XSIAM-Engineer Multiple Select — 40 Questions

Question 1

An administrator is setting up custom Role-Based Access Control (RBAC) folders and permissions in Cortex XSIAM to segregate data access between regional security teams. Which TWO configuration steps are required when creating a new custom role and assigning data scopes? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define the specific functional permissions (such as incident viewing, response actions, or configuration management) assigned to the role.. Option A is correct because a custom RBAC role in Cortex XSIAM must explicitly define its functional permissions, i.e., which actions members can perform such as viewing incidents, executing response actions, or managing configuration, since permissions are granted by the role and not inherited implicitly. Option D is correct because data scopes are the mechanism that restricts which incidents, alerts, or datasets a role can access, typically based on tags or criteria, which is exactly what is needed to segregate data between regional security teams. The other options do not belong: B is wrong because roles are created through the Cortex XSIAM management console or supported APIs, not by manually compiling source code into a JSON manifest; C is wrong because authorization is enforced centrally by the Cortex XSIAM platform, not by XSOAR engines on analyst workstations; and E is wrong because Broker VMs and log collectors handle data ingestion and forwarding, and rebooting them is not part of propagating role definitions.

Answer

Manually compile the source code of the role policy into a JSON manifest and push it via the REST API.

Answer

Install an additional XSOAR engine on each analyst workstation to enforce local authorization checks.

Answer

Reboot all Broker VMs in the region to propagate the new role definitions to local log collectors.

Question 2

Which TWO components or methods are valid options for ingesting third-party log data into XSIAM? (Choose two)

Accepted Answer

Palo Alto Networks Broker VM log collectors. Option B is correct because the Palo Alto Networks Broker VM is the on-premises component that hosts log collectors and forwards third-party log data into XSIAM when direct cloud ingestion isn't possible. Option D is correct because XSIAM supports cloud-native data ingestion through integrations such as AWS SQS and Azure Event Hubs, which pull logs from cloud services into the platform. Option A is incorrect because XSIAM does not ingest third-party logs via manual CSV uploads on a user profile page. Option C is incorrect because XSIAM does not use direct SQL Server database replication as an ingestion method. Option E is incorrect because there is no physical serial cable connection to an XSIAM tenant gateway for log ingestion.

Answer

Manual CSV file upload via the user profile page

Answer

Direct database replication via SQL Server Management Studio

Answer

Physical serial cable connection to the XSIAM tenant gateway

Question 3

An administrator wants to optimize XQL search performance across large log datasets. Which TWO best practices should be applied when writing queries? (Choose two)

Accepted Answer

Specify the dataset early in the query using the `dataset = ...` clause to narrow the search scope.. Option A is correct because specifying the dataset early with the `dataset = ...` clause restricts the XQL search to only the relevant data, reducing the volume of records scanned and improving query performance. Option E is correct because limiting the time range to the smallest necessary window minimizes the amount of historical data processed, which is a core optimization for large log datasets. Options B and C are incorrect because querying all historical data without time limits and avoiding filters both increase the data scanned and degrade performance. Option D is incorrect because raw regex parsing on unparsed datasets is expensive and less efficient than using parsed fields and structured filters.

Answer

Always query all historical datasets without time limits to ensure completeness.

Answer

Avoid using any filters and sort by random strings.

Answer

Execute all searches using raw regex parsing on unparsed datasets.

Question 4

An administrator needs to ensure that custom dashboards created by SOC analysts are backed up or migrated between environments. Which TWO options are available for content portability in XSIAM? (Choose two)

Accepted Answer

Export dashboard definitions to JSON format for migration across tenants.. Option C is correct because XSIAM allows dashboard definitions to be exported as JSON, which preserves the dashboard structure, widgets, and queries so they can be imported into another tenant or environment. Option D is correct because the Content Management feature supports packaging custom dashboards and widgets into a content pack, enabling controlled backup and migration of content between environments. Option A is incorrect because browser cookies only maintain a user's authenticated session and contain no portable dashboard definitions. Option B is incorrect because paper printouts are static and cannot be reimported or migrated as functional content. Option E is incorrect because manually retyping XQL queries is error-prone and does not constitute a supported content portability mechanism.

Answer

Copy the browser cookies of the analyst's session.

Answer

Print physical paper copies of the dashboard screens.

Answer

Manually retype every XQL query into a notepad file on a local workstation without export tools.

Question 5

Which THREE of the following are benefits of using the XDM (eXtendable Data Model) in Cortex XSIAM?

