XSIAM-Engineer Planning And Installation Practice Test 3 — 15 Questions

Question 1

During a high-availability planning session for an on-premises Broker VM deployment, an architect considers deploying multiple Broker VMs behind a load balancer to handle syslog collection from thousands of network devices. What is a critical architectural limitation or consideration when placing Broker VMs behind a load balancer for syslog collection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Load balancing TCP or UDP syslog streams requires careful session persistence and source IP retention to ensure parser context is maintained. When placing multiple Broker VMs behind a load balancer for syslog collection, session persistence (sticky sessions) and source IP retention are critical to ensure that all syslog messages from a given device go to the same Broker VM. This maintains parser context and prevents log parsing errors due to distributed processing.

Answer

Broker VMs cannot accept syslog data if they are registered to the same XSIAM tenant token

Answer

Load balancers prevent the Broker VM from communicating with the Cortex XSIAM cloud backend via port 443

Answer

Broker VMs automatically sync local log queues across the load balancer using BGP routing

Question 2

When planning the installation of Cortex XSIAM content packs from the Marketplace, what prerequisite check must an administrator perform to ensure successful installation and utilization?

Accepted Answer

Verify that the administrator account has Content Administrator or equivalent privileges and check license entitlements. Before installing content packs from the Cortex XSIAM Marketplace, the administrator must verify that their account has Content Administrator or equivalent RBAC privileges and that the tenant's license entitles them to the content being installed. Without proper permissions, the install option is unavailable or fails, and without license entitlement, packs may install but not function.

Answer

Manually compile source code files using the XQL command line

Answer

Reboot all deployed Broker VMs simultaneously

Answer

Disable all active endpoint security policies temporarily

Question 3

An administrator needs to integrate third-party threat intelligence feeds into Cortex XSIAM to enrich incoming security telemetry. Where should the administrator configure and manage these threat intelligence integrations within the XSIAM platform?

Accepted Answer

Marketplace > Content Hub (or Settings > Integrations). Third-party threat intelligence feeds in Cortex XSIAM are delivered as content packs (integrations) that must be installed and configured from the Marketplace / Content Hub, then instantiated under Settings > Integrations. This is where API keys, feed URLs, and fetch intervals are supplied so the feeds can enrich telemetry via XDM mapping.

Answer

Endpoint Security > Policies > Threat Protection

Answer

Settings > Configurations > Threat Intelligence > Feeds

Answer

XQL Search > Settings > Threat Feeds

Question 4

An organization plans to ingest cloud audit logs from Amazon Web Services (AWS) into Cortex XSIAM using an automated collector architecture. Which native AWS service integration mechanism is typically recommended and supported by XSIAM for scalable log collection?

Accepted Answer

AWS S3 bucket ingestion leveraging SQS notifications and IAM role authentication. XSIAM's recommended scalable AWS log-collection architecture uses S3 bucket ingestion: AWS services write audit/cloud logs to an S3 bucket, S3 event notifications publish to an SQS queue, and XSIAM's collector polls the queue and pulls the objects using IAM role authentication. This decouples ingestion from the log source, scales horizontally, and avoids exposing credentials. It is the standard, supported pattern for high-volume AWS audit log ingestion.

Answer

Direct SNMP traps forwarded from AWS EC2 metadata service

Answer

Syslog forwarding from the AWS Root Account login page

Answer

Local Cortex XDR agent installation on AWS RDS database instances

Question 5

An administrator is troubleshooting a newly configured API-based integration that is failing to ingest logs into Cortex XSIAM. The test connection fails with an authentication error, despite valid API credentials being entered. What is a common architectural oversight that causes this failure?

Accepted Answer

The API user account lacks the necessary permissions on the target platform, or network egress is blocked. Authentication failures in API-based integrations are most often caused by authorization or connectivity problems rather than the credentials themselves. Even with a valid API key, the account must have the correct scopes/roles on the target platform, and the Broker VM or integration host must be able to reach the API endpoint over the required ports. Blocked egress or insufficient permissions will surface as an authentication error in the test connection.

Answer

The Broker VM requires a manual firmware downgrade to support legacy API protocols

Answer

The Cortex XDR agent service on endpoints has stopped responding

Answer

The XQL query builder cache is corrupted and requires a database purge

Question 6

An engineer wants to verify the version and resource utilization of a running Broker VM. Where in the Cortex XSIAM user interface can this operational metric be inspected?

Accepted Answer

Settings > Configurations > Data Collection > Broker VM. The Broker VM is a customer-deployed component that collects and forwards data to Cortex XSIAM, and its operational state (version, CPU, memory, disk utilization, connectivity) is surfaced in the management UI under Settings > Configurations > Data Collection > Broker VM. This is the designated administrative location for inspecting deployed broker instances and their health metrics. The other locations are investigation, query, or dashboard surfaces that do not expose Broker VM appliance telemetry.

Answer

Investigate > Alerts > System Events

Answer

XQL Search > Run > sys_resources

Answer

Dashboards > Threat Intelligence > Overview

Question 7

An architect is designing an automated deployment script for rolling out Cortex XDR agents across thousands of Linux servers using an enterprise configuration management tool (e.g., Ansible). To ensure silent installation and proper initial group assignment, what must be included in the installation command parameters?

Accepted Answer

The silent installation flag along with the correct installation token (ID) and optional group parameters. Linux silent installations require specific command-line arguments, including the installation token (auth-code or customer ID) and optionally the initial group tag to ensure proper onboarding without user prompts.

Answer

A manual SSH key exchange with the Cortex XSIAM cloud backend

Answer

The interactive GUI installer switch combined with root password prompting

Answer

Pre-formatting the Linux root file system with XSIAM-specific journaling

Question 8

When planning an enterprise-wide rollout of Cortex XDR agents, administrators often utilize 'Upgrade Rings'. What is the primary purpose of an upgrade ring in Cortex XSIAM deployment strategy?

Accepted Answer

To stage and test new agent versions on pilot endpoint groups before broad production rollout. Upgrade rings allow administrators to test new agent versions on a small pilot group of endpoints before deploying them broadly across the organization.

Answer

To automatically rotate encryption keys for network proxies every 24 hours

Answer

To segment firewall log ingestion by geographic region

Answer

To load-balance syslog traffic across multiple Broker VMs

Question 9

An enterprise is deploying Cortex XSIAM in an isolated environment that requires all outgoing traffic to traverse an explicit forward proxy requiring authentication (Kerberos/NTLM). How must the Broker VM be configured to support this network topology?

Accepted Answer

Configure the proxy settings during the initial Broker VM network setup or configuration menu, providing necessary proxy credentials. Broker VM supports explicit forward proxy configuration with authentication (including Kerberos/NTLM) during the initial network setup or via the Broker VM configuration menu. The administrator supplