XSIAM-Engineer Planning And Installation — 15 Questions

Question 1

An enterprise environment has deployed multiple Cortex XDR agents across diverse operating systems. The administrator wants to organize endpoints logically within XSIAM before assigning granular security policies. Which Cortex XSIAM feature should be used to dynamically group these endpoints based on criteria such as OS version, domain, or IP subnet?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Endpoint Groups. Endpoint Groups in Cortex XSIAM are the native construct for logically organizing endpoints and are used as the target for policy assignment. They support dynamic membership based on criteria such as OS version, domain, IP subnet, and other endpoint attributes, so endpoints automatically join or leave the group as their attributes change. This makes them the correct feature for grouping before applying granular security policies.

Answer

Asset Tags

Answer

Data Filters

Answer

Correlation Rules

Question 2

An administrator is configuring a Broker VM in a secured DMZ zone to collect logs from on-premises security devices. The network security team requires strict verification of outbound ports to the Cortex XSIAM tenant. Which exact combination of destination ports must be permitted outbound from the Broker VM to ensure proper operation and cloud communication?

Accepted Answer

TCP 443 outbound for cloud communication and log ingestion APIs. The Broker VM communicates with the Cortex XSIAM tenant exclusively over outbound TCP 443, which carries both the management/cloud communication channel and the log ingestion APIs. No inbound ports need to be opened from the internet, and no additional protocols are required for the broker to forward collected logs to the tenant. This is why TCP 443 outbound is the only port combination required.

Answer

TCP 443 and TCP 22 for secure tunneling and remote management

Answer

TCP 6514 and UDP 514 for syslog relay directly to the tenant database

Answer

TCP 8443 and UDP 123 for internal heartbeat synchronization

Question 3

An XSIAM architect is planning the deployment size for an enterprise environment generating 5 TB of raw telemetry data per day. During the capacity sizing phase, the architect must account for indexing, replication, and data retention requirements. Which architectural factor is primarily responsible for the baseline storage multiplier before long-term retention is applied?

Accepted Answer

The inclusion of raw log retention alongside parsed dataset indices. The baseline storage multiplier in XSIAM sizing is primarily driven by the fact that raw logs are retained alongside the parsed dataset indices. When telemetry is ingested, XSIAM stores both the raw event data and the normalized/parsed indexed form, so the effective storage footprint is a multiple of the raw daily volume before any long-term retention tiering is applied. This dual retention is the dominant architectural factor in the baseline multiplier.

Answer

The mandatory inclusion of Prisma Cloud posture data within the same storage quota

Answer

The real-time synchronization of local syslog forwarder configurations to Panorama

Answer

The automatic generation of daily Cortex XDR agent binaries for endpoints

Question 4

An organization has strict regulatory compliance mandates requiring all data ingested into Cortex XSIAM to be encrypted in transit and at rest using customer-managed encryption keys (CMEK). During the tenant initialization and planning phase, where must the administrator configure the CMEK parameters?

Accepted Answer

During the initial tenant provisioning workflow coordinated with Palo Alto Networks cloud operations and KMS integration. Customer-managed encryption keys (CMEK) integration for Cortex XSIAM is coordinated with Palo Alto Networks support and cloud provider key management services (such as AWS KMS or Azure Key Vault) during the initial tenant provisioning and onboarding workflow.

Answer

Directly inside the XSIAM web UI under Settings > Configurations > Security > Encryption

Answer

Within the Broker VM local hypervisor configuration console via CLI

Answer

Inside the Cortex XDR agent installation wizard command-line parameters

Question 5

An organization is deploying Cortex XSIAM in an environment with strict data residency requirements. The tenant is provisioned in the European Union (EU) region. During the deployment of Broker VMs and API integrations, what must the architect ensure regarding endpoint and collector configurations?

Accepted Answer

All Broker VMs and API data sources must be configured with the specific regional tenant FQDN matching the EU data center. Cortex XSIAM tenants are provisioned in specific regional data centers (e.g., EU, US). All components—including Broker VMs and API integrations—must be configured to communicate with the regional tenant FQDN to ensure data remains within the required jurisdiction. Using the EU-specific FQDN guarantees that endpoint telemetry and API data are processed and stored in the EU data center, satisfying data residency requirements.

Answer

Broker VMs must be deployed on physical hardware residing inside Palo Alto Networks headquarters in Santa Clara

Answer

Global tenant URLs automatically re-route data across regions based on latency without compliance impact

Answer

Agents must use local DNS poisoning to bypass regional routing restrictions

Question 6

An administrator is preparing to deploy Cortex XDR agents across a heterogeneous enterprise network. Which THREE deployment methods are natively supported and commonly utilized for agent rollout? (Choose three)

Accepted Answer

Enterprise Endpoint Management and Software Distribution tools (e.g., Microsoft Intune, SCCM, or Jamf). Option A is correct because Cortex XDR agents are commonly deployed at scale through enterprise endpoint management and software distribution platforms such as Microsoft Intune, SCCM, or Jamf, which push the installer packages to managed endpoints. Option B is correct because a direct manual installation executed locally on an endpoint (with the required administrative rights) is a natively supported rollout method, typically used for small numbers of machines or troubleshooting. Option E is correct because Windows endpoints can receive the Cortex XDR agent via an Active Directory Group Policy Object that distributes the MSI installation package, a standard native deployment mechanism. Option C is not valid because BIOS EEPROM flashing is a firmware operation and has nothing to do with installing an endpoint security agent. Option D is not valid because Bluetooth file transfer from a mobile phone is not a supported or practical enterprise agent deployment method.