Accepted Answer

Improved performance and speed of XQL queries.. Option B is correct because XDM maps ingested data into a consistent, indexed schema, which lets XQL queries run against normalized fields and datasets more efficiently, improving query performance and speed. Option C is correct because XDM provides a common vocabulary and unified fields (for example, shared actor, causality, and alert fields) that make it possible to correlate alerts and events from many different vendors rather than treating each source's proprietary format separately. Option D is correct because the core purpose of the Cortex XSIAM eXtendable Data Model is to normalize disparate data sources—endpoint, network, cloud, identity, and third-party logs—into a single common schema so they can be searched and analyzed uniformly. Option A is not a benefit of XDM; API keys for third-party integrations are created through configuration/integration settings, not by the data model. Option E is also not a benefit of XDM; the model normalizes field structure and semantics, but it does not automatically translate all log content into English.

Answer

Automatic creation of API keys for third-party tools.

Answer

Automatic translation of all log content into English.

Question 6

An administrator is deploying Cortex XSIAM agents on a fleet of corporate servers and needs to ensure proper installation parameters and operational readiness. Which TWO methods are valid for deploying or managing agent installations in XSIAM? (Choose two)

Accepted Answer

Configuring automated agent upgrade profiles and installation packages directly from the Cortex XSIAM management console.. Option A is correct because the Cortex XSIAM management console provides built-in agent management capabilities, including creating installation packages and configuring automated upgrade profiles that push new agent versions to endpoints without manual intervention. Option E is correct because XSIAM agents can be deployed through third-party software distribution tools such as Microsoft SCCM or Jamf, where the installer package is executed with an installation token parameter that authenticates the endpoint to the XSIAM tenant during registration. Option B is incorrect because telnet on port 23 is an insecure legacy remote-shell protocol and is not a supported mechanism for triggering any XSIAM agent installer service. Option C is incorrect because XSIAM agents are user-space endpoint software, not BIOS-embedded kernel drivers, and firmware flashing is not a deployment method. Option D is incorrect because XSIAM does not use a physical USB-delivered master cryptographic key; agent authentication relies on installation tokens and tenant-issued credentials.

Answer

Manually telnetting into port 23 of every server to trigger the built-in operating system agent installer service.

Answer

Flashing the server BIOS with a specialized firmware image that contains the embedded XSIAM kernel driver.

Answer

Physically connecting a USB thumb drive containing the master cryptographic key to each server's motherboard.

Question 7

An administrator is troubleshooting an API integration that has stopped collecting data. Which THREE diagnostic steps should be performed? (Choose three)

Accepted Answer

Verify if the API key, token, or credentials have expired or been revoked.. Option A is correct because API integrations commonly fail when the API key, OAuth token, or service account credentials have expired, been rotated, or been revoked, and verifying their validity is a fundamental first diagnostic step. Option D is correct because the integration poller must be able to reach the external API endpoint over the required ports; firewall rules, proxy settings, DNS resolution, or routing changes can silently block outbound HTTPS (TCP 443) traffic and halt data collection. Option E is correct because the XSIAM integration execution logs surface specific HTTP status codes (e.g., 401 Unauthorized, 403 Forbidden, 429 Too Many Requests) and error messages that pinpoint whether the failure is authentication, rate limiting, or endpoint-related. Option B is incorrect because reinstalling printer drivers on the administrator's laptop has no bearing on a server-side API integration and is unrelated to data collection. Option C is incorrect because formatting the Broker VM Docker container storage volumes would destroy the broker's configuration and data rather than diagnose the integration failure, and is not a valid troubleshooting step.

Answer

Reinstall the local printer drivers on the administrator's laptop.

Answer

Format the Broker VM Docker container storage volumes.

Question 8

An administrator is configuring data collection settings and incident rules in Cortex XSIAM. Which TWO configuration steps are required to ensure proper data parsing and alert generation for a newly added third-party firewall log source? (Choose two)

Accepted Answer

Ensuring the corresponding vendor content pack is installed and active to correctly parse and normalize logs into the XSIAM schema. Option C is correct because Cortex XSIAM relies on vendor-specific content packs (parsers and data models) to correctly parse and normalize third-party firewall logs into the XSIAM schema, which is a prerequisite for meaningful alert generation. Option D is correct because logs must first be ingested through the proper collection mechanism — a Broker VM receiver (e.g., Syslog/CEF receiver) or an API integration instance — before parsing and alerting can occur. Option A is incorrect because recompiling the Cortex XDR agent kernel extension relates to endpoint agent functionality, not to ingesting or parsing third-party firewall logs. Option B is incorrect because flushing SOC analysts' browser caches has no effect on data collection, parsing, or incident rule evaluation. Option E is incorrect because the cloud data lake is a managed service; manually modifying its kernel source via SSH is neither supported nor required for log onboarding.

