XSIAM-Engineer Operations And Lifecycle Management — All Questions With Answers

Read the full Operations And Lifecycle Management explanation →

An XSIAM engineer is preparing to upgrade the Cortex XSIAM tenant to a new release. The security team wants to ensure that all custom correlation rules, playbooks, and dashboards are preserved and can be rolled back if the upgrade introduces issues. What should the engineer do FIRST before initiating the upgrade?

Question 8hardmultiple choice

A Cortex XSIAM engineer needs to ensure that audit logs are retained for 365 days to comply with regulatory requirements. The current retention period for audit logs is set to 90 days. Where should the engineer modify this setting?

Question 9hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer needs to automate the remediation of a specific type of malware detected on endpoints. The remediation script must run only when the malware is detected and must be applied to the affected endpoint. Which XSIAM component should be used to achieve this?

Question 10mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer needs to ensure that all endpoints have the latest version of the Cortex XDR agent. Which action should be taken to automatically update agents to the latest version?

Question 11mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM administrator needs to ensure that a newly created custom correlation rule can be automatically reverted to its previous state after a problematic change. The administrator wants to control this at the rule level without using a full system backup. What should be done?

Question 12mediummultiple choice

A Cortex XSIAM administrator is preparing to upgrade a production tenant from version 2.5 to 2.6. Before the upgrade window, the administrator needs to verify that all custom integrations and playbooks will remain compatible. Which action should the administrator take first?

Question 13mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A security operations team is onboarding a new cloud workload protection agent. The agent registers successfully but no endpoint data appears in XSIAM. The administrator confirms the agent is running on the host. Which XSIAM component should the administrator verify to ensure the agent's telemetry is being routed to the correct data plane?

Question 14mediummultiple choice

A Cortex XSIAM administrator needs to restore a dataset that was accidentally deleted from the data lake by a junior analyst. The administrator has a full tenant backup that was taken two days ago. Which restore option is available in the XSIAM backup and restore interface?

Question 15easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A SOC manager needs to grant a new analyst the ability to view incidents and run queries in XSIAM, but should not allow the analyst to modify correlation rules or delete incidents. Which predefined role should be assigned to follow the principle of least privilege?

Question 16mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A security engineer is asked to validate that the XSIAM platform is properly licensed and that the subscription will not expire within the next 30 days. Where in the Cortex XSIAM interface should the engineer check the license capacity and expiration date?

Question 17mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer is asked to configure a custom data retention policy for a high-volume endpoint telemetry dataset so that raw events older than 30 days are automatically purged while alerts and incidents remain available for 12 months. Where should the engineer configure this dataset-level retention?

Question 18hardmulti select

An XSIAM administrator is configuring a new data source integration for a cloud-based application. The integration requires authentication and data retrieval. Which TWO steps are essential to ensure the integration works correctly and securely? (Choose two.)

Question 19easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A security operations center manager wants to grant a new analyst the ability to view incidents and run queries but not to modify incident details or configuration. Which Cortex XSIAM role should be assigned to the analyst?

Question 20hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM engineer is configuring a new data source that sends logs via syslog to a Broker VM. The engineer notices that logs are being received by the Broker VM but are not appearing in the XSIAM data lake. The Broker VM's log ingestion configuration shows the correct parser is selected. What should the engineer check next to resolve the issue?

Question 21mediummultiple choice

A Cortex XSIAM administrator needs to schedule a recurring export of all incidents created in the last 24 hours to an external SFTP server for compliance archiving. Which feature should the administrator use?

Question 22hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is preparing to upgrade the XSIAM tenant to a new major version. Which TWO actions should the administrator take before initiating the upgrade to ensure a smooth transition? (Choose two.)

Question 23easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer needs to grant a new SOC analyst the ability to view incidents and run queries but not to modify policies or delete data. Which built-in role should the engineer assign to satisfy the principle of least privilege?

Question 24hardmulti select

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator is preparing to enable automated incident response playbooks in production. The administrator needs to ensure that playbooks execute reliably without causing unintended actions. Which TWO safeguards should the administrator implement before enabling automation? (Choose two.)

Question 25mediummultiple choice

An XSIAM administrator needs to schedule a weekly report that summarizes incident trends and exports it as a PDF to a shared network drive. Which feature should the administrator use to accomplish this?

Question 26hardmulti select

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer must ensure that the platform can continue to receive endpoint telemetry and generate detections even if the primary Broker VM fails. Which two actions should the engineer take to provide high availability for log collection? (Choose two.)

Question 27easymultiple choice

An organization requires all audit logs generated within XSIAM to be exported to an external SIEM for long-term archiving. Which feature should the administrator configure?

Question 28mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator notices that a particular correlation rule is generating a high volume of false positive incidents. What is the recommended operational step to refine the rule without disabling it entirely?

Question 29easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator wants to ensure that specific sensitive incident categories are restricted to a dedicated tier-2 response team. Which XSIAM construct should be configured to achieve this role-based operational segregation?

Question 30hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to troubleshoot why a Broker VM is failing to ingest logs from an internal syslog source. Which diagnostic utility available on the Broker VM console should the administrator use first?

Question 31hardmultiple choice

An administrator needs to update the Cortex XDR agent installation package across 5,000 endpoints without causing network saturation. Which feature should be utilized to manage this rollout effectively?

Question 32mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM administrator needs to configure log forwarding from a Linux server to the XSIAM collector. Which action must be performed first on the endpoint before deploying the Collector service?

Question 33mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An enterprise has multiple distinct business units, and the security operations team wants to ensure that analysts from Business Unit A can only investigate incidents assigned to their own unit, while global administrators can view everything. Which feature enables this multi-tenant or partitioned operational structure within a single XSIAM tenant?

Question 34mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator wants to configure automated email notifications to be sent to external stakeholders whenever a Critical severity incident is created. Which feature should be configured?

Question 35hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator configured a new API data collector to ingest threat intelligence feeds, but no data is appearing in XSIAM. Upon checking the Integration page, the status shows an authentication failure. What is the most likely cause and correct remediation?

Question 36easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to check the status of scheduled background reports and export tasks in XSIAM. Where can this task history be reviewed?

Question 37easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to verify whether a newly created Correlation Rule is actively evaluating incoming telemetry. Where should the administrator check the rule's operational status and recent execution statistics?

Question 38mediummultiple choice

An administrator wants to customize the fields displayed in the Incident table view to better align with the SOC's operational workflow. How should this be accomplished?

Question 39hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An organization is updating its internal Certificate Authority (CA). The administrator needs to update the trusted CA certificates used by the Broker VMs for secure syslog ingestion. Where must this certificate update be performed?

Question 40hardmultiple choice

An administrator is troubleshooting a scenario where custom parsers are failing to correctly extract fields because the incoming log format changed slightly. What operational step should be taken to update the parser without disrupting active data ingestion?

Question 41mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An operations team needs to ensure that inactive user accounts are automatically locked out after 90 days of inactivity. Where is this security policy managed?

Question 42hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is setting up a new Broker VM in an isolated network zone that requires all outbound HTTPS traffic to traverse an explicit corporate proxy server. Where must the proxy configuration be applied for the Broker VM to communicate with XSIAM?

Question 43easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to review all administrative actions (such as user logins, configuration changes, and role modifications) performed within the XSIAM tenant over the last 30 days. Where is this audit data located?

Question 44easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator wants to create a custom dashboard displaying key SOC metrics such as open incidents by severity and top alerted hosts. Which section of XSIAM should the administrator use to build this dashboard?

Question 45hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is investigating why an automated response playbook integrated via Cortex XSOAR failed to execute when triggered by an XSIAM incident. Where should the administrator check the integration communication logs?

Question 46easymultiple choice

An analyst wants to quickly search across all ingested logs for a specific IP address without writing a complex query from scratch. Which feature in XSIAM provides a rapid, centralized search interface?

Question 47mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to deploy a custom content pack containing specialized dashboards, parsers, and rules across multiple child tenants in a multi-tenant XSIAM environment. Where should the content pack be managed and distributed?

Question 48mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is configuring log collection from a cloud storage bucket (e.g., AWS S3) into XSIAM. Which TWO configuration steps are required to establish this ingestion pipeline? (Choose two)

Question 49hardmulti select

Read the full Operations And Lifecycle Management explanation →

An operations team is planning a routine maintenance window for Broker VMs. Which THREE best practices should be followed to ensure operational continuity? (Choose three)

Question 50hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is troubleshooting an issue where an endpoint agent is unable to connect to the XSIAM cloud management console, and local logs indicate certificate pinning verification failure. What is the most likely cause?

