XSIAM-Engineer Operations And Lifecycle Management — Timed 15 Questions

Question 1

An XSIAM tenant is approaching its licensed data ingestion volume limit. The operations team needs to identify which data sources are consuming the highest ingestion bandwidth. Where should the administrator check this information?

15 minute time limit — choose an answer to begin.

Accepted Answer

Go to Settings > Configurations > License Management to view data ingestion breakdown by source and vendor.. License utilization and ingestion volume by data source can be monitored in XSIAM under Settings > License Management or the License Usage dashboard.

Answer

Review the Audit Trail dashboard for high-frequency API polling events.

Answer

Execute an XQL query using the `dataset = host_inventory` command and group by storage size.

Answer

Check the Cortex XDR Agent health status page under Endpoint Management.

Question 2

During routine maintenance, an administrator notices that a custom parser is dropping incoming events from a newly integrated security appliance. Where should the administrator check to debug syntax and grok pattern failures in real time?

Accepted Answer

Navigate to Settings > Configurations > Data Collection > Parsers, select the custom parser, and use the Test Parser feature with sample raw logs.. The Log Forwarding and Log ingestion troubleshooting within XSIAM includes a parser testing utility where sample log lines can be pasted and tested against custom parsers to debug grok patterns and extraction rules.

Answer

SSH into the Cortex XSIAM management cluster master node and check the /var/log/parser.log file.

Answer

Open the Cortex XDR Agent console on the local machine and export the Agent Log Collector bundle.

Answer

Review the Incident Graph to trace dropped packets from the ingestion pipeline.

Question 3

An analyst reports that the XSIAM web interface session is timing out too quickly due to security policies. Where can an administrator modify the idle session timeout duration?

Accepted Answer

Navigate to Settings > Configurations > Global Settings to adjust the idle session timeout value.. Idle session timeout for the XSIAM/Cortex XSIAM web console is a global platform-level setting, not a per-agent or per-policy control. Administrators change it under Settings > Configurations > Global Settings, where the idle session timeout value governs how long an authenticated browser session can remain inactive before the user is forced to re-authenticate. This is the only location that directly controls console session expiry.

Answer

Update the Log Forwarding profile timeout threshold.

Answer

Modify the Agent Settings profile assigned to the administrator's laptop.

Answer

Edit the XQL query execution limit parameters in Analytics settings.

Question 4

An organization mandates that specific log datasets must be retained for 400 days, exceeding the default retention period. Where should the administrator configure extended data retention rules?

Accepted Answer

Go to Settings > Configurations > Data Retention to configure custom retention periods for specific datasets.. The correct location to configure extended data retention is Settings > Configurations > Data Retention. This allows administrators to set custom retention periods for specific datasets, overriding the default. This is the centralized place for managing retention policies in XSIAM.

Answer

Set up a local cron job on each Broker VM to archive logs to local hard drives.

Answer

Modify the global license key string to unlock extended storage capacities.

Answer

Create an automated XSOAR playbook to export raw logs to local USB drives daily.

Question 5

An administrator is configuring a webhook integration to forward XSIAM incidents to an external ticketing system. The remote server requires mutual TLS (mTLS) client certificate authentication. Where should the client certificate be uploaded in XSIAM?

Accepted Answer

Upload the client certificate within the integration instance or certificate store settings for the webhook.. For a webhook integration requiring mutual TLS (mTLS), the client certificate must be uploaded within the integration instance or certificate store settings for that webhook. This is where XSIAM stores the client certificate and private key used to authenticate to the remote server during the TLS handshake. It is the correct and only appropriate location for mTLS client credentials.

Answer

Paste the certificate into the custom CSS styling box under Global Settings.

Answer

Store the certificate in the Broker VM local `/etc/passwd` file.

Answer

Install the certificate in the local browser certificate store of the analyst viewing the incident.

Question 6

An organization requires that all API access tokens used for programmatic interaction with XSIAM expire every 90 days. Where can API key expiration policies be configured?

