XSIAM-Engineer Planning And Installation Practice Test 2 — 15 Questions

Question 1

A security engineer is preparing to install a Broker VM in a remote office that has limited bandwidth. The engineer needs to ensure that the Broker VM can communicate with the Cortex XSIAM tenant. Which outbound connectivity requirement must be met?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Outbound TCP 443 to the Cortex XSIAM tenant FQDN and outbound DNS (UDP/TCP 53) for name resolution.. Broker VMs communicate with the Cortex XSIAM tenant exclusively over TCP 443. They also require DNS to resolve the tenant FQDN. No additional inbound ports are needed unless the Broker VM is also collecting logs, in which case inbound syslog ports may be opened. The correct answer reflects the standard outbound requirements.

Answer

Outbound TCP 443 to the Cortex XSIAM tenant FQDN and outbound TCP 22 for management.

Answer

Outbound TCP 443 to the Cortex XSIAM tenant FQDN and outbound UDP 514 to the tenant for syslog.

Answer

Outbound TCP 443 to the Cortex XSIAM tenant FQDN and outbound TCP 4443 for Broker VM registration.

Question 2

An engineer is planning the network requirements for a new Cortex XSIAM deployment that includes a Broker VM for log collection. The security team asks which outbound connectivity requirements must be met for the Broker VM to function. (Choose two.)

Accepted Answer

Outbound TCP 443 to the Cortex XSIAM tenant endpoints. Broker VM requires outbound TCP 443 to the Cortex XSIAM tenant for secure data forwarding and management, and outbound DNS to resolve tenant hostnames. These are the essential outbound connectivity requirements. The other options either describe inbound collection ports, unnecessary services, or non-essential protocols.

Answer

Outbound TCP 22 for SSH management from the tenant

Answer

Outbound UDP 514 to the tenant for syslog forwarding

Answer

Outbound ICMP for path MTU discovery

Question 3

An architect is planning the installation of Cortex XSIAM in a large enterprise with multiple data centers. The company requires that all log data be stored locally for compliance reasons, but also wants to leverage Cortex XSIAM's analytics. Which deployment model should the architect recommend?

Accepted Answer

Cortex XSIAM with local data storage and cloud-based management. For compliance requiring local log storage, Cortex XSIAM can be deployed with Broker VMs configured to store logs locally on-premises. The Broker VM can retain raw logs while forwarding processed data or alerts to the cloud for analytics. This hybrid approach balances compliance with the benefits of cloud-based detection and response.

Answer

Fully on-premises Cortex XSIAM deployment

Answer

Cortex XSIAM with on-premises Broker VMs and cloud-based analytics

Answer

Cortex XSIAM with cloud-only log storage

Question 4

A security architect is planning the deployment of Cortex XSIAM in a hybrid environment with both cloud and on-premises assets. They need to ensure that all data sources are properly integrated. Which TWO components are required to collect data from on-premises sources that cannot install agents? (Choose two.)

Accepted Answer

Cortex XSIAM tenant. To collect data from on-premises sources that cannot install agents, a Broker VM is required on-premises to receive and forward the data. The Cortex XSIAM tenant is the cloud destination where the data is analyzed and stored. Together, these two components form the essential collection path. The Cortex XDR agent is for endpoints, a separate syslog server is redundant, and Cortex Data Lake is not part of the core XSIAM architecture.

Answer

Cortex Data Lake

Answer

Cortex XDR agent

Answer

Syslog server

Question 5

An engineer is planning the installation of Cortex XSIAM and needs to ensure that the Broker VM can successfully collect logs from various sources. Which TWO configurations are required on the Broker VM to enable log collection from network devices? (Choose two.)

Accepted Answer

Set up a log forwarding profile on the source devices. To collect logs from network devices via syslog, the Broker VM must be configured to receive syslog traffic, and the source devices must be configured to send logs to the Broker VM. These two steps are essential for the data flow. Without either, logs will not be collected. Other options are not required for this specific task.