Question 51mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator needs to restrict access to sensitive XSIAM incident data to specific compliance officers. Which TWO actions accomplish this requirement? (Choose two)

Question 52hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator notices high resource utilization on a Broker VM. Which THREE diagnostic steps or remediation actions should be taken? (Choose three)

Question 53mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is setting up external log forwarding from XSIAM to a third-party SIEM. Which TWO protocols are natively supported for log forwarding destinations? (Choose two)

Question 54hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator wants to ensure high availability and disaster recovery readiness for an XSIAM deployment relying on Broker VMs and cloud ingestion. Which THREE operational practices should be implemented? (Choose three)

Question 55mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is reviewing the health of endpoint agents across the enterprise. Which TWO statuses or metrics can be monitored in the Endpoint Management view? (Choose two)

Question 56hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is designing a custom incident triage workflow in XSIAM. Which THREE actions can be automated as part of incident management configuration? (Choose three)

Question 57mediummulti select

Read the full Operations And Lifecycle Management explanation →

An organization requires strict adherence to data governance policies. Which TWO configurations help ensure that sensitive data is handled properly within XSIAM? (Choose two)

Question 58hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is troubleshooting an API integration that has stopped collecting data. Which THREE diagnostic steps should be performed? (Choose three)

Question 59mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator wants to optimize XQL search performance across large log datasets. Which TWO best practices should be applied when writing queries? (Choose two)

Question 60hardmulti select

Read the full Operations And Lifecycle Management explanation →

An enterprise is undergoing a security audit and requires proof of XSIAM system resilience and data integrity. Which THREE operational artifacts or features should the administrator provide to the auditors? (Choose three)

Question 61hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux servers. Which THREE tasks should be performed during the planning and deployment phase? (Choose three)

Question 62mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to modify the display name and description of a custom data collector instance. Where can this configuration be edited?

Question 63hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is troubleshooting a custom BIOC (Behavioral Indicator of Compromise) rule that is not triggering alerts even though matching logs are present in the Cortex Data Lake. What is the most effective operational step to debug the rule?

Question 64easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to check the remaining license capacity and expiration date of the XSIAM subscription. Where should the administrator look?

Question 65mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An organization wants to integrate XSIAM user authentication with an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is Single Sign-On (SSO) configured?

Question 66hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is investigating a data discrepancy where certain security logs ingested via a Broker VM do not match the raw source timestamps. Where can timezone and timestamp normalization settings be reviewed or adjusted?

Question 67easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator wants to view a chronological list of recent software updates and content pack releases applied to the XSIAM tenant. Where can this release history be checked?

Question 68mediummultiple choice

An administrator needs to configure automated incident assignment so that all incidents originating from network firewall logs are automatically routed to the Network Security SOC team. Which XSIAM feature accomplishes this?

Question 69hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is configuring a new syslog ingestion source on a Broker VM. The syslog messages use TCP with TLS encryption (Reliable Syslog). Where must the corresponding TLS server certificates for the Broker VM be configured?

Question 70mediummultiple choice

An organization wants to ensure that all sensitive personally identifiable information (PII) fields within ingested log datasets are automatically masked or hashed before being stored in the Cortex Data Lake. Which XSIAM capability should be configured?

Question 71easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to add a new user account to XSIAM and assign appropriate privileges. Where is user account creation and management performed?

Question 72hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is troubleshooting a Broker VM that has lost connectivity to the XSIAM management plane. After checking network routing and firewalls, the administrator suspects local Docker container network corruption on the Broker VM host. Which administrative utility script on the Broker VM can be used to restart and reset the container networking stack?

Question 73mediummulti select

An administrator needs to ensure that custom dashboards created by SOC analysts are backed up or migrated between environments. Which TWO options are available for content portability in XSIAM? (Choose two)

Question 74easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An analyst wants to export a list of active incidents to a CSV file for offline reporting. Which feature in the Incident view should be used?

Question 75mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A security engineer has created a custom correlation rule in XSIAM that triggers an alert when a specific process is executed on an endpoint. After saving the rule, the engineer notices that the alert is not appearing in the incident queue, even though the process was executed. The rule is enabled and the process event is being ingested. What is the most likely cause?

Question 76easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A security operations center (SOC) manager wants to ensure that all analysts can view a newly created custom dashboard that displays critical incident metrics. The dashboard was created by a senior analyst and saved in their personal folder. What is the most efficient way to make this dashboard available to the entire SOC team?

Question 77hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator needs to ensure that audit logs for all user actions are retained for 365 days to meet compliance requirements. The tenant is currently configured with the default retention period. Where should the administrator modify this setting?

Question 78easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to ensure that all new endpoint agents automatically receive the latest security policy upon registration. Which XSIAM feature should the administrator configure to enforce this behavior?

Question 79easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator needs to grant a new SOC analyst the ability to view incidents and run playbooks but not modify system configurations. Which built-in role should the administrator assign?

