XSIAM-Engineer Planning And Installation Practice Test 2 — 15 Questions

Question 1

An organization plans to ingest cloud audit logs from Amazon Web Services (AWS) into Cortex XSIAM using an automated collector architecture. Which native AWS service integration mechanism is typically recommended and supported by XSIAM for scalable log collection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS S3 bucket ingestion leveraging SQS notifications and IAM role authentication. AWS log integration into Cortex XSIAM commonly leverages AWS S3 buckets populated by CloudTrail or VPC flow logs, accessed via SQS and IAM roles through an AWS integrations content pack or Broker VM AWS collector.

Answer

Direct SNMP traps forwarded from AWS EC2 metadata service

Answer

Syslog forwarding from the AWS Root Account login page

Answer

Local Cortex XDR agent installation on AWS RDS database instances

Question 2

An administrator is troubleshooting a newly configured API-based integration that is failing to ingest logs into Cortex XSIAM. The test connection fails with an authentication error, despite valid API credentials being entered. What is a common architectural oversight that causes this failure?

Accepted Answer

The API user account lacks the necessary permissions on the target platform, or network egress is blocked. API integrations often fail authentication if the API key lacks the required permissions/roles within the source platform or if network firewalls block outbound/inbound HTTPS requests to the vendor's API endpoint.

Answer

The Broker VM requires a manual firmware downgrade to support legacy API protocols

Answer

The Cortex XDR agent service on endpoints has stopped responding

Answer

The XQL query builder cache is corrupted and requires a database purge

Question 3

An engineer wants to verify the version and resource utilization of a running Broker VM. Where in the Cortex XSIAM user interface can this operational metric be inspected?

Accepted Answer

Settings > Configurations > Data Collection > Broker VM. Broker VM resource utilization (CPU, memory, disk) and version details are visible under Settings > Configurations > Data Collection > Broker VM.

Answer

Investigate > Alerts > System Events

Answer

XQL Search > Run > sys_resources

Answer

Dashboards > Threat Intelligence > Overview

Question 4

An architect is designing an automated deployment script for rolling out Cortex XDR agents across thousands of Linux servers using an enterprise configuration management tool (e.g., Ansible). To ensure silent installation and proper initial group assignment, what must be included in the installation command parameters?

Accepted Answer

The silent installation flag along with the correct installation token (ID) and optional group parameters. Linux silent installations require specific command-line arguments, including the installation token (auth-code or customer ID) and optionally the initial group tag to ensure proper onboarding without user prompts.

Answer

A manual SSH key exchange with the Cortex XSIAM cloud backend

Answer

The interactive GUI installer switch combined with root password prompting

Answer

Pre-formatting the Linux root file system with XSIAM-specific journaling

Question 5

When planning an enterprise-wide rollout of Cortex XDR agents, administrators often utilize 'Upgrade Rings'. What is the primary purpose of an upgrade ring in Cortex XSIAM deployment strategy?

Accepted Answer

To stage and test new agent versions on pilot endpoint groups before broad production rollout. Upgrade rings allow administrators to test new agent versions on a small pilot group of endpoints before deploying them broadly across the organization.

Answer

To automatically rotate encryption keys for network proxies every 24 hours

Answer

To segment firewall log ingestion by geographic region

Answer

To load-balance syslog traffic across multiple Broker VMs

Question 6

An enterprise is deploying Cortex XSIAM in an isolated environment that requires all outgoing traffic to traverse an explicit forward proxy requiring authentication (Kerberos/NTLM). How must the Broker VM be configured to support this network topology?

Accepted Answer

Configure the proxy settings during the initial Broker VM network setup or configuration menu, providing necessary proxy credentials. Broker VMs support explicit proxy configurations through their setup wizard or configuration files, allowing administrators to specify proxy IP, port, and authentication credentials.

Answer

Convert all syslog streams to ICMP tunneling packets to bypass proxy authentication

Answer

Install an external NTLM relay daemon directly onto the XSIAM cloud backend

Answer

Broker VMs do not support forward proxies and require a direct internet connection at all times

Question 7

An administrator is configuring data collection policies in Cortex XSIAM to optimize storage and ingestion costs. The organization wishes to exclude verbose, non-security-relevant informational logs from a specific firewall source. Which mechanism should the administrator configure?

Accepted Answer

Data Ingestion Filters / Drop Rules. Data filters or ingestion rules in XSIAM allow administrators to drop, filter, or retain specific log subsets before they consume indexed storage quotas.

Answer

Endpoint isolation policies

Answer

XQL scheduled queries with automated table deletion

Answer

Agent upgrade rings

Question 8

An architect is designing the high-availability and disaster recovery (HA/DR) strategy for an on-premises log collection tier utilizing multiple Broker VMs. If Primary Broker VM 'A' fails completely, what happens to the log streams being sent to it from local security devices?