Answer

Configure a firewall rule to allow inbound syslog traffic to the Broker VM

Answer

Install a Cortex XDR agent on the Broker VM

Answer

Enable the Cortex XSIAM API on the Broker VM

Question 6

A security engineer is planning to deploy Cortex XSIAM agents to 5,000 endpoints across multiple domains. The engineer wants to ensure that the agents can be centrally managed and that endpoint data is correlated in the Cortex XSIAM tenant. Which component must be deployed to enable agent management and data collection?

Accepted Answer

Cortex XSIAM tenant with the appropriate agent licenses and a distribution ID for agent installation.. Cortex XSIAM agents are managed centrally by the cloud tenant. The tenant requires agent licenses and a distribution ID to install agents and associate them with the correct tenant. Broker VMs are not needed for agent communication, and on-premises management servers are not part of the architecture.

Answer

A Broker VM deployed in each domain to act as a proxy for agent communication.

Answer

An on-premises Cortex XSIAM management server to handle agent registration.

Answer

Cortex XDR agent with a unique distribution ID for each domain.

Question 7

An administrator is preparing to install a Broker VM on a VMware ESXi host. The environment uses a proxy for internet access, and the administrator needs to provide the Broker VM with the correct network settings. Which two pieces of information are minimally required to configure the Broker VM's management interface?

Accepted Answer

IP address, subnet mask, default gateway, and DNS server. The Broker VM's management interface requires standard Layer 3 settings: IP address, subnet mask, default gateway, and DNS server. These enable local communication and name resolution so the appliance can reach the Cortex XSIAM tenant. MAC address, VLAN ID, proxy settings, and tenant credentials are either supplementary or used at later stages and cannot replace the core IP configuration.

Answer

Proxy address and port only

Answer

Tenant API key and tenant FQDN only

Answer

MAC address and VLAN ID only

Question 8

A security engineer is planning to deploy Cortex XSIAM to collect logs from a high-volume firewall that generates 50,000 events per second. The engineer must ensure the Broker VM can handle the load without dropping events. Which Broker VM component should be sized based on the expected event rate?

Accepted Answer

CPU and memory allocated to the Broker VM. The Broker VM is responsible for receiving, processing, and forwarding logs to Cortex XSIAM. Its CPU and memory resources directly impact its ability to handle high event rates without dropping data. Disk and network are secondary considerations for throughput. Proper sizing of CPU and memory ensures reliable log collection at the required EPS.

Answer

Number of CPU cores assigned to the Cortex XSIAM tenant

Answer

Disk space allocated to the Broker VM

Answer

Network interface speed of the Broker VM

Question 9

An administrator is preparing to deploy the Cortex XDR agent on Windows workstations via an Active Directory Group Policy Object (GPO). Which file format must the administrator download from the XSIAM console for this deployment method?

Accepted Answer

.msi. For GPO-based deployment on Windows, the Cortex XDR agent must be distributed as an .msi package, which Group Policy Software Installation can deploy silently and manage via Active Directory. The .msi format supports command-line properties and centralized installation.

Answer

.exe

Answer

.tar.gz

Answer

.ova

Question 10

A security engineer needs to ingest custom syslog data from an on-premises legacy firewall into Cortex XSIAM. No native content pack exists for this specific legacy device. What is the recommended approach to ingest and correctly parse this unstructured log data?

Accepted Answer

Configure a Broker VM Syslog collector and build a custom parsing rule using XQL mapping. The recommended approach for ingesting custom syslog from a legacy device with no native content pack is to deploy a Broker VM with a Syslog collector, which receives the raw logs on-premises and forwards them to Cortex XSIAM. Since the data is unstructured and lacks a prebuilt parser, the engineer must create a custom parsing rule using XQL (XSIAM Query Language) mapping to extract fields and normalize the data into the XSIAM schema. This method provides full control over ingestion and parsing without relying on unsupported integrations.

Answer

Forward the logs to Panorama and enable Cortex Data Lake native mirroring

Answer

Directly upload raw text files via the incident management tab daily

Answer

Install a Cortex XDR agent directly onto the legacy firewall device

Question 11

During the initial onboarding phase of a Cortex XSIAM tenant, an administrator needs to download and deploy the Broker VM OVA template. Where within the Cortex XSIAM UI can the administrator find the Broker VM image download link and deployment tokens?