Question 80hardmultiple choice

A SOC manager wants to reduce alert fatigue by suppressing alerts that are triggered by a known benign scanner running on a critical server. The scanner generates repeated alerts with the same signature. Which XSIAM capability should the administrator use to suppress these specific alerts while still logging the events?

Question 81hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator needs to configure a new Broker VM to collect logs from a remote site. The Broker VM must be registered with the XSIAM tenant and then configured to forward logs to the XSIAM instance. Which sequence of actions should the administrator perform?

Question 82mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM administrator needs to ensure that a critical correlation rule triggers an alert only when a specific user account is involved in a security event. The rule currently triggers for all users. What is the most efficient way to modify the rule to meet this requirement?

Question 83mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to ensure that all XSIAM audit logs are retained for 365 days to meet compliance requirements. Where should the administrator configure the retention period for audit logs?

Question 84mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator needs to ensure that the platform automatically creates an incident when a specific correlation rule is triggered by multiple high-severity alerts within a 5-minute window. Which component should be configured to achieve this?

Question 85hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM administrator notices that the Cortex XDR agent on a critical server is not reporting to the console. The administrator verifies that the server has network connectivity to the XSIAM tenant and that the agent service is running. Which log should the administrator check first on the endpoint to diagnose the communication issue?

Question 86hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer is troubleshooting a sudden drop in ingested endpoint telemetry. The Broker VM shows healthy connectivity, but the XSIAM console reports that the endpoint dataset is not receiving new events. Which action should the engineer take first to determine whether the issue is a parsing or a collection problem?

Question 87hardmultiple choice

An XSIAM administrator needs to ensure that a newly deployed correlation rule does not generate an excessive number of alerts during its initial tuning phase. The administrator wants to limit the rule's impact while still collecting data for analysis. What is the most appropriate approach?

Question 88mediummulti select

Read the full Operations And Lifecycle Management explanation →

An XSIAM administrator needs to ensure that the platform can correlate events from multiple data sources to detect sophisticated attacks. Which TWO actions are required to enable this correlation? (Choose two.)

Question 89easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator needs to grant a new SOC analyst read-only access to incidents and alerts but prevent any modifications. Which role should be assigned to the analyst?

Question 90mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is planning to upgrade the XSIAM instance to a new major version. The administrator must ensure that the upgrade process does not disrupt ongoing security operations. Which two actions should be taken before initiating the upgrade? (Choose two.)

Question 91hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM engineer needs to ensure that a specific set of indicators of compromise (IOCs) is automatically blocked on all endpoints managed by XSIAM. The IOCs are provided in a CSV file and are updated daily. What is the most efficient and maintainable way to achieve this?

Question 92mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer is asked to ensure that when an incident is closed, a follow-up review task is automatically created for the SOC manager if the incident severity is Critical. Which mechanism should the engineer use to implement this automation?

Question 93mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer is asked to reduce the volume of duplicate alerts generated when the same endpoint triggers the same behavioral BIOC repeatedly within a short window. The engineer wants to group these into a single alert while preserving the original event details for investigation. Which feature should be configured?

Question 94hardmulti select

A Cortex XSIAM engineer must configure a playbook so that a containment action only executes after an analyst has reviewed the alert and explicitly approved it, and so that the playbook resumes from that point once approval is granted. Which two components should be used to implement this? (Choose two.)

Question 95easymultiple choice

A Cortex XSIAM engineer needs to give a newly hired tier-1 analyst the ability to view and triage alerts but not to modify playbooks, delete datasets, or change tenant-wide configurations. Which mechanism should the engineer use to enforce these boundaries?

Question 96mediummultiple choice

A Cortex XSIAM engineer notices that a set of custom correlation rules suddenly stopped generating alerts after a content update, even though the underlying telemetry is still arriving. The engineer wants to confirm whether the rules were modified, disabled, or overwritten by the update. Which source should be reviewed first?

Question 97hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer must ensure that a specific high-impact containment playbook cannot be triggered by an automated alert source without oversight, but the same playbook should still be runnable on demand by senior analysts during an active incident. Which configuration best satisfies both requirements?

Question 1mediummultiple choice

An XSIAM tenant is approaching its licensed data ingestion volume limit. The operations team needs to identify which data sources are consuming the highest ingestion bandwidth. Where should the administrator check this information?

Question 2hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

During routine maintenance, an administrator notices that a custom parser is dropping incoming events from a newly integrated security appliance. Where should the administrator check to debug syntax and grok pattern failures in real time?

Question 3easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An analyst reports that the XSIAM web interface session is timing out too quickly due to security policies. Where can an administrator modify the idle session timeout duration?