Accepted Answer

Manage API key creation, expiration, and revocation under Settings > Integrations > API Keys.. API key lifecycles and generation policies are managed under Settings > Integrations > API Keys or Access Management.

Answer

Configure the Agent Software Upgrade schedule under Endpoint Management.

Answer

Adjust the Broker VM Docker container memory limit.

Answer

Modify the XQL query timeout threshold.

Question 7

An XSIAM engineer is preparing to upgrade the Cortex XSIAM tenant to a new release. The security team wants to ensure that all custom correlation rules, playbooks, and dashboards are preserved and can be rolled back if the upgrade introduces issues. What should the engineer do FIRST before initiating the upgrade?

Accepted Answer

Export a full tenant backup using the Backup and Restore feature in the Cortex XSIAM management console.. The Backup and Restore feature in Cortex XSIAM is the correct first step because it captures the entire tenant configuration, including custom correlation rules, playbooks, and dashboards. This ensures that if the upgrade fails or causes regressions, the engineer can restore the previous state. Manually copying files or disabling rules does not provide a reliable rollback path and can leave the environment unprotected.

Answer

Disable all custom correlation rules to prevent them from interfering with the upgrade process.

Answer

Schedule the upgrade during a maintenance window without any backup, since Cortex XSIAM upgrades are always non-destructive.

Answer

Manually copy all custom correlation rules and playbooks to a text file for later re-import.

Question 8

A Cortex XSIAM engineer needs to ensure that audit logs are retained for 365 days to comply with regulatory requirements. The current retention period for audit logs is set to 90 days. Where should the engineer modify this setting?

Accepted Answer

In the Cortex XSIAM management console, navigate to Settings > Configurations > Data Retention and adjust the Audit Logs retention period.. The Data Retention configuration page in Cortex XSIAM is where administrators can set the retention period for audit logs and other data types. Changing the audit log retention to 365 days ensures compliance with regulatory requirements. Other sections like Access Management, Data Sources, or System Settings do not control audit log retention, so they are incorrect.

Answer

In the Cortex XSIAM management console, navigate to Settings > Configurations > System Settings and change the audit log retention in the Logging section.

Answer

In the Cortex XSIAM management console, navigate to Settings > Configurations > Access Management and modify the audit log retention under the User Roles section.

Answer

In the Cortex XSIAM management console, navigate to Settings > Configurations > Data Sources and edit the retention for the Audit Logs data source.

Question 9

A Cortex XSIAM engineer needs to automate the remediation of a specific type of malware detected on endpoints. The remediation script must run only when the malware is detected and must be applied to the affected endpoint. Which XSIAM component should be used to achieve this?

Accepted Answer

Create a Correlation Rule that triggers a playbook when the malware is detected.. Correlation Rules in Cortex XSIAM evaluate events and can trigger playbooks for automated response. By creating a correlation rule that detects the specific malware, the engineer can ensure the remediation playbook runs only when that malware is detected, satisfying the conditional automation requirement. Other options do not provide event-driven execution.

Answer

Use the Cortex XSIAM API to poll for malware alerts and then manually run the script.

Answer

Create a BIOC rule that directly executes the remediation script on the endpoint.

Answer

Configure a scheduled report to run the remediation script on all endpoints daily.

Question 10

A Cortex XSIAM engineer needs to ensure that all endpoints have the latest version of the Cortex XDR agent. Which action should be taken to automatically update agents to the latest version?

Accepted Answer

In the Cortex XSIAM console, go to Endpoints > Agent Management and enable automatic agent upgrades.. To automatically update Cortex XDR agents, the engineer should enable automatic agent upgrades in the Endpoints > Agent Management section of the Cortex XSIAM console. This built-in feature handles version checks and upgrades. Other methods are manual or not native, and thus do not provide the required automation.

Answer

Configure the agent to check for updates via the Update Server setting in the agent configuration profile.

Answer

Manually download the latest agent installer and deploy it to each endpoint via Group Policy.

Answer

Create a scheduled playbook that runs a script on all endpoints to download and install the latest agent.

