XSIAM-Engineer Operations And Lifecycle Management — 25 Questions

Question 1

An XSIAM tenant is approaching its licensed data ingestion volume limit. The operations team needs to identify which data sources are consuming the highest ingestion bandwidth. Where should the administrator check this information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Go to Settings > Configurations > License Management to view data ingestion breakdown by source and vendor.. License utilization and ingestion volume by data source can be monitored in XSIAM under Settings > License Management or the License Usage dashboard.

Answer

Review the Audit Trail dashboard for high-frequency API polling events.

Answer

Execute an XQL query using the `dataset = host_inventory` command and group by storage size.

Answer

Check the Cortex XDR Agent health status page under Endpoint Management.

Question 2

During routine maintenance, an administrator notices that a custom parser is dropping incoming events from a newly integrated security appliance. Where should the administrator check to debug syntax and grok pattern failures in real time?

Accepted Answer

Navigate to Settings > Configurations > Data Collection > Parsers, select the custom parser, and use the Test Parser feature with sample raw logs.. The Log Forwarding and Log ingestion troubleshooting within XSIAM includes a parser testing utility where sample log lines can be pasted and tested against custom parsers to debug grok patterns and extraction rules.

Answer

SSH into the Cortex XSIAM management cluster master node and check the /var/log/parser.log file.

Answer

Open the Cortex XDR Agent console on the local machine and export the Agent Log Collector bundle.

Answer

Review the Incident Graph to trace dropped packets from the ingestion pipeline.

Question 3

An analyst reports that the XSIAM web interface session is timing out too quickly due to security policies. Where can an administrator modify the idle session timeout duration?

Accepted Answer

Navigate to Settings > Configurations > Global Settings to adjust the idle session timeout value.. Idle session timeout for the XSIAM/Cortex XSIAM web console is a global platform-level setting, not a per-agent or per-policy control. Administrators change it under Settings > Configurations > Global Settings, where the idle session timeout value governs how long an authenticated browser session can remain inactive before the user is forced to re-authenticate. This is the only location that directly controls console session expiry.

Answer

Update the Log Forwarding profile timeout threshold.

Answer

Modify the Agent Settings profile assigned to the administrator's laptop.

Answer

Edit the XQL query execution limit parameters in Analytics settings.

Question 4

An organization mandates that specific log datasets must be retained for 400 days, exceeding the default retention period. Where should the administrator configure extended data retention rules?

Accepted Answer

Go to Settings > Configurations > Data Retention to configure custom retention periods for specific datasets.. The correct location to configure extended data retention is Settings > Configurations > Data Retention. This allows administrators to set custom retention periods for specific datasets, overriding the default. This is the centralized place for managing retention policies in XSIAM.

Answer

Set up a local cron job on each Broker VM to archive logs to local hard drives.

Answer

Modify the global license key string to unlock extended storage capacities.

Answer

Create an automated XSOAR playbook to export raw logs to local USB drives daily.

Question 5

An administrator is configuring a webhook integration to forward XSIAM incidents to an external ticketing system. The remote server requires mutual TLS (mTLS) client certificate authentication. Where should the client certificate be uploaded in XSIAM?

Accepted Answer

Upload the client certificate within the integration instance or certificate store settings for the webhook.. For a webhook integration requiring mutual TLS (mTLS), the client certificate must be uploaded within the integration instance or certificate store settings for that webhook. This is where XSIAM stores the client certificate and private key used to authenticate to the remote server during the TLS handshake. It is the correct and only appropriate location for mTLS client credentials.

Answer

Paste the certificate into the custom CSS styling box under Global Settings.

Answer

Store the certificate in the Broker VM local `/etc/passwd` file.

Answer

Install the certificate in the local browser certificate store of the analyst viewing the incident.

Question 6

An organization requires that all API access tokens used for programmatic interaction with XSIAM expire every 90 days. Where can API key expiration policies be configured?

Accepted Answer

Manage API key creation, expiration, and revocation under Settings > Integrations > API Keys.. API key lifecycles and generation policies are managed under Settings > Integrations > API Keys or Access Management.

