XSIAM-Engineer Operations And Lifecycle Management Practice Test 3 — 15 Questions

Question 1

An administrator needs to update the Cortex XDR agent installation package across 5,000 endpoints without causing network saturation. Which feature should be utilized to manage this rollout effectively?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an Agent Upgrade schedule and phased deployment profile within Endpoint Management > Agent Settings.. Agent software updates can be controlled using Agent Settings and deployment profiles where administrators can set distribution rules, throttling, and phased rollouts.

Answer

Manually push the MSI package via Active Directory Group Policy Objects using an external script.

Answer

Execute an XQL remediation action with the `upgrade_agent` command across all active sessions.

Answer

Set up a global Log Forwarding profile to broadcast the binary over syslog.

Question 2

An XSIAM administrator needs to configure log forwarding from a Linux server to the XSIAM collector. Which action must be performed first on the endpoint before deploying the Collector service?

Accepted Answer

Generate and download the Collector installation script and registration token from the XSIAM UI.. Before deploying the Collector service on a Linux endpoint, the administrator must generate and download the Collector installation script and registration token from the XSIAM UI. This token authenticates the collector to the tenant and is required for the installation to register successfully. Without it, the collector cannot be associated with the correct XSIAM instance.

Answer

Enable port 22 inbound on the Cortex XSIAM management tenant for SSH tunnel establishment.

Answer

Manually create the database schema in the Cortex Data Lake to accept the raw logs.

Answer

Configure the syslog daemon on the local server to forward directly to port 443 of the cloud engine without an agent.

Question 3

An enterprise has multiple distinct business units, and the security operations team wants to ensure that analysts from Business Unit A can only investigate incidents assigned to their own unit, while global administrators can view everything. Which feature enables this multi-tenant or partitioned operational structure within a single XSIAM tenant?

Accepted Answer

Configure Security Domains / Data Partitioning to restrict incident visibility by organizational boundaries.. Security Domains (also called data partitioning) in XSIAM allow administrators to define organizational boundaries and assign users to domains, so analysts only see incidents, alerts, and assets within their domain. Global administrators can be granted access to all domains, satisfying the requirement for cross-unit visibility.

Answer

Deploy separate Broker VMs for each business unit without configuring user roles.

Answer

Create separate correlation rules with identical logic for each user.

Answer

Set up independent data retention periods for each analyst account.

Question 4

An administrator wants to configure automated email notifications to be sent to external stakeholders whenever a Critical severity incident is created. Which feature should be configured?

Accepted Answer

Configure an Incident Notification profile or webhook integration under Settings > Integrations / Notifications.. Cortex XSIAM provides Incident Notification profiles and webhook integrations under Settings that allow administrators to define rules (e.g., severity = Critical) and send email notifications to external stakeholders. This is the native, supported way to automate email alerts for incidents. It can also integrate with ticketing systems and SIEM/SOAR tools via webhooks.

Answer

Enable Auto-Isolation rules on all endpoints.

Answer

Modify the Log Forwarding profile to send raw JSON syslog packets to the stakeholder's email address.

Answer

Set up a scheduled XQL query that emails CSV attachments every minute.

Question 5

An administrator configured a new API data collector to ingest threat intelligence feeds, but no data is appearing in XSIAM. Upon checking the Integration page, the status shows an authentication failure. What is the most likely cause and correct remediation?

Accepted Answer

The API key or credentials have expired or are incorrect; update the integration instance configuration with valid credentials under Settings > Configurations > Data Collection > Integrations.. An authentication failure status on an integration almost always indicates that the API key, token, or service account credentials configured in the integration instance are invalid, expired, or lack the required scopes. The correct remediation is to update the integration instance under Settings > Configurations > Data Collection > Integrations with valid credentials and re-test the connection.

Answer

The XQL query syntax used by the integration is malformed and requires rewriting the SQL statement.

Answer

The local firewall on the Cortex XDR agent is blocking outbound HTTPS requests to the threat intel feed.

Answer

The Broker VM container needs to be restarted via SSH to reload the routing table.

Question 6

An administrator needs to check the status of scheduled background reports and export tasks in XSIAM. Where can this task history be reviewed?

Accepted Answer

Navigate to Reporting > Scheduled Reports to view job execution history and status.. Scheduled background reports and export tasks in Cortex XSIAM are managed and monitored under the Reporting section, specifically the Scheduled Reports interface. This area shows job execution history, status (success, failure, in-progress), timestamps, and any error details for each scheduled report or export job.

Answer

Inspect the raw storage blocks in the Data Lake Explorer.

Answer

Review the Incident Response playbook execution logs in Cortex XSOAR.

Answer

Check the Endpoint Management > Task Management tab.

Question 7

An administrator needs to verify whether a newly created Correlation Rule is actively evaluating incoming telemetry. Where should the administrator check the rule's operational status and recent execution statistics?

Accepted Answer

Check the Correlation Rules / Analytics page where rule status, hit counts, and last execution details are displayed.. Correlation rules and analytics rules display their operational status, hit counts, and execution metrics within the Analytics or Correlation Rules management page.

Answer

Inspect the Cortex XDR Agent installation directory for rule cache files.

Answer

Review the Windows Event Viewer on the primary Domain Controller.

Answer

Examine the Firewall Traffic logs for outgoing rule-check packets.