Answer

Recompiling the Cortex XDR agent kernel extension on all endpoints

Answer

Flushing the browser cache of all SOC analysts

Answer

Manually modifying the cloud data lake kernel source code via SSH

Question 9

An administrator is configuring log collection from a cloud storage bucket (e.g., AWS S3) into XSIAM. Which TWO configuration steps are required to establish this ingestion pipeline? (Choose two)

Accepted Answer

Specify the target bucket name and region in the XSIAM Data Collection configuration.. Cloud storage bucket ingestion requires setting up cloud integration credentials (IAM roles/keys) and configuring the data collection instance in XSIAM specifying the bucket details.

Answer

Deploy a physical hardware appliance in every AWS Availability Zone.

Answer

Configure the local Windows registry on the administrator workstation to route AWS traffic.

Answer

Manually install the Cortex XDR Agent on the AWS S3 root server.

Question 10

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux servers. Which THREE tasks should be performed during the planning and deployment phase? (Choose three)

Accepted Answer

Establish phased rollout groups to monitor stability and prevent widespread issues.. Option B is correct because a phased rollout (pilot rings/groups) lets the administrator validate agent stability, performance, and compatibility on a small subset before broad deployment, limiting blast radius if a version causes issues. Option D is correct because existing endpoint security software (e.g., other AV/EDR, or OS-native tools like Windows Defender or SELinux) can conflict with the Cortex XDR agent's kernel-level components, so defining exclusions prevents installation failures, performance degradation, or false positives. Option E is correct because Cortex XDR provides separate agent installers and profiles per platform—Windows (.msi/.exe), macOS (.pkg/.dmg), and Linux (.rpm/.deb)—so OS-specific packages and profiles are required for a mixed environment. Option A is not needed because agent deployment is done via software distribution, GPO, SCCM, or scripts over the network, not serial consoles. Option C is wrong because disabling firewall rules on the XSIAM/Cortex cloud tenant is neither required nor advisable for agent deployment and would weaken security.

Answer

Manually connect a serial console cable to every server in the data center.

Answer

Disable all firewall rules on the XSIAM cloud tenant.

Question 11

An administrator is configuring data ingestion in XSIAM and needs to ensure that logs from a custom internal application are correctly normalized. Which THREE components are essential parts of the XSIAM log ingestion and normalization pipeline? (Choose three)

Accepted Answer

XSIAM Data Lake schema targets. Option E (Log Collector such as Broker VM or Agent) is essential because logs must first be received and forwarded into XSIAM; the Broker VM or endpoint agent provides the ingestion transport that delivers raw events to the platform. Option D (Parsing Rules / Normalization mapping) is correct because XSIAM uses parsing and normalization rules to extract fields from raw logs and map them to the common Cortex Data Model (CDM), which is exactly what is needed to correctly normalize a custom application's logs. Option C (XSIAM Data Lake schema targets) is correct because normalized events must be written into the Data Lake against defined schema targets, ensuring the parsed fields conform to the expected dataset structure for querying and detection. Option A is incorrect because physical network firewall bypass rules are a network-security concept unrelated to log parsing or normalization. Option B is incorrect because XSIAM does not require manually executed SQL queries for every incoming log packet; ingestion and normalization are handled automatically by collectors, parsers, and schema mapping.

Answer

Physical network firewall bypass rules

Answer

Manually executed SQL queries for every incoming log packet

Question 12

An administrator is reviewing infrastructure readiness for deploying Cortex XSIAM engines on-premises. Which TWO prerequisites must be validated on the host infrastructure before engine installation? (Choose two)

Accepted Answer

Outbound TCP port 443 connectivity to the Cortex XSIAM cloud environment.. Option A is correct because Cortex XSIAM engines must maintain outbound TCP 443 connectivity to the Cortex XSIAM cloud environment for management, telemetry, and updates, so this must be validated before installation. Option B is correct because engine hosts require adequate CPU, RAM, and disk sizing to handle the anticipated query and parsing workloads; undersized resources will cause performance and ingestion problems. Option C is incorrect because no physical motherboard access or hardware crypto-accelerator card installation is a prerequisite for XSIAM engine deployment. Option D is incorrect because disabling all host firewalls and SELinux entirely is not a requirement and would be a poor security practice. Option E is incorrect because the host does not need to run an Active Directory Domain Controller role to install a Cortex XSIAM engine.

