XSIAM-Engineer Operations And Lifecycle Management Practice Test 2 — 15 Questions

Question 1

A security engineer is asked to validate that the XSIAM platform is properly licensed and that the subscription will not expire within the next 30 days. Where in the Cortex XSIAM interface should the engineer check the license capacity and expiration date?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Settings > License Management. License capacity and expiration are managed in the dedicated License Management section under Settings. This area provides the authoritative view of subscription status, including expiration date and usage against entitlement. Checking any other location, such as health monitoring or dashboards, will not yield the required licensing details and could lead to missing a critical renewal deadline.

Answer

Settings > Configurations > Licensing

Answer

Settings > Health & Monitoring > License Status

Answer

Dashboard > System Overview

Question 2

A Cortex XSIAM engineer is asked to configure a custom data retention policy for a high-volume endpoint telemetry dataset so that raw events older than 30 days are automatically purged while alerts and incidents remain available for 12 months. Where should the engineer configure this dataset-level retention?

Accepted Answer

In Settings > Configurations > Data Retention, set the retention period for the endpoint telemetry dataset to 30 days and set the alert dataset retention to 365 days.. Dataset-level retention is configured centrally in Settings > Configurations > Data Retention, where each dataset can have a distinct retention window. Assigning 30 days to the endpoint telemetry dataset limits raw event storage, while keeping the alert dataset at 365 days preserves detection and investigation context. The other paths either manipulate ingestion licensing, attempt unsupported deletion via queries, or interfere with collection instead of storage lifecycle.

Answer

Edit the Broker VM log forwarding configuration to drop endpoint telemetry events after 30 days by adding an age-based filter on the collector.

Answer

In the Cortex Data Lake tenant settings, adjust the ingestion license allocation for the endpoint telemetry dataset to 30 days and restart the data pipeline.

Answer

Create a scheduled query in the Query Center that runs daily to delete endpoint telemetry records older than 30 days from the dataset.

Question 3

An XSIAM administrator is configuring a new data source integration for a cloud-based application. The integration requires authentication and data retrieval. Which TWO steps are essential to ensure the integration works correctly and securely? (Choose two.)

Accepted Answer

Generate an API key with the least privileges required for data access.. The essential steps are to generate a least-privilege API key for secure authentication and to test the integration with a manual fetch to verify data ingestion. These steps ensure both security and functionality, which are critical for any data source integration.

Answer

Assign the integration to a dedicated user account with domain administrator rights.

Answer

Configure a Broker VM to proxy all API requests through the on-premises network.

Answer

Enable automatic updates for the integration to receive new features.

Question 4

A security operations center manager wants to grant a new analyst the ability to view incidents and run queries but not to modify incident details or configuration. Which Cortex XSIAM role should be assigned to the analyst?

Accepted Answer

Viewer. The Viewer role is designed for read-only access, allowing users to view incidents and run queries but not modify incident details or system configuration. This matches the manager's need for an analyst who can observe and investigate without making changes. Other roles like Security Analyst or Investigator include write permissions that would violate the least-privilege principle.

Answer

Account Admin

Answer

Investigator

Answer

Security Analyst

Question 5

An XSIAM engineer is configuring a new data source that sends logs via syslog to a Broker VM. The engineer notices that logs are being received by the Broker VM but are not appearing in the XSIAM data lake. The Broker VM's log ingestion configuration shows the correct parser is selected. What should the engineer check next to resolve the issue?

Accepted Answer

Verify that the Broker VM has outbound connectivity to the XSIAM management console on port 443.. The Broker VM acts as a log forwarder, receiving logs from sources and sending them to the XSIAM management console. If logs are received but not appearing in the data lake, the most likely cause is a failure in the forwarding path, such as blocked outbound connectivity. Verifying outbound access on port 443 ensures the Broker VM can communicate with XSIAM and deliver the logs.

Answer

Ensure the syslog source is sending logs in the correct format as defined by the parser.

Answer

Confirm that the data source's IP address is included in the Broker VM's allowed sources list.

Answer

Check the Broker VM's disk space to ensure it has not run out of storage for buffering logs.

Question 6

A Cortex XSIAM administrator needs to schedule a recurring export of all incidents created in the last 24 hours to an external SFTP server for compliance archiving. Which feature should the administrator use?

Accepted Answer

Create a Scheduled Report with an Incident dataset and configure an SFTP destination.. Scheduled Reports in Cortex XSIAM are designed for recurring exports of datasets, including incidents, and support SFTP as a delivery destination. This native feature automates the daily archiving requirement securely. Manual export lacks automation, forwarding rules do not exist for incidents, and custom playbooks, while possible, are not the intended tool for scheduled reporting.

Answer

Create a playbook that runs daily, queries incidents, and writes them to an SFTP server using a built-in integration.

Answer

Configure a forwarding rule in Settings > Configurations > Integrations to send incidents to SFTP.

Answer

Use the Incident view's Export to CSV button and manually upload the file to SFTP each day.

Question 7

An administrator is preparing to upgrade the XSIAM tenant to a new major version. Which TWO actions should the administrator take before initiating the upgrade to ensure a smooth transition? (Choose two.)

Accepted Answer

Review the release notes for breaking changes and new features.. Before upgrading XSIAM, reviewing release notes is crucial to understand changes and potential impacts. Verifying that all Broker VMs are online and healthy ensures that data collection and communication continue without interruption during and after the upgrade. These two actions directly contribute to a smooth transition. Other actions like exporting dashboards or scheduling a maintenance window are good practices but not strictly required for technical readiness.

Answer

Schedule the upgrade during a maintenance window.

Answer

Export all custom dashboards and reports.

Answer

Disable all BIOC rules to prevent false positives during the upgrade.

Question 8

A Cortex XSIAM engineer needs to grant a new SOC analyst the ability to view incidents and run queries but not to modify policies or delete data. Which built-in role should the engineer assign to satisfy the principle of least privilege?

Accepted Answer

Security Analyst. The Security Analyst role provides the necessary investigative capabilities—viewing incidents and running queries—without granting policy modification or data deletion rights. Administrative roles exceed the requirement, and the Viewer role is too limited to support query execution and incident handling. Choosing Security Analyst enforces least privilege while enabling the analyst to perform their job.

Answer

Account Administrator

Answer

Viewer

Answer

Instance Administrator

Question 9

A Cortex XSIAM administrator is preparing to enable automated incident response playbooks in production. The administrator needs to ensure that playbooks execute reliably without causing unintended actions. Which TWO safeguards should the administrator implement before enabling automation? (Choose two.)

Accepted Answer

Configure role-based access control to limit who can modify or run playbooks.. Before enabling automated playbooks, administrators should test them in simulation mode to validate logic and avoid false positives, and implement RBAC to control who can modify or execute playbooks. These safeguards reduce the risk of unintended actions. Unlimited timeouts, disabled logging, and excessive permissions are not safeguards and would increase operational risk.

Answer

Grant all analysts full administrative rights to ensure they can fix playbook issues quickly.

Answer

Set the playbook execution timeout to zero to allow unlimited runtime for complex playbooks.

Answer

Disable all playbook logging to reduce storage consumption and improve performance.

Question 10

An XSIAM administrator needs to schedule a weekly report that summarizes incident trends and exports it as a PDF to a shared network drive. Which feature should the administrator use to accomplish this?

Accepted Answer

Use the Reports page to create a new report template with incident widgets, then schedule it.. The Reports page is specifically designed for creating, scheduling, and distributing reports. It provides templates with widgets that can display incident trends and other data, and supports scheduling with export to PDF. This automates the weekly delivery to a network drive. Other options either lack scheduling, PDF formatting, or automation capabilities.

Answer

Configure a playbook that generates a PDF and sends it via email.

Answer

Set up a dashboard and use the Export to PDF button to manually save it weekly.