Question 8

An administrator wants to customize the fields displayed in the Incident table view to better align with the SOC's operational workflow. How should this be accomplished?

Accepted Answer

Use the column customization settings within the Incident view to add, remove, or reorder displayed fields.. Administrators can customize column visibility, order, and layout directly within the Incident view UI using the column selection / customization options.

Answer

Reinstall the Cortex XDR management extension pack.

Answer

Rewrite the underlying XQL query for the default dashboard using API calls.

Answer

Modify the global database schema JSON file via the Admin CLI.

Question 9

An organization is updating its internal Certificate Authority (CA). The administrator needs to update the trusted CA certificates used by the Broker VMs for secure syslog ingestion. Where must this certificate update be performed?

Accepted Answer

Manage and update trusted CA certificates within the Broker VM configuration settings in the XSIAM console.. Trusted CA certificates for Broker VM secure syslog ingestion must be managed and updated within the Broker VM configuration settings in the XSIAM console. This centralized approach ensures all Broker VMs trust the new CA for TLS connections. It is the supported and scalable method for certificate updates.

Answer

Modify the global tenant license key to include custom CA extensions.

Answer

Upload the certificate directly into the browser's local trusted root store.

Answer

Run the `certmgr /add` command on every managed Windows endpoint.

Question 10

An administrator is troubleshooting a scenario where custom parsers are failing to correctly extract fields because the incoming log format changed slightly. What operational step should be taken to update the parser without disrupting active data ingestion?

Accepted Answer

Edit the parser definition in Settings > Configurations > Data Collection > Parsers, update the grok pattern, and test with sample logs before saving.. Custom parsers can be edited and tested in real-time within the Parsers configuration page, allowing administrators to refine grok patterns and save the updated parser version safely.

Answer

Stop the entire XSIAM tenant, wipe the database, and re-import all log sources from scratch.

Answer

Disable data ingestion globally while rewriting the SQL database schema.

Answer

Deploy a local text-editor plugin to every Broker VM via SSH to modify underlying regex config files.

Question 11

An operations team needs to ensure that inactive user accounts are automatically locked out after 90 days of inactivity. Where is this security policy managed?

Accepted Answer

Go to Settings > Access Management > Authentication / Security settings to configure password and account inactivity policies.. Account inactivity lockout policies in Cortex XSIAM are managed under Settings > Access Management > Authentication / Security settings, where password policies and account inactivity thresholds are configured. This is where administrators define how long an account can remain inactive before being locked. It is the correct location for enforcing a 90-day inactivity lockout.

Answer

Configure an Agent Protection policy under Endpoint Management.

Answer

Set up an automated correlation rule to detect inactive login tokens.

Answer

Modify the Log Forwarding rule timeout threshold.

Question 12

An administrator is setting up a new Broker VM in an isolated network zone that requires all outbound HTTPS traffic to traverse an explicit corporate proxy server. Where must the proxy configuration be applied for the Broker VM to communicate with XSIAM?

Accepted Answer

Configure the proxy settings during the Broker VM setup or within its configuration parameters so it can reach the XSIAM cloud.. Broker VM proxy settings are configured during deployment or via the Broker VM configuration interface to ensure all cloud communications traverse the designated proxy.

Answer

Apply the proxy configuration via the Cortex XDR Agent installation profile.

Answer

Configure the proxy settings inside the Windows registry of the local administrator's workstation.

Answer

Modify the XQL search query headers to include proxy authentication tokens.

Question 13

An administrator needs to review all administrative actions (such as user logins, configuration changes, and role modifications) performed within the XSIAM tenant over the last 30 days. Where is this audit data located?

Accepted Answer

Navigate to Settings > Audit Trail to review administrator activities and configuration changes.. Cortex XSIAM records all administrative activity — logins, configuration changes, role modifications, and API actions — in the Audit Trail, accessible under Settings. This is the centralized location for compliance and forensic review of who did what and when within the tenant.

Answer

Open the Endpoint Management > Audit Log view.

Answer

Check the Incident Management dashboard filtered by user severity.

Answer

Run an XQL query on the `host_boot` dataset.

Question 14

An administrator wants to create a custom dashboard displaying key SOC metrics such as open incidents by severity and top alerted hosts. Which section of XSIAM should the administrator use to build this dashboard?

Accepted Answer

Navigate to Dashboards > Create Dashboard to add widgets based on XQL queries.. Custom dashboards can be created and managed under the Dashboards section of the XSIAM navigation menu using widgets powered by XQL queries.

Answer

Use the Report Builder to schedule weekly PDF summaries.

Answer

Go to Settings > Configurations > Data Collection > Dashboards.

Answer

Open the Incident Graph and click Export as Dashboard.

Question 15

An administrator is investigating why an automated response playbook integrated via Cortex XSOAR failed to execute when triggered by an XSIAM incident. Where should the administrator check the integration communication logs?

Accepted Answer

Review the Cortex XSOAR integration instance logs and audit trail for API communication errors.. When an XSIAM playbook fails to execute via Cortex XSOAR, the integration instance logs and audit trail in XSOAR are the authoritative place to see API errors, authentication failures, and command execution results. These logs show exactly why the integration call failed.

Answer

Examine the Data Lake storage partition allocation table.

Answer

Inspect the Cortex XDR Agent debug bundle collected from the affected server.

Answer

Check the local `syslog.log` file on the Broker VM container.