Answer

Physical flashing of agent binaries onto endpoint BIOS EEPROM chips

Answer

Manual Bluetooth file transfer from an administrator mobile phone to workstations

Question 7

An architect is designing the high availability and disaster recovery aspects of an on-premises log collection architecture. Which TWO best practices should be implemented for Broker VM deployments? (Choose three) -> Wait, this is a TWO question: Which TWO best practices should be implemented for Broker VM deployments? (Choose two)

Accepted Answer

Monitoring Broker VM resource utilization (CPU, memory, and disk) regularly via the XSIAM console. Broker VM high availability and operational best practices include proper resource sizing, clustering, and monitoring.

Answer

Disabling all system logging on the Broker VM to maximize raw processing speed

Answer

Running Broker VMs inside unpatched legacy hypervisors

Answer

Connecting all Broker VMs to a single public IP address with port forwarding

Question 8

An enterprise environment is planning to ingest threat intelligence feeds into Cortex XSIAM. Which THREE threat intelligence formats or integration methods are natively supported by XSIAM content packs? (Choose three)

Accepted Answer

Direct file uploads of CSV or IOC list files via marketplace integration content packs. Option A is correct because Cortex XSIAM content packs from the Marketplace include integrations that support ingesting threat intelligence via direct file uploads of CSV or IOC list files, allowing analysts to import bulk indicators without building custom parsers. Option C is correct because XSIAM natively supports TAXII servers and STIX-formatted feeds, which are the standard protocols and data models for automated threat intelligence exchange, enabling scheduled polling and indicator ingestion. Option D is correct because XSIAM provides custom REST API integration capabilities, so content packs can connect to third-party TIP providers and pull indicators through authenticated API calls. Option B is not correct because analog RF channels are not a data transport used by XSIAM for threat intelligence ingestion. Option E is not correct because punch cards are obsolete physical media and are not a supported method for entering indicators into XSIAM.

Answer

Broadcasting IOCs over analog radio frequency (RF) channels

Answer

Manual entry of indicators carved onto physical punch cards

Question 9

An architect is designing an automated log forwarding pipeline where Cortex XSIAM forwards specific enriched telemetry or incidents to an external destination (such as a third-party SIEM or data lake). Which THREE mechanisms or integrations are available for exporting data out of XSIAM? (Choose three)

Accepted Answer

Syslog forwarding profiles configured on Broker VMs to transmit logs to external SIEMs. Option B is correct because XSIAM supports syslog forwarding profiles configured on Broker VMs, which act as the forwarding layer to transmit logs to external SIEMs or syslog receivers. Option D is correct because webhook-based API integrations allow XSIAM to push incident and alert payloads in real time to external HTTP endpoints, enabling automated export to third-party systems. Option E is correct because the Cortex Data Exporter service is designed specifically to forward logs from XSIAM to external storage or SIEM destinations. Option A is incorrect because tape backup drives are not a supported data-export integration for XSIAM's log forwarding pipeline. Option C is incorrect because manual FTP dumps of the raw database via root SSH are not a supported or architecturally valid export mechanism in XSIAM.

Answer

Direct physical tape backup drives attached to the cloud data lake backend storage nodes

Answer

Manual FTP file dumps of the entire raw database executed via root SSH commands

Question 10

An organization is preparing to ingest Microsoft Windows Event Forwarding (WEF) logs into Cortex XSIAM via a Broker VM. Which THREE components or prerequisites are required for a successful WEF ingestion architecture? (Choose three)

Accepted Answer

Active Directory Group Policy Objects (GPOs) configuring workstations to forward events to the WEF server. Option A is correct because WEF ingestion depends on Active Directory Group Policy Objects (GPOs) that configure the Windows Event Forwarding subscription and point workstations and servers to send their events to the designated WEF server. Option D is correct because a Windows Event Collector (WEC) server infrastructure must exist in the enterprise network to receive, aggregate, and store the forwarded events before XSIAM collects them. Option E is correct because the Broker VM must be configured with the appropriate Windows Event Collector or WinRM ingestion collector so it can pull the collected events from the WEF/WEC server into Cortex XSIAM. Option B is incorrect because Cortex XDR agents are installed on endpoints and servers, not on core network routers, and WEF ingestion does not require agent installation on routers. Option C is incorrect because converting domain controllers to Linux would break Active Directory and Windows Event Forwarding, which rely on Windows-based domain controllers and GPOs.