Question 4mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An organization mandates that specific log datasets must be retained for 400 days, exceeding the default retention period. Where should the administrator configure extended data retention rules?

Question 5hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is configuring a webhook integration to forward XSIAM incidents to an external ticketing system. The remote server requires mutual TLS (mTLS) client certificate authentication. Where should the client certificate be uploaded in XSIAM?

Question 6mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An organization requires that all API access tokens used for programmatic interaction with XSIAM expire every 90 days. Where can API key expiration policies be configured?

Question 7mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM engineer is preparing to upgrade the Cortex XSIAM tenant to a new release. The security team wants to ensure that all custom correlation rules, playbooks, and dashboards are preserved and can be rolled back if the upgrade introduces issues. What should the engineer do FIRST before initiating the upgrade?

Question 8hardmultiple choice

A Cortex XSIAM engineer needs to ensure that audit logs are retained for 365 days to comply with regulatory requirements. The current retention period for audit logs is set to 90 days. Where should the engineer modify this setting?

Question 9hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer needs to automate the remediation of a specific type of malware detected on endpoints. The remediation script must run only when the malware is detected and must be applied to the affected endpoint. Which XSIAM component should be used to achieve this?

Question 10mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer needs to ensure that all endpoints have the latest version of the Cortex XDR agent. Which action should be taken to automatically update agents to the latest version?

Question 11mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM administrator needs to ensure that a newly created custom correlation rule can be automatically reverted to its previous state after a problematic change. The administrator wants to control this at the rule level without using a full system backup. What should be done?

Question 12mediummultiple choice

A Cortex XSIAM administrator is preparing to upgrade a production tenant from version 2.5 to 2.6. Before the upgrade window, the administrator needs to verify that all custom integrations and playbooks will remain compatible. Which action should the administrator take first?

Question 13mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A security operations team is onboarding a new cloud workload protection agent. The agent registers successfully but no endpoint data appears in XSIAM. The administrator confirms the agent is running on the host. Which XSIAM component should the administrator verify to ensure the agent's telemetry is being routed to the correct data plane?

Question 14mediummultiple choice

A Cortex XSIAM administrator needs to restore a dataset that was accidentally deleted from the data lake by a junior analyst. The administrator has a full tenant backup that was taken two days ago. Which restore option is available in the XSIAM backup and restore interface?

Question 15easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A SOC manager needs to grant a new analyst the ability to view incidents and run queries in XSIAM, but should not allow the analyst to modify correlation rules or delete incidents. Which predefined role should be assigned to follow the principle of least privilege?

Question 16mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A security engineer is asked to validate that the XSIAM platform is properly licensed and that the subscription will not expire within the next 30 days. Where in the Cortex XSIAM interface should the engineer check the license capacity and expiration date?

Question 17mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer is asked to configure a custom data retention policy for a high-volume endpoint telemetry dataset so that raw events older than 30 days are automatically purged while alerts and incidents remain available for 12 months. Where should the engineer configure this dataset-level retention?

Question 18hardmulti select

An XSIAM administrator is configuring a new data source integration for a cloud-based application. The integration requires authentication and data retrieval. Which TWO steps are essential to ensure the integration works correctly and securely? (Choose two.)

Question 19easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A security operations center manager wants to grant a new analyst the ability to view incidents and run queries but not to modify incident details or configuration. Which Cortex XSIAM role should be assigned to the analyst?

Question 20hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM engineer is configuring a new data source that sends logs via syslog to a Broker VM. The engineer notices that logs are being received by the Broker VM but are not appearing in the XSIAM data lake. The Broker VM's log ingestion configuration shows the correct parser is selected. What should the engineer check next to resolve the issue?

Question 21mediummultiple choice

A Cortex XSIAM administrator needs to schedule a recurring export of all incidents created in the last 24 hours to an external SFTP server for compliance archiving. Which feature should the administrator use?

Question 22hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is preparing to upgrade the XSIAM tenant to a new major version. Which TWO actions should the administrator take before initiating the upgrade to ensure a smooth transition? (Choose two.)

Question 23easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer needs to grant a new SOC analyst the ability to view incidents and run queries but not to modify policies or delete data. Which built-in role should the engineer assign to satisfy the principle of least privilege?

Question 24hardmulti select

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator is preparing to enable automated incident response playbooks in production. The administrator needs to ensure that playbooks execute reliably without causing unintended actions. Which TWO safeguards should the administrator implement before enabling automation? (Choose two.)

