answer

A 'Run Script' task that manually parses the incident description using regular expressions to find IP addresses.

Question 15

A Cortex XSIAM engineer is building a playbook that must wait for an external SOC analyst to approve a high-risk containment action before proceeding. The playbook should pause execution and resume only after the analyst submits a response through a form link. Which task type should the engineer add to the playbook to accomplish this?

Accepted Answer

A 'Data Collection' task that sends a form and waits for the analyst's reply. Human-in-the-loop approvals in XSIAM playbooks are implemented with the Data Collection task, which sends a form to a designated recipient and suspends execution until a reply is received. The submitted answers become context data that downstream conditional logic can evaluate. Neither conditional branching, War Room manual tasks, nor API polling can both prompt an external analyst and pause the playbook for that response.

Answer

A 'Generic Polling' task that repeatedly queries the ticketing system for approval status

Answer

A 'Conditional' task that evaluates a variable set by the analyst

Answer

A 'Manual' task that requires the engineer to click 'Complete' in the War Room