Accepted Answer

Log collection halts unless a network load balancer, DNS failover, or secondary forwarding destination is configured. If syslog-sending devices are configured with a single static IP pointing to Broker VM A, they will stop forwarding unless a high-availability mechanism (such as DNS failover, VRRP, or a load balancer) redirects traffic to Broker VM B.

Answer

Broker VM 'B' automatically polls the local disk of Broker VM 'A' via SSH to retrieve uncollected logs

Answer

The Cortex XDR agent on endpoints takes over the local syslog listening port

Answer

The XSIAM cloud backend automatically reroutes local syslog streams via cloud-to-premises BGP peering

Question 9

An organization requires that certain sensitive datasets ingested into Cortex XSIAM be automatically purged after a specific retention period shorter than the default tier. Where can an administrator configure custom retention policies for specific datasets?

Accepted Answer

Settings > Configurations > Data Management > Retentions. Custom data retention settings and storage tiering policies are managed under the data management and retention settings within the Cortex XSIAM administrative console.

Answer

Marketplace > Content Hub > Retention Pack

Answer

Endpoint Security > Profiles > Storage Settings

Answer

Investigate > XQL Search > Retention Command

Question 10

During the planning of a Cortex XSIAM deployment in an environment utilizing strict network segmentation, an administrator must ensure that communication between the Broker VM and local log sources (such as firewalls and SIEM forwarders) uses supported protocols. Which protocol combination is natively supported by Broker VM collectors for incoming log ingestion?

Accepted Answer

Syslog (TCP/UDP), Syslog-TLS, and HTTPS/API collection. Broker VMs support standard ingestion protocols including Syslog (TCP/UDP), Syslog-TLS, HTTP/HTTPS API collection, and secure file polling mechanisms.

Answer

Direct SMB file shares, RDP clipboard sharing, and NetBIOS name resolution

Answer

IPsec VPN encapsulation and GRE tunneling directly to the agent kernel

Answer

SNMP v1 read-only polling and Telnet terminal scraping

Question 11

An administrator needs to verify whether a newly deployed Broker VM is successfully forwarding logs to the Cortex XSIAM tenant. Which tool or menu within the XSIAM console allows the administrator to view real-time incoming log counts and ingestion rates?

Accepted Answer

Dashboards > Data Ingestion (or Settings > Data Collection). Ingestion rates and telemetry volumes can be monitored using the Data Ingestion or System Health dashboards within Cortex XSIAM.

Answer

XQL Search > Incident Explorer

Answer

Cloud Identity > Users > Audit Trail

Answer

Incidents > Active Alerts

Question 12

An administrator is deploying Cortex XDR agents to a fleet of macOS endpoints using a Mobile Device Management (MDM) solution like Jamf Pro. What is required to ensure the agent has full disk access and system extension approvals on modern macOS versions without user prompting?

Accepted Answer

Deploying MDM configuration profiles containing System Extension and Full Disk Access payloads. Modern macOS versions require MDM configuration profiles (Payloads) to pre-approve System Extensions and grant Full Disk Access to security software like Cortex XDR.

Answer

Manually running sudo commands via SSH on every Mac workstation

Answer

Disabling the macOS Gatekeeper security feature globally via terminal

Answer

Configuring an internal Broker VM to proxy macOS system calls

Question 13

An architect is estimating storage capacity requirements for Cortex XSIAM. Which formula correctly represents the core calculation for raw daily log ingestion planning?

Accepted Answer

Average daily log volume (GB/day) multiplied by retention period (days), adjusted for indexing and replication multipliers. Daily storage sizing is calculated by multiplying the average daily event count by the average event size, accounting for compression and parsing factors.

Answer

Number of active user accounts multiplied by active session duration

Answer

Number of endpoints multiplied by total RAM capacity

Answer

Total CPU cores on Broker VMs divided by network latency

Question 14

An administrator needs to configure granular access control so that junior SOC analysts can view incidents and run XQL queries, but cannot modify tenant settings or install integrations. Where should the administrator configure these permissions?

Accepted Answer

Settings > Configurations > Access Control > Roles. Role-Based Access Control (RBAC) in Cortex XSIAM is configured under Settings > Configurations > Access Control > Roles.

Answer

Endpoints > Policy > Access Control List

Answer

Investigate > Analysts > Permissions Manager

Answer

Marketplace > Content Hub > User Security Pack

Question 15

An organization is integrating Microsoft Entra ID (formerly Azure AD) sign-in logs into Cortex XSIAM. The architect decides to use an Event Hub integration model via a Content Hub pack. What is the architectural role of the Event Hub in this ingestion pipeline?

Accepted Answer

It acts as a scalable streaming buffer that temporarily holds log messages until pulled by the XSIAM integration collector. Azure Event Hub acts as a scalable streaming message broker that collects logs from Entra ID and holds them until the Cortex XSIAM integration pulls them for parsing and ingestion.

Answer

It replaces the need for SSL certificates by enforcing unencrypted local network pipes

Answer

It translates Azure audit logs directly into native Cortex XDR agent binary commands

Answer

It acts as a local hypervisor running a containerized Broker VM instance in Azure