Question 25mediummultiple choice

An XSIAM administrator needs to schedule a weekly report that summarizes incident trends and exports it as a PDF to a shared network drive. Which feature should the administrator use to accomplish this?

Question 26hardmulti select

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer must ensure that the platform can continue to receive endpoint telemetry and generate detections even if the primary Broker VM fails. Which two actions should the engineer take to provide high availability for log collection? (Choose two.)

Question 27easymultiple choice

An organization requires all audit logs generated within XSIAM to be exported to an external SIEM for long-term archiving. Which feature should the administrator configure?

Question 28mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator notices that a particular correlation rule is generating a high volume of false positive incidents. What is the recommended operational step to refine the rule without disabling it entirely?

Question 29easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator wants to ensure that specific sensitive incident categories are restricted to a dedicated tier-2 response team. Which XSIAM construct should be configured to achieve this role-based operational segregation?

Question 30hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to troubleshoot why a Broker VM is failing to ingest logs from an internal syslog source. Which diagnostic utility available on the Broker VM console should the administrator use first?

Question 31hardmultiple choice

An administrator needs to update the Cortex XDR agent installation package across 5,000 endpoints without causing network saturation. Which feature should be utilized to manage this rollout effectively?

Question 32mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM administrator needs to configure log forwarding from a Linux server to the XSIAM collector. Which action must be performed first on the endpoint before deploying the Collector service?

Question 33mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An enterprise has multiple distinct business units, and the security operations team wants to ensure that analysts from Business Unit A can only investigate incidents assigned to their own unit, while global administrators can view everything. Which feature enables this multi-tenant or partitioned operational structure within a single XSIAM tenant?

Question 34mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator wants to configure automated email notifications to be sent to external stakeholders whenever a Critical severity incident is created. Which feature should be configured?

Question 35hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator configured a new API data collector to ingest threat intelligence feeds, but no data is appearing in XSIAM. Upon checking the Integration page, the status shows an authentication failure. What is the most likely cause and correct remediation?

Question 36easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to check the status of scheduled background reports and export tasks in XSIAM. Where can this task history be reviewed?

Question 37easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to verify whether a newly created Correlation Rule is actively evaluating incoming telemetry. Where should the administrator check the rule's operational status and recent execution statistics?

Question 38mediummultiple choice

An administrator wants to customize the fields displayed in the Incident table view to better align with the SOC's operational workflow. How should this be accomplished?

Question 39hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An organization is updating its internal Certificate Authority (CA). The administrator needs to update the trusted CA certificates used by the Broker VMs for secure syslog ingestion. Where must this certificate update be performed?

Question 40hardmultiple choice

An administrator is troubleshooting a scenario where custom parsers are failing to correctly extract fields because the incoming log format changed slightly. What operational step should be taken to update the parser without disrupting active data ingestion?

Question 41mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An operations team needs to ensure that inactive user accounts are automatically locked out after 90 days of inactivity. Where is this security policy managed?

Question 42hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is setting up a new Broker VM in an isolated network zone that requires all outbound HTTPS traffic to traverse an explicit corporate proxy server. Where must the proxy configuration be applied for the Broker VM to communicate with XSIAM?

Question 43easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to review all administrative actions (such as user logins, configuration changes, and role modifications) performed within the XSIAM tenant over the last 30 days. Where is this audit data located?

Question 44easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator wants to create a custom dashboard displaying key SOC metrics such as open incidents by severity and top alerted hosts. Which section of XSIAM should the administrator use to build this dashboard?

Question 45hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is investigating why an automated response playbook integrated via Cortex XSOAR failed to execute when triggered by an XSIAM incident. Where should the administrator check the integration communication logs?

Question 46easymultiple choice

An analyst wants to quickly search across all ingested logs for a specific IP address without writing a complex query from scratch. Which feature in XSIAM provides a rapid, centralized search interface?

Question 47mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to deploy a custom content pack containing specialized dashboards, parsers, and rules across multiple child tenants in a multi-tenant XSIAM environment. Where should the content pack be managed and distributed?

Question 48mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is configuring log collection from a cloud storage bucket (e.g., AWS S3) into XSIAM. Which TWO configuration steps are required to establish this ingestion pipeline? (Choose two)

Question 49hardmulti select

Read the full Operations And Lifecycle Management explanation →

An operations team is planning a routine maintenance window for Broker VMs. Which THREE best practices should be followed to ensure operational continuity? (Choose three)

Question 50hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is troubleshooting an issue where an endpoint agent is unable to connect to the XSIAM cloud management console, and local logs indicate certificate pinning verification failure. What is the most likely cause?