Answer

Direct physical access to the server motherboard to install a hardware crypto-accelerator card.

Answer

Disabling all host system firewalls and SELinux entirely across the corporate datacenter.

Answer

Active Directory Domain Controller role installed on the same host operating system.

Question 13

An administrator wants to ensure high availability and disaster recovery readiness for an XSIAM deployment relying on Broker VMs and cloud ingestion. Which THREE operational practices should be implemented? (Choose three)

Accepted Answer

Configure redundant Broker VM instances behind a load balancer for syslog ingestion.. Option A is correct because deploying redundant Broker VM instances behind a load balancer eliminates a single point of failure for syslog ingestion, allowing traffic to fail over if one Broker VM becomes unavailable, which directly supports high availability. Option D is correct because maintaining current documentation and configuration backups of custom parsers and integration settings ensures that, in a disaster recovery scenario, the XSIAM tenant can be rebuilt or migrated quickly without losing bespoke parsing logic or connector configuration. Option E is correct because regularly monitoring ingestion pipeline health dashboards allows administrators to detect dropped logs, stalled connectors, or degraded Broker VM performance early, enabling remediation before data gaps compromise detection and response. Option B is incorrect because storing raw logs exclusively on local Broker VM drives without cloud replication creates a single point of failure and violates disaster recovery readiness, since local disk loss would permanently destroy the logs. Option C is incorrect because disabling automated correlation rules to conserve bandwidth would severely degrade detection capabilities and does not constitute a valid high availability or disaster recovery practice.

Answer

Store all raw logs exclusively on local Broker VM hard drives without cloud replication.

Answer

Disable all automated correlation rules to conserve disaster recovery bandwidth.

Question 14

An architect is planning the deployment of Cortex XSIAM in a large enterprise with multiple data centers. The architect must ensure high availability and scalability for log collection. Which TWO design considerations are critical for the Broker VM deployment? (Choose two.)

Accepted Answer

Ensure that each Broker VM has outbound connectivity to the Cortex XSIAM tenant.. For high availability and scalability, deploying multiple Broker VMs across data centers distributes the load and provides redundancy. Each Broker VM must also have outbound connectivity to the Cortex XSIAM tenant to forward logs. Together, these considerations ensure that log collection continues even if one site or Broker VM fails, and that the system can scale with increasing log volumes.

Answer

Use the same Broker VM to collect logs from all data centers over the WAN.

Answer

Deploy a single Broker VM with a load balancer to handle all log sources.

Answer

Configure each Broker VM with identical resource specifications to simplify management.

Question 15

An administrator is planning the deployment of Broker VMs to support data ingestion across multiple isolated network segments. Which TWO considerations are critical for proper Broker VM architecture and sizing? (Choose two)

Accepted Answer

The expected Events Per Second (EPS) volume traversing the specific Broker VM instance. Option C is correct because Broker VM sizing is driven primarily by the Events Per Second (EPS) throughput that will traverse each individual Broker instance; CPU, RAM, and disk must be provisioned based on that per-Broker ingestion load, so the expected EPS volume is a critical architectural consideration. Option E is correct because each Broker VM must be able to reach the XSIAM tenant URL outbound over HTTPS on TCP port 443 to register, receive configuration, and forward collected data to the cloud tenant; without this outbound connectivity the Broker cannot function. Option A is incorrect because Brokers collect data via syslog, agent, or API-based ingestion and do not require local administrative write access to network switches. Option B is incorrect because Broker VMs are not designed to host a local XSOAR database with 50 TB of persistence; data is forwarded to the XSIAM tenant rather than stored locally at that scale. Option D is incorrect because deploying a Windows Active Directory domain controller on each Broker VM is unrelated to Broker architecture and would add unnecessary complexity and attack surface.