Accepted Answer

Settings > Configurations > Data Collection > Broker VM. The Broker VM OVA download link and deployment tokens are located in Cortex XSIAM under Settings > Configurations > Data Collection > Broker VM. This is where administrators generate the deployment token and download the OVA for on-premises installation.

Answer

Marketplace > Content Hub > Broker VM Management

Answer

Incidents > Response > Integrations > Broker VM

Answer

Dashboards > System Status > Virtual Appliances

Question 12

An architect is designing a multi-tenant XSIAM data ingestion pipeline where distinct business units must have isolated visibility and role-based access control over their respective log sources. Which XSIAM architectural construct should be configured to ensure strict data segregation between business units?

Accepted Answer

Dataset-level Role-Based Access Control (RBAC) and Query Scopes. Dataset-level RBAC combined with query scopes is the XSIAM construct that restricts which users or roles can view and query specific datasets, enabling strict segregation between business units. By assigning roles that only grant access to the datasets belonging to a given business unit, the architect ensures that analysts in one unit cannot see another unit's log data. This is the documented mechanism for multi-tenant style isolation within a single XSIAM tenant.

Answer

Broker VM interface bonding configurations

Answer

Agent Installation Packages with embedded proxy exclusions

Answer

Log Collector Profiles with dedicated forwarding keys

Question 13

An engineer is tasked with reviewing the health and status of data collectors deployed across various remote sites. Within the Cortex XSIAM management console, which navigation path provides a consolidated view of all Broker VMs and their current operational status?

Accepted Answer

Settings > Configurations > Data Collection > Broker VM. In Cortex XSIAM, Broker VMs are managed under Settings > Configurations > Data Collection > Broker VM. This path provides a consolidated dashboard showing all deployed Broker VMs, their connectivity status, version, and health metrics. It is the central location for monitoring and troubleshooting data collection infrastructure.

Answer

Cloud Identity > Integrations > Status

Answer

Dashboards > Incident Management > Overview

Answer

Investigate > Endpoint Security > Collectors

Question 14

An administrator is verifying that firewall rules at the corporate perimeter permit outbound communication from Cortex XDR agents. Which destination criteria must be allowed for agent communication?

Accepted Answer

Outbound TCP port 443 to Palo Alto Networks XSIAM cloud FQDNs. Cortex XDR agents communicate with the Cortex XSIAM cloud over outbound TCP 443 to Palo Alto Networks cloud FQDNs. This encrypted channel carries telemetry, policy updates, and management traffic, so perimeter firewall rules must allow outbound 443 to those destinations.

Answer

Inbound TCP port 22 and 3389 for remote diagnostics

Answer

Outbound UDP port 514 for direct syslog streaming to the cloud

Answer

Inbound and outbound TCP port 80 for unencrypted configuration checks

Question 15

An administrator is planning network changes for an environment where endpoints communicate through a corporate HTTP proxy. To ensure Cortex XDR agents maintain continuous connectivity to the XSIAM tenant, what must the administrator verify regarding the proxy configuration?

Accepted Answer

The proxy must allow outbound HTTPS traffic to XSIAM FQDNs and support websocket connections without SSL inspection. Cortex XDR agents communicate with the XSIAM tenant over outbound HTTPS (TCP 443) and use websocket connections for persistent, near-real-time command-and-control and telemetry streaming. When a corporate HTTP proxy sits in the path, it must permit outbound HTTPS to the XSIAM FQDNs and must NOT perform SSL inspection/decryption on that traffic, because breaking the TLS session invalidates the agent's certificate pinning and the websocket upgrade fails. Verifying these proxy allowances is the prerequisite for continuous agent connectivity.

Answer

The proxy server must run a local Broker VM instance to cache agent heartbeat signals

Answer

The proxy must translate all UDP syslog packets into TCP streams before forwarding

Answer

The proxy must perform full SSL decryption on all agent-to-cloud traffic to inspect security payloads