Question 51mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator needs to restrict access to sensitive XSIAM incident data to specific compliance officers. Which TWO actions accomplish this requirement? (Choose two)

Question 52hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator notices high resource utilization on a Broker VM. Which THREE diagnostic steps or remediation actions should be taken? (Choose three)

Question 53mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is setting up external log forwarding from XSIAM to a third-party SIEM. Which TWO protocols are natively supported for log forwarding destinations? (Choose two)

Question 54hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator wants to ensure high availability and disaster recovery readiness for an XSIAM deployment relying on Broker VMs and cloud ingestion. Which THREE operational practices should be implemented? (Choose three)

Question 55mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is reviewing the health of endpoint agents across the enterprise. Which TWO statuses or metrics can be monitored in the Endpoint Management view? (Choose two)

Question 56hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is designing a custom incident triage workflow in XSIAM. Which THREE actions can be automated as part of incident management configuration? (Choose three)

Question 57mediummulti select

Read the full Operations And Lifecycle Management explanation →

An organization requires strict adherence to data governance policies. Which TWO configurations help ensure that sensitive data is handled properly within XSIAM? (Choose two)

Question 58hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is troubleshooting an API integration that has stopped collecting data. Which THREE diagnostic steps should be performed? (Choose three)

Question 59mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator wants to optimize XQL search performance across large log datasets. Which TWO best practices should be applied when writing queries? (Choose two)

Question 60hardmulti select

Read the full Operations And Lifecycle Management explanation →

An enterprise is undergoing a security audit and requires proof of XSIAM system resilience and data integrity. Which THREE operational artifacts or features should the administrator provide to the auditors? (Choose three)

Question 61hardmulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux servers. Which THREE tasks should be performed during the planning and deployment phase? (Choose three)

Question 62mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to modify the display name and description of a custom data collector instance. Where can this configuration be edited?

Question 63hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is troubleshooting a custom BIOC (Behavioral Indicator of Compromise) rule that is not triggering alerts even though matching logs are present in the Cortex Data Lake. What is the most effective operational step to debug the rule?

Question 64easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to check the remaining license capacity and expiration date of the XSIAM subscription. Where should the administrator look?

Question 65mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An organization wants to integrate XSIAM user authentication with an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is Single Sign-On (SSO) configured?

Question 66hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is investigating a data discrepancy where certain security logs ingested via a Broker VM do not match the raw source timestamps. Where can timezone and timestamp normalization settings be reviewed or adjusted?

Question 67easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator wants to view a chronological list of recent software updates and content pack releases applied to the XSIAM tenant. Where can this release history be checked?

Question 68mediummultiple choice

An administrator needs to configure automated incident assignment so that all incidents originating from network firewall logs are automatically routed to the Network Security SOC team. Which XSIAM feature accomplishes this?

Question 69hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is configuring a new syslog ingestion source on a Broker VM. The syslog messages use TCP with TLS encryption (Reliable Syslog). Where must the corresponding TLS server certificates for the Broker VM be configured?

Question 70mediummultiple choice

An organization wants to ensure that all sensitive personally identifiable information (PII) fields within ingested log datasets are automatically masked or hashed before being stored in the Cortex Data Lake. Which XSIAM capability should be configured?

Question 71easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to add a new user account to XSIAM and assign appropriate privileges. Where is user account creation and management performed?

Question 72hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator is troubleshooting a Broker VM that has lost connectivity to the XSIAM management plane. After checking network routing and firewalls, the administrator suspects local Docker container network corruption on the Broker VM host. Which administrative utility script on the Broker VM can be used to restart and reset the container networking stack?

Question 73mediummulti select

An administrator needs to ensure that custom dashboards created by SOC analysts are backed up or migrated between environments. Which TWO options are available for content portability in XSIAM? (Choose two)

Question 74easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An analyst wants to export a list of active incidents to a CSV file for offline reporting. Which feature in the Incident view should be used?

Question 75mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A security engineer has created a custom correlation rule in XSIAM that triggers an alert when a specific process is executed on an endpoint. After saving the rule, the engineer notices that the alert is not appearing in the incident queue, even though the process was executed. The rule is enabled and the process event is being ingested. What is the most likely cause?

Question 76easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A security operations center (SOC) manager wants to ensure that all analysts can view a newly created custom dashboard that displays critical incident metrics. The dashboard was created by a senior analyst and saved in their personal folder. What is the most efficient way to make this dashboard available to the entire SOC team?

Question 77hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator needs to ensure that audit logs for all user actions are retained for 365 days to meet compliance requirements. The tenant is currently configured with the default retention period. Where should the administrator modify this setting?