Answer

Ensuring the Broker VM has local administrative write access to all ingested network switches

Answer

Configuring local XSOAR database persistence exceeding 50 Terabytes on the Broker VM

Answer

Deploying a separate Windows Active Directory domain controller on each Broker VM

Question 16

An architect is designing an enterprise deployment strategy for Cortex XSIAM in an environment with strict change management windows. Which THREE planning considerations are critical for a successful rollout? (Choose three)

Accepted Answer

Defining data ingestion scopes and filtering rules to manage storage quotas and costs. Option A is correct because defining data ingestion scopes and filtering rules directly controls how much telemetry is parsed, indexed, and retained in Cortex XSIAM, which governs storage quota consumption and licensing costs in an enterprise rollout. Option B is correct because establishing pilot testing groups (upgrade rings) lets the organization validate agent versions and content pack updates in a limited cohort before broad deployment, which is essential when changes must fit strict change management windows. Option D is correct because XSIAM agents and brokers must reach Cortex XSIAM service endpoints over outbound TCP 443, so firewall and proxy egress rules must be updated to allow the required XSIAM FQDNs or endpoints will fail to register and report. Option C is not a legitimate planning consideration because rewriting local OS kernels is neither required nor supported by Cortex XSIAM and is unrelated to deployment strategy. Option E is also incorrect because replacing physical network switches with fiber-optic hubs is not a XSIAM deployment requirement and hubs are obsolete, collision-prone devices that would degrade rather than enable the rollout.

Answer

Requiring all end users to manually rewrite their local operating system kernels

Answer

Replacing all physical network switches with fiber-optic hubs

Question 17

An administrator is reviewing the health of endpoint agents across the enterprise. Which TWO statuses or metrics can be monitored in the Endpoint Management view? (Choose two)

Accepted Answer

Installed agent software version and content version. Option A is correct because the Endpoint Management view exposes the installed agent software version and the content version (e.g., signature/definition updates) for each managed endpoint, which are core health metrics for verifying agents are current. Option C is correct because agent connection status (Connected / Disconnected) is a primary health indicator shown in Endpoint Management, allowing administrators to identify endpoints that have lost communication with the management server. Option B is incorrect because printer ink levels are hardware consumable data unrelated to endpoint agent health and are not reported by the agent management console. Option D is incorrect because Wi-Fi password history is user credential data that is neither collected nor displayed for endpoint health monitoring. Option E is incorrect because browser-stored personal email credentials are private user data outside the scope of agent status and content version monitoring.

Answer

Local printer ink levels on managed workstations

Answer

Individual employee Wi-Fi password history

Answer

Personal email login credentials stored in browser caches

Question 18

Which THREE parameters can be configured when setting up a log ingestion parsing rule in XSIAM? (Choose three)

Accepted Answer

Target vendor and product mapping. Option C is correct because a parsing rule must identify the log source by mapping it to the target vendor and product, which determines how the incoming raw logs are recognized and parsed. Option D is correct because the core of a parsing rule is defining XDM (Extended Data Model) field mappings and transformations that convert raw log fields into normalized XSIAM schema fields. Option E is correct because parsing rules support filtering conditions that restrict the rule to specific log subsets, so only matching events are parsed by that rule. Option A is not correct because Broker VM hardware CPU allocation is an infrastructure/appliance sizing setting, not a parameter of a log parsing rule. Option B is not correct because automatic remediation playbook execution is configured in playbooks or automation rules, not within the log ingestion parsing rule itself.

Answer

Broker VM hardware CPU allocation limits

Answer

Automatic remediation playbook execution ID

Question 19

An XSIAM administrator needs to ensure that the platform can correlate events from multiple data sources to detect sophisticated attacks. Which TWO actions are required to enable this correlation? (Choose two.)

Accepted Answer

Create correlation rules that define the attack patterns.. To enable effective correlation, XSIAM requires that data from various sources be normalized to a common schema and that correlation rules be defined to detect attack patterns. Normalization ensures events are comparable, and rules specify what patterns to look for. The Correlation Engine is always active, and no additional on-premises server or UBA enablement is necessary for basic correlation.

Answer

Enable the Correlation Engine in the XSIAM settings.

Answer

Enable User Behavior Analytics (UBA) for all users.

Answer

Install a separate correlation server on-premises.

Question 20

A Cortex XSIAM engineer is troubleshooting a custom automation script that runs as part of an incident response playbook. The script intermittently fails with timeout errors when it calls an external enrichment API, and the engineer wants to make the playbook more resilient without changing the external service. Which TWO changes should the engineer make? (Choose two.)

Accepted Answer

Increase the task's timeout value in the playbook task configuration. Intermittent timeouts from an external API are best handled by making the caller tolerant of transient failures. Retrying with exponential backoff recovers from brief outages and throttling, while a longer task timeout accommodates legitimately slow responses. Together these changes harden the script without touching the external service. Suppressing errors, rescheduling the call, or swapping languages does not improve resilience.

Answer

Move the API call to a separate playbook that runs on a schedule instead of on demand

Answer

Convert the script from Python to PowerShell to change its network stack

Answer

Disable the playbook's error handling so failures are silently ignored