Answer

Configure the Agent Software Upgrade schedule under Endpoint Management.

Answer

Adjust the Broker VM Docker container memory limit.

Answer

Modify the XQL query timeout threshold.

Question 7

An XSIAM engineer is preparing to upgrade the Cortex XSIAM tenant to a new release. The security team wants to ensure that all custom correlation rules, playbooks, and dashboards are preserved and can be rolled back if the upgrade introduces issues. What should the engineer do FIRST before initiating the upgrade?

Accepted Answer

Export a full tenant backup using the Backup and Restore feature in the Cortex XSIAM management console.. The Backup and Restore feature in Cortex XSIAM is the correct first step because it captures the entire tenant configuration, including custom correlation rules, playbooks, and dashboards. This ensures that if the upgrade fails or causes regressions, the engineer can restore the previous state. Manually copying files or disabling rules does not provide a reliable rollback path and can leave the environment unprotected.

Answer

Disable all custom correlation rules to prevent them from interfering with the upgrade process.

Answer

Schedule the upgrade during a maintenance window without any backup, since Cortex XSIAM upgrades are always non-destructive.

Answer

Manually copy all custom correlation rules and playbooks to a text file for later re-import.

Question 8

A Cortex XSIAM engineer needs to ensure that audit logs are retained for 365 days to comply with regulatory requirements. The current retention period for audit logs is set to 90 days. Where should the engineer modify this setting?

Accepted Answer

In the Cortex XSIAM management console, navigate to Settings > Configurations > Data Retention and adjust the Audit Logs retention period.. The Data Retention configuration page in Cortex XSIAM is where administrators can set the retention period for audit logs and other data types. Changing the audit log retention to 365 days ensures compliance with regulatory requirements. Other sections like Access Management, Data Sources, or System Settings do not control audit log retention, so they are incorrect.

Answer

In the Cortex XSIAM management console, navigate to Settings > Configurations > System Settings and change the audit log retention in the Logging section.

Answer

In the Cortex XSIAM management console, navigate to Settings > Configurations > Access Management and modify the audit log retention under the User Roles section.

Answer

In the Cortex XSIAM management console, navigate to Settings > Configurations > Data Sources and edit the retention for the Audit Logs data source.

Question 9

A Cortex XSIAM engineer needs to automate the remediation of a specific type of malware detected on endpoints. The remediation script must run only when the malware is detected and must be applied to the affected endpoint. Which XSIAM component should be used to achieve this?

Accepted Answer

Create a Correlation Rule that triggers a playbook when the malware is detected.. Correlation Rules in Cortex XSIAM evaluate events and can trigger playbooks for automated response. By creating a correlation rule that detects the specific malware, the engineer can ensure the remediation playbook runs only when that malware is detected, satisfying the conditional automation requirement. Other options do not provide event-driven execution.

Answer

Use the Cortex XSIAM API to poll for malware alerts and then manually run the script.

Answer

Create a BIOC rule that directly executes the remediation script on the endpoint.

Answer

Configure a scheduled report to run the remediation script on all endpoints daily.

Question 10

A Cortex XSIAM engineer needs to ensure that all endpoints have the latest version of the Cortex XDR agent. Which action should be taken to automatically update agents to the latest version?

Accepted Answer

In the Cortex XSIAM console, go to Endpoints > Agent Management and enable automatic agent upgrades.. To automatically update Cortex XDR agents, the engineer should enable automatic agent upgrades in the Endpoints > Agent Management section of the Cortex XSIAM console. This built-in feature handles version checks and upgrades. Other methods are manual or not native, and thus do not provide the required automation.

Answer

Configure the agent to check for updates via the Update Server setting in the agent configuration profile.

Answer

Manually download the latest agent installer and deploy it to each endpoint via Group Policy.

Answer

Create a scheduled playbook that runs a script on all endpoints to download and install the latest agent.

Question 11

An XSIAM administrator needs to ensure that a newly created custom correlation rule can be automatically reverted to its previous state after a problematic change. The administrator wants to control this at the rule level without using a full system backup. What should be done?