Question 78easymultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to ensure that all new endpoint agents automatically receive the latest security policy upon registration. Which XSIAM feature should the administrator configure to enforce this behavior?

Question 79easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator needs to grant a new SOC analyst the ability to view incidents and run playbooks but not modify system configurations. Which built-in role should the administrator assign?

Question 80hardmultiple choice

A SOC manager wants to reduce alert fatigue by suppressing alerts that are triggered by a known benign scanner running on a critical server. The scanner generates repeated alerts with the same signature. Which XSIAM capability should the administrator use to suppress these specific alerts while still logging the events?

Question 81hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator needs to configure a new Broker VM to collect logs from a remote site. The Broker VM must be registered with the XSIAM tenant and then configured to forward logs to the XSIAM instance. Which sequence of actions should the administrator perform?

Question 82mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM administrator needs to ensure that a critical correlation rule triggers an alert only when a specific user account is involved in a security event. The rule currently triggers for all users. What is the most efficient way to modify the rule to meet this requirement?

Question 83mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

An administrator needs to ensure that all XSIAM audit logs are retained for 365 days to meet compliance requirements. Where should the administrator configure the retention period for audit logs?

Question 84mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator needs to ensure that the platform automatically creates an incident when a specific correlation rule is triggered by multiple high-severity alerts within a 5-minute window. Which component should be configured to achieve this?

Question 85hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM administrator notices that the Cortex XDR agent on a critical server is not reporting to the console. The administrator verifies that the server has network connectivity to the XSIAM tenant and that the agent service is running. Which log should the administrator check first on the endpoint to diagnose the communication issue?

Question 86hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer is troubleshooting a sudden drop in ingested endpoint telemetry. The Broker VM shows healthy connectivity, but the XSIAM console reports that the endpoint dataset is not receiving new events. Which action should the engineer take first to determine whether the issue is a parsing or a collection problem?

Question 87hardmultiple choice

An XSIAM administrator needs to ensure that a newly deployed correlation rule does not generate an excessive number of alerts during its initial tuning phase. The administrator wants to limit the rule's impact while still collecting data for analysis. What is the most appropriate approach?

Question 88mediummulti select

Read the full Operations And Lifecycle Management explanation →

An XSIAM administrator needs to ensure that the platform can correlate events from multiple data sources to detect sophisticated attacks. Which TWO actions are required to enable this correlation? (Choose two.)

Question 89easymultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM administrator needs to grant a new SOC analyst read-only access to incidents and alerts but prevent any modifications. Which role should be assigned to the analyst?

Question 90mediummulti select

Read the full Operations And Lifecycle Management explanation →

An administrator is planning to upgrade the XSIAM instance to a new major version. The administrator must ensure that the upgrade process does not disrupt ongoing security operations. Which two actions should be taken before initiating the upgrade? (Choose two.)

Question 91hardmultiple choice

Read the full Operations And Lifecycle Management explanation →

An XSIAM engineer needs to ensure that a specific set of indicators of compromise (IOCs) is automatically blocked on all endpoints managed by XSIAM. The IOCs are provided in a CSV file and are updated daily. What is the most efficient and maintainable way to achieve this?

Question 92mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer is asked to ensure that when an incident is closed, a follow-up review task is automatically created for the SOC manager if the incident severity is Critical. Which mechanism should the engineer use to implement this automation?

Question 93mediummultiple choice

Read the full Operations And Lifecycle Management explanation →

A Cortex XSIAM engineer is asked to reduce the volume of duplicate alerts generated when the same endpoint triggers the same behavioral BIOC repeatedly within a short window. The engineer wants to group these into a single alert while preserving the original event details for investigation. Which feature should be configured?

Question 94hardmulti select

A Cortex XSIAM engineer must configure a playbook so that a containment action only executes after an analyst has reviewed the alert and explicitly approved it, and so that the playbook resumes from that point once approval is granted. Which two components should be used to implement this? (Choose two.)

Question 95easymultiple choice

A Cortex XSIAM engineer needs to give a newly hired tier-1 analyst the ability to view and triage alerts but not to modify playbooks, delete datasets, or change tenant-wide configurations. Which mechanism should the engineer use to enforce these boundaries?

Question 96mediummultiple choice

A Cortex XSIAM engineer notices that a set of custom correlation rules suddenly stopped generating alerts after a content update, even though the underlying telemetry is still arriving. The engineer wants to confirm whether the rules were modified, disabled, or overwritten by the update. Which source should be reviewed first?

Question 97hardmultiple choice