Answer

Create a scheduled query in the Query Center and configure an export action.

Question 11

A Cortex XSIAM engineer must ensure that the platform can continue to receive endpoint telemetry and generate detections even if the primary Broker VM fails. Which two actions should the engineer take to provide high availability for log collection? (Choose two.)

Accepted Answer

Configure the endpoint agents to send telemetry to both Broker VMs simultaneously.. High availability for log collection requires redundancy at the collection layer. Deploying a standby Broker VM and configuring agents to send to both collectors ensures that a single collector failure does not stop telemetry ingestion. Data Lake replication, query-based backfill, and retention changes operate on stored data and cannot maintain live collection, so they do not satisfy the requirement.

Answer

Create a scheduled query that backfills missing endpoint telemetry from the endpoint agents' local cache.

Answer

Enable Cortex Data Lake replication across regions to mirror the endpoint dataset.

Answer

Increase the retention period of the endpoint telemetry dataset to 90 days.

Question 12

An organization requires all audit logs generated within XSIAM to be exported to an external SIEM for long-term archiving. Which feature should the administrator configure?

Accepted Answer

Configure a Log Forwarding profile under Settings > Configurations > Data Collection > Log Forwarding.. External log forwarding rules can be configured in XSIAM to stream logs, including audit and security events, to third-party destinations via standard protocols like syslog or HTTP.

Answer

Enable Cortex XSOAR playbook automation to execute a daily database backup.

Answer

Set up a BIOC alert rule to email CSV exports every 24 hours.

Answer

Modify the Data Retention profile to replicate raw blocks to an external S3 bucket automatically.

Question 13

An administrator notices that a particular correlation rule is generating a high volume of false positive incidents. What is the recommended operational step to refine the rule without disabling it entirely?

Accepted Answer

Edit the correlation rule definition in Analytics / Correlation Rules to add exclusion filters for known benign entities.. The recommended operational step is to refine the correlation rule itself by adding exclusion filters (also called rule exceptions or whitelists) for known benign entities such as specific hostnames, users, or IP ranges. This preserves detection coverage for genuine threats while suppressing the false positives, and it is done in the Analytics / Correlation Rules section of XSIAM.

Answer

Purge the Cortex Data Lake table associated with the alert ID.

Answer

Delete the default data parser associated with the event source to block the noisy logs entirely.

Answer

Change the tenant status from Active to Evaluation mode to suppress notifications.

Question 14

An administrator wants to ensure that specific sensitive incident categories are restricted to a dedicated tier-2 response team. Which XSIAM construct should be configured to achieve this role-based operational segregation?

Accepted Answer

Configure User Roles and User Groups under Settings > Access Management to limit incident viewing permissions.. User Roles and User Groups under Settings > Access Management are the native XSIAM RBAC constructs that control which users can view or act on incidents. By assigning a role scoped to specific incident categories or severities and placing tier-2 responders in a dedicated group, the administrator restricts sensitive incident categories to that team while excluding tier-1 users.

Answer

Modify the global tenant retention policy to purge tier-1 logs automatically.

Answer

Deploy a separate Cortex XSOAR server to handle tier-2 escalations independently.

Answer

Write a BIOC rule to drop unauthorized access attempts at the ingestion layer.

Question 15

An administrator needs to troubleshoot why a Broker VM is failing to ingest logs from an internal syslog source. Which diagnostic utility available on the Broker VM console should the administrator use first?

Accepted Answer

Access the Broker VM management console to check service status, connectivity test tools, and container logs.. Broker VMs include management interfaces and troubleshooting utilities (such as system status checks, service health monitoring, and log collection tools) accessible via its local administrative CLI or web interface.

Answer

Run the `xdrctl troubleshoot` command from any managed Windows endpoint agent console.

Answer

Reset the cloud tenant encryption keys under General Settings.

Answer

Open the XSIAM Incident Graph to view packet captures from the Broker VM IP.