Accepted Answer

Create a snapshot of the rule using the 'Save as Version' option in the rule editor.. The correct approach is to use the built-in versioning feature within the correlation rule editor. Saving versions creates snapshots that can be restored, providing a safety net for rule changes. This method is integrated into XSIAM and avoids the overhead of external backups or manual audits.

Answer

Use the 'Audit Trail' to manually revert changes by reapplying the previous configuration from logs.

Answer

Enable the 'Version Control' setting in the correlation rule configuration and set a retention period.

Answer

Configure a scheduled job in the XSIAM CLI to export the rule to an external repository every hour.

Question 12

A Cortex XSIAM administrator is preparing to upgrade a production tenant from version 2.5 to 2.6. Before the upgrade window, the administrator needs to verify that all custom integrations and playbooks will remain compatible. Which action should the administrator take first?

Accepted Answer

Review the XSIAM Release Notes and check the Compatibility Matrix under Settings > System > Upgrades.. Before upgrading Cortex XSIAM, the administrator must consult the Release Notes and the Compatibility Matrix to identify breaking changes and validated integration/playbook versions. This proactive check allows remediation before the maintenance window. Exporting or deleting content, or relying on Marketplace automation or support tickets, does not replace the authoritative pre-upgrade compatibility review that the Release Notes and Compatibility Matrix provide.

Answer

Open a support ticket requesting a compatibility audit of all custom content and wait for the vendor to confirm readiness.

Answer

Export all custom playbooks to a local archive, then delete them before the upgrade to avoid conflicts.

Answer

Run the built-in Upgrade Readiness Report from the Marketplace and apply all recommended fixes automatically.

Question 13

A security operations team is onboarding a new cloud workload protection agent. The agent registers successfully but no endpoint data appears in XSIAM. The administrator confirms the agent is running on the host. Which XSIAM component should the administrator verify to ensure the agent's telemetry is being routed to the correct data plane?

Accepted Answer

Broker VM. When an endpoint agent is running but no data appears in XSIAM, the most likely cause is a failure in the data path between the agent and the XSIAM tenant. The Broker VM is the designated component that relays endpoint telemetry to the cloud. Checking its registration, configuration, and network connectivity ensures the agent's data can reach XSIAM. Other components like the Collector or Data Lake serve different roles and would not explain the missing endpoint data.

Answer

XSIAM Manager

Answer

Cortex Data Lake

Answer

XSIAM Collector

Question 14

A Cortex XSIAM administrator needs to restore a dataset that was accidentally deleted from the data lake by a junior analyst. The administrator has a full tenant backup that was taken two days ago. Which restore option is available in the XSIAM backup and restore interface?

Accepted Answer

Restore individual datasets from the backup using the Backup & Restore page.. XSIAM's Backup & Restore feature supports granular recovery of individual datasets, which is ideal when a specific dataset is accidentally deleted. Restoring only that dataset from the most recent backup minimizes impact on other data and configurations. Full tenant restore is unnecessary and risky, API-based restore is not available, and re-ingestion is impractical and incomplete.

Answer

Re-ingest the raw logs from the original data sources to rebuild the dataset.

Answer

Use the API endpoint /public_api/v1/backup/restore_dataset to restore the dataset programmatically.

Answer

Restore the entire tenant configuration and data from the backup, overwriting all current data.

Question 15

A SOC manager needs to grant a new analyst the ability to view incidents and run queries in XSIAM, but should not allow the analyst to modify correlation rules or delete incidents. Which predefined role should be assigned to follow the principle of least privilege?

Accepted Answer

Security Analyst. The Security Analyst role is specifically tailored for SOC analysts, providing the necessary permissions to view and investigate incidents, run queries, and perform day-to-day tasks without granting administrative rights. It adheres to least privilege by preventing modifications to critical configurations like correlation rules and prohibiting incident deletion.