Question 11

An XSIAM administrator needs to ensure that a newly created custom correlation rule can be automatically reverted to its previous state after a problematic change. The administrator wants to control this at the rule level without using a full system backup. What should be done?

Accepted Answer

Create a snapshot of the rule using the 'Save as Version' option in the rule editor.. The correct approach is to use the built-in versioning feature within the correlation rule editor. Saving versions creates snapshots that can be restored, providing a safety net for rule changes. This method is integrated into XSIAM and avoids the overhead of external backups or manual audits.

Answer

Use the 'Audit Trail' to manually revert changes by reapplying the previous configuration from logs.

Answer

Enable the 'Version Control' setting in the correlation rule configuration and set a retention period.

Answer

Configure a scheduled job in the XSIAM CLI to export the rule to an external repository every hour.

Question 12

A Cortex XSIAM administrator is preparing to upgrade a production tenant from version 2.5 to 2.6. Before the upgrade window, the administrator needs to verify that all custom integrations and playbooks will remain compatible. Which action should the administrator take first?

Accepted Answer

Review the XSIAM Release Notes and check the Compatibility Matrix under Settings > System > Upgrades.. Before upgrading Cortex XSIAM, the administrator must consult the Release Notes and the Compatibility Matrix to identify breaking changes and validated integration/playbook versions. This proactive check allows remediation before the maintenance window. Exporting or deleting content, or relying on Marketplace automation or support tickets, does not replace the authoritative pre-upgrade compatibility review that the Release Notes and Compatibility Matrix provide.

Answer

Open a support ticket requesting a compatibility audit of all custom content and wait for the vendor to confirm readiness.

Answer

Export all custom playbooks to a local archive, then delete them before the upgrade to avoid conflicts.

Answer

Run the built-in Upgrade Readiness Report from the Marketplace and apply all recommended fixes automatically.

Question 13

A security operations team is onboarding a new cloud workload protection agent. The agent registers successfully but no endpoint data appears in XSIAM. The administrator confirms the agent is running on the host. Which XSIAM component should the administrator verify to ensure the agent's telemetry is being routed to the correct data plane?

Accepted Answer

Broker VM. When an endpoint agent is running but no data appears in XSIAM, the most likely cause is a failure in the data path between the agent and the XSIAM tenant. The Broker VM is the designated component that relays endpoint telemetry to the cloud. Checking its registration, configuration, and network connectivity ensures the agent's data can reach XSIAM. Other components like the Collector or Data Lake serve different roles and would not explain the missing endpoint data.

Answer

XSIAM Manager

Answer

Cortex Data Lake

Answer

XSIAM Collector

Question 14

A Cortex XSIAM administrator needs to restore a dataset that was accidentally deleted from the data lake by a junior analyst. The administrator has a full tenant backup that was taken two days ago. Which restore option is available in the XSIAM backup and restore interface?

Accepted Answer

Restore individual datasets from the backup using the Backup & Restore page.. XSIAM's Backup & Restore feature supports granular recovery of individual datasets, which is ideal when a specific dataset is accidentally deleted. Restoring only that dataset from the most recent backup minimizes impact on other data and configurations. Full tenant restore is unnecessary and risky, API-based restore is not available, and re-ingestion is impractical and incomplete.

Answer

Re-ingest the raw logs from the original data sources to rebuild the dataset.

Answer

Use the API endpoint /public_api/v1/backup/restore_dataset to restore the dataset programmatically.

Answer

Restore the entire tenant configuration and data from the backup, overwriting all current data.

Question 15

A SOC manager needs to grant a new analyst the ability to view incidents and run queries in XSIAM, but should not allow the analyst to modify correlation rules or delete incidents. Which predefined role should be assigned to follow the principle of least privilege?

Accepted Answer

Security Analyst. The Security Analyst role is specifically tailored for SOC analysts, providing the necessary permissions to view and investigate incidents, run queries, and perform day-to-day tasks without granting administrative rights. It adheres to least privilege by preventing modifications to critical configurations like correlation rules and prohibiting incident deletion.

Answer

Instance Administrator

Answer

Account Administrator

Answer

Viewer