Answer

Direct installation of the Cortex XDR agent directly onto core network core routers

Answer

Converting all domain controllers to run Linux operating systems

Question 11

When planning identity and access management integration for Cortex XSIAM administration, which THREE authentication or directory methods are natively supported? (Choose three)

Accepted Answer

Local administrator accounts managed directly within the Cortex XSIAM platform. Cortex XSIAM natively supports local administrator accounts (A), which are created and managed directly in the platform and are typically used for initial setup, break-glass access, and environments without an external IdP. It also natively supports SAML 2.0 SSO (C), allowing integration with enterprise IdPs such as Okta or Microsoft Entra ID for centralized authentication and role mapping. API keys generated within Cortex XSIAM (D) are a supported native method for programmatic access by external tools, scripts, and integrations, using key-based authentication rather than interactive login. Option B is incorrect because Cortex XSIAM does not perform direct Kerberos TGT exchange without an intermediary IdP; Kerberos-based identity would flow through a federated IdP or directory service, not as a standalone native method. Option E is incorrect because legacy NTLMv1 challenge-response is not a supported native authentication method for Cortex XSIAM administration.

Answer

Direct Kerberos ticket-granting ticket (TGT) exchange without an intermediary IdP

Answer

Legacy Windows NT LAN Manager (NTLMv1) direct challenge-response authentication

Question 12

During the planning phase for an on-premises Cortex XSIAM deployment, a security architect must ensure that the Cortex XDR agents on endpoints can communicate with the Broker VM to send telemetry and receive policy updates. The Broker VM is deployed in a DMZ, and the network team needs to open the necessary ports. Which port must be allowed for agent-to-Broker VM communication?

Accepted Answer

TCP 444. The Cortex XDR agent uses TCP port 444 to communicate with the Broker VM. This port is essential for agent registration, sending telemetry, and receiving policy updates when the Broker VM acts as a proxy or log collector. Without allowing TCP 444, endpoints cannot forward data to the Broker VM, breaking the data pipeline to Cortex XSIAM. Other ports serve different purposes and do not support this specific agent-to-Broker VM communication.

Answer

TCP 443

Answer

TCP 8443

Answer

TCP 22

Question 13

A security engineer is planning the installation of a Broker VM for Cortex XSIAM. The Broker VM will be deployed on a VMware ESXi host. The engineer needs to ensure that the virtual machine meets the minimum system requirements for CPU, RAM, and disk space. Which of the following specifications meets the minimum requirements for a Broker VM?

Accepted Answer

8 vCPUs, 16 GB RAM, 250 GB disk. The Broker VM requires at least 8 vCPUs, 16 GB RAM, and 250 GB disk space to function properly. These specifications ensure that the Broker VM can handle log collection, forwarding, and other services without performance degradation. Configurations with fewer resources may lead to dropped logs or delayed processing, while over-provisioning is unnecessary for minimum compliance. Understanding the baseline helps in proper capacity planning for Cortex XSIAM deployments.

Answer

4 vCPUs, 8 GB RAM, 100 GB disk

Answer

16 vCPUs, 32 GB RAM, 1 TB disk

Answer

2 vCPUs, 4 GB RAM, 500 GB disk

Question 14

A security architect is planning the initial deployment of Cortex XSIAM in a large enterprise. They must choose an ingestion method for a high-volume syslog stream from network devices that cannot install agents. The architect wants to minimize latency and avoid unnecessary data duplication. Which ingestion method should they select?

Accepted Answer

Deploy a Broker VM and configure it to receive syslog, then forward the data to Cortex XSIAM.. The Broker VM is the standard on-premises component for ingesting agentless data such as syslog. It receives data from network devices, performs parsing and normalization, and forwards it to the Cortex XSIAM tenant. This minimizes latency by keeping collection close to the source and prevents duplication by centralizing the stream. Direct ingestion, agent installation, or manual uploads are not supported or practical for this use case.

Answer

Configure the devices to forward syslog directly to the Cortex XSIAM tenant's public ingestion endpoint.

Answer

Install a Cortex XDR agent on each network device to collect and forward the logs.

Answer

Use an external syslog server to store logs, then manually upload them to Cortex XSIAM via the API.

Question 15

A security engineer is preparing to deploy a Broker VM in a demilitarized zone (DMZ) to collect logs from various sources. The engineer needs to ensure the Broker VM has the necessary resources for handling high log volumes. Which of the following should be considered a minimum requirement for a production Broker VM deployment?

Accepted Answer

4 vCPUs, 16 GB RAM, 200 GB disk space. A production Broker VM requires sufficient resources to handle log collection, processing, and forwarding without dropping data. Palo Alto Networks recommends at least 4 vCPUs, 16 GB RAM, and 200 GB disk space as a baseline. This ensures the Broker VM can manage moderate to high log volumes, buffer during network interruptions, and perform necessary tasks.

Answer

2 vCPUs, 8 GB RAM, 100 GB disk space

Answer

8 vCPUs, 32 GB RAM, 500 GB disk space

Answer

1 vCPU, 4 GB RAM, 50 GB disk space