Answer

Instance Administrator

Answer

Account Administrator

Answer

Viewer

Question 16

A security engineer is asked to validate that the XSIAM platform is properly licensed and that the subscription will not expire within the next 30 days. Where in the Cortex XSIAM interface should the engineer check the license capacity and expiration date?

Accepted Answer

Settings > License Management. License capacity and expiration are managed in the dedicated License Management section under Settings. This area provides the authoritative view of subscription status, including expiration date and usage against entitlement. Checking any other location, such as health monitoring or dashboards, will not yield the required licensing details and could lead to missing a critical renewal deadline.

Answer

Settings > Configurations > Licensing

Answer

Settings > Health & Monitoring > License Status

Answer

Dashboard > System Overview

Question 17

A Cortex XSIAM engineer is asked to configure a custom data retention policy for a high-volume endpoint telemetry dataset so that raw events older than 30 days are automatically purged while alerts and incidents remain available for 12 months. Where should the engineer configure this dataset-level retention?

Accepted Answer

In Settings > Configurations > Data Retention, set the retention period for the endpoint telemetry dataset to 30 days and set the alert dataset retention to 365 days.. Dataset-level retention is configured centrally in Settings > Configurations > Data Retention, where each dataset can have a distinct retention window. Assigning 30 days to the endpoint telemetry dataset limits raw event storage, while keeping the alert dataset at 365 days preserves detection and investigation context. The other paths either manipulate ingestion licensing, attempt unsupported deletion via queries, or interfere with collection instead of storage lifecycle.

Answer

Edit the Broker VM log forwarding configuration to drop endpoint telemetry events after 30 days by adding an age-based filter on the collector.

Answer

In the Cortex Data Lake tenant settings, adjust the ingestion license allocation for the endpoint telemetry dataset to 30 days and restart the data pipeline.

Answer

Create a scheduled query in the Query Center that runs daily to delete endpoint telemetry records older than 30 days from the dataset.

Question 18

An XSIAM administrator is configuring a new data source integration for a cloud-based application. The integration requires authentication and data retrieval. Which TWO steps are essential to ensure the integration works correctly and securely? (Choose two.)

Accepted Answer

Generate an API key with the least privileges required for data access.. The essential steps are to generate a least-privilege API key for secure authentication and to test the integration with a manual fetch to verify data ingestion. These steps ensure both security and functionality, which are critical for any data source integration.

Answer

Assign the integration to a dedicated user account with domain administrator rights.

Answer

Configure a Broker VM to proxy all API requests through the on-premises network.

Answer

Enable automatic updates for the integration to receive new features.

Question 19

A security operations center manager wants to grant a new analyst the ability to view incidents and run queries but not to modify incident details or configuration. Which Cortex XSIAM role should be assigned to the analyst?

Accepted Answer

Viewer. The Viewer role is designed for read-only access, allowing users to view incidents and run queries but not modify incident details or system configuration. This matches the manager's need for an analyst who can observe and investigate without making changes. Other roles like Security Analyst or Investigator include write permissions that would violate the least-privilege principle.

Answer

Account Admin

Answer

Investigator

Answer

Security Analyst

Question 20

An XSIAM engineer is configuring a new data source that sends logs via syslog to a Broker VM. The engineer notices that logs are being received by the Broker VM but are not appearing in the XSIAM data lake. The Broker VM's log ingestion configuration shows the correct parser is selected. What should the engineer check next to resolve the issue?

Accepted Answer

Verify that the Broker VM has outbound connectivity to the XSIAM management console on port 443.. The Broker VM acts as a log forwarder, receiving logs from sources and sending them to the XSIAM management console. If logs are received but not appearing in the data lake, the most likely cause is a failure in the forwarding path, such as blocked outbound connectivity. Verifying outbound access on port 443 ensures the Broker VM can communicate with XSIAM and deliver the logs.

Answer

Ensure the syslog source is sending logs in the correct format as defined by the parser.

Answer

Confirm that the data source's IP address is included in the Broker VM's allowed sources list.

Answer

Check the Broker VM's disk space to ensure it has not run out of storage for buffering logs.