XSIAM-Engineer Operations And Lifecycle Management Practice Test 5 — 15 Questions

Question 1

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux servers. Which THREE tasks should be performed during the planning and deployment phase? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Establish phased rollout groups to monitor stability and prevent widespread issues.. Option B is correct because a phased rollout (pilot rings/groups) lets the administrator validate agent stability, performance, and compatibility on a small subset before broad deployment, limiting blast radius if a version causes issues. Option D is correct because existing endpoint security software (e.g., other AV/EDR, or OS-native tools like Windows Defender or SELinux) can conflict with the Cortex XDR agent's kernel-level components, so defining exclusions prevents installation failures, performance degradation, or false positives. Option E is correct because Cortex XDR provides separate agent installers and profiles per platform—Windows (.msi/.exe), macOS (.pkg/.dmg), and Linux (.rpm/.deb)—so OS-specific packages and profiles are required for a mixed environment. Option A is not needed because agent deployment is done via software distribution, GPO, SCCM, or scripts over the network, not serial consoles. Option C is wrong because disabling firewall rules on the XSIAM/Cortex cloud tenant is neither required nor advisable for agent deployment and would weaken security.

Answer

Manually connect a serial console cable to every server in the data center.

Answer

Disable all firewall rules on the XSIAM cloud tenant.

Question 2

An administrator needs to modify the display name and description of a custom data collector instance. Where can this configuration be edited?

Accepted Answer

Navigate to Settings > Configurations > Data Collection > Collectors, select the instance, and edit its configuration.. Data collector instances and their metadata can be edited under Settings > Configurations > Data Collection > Collectors.

Answer

Modify the global DNS zone file on the primary nameserver.

Answer

Open the Endpoint Management > Agent Details screen.

Answer

Run an XQL update command against the `collector_metadata` system table.

Question 3

An administrator is troubleshooting a custom BIOC (Behavioral Indicator of Compromise) rule that is not triggering alerts even though matching logs are present in the Cortex Data Lake. What is the most effective operational step to debug the rule?

Accepted Answer

Use the BIOC rule test / simulation feature in the Analytics section to validate the rule logic against historical event data.. BIOC rules can be tested and debugged using the rule testing and simulation features within the Analytics configuration menu to verify syntax and matching logic against sample events.

Answer

Change the tenant license key to an enterprise tier.

Answer

Reboot the XSIAM management cloud cluster master node via SSH.

Answer

Disable the default Cortex XDR agent prevention modules.

Question 4

An administrator needs to check the remaining license capacity and expiration date of the XSIAM subscription. Where should the administrator look?

Accepted Answer

Navigate to Settings > License Management to view subscription status and capacity.. License capacity and subscription expiration for XSIAM are managed centrally under Settings > License Management, where administrators can view the total license count, consumed licenses, remaining capacity, and the expiration date of the subscription. This is the designated administrative pane for all licensing-related information in the Cortex XSIAM console. Checking here ensures accurate, real-time data directly from the management plane.

Answer

Check the Incident Graph summary panel.

Answer

Review the XQL query execution history log.

Answer

Open the Endpoint Management > Agent Status tab.

Question 5

An organization wants to integrate XSIAM user authentication with an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is Single Sign-On (SSO) configured?

Accepted Answer

Configure SAML settings under Settings > Access Management > SSO / Authentication.. SAML and SSO authentication settings for XSIAM console users are configured under Settings > Access Management > SSO / Authentication.

Answer

Modify the global agent installation package configuration.

Answer

Set up a Log Forwarding profile with SAML parameters.

Answer

Deploy a Broker VM with an Active Directory LDAP connector.

Question 6

An administrator is investigating a data discrepancy where certain security logs ingested via a Broker VM do not match the raw source timestamps. Where can timezone and timestamp normalization settings be reviewed or adjusted?

Accepted Answer

Review and adjust parser extraction rules and timezone configurations in Settings > Configurations > Data Collection > Parsers.. Timestamp parsing and normalization rules can be reviewed and adjusted within custom parser definitions or ingestion settings in XSIAM.

Answer

Change the system clock on the local administrator workstation.

Answer

Reinstall the Cortex XDR Agent on all network switches.

Answer

Purge the entire Cortex Data Lake to reset cloud time servers.

Question 7

An administrator wants to view a chronological list of recent software updates and content pack releases applied to the XSIAM tenant. Where can this release history be checked?

Accepted Answer

Check Content Management or Help > Release Notes to review recent updates and content pack releases.. Content updates, content pack releases, and platform version histories can be viewed under Content Management or Help > Release Notes.

Answer

Inspect the Broker VM Docker container logs via SSH.

Answer

Review the Incident Graph timeline.

Answer

Open the Endpoint Management > Agent Version log.

Question 8

An administrator needs to configure automated incident assignment so that all incidents originating from network firewall logs are automatically routed to the Network Security SOC team. Which XSIAM feature accomplishes this?

Accepted Answer

Configure Incident Assignment Rules based on source data categories or alert types.. Incident assignment rules and automation routing rules can be configured in XSIAM to automatically assign incoming incidents based on data sources, severity, or categories.

Answer

Modify the global tenant retention policy to isolate firewall logs.

Answer

Enable Auto-Isolation profiles on all network gateways.

Answer

Set up a Log Forwarding profile targeting the Network Security team's email addresses.

Question 9

An administrator is configuring a new syslog ingestion source on a Broker VM. The syslog messages use TCP with TLS encryption (Reliable Syslog). Where must the corresponding TLS server certificates for the Broker VM be configured?

Accepted Answer

Configure the TLS server certificates and listener ports within the Broker VM configuration settings in the XSIAM console.. Broker VM TLS listener certificates for secure syslog ingestion are configured within the Broker VM configuration settings in the XSIAM management console.

Answer

Upload the certificates into the Cortex XDR Agent policy assigned to workstations.

Answer

Store the certificates in the browser's local storage cache.

Answer

Paste the certificates into the XQL query editor console.

Question 10

An organization wants to ensure that all sensitive personally identifiable information (PII) fields within ingested log datasets are automatically masked or hashed before being stored in the Cortex Data Lake. Which XSIAM capability should be configured?

Accepted Answer

Configure Log Redaction / Masking rules under Data Collection settings to sanitize PII fields during ingestion.. Log masking, hashing, or filtering rules can be configured in XSIAM to redact sensitive data during ingestion.

Answer

Set the global data retention period to zero.

Answer

Deploy an Endpoint Agent exclusion profile to block logging on endpoints.

Answer

Enable Auto-Quarantine rules on all database servers.

Question 11

An administrator needs to add a new user account to XSIAM and assign appropriate privileges. Where is user account creation and management performed?

Accepted Answer

Navigate to Settings > Access Management > Users to add new user accounts and assign roles.. User account creation and privilege assignment are managed under Settings > Access Management > Users.

Answer

Check the Endpoint Management > Add Device wizard.

Answer

Go to License Management and click Allocate Seat.

Answer

Open the Incident Response dashboard and click New Analyst.

Question 12

An administrator is troubleshooting a Broker VM that has lost connectivity to the XSIAM management plane. After checking network routing and firewalls, the administrator suspects local Docker container network corruption on the Broker VM host. Which administrative utility script on the Broker VM can be used to restart and reset the container networking stack?

Accepted Answer

Access the Broker VM administrative console CLI to execute service restart and network reset utilities.. The Broker VM administrative console CLI provides service restart and network reset utilities specifically designed to recover from local Docker container network corruption. Administrators can access this console directly on the Broker VM (via SSH or local console) and execute commands to restart the Docker services and reset the container networking stack, restoring connectivity to the XSIAM management plane. This is the correct tool for host-level container network troubleshooting.

Answer

Modify the global tenant encryption keys under General Settings.

Answer

Execute an XQL query with the `reset_broker` command.

Answer

Run the `xdrctl uninstall` command on every managed Windows endpoint.

Question 13

An administrator needs to ensure that custom dashboards created by SOC analysts are backed up or migrated between environments. Which TWO options are available for content portability in XSIAM? (Choose two)

Accepted Answer

Export dashboard definitions to JSON format for migration across tenants.. Option C is correct because XSIAM allows dashboard definitions to be exported as JSON, which preserves the dashboard structure, widgets, and queries so they can be imported into another tenant or environment. Option D is correct because the Content Management feature supports packaging custom dashboards and widgets into a content pack, enabling controlled backup and migration of content between environments. Option A is incorrect because browser cookies only maintain a user's authenticated session and contain no portable dashboard definitions. Option B is incorrect because paper printouts are static and cannot be reimported or migrated as functional content. Option E is incorrect because manually retyping XQL queries is error-prone and does not constitute a supported content portability mechanism.

Answer

Copy the browser cookies of the analyst's session.

Answer

Print physical paper copies of the dashboard screens.

Answer

Manually retype every XQL query into a notepad file on a local workstation without export tools.

Question 14

An analyst wants to export a list of active incidents to a CSV file for offline reporting. Which feature in the Incident view should be used?

Accepted Answer

Use the export option in the Incident view toolbar to download incidents as a CSV file.. The Incident view includes export options that allow exporting selected or all incident data into CSV format.

Answer

Run an automated ransomware remediation script.

Answer

Configure a Log Forwarding profile to dump CSV files to a local printer.

Answer

Open the Endpoint Management view and select Export Agents.

Question 15

A security engineer has created a custom correlation rule in XSIAM that triggers an alert when a specific process is executed on an endpoint. After saving the rule, the engineer notices that the alert is not appearing in the incident queue, even though the process was executed. The rule is enabled and the process event is being ingested. What is the most likely cause?

Accepted Answer

The correlation rule requires a deployment step after saving to become active in the XSIAM environment.. After creating or editing a correlation rule in XSIAM, it must be deployed to become active. The deployment process compiles the rule and pushes it to the relevant engines. Without this step, the rule remains in a draft state and will not generate alerts, even if all conditions are met. Therefore, the missing deployment is the most likely cause of the missing alert.

Answer

The rule's severity is set to 'Informational', so alerts are suppressed by default.

Answer

The rule's time window is set to a past period, so it only evaluates historical data and not new events.

Answer

The process event is not being parsed correctly by the XSIAM data model, so the rule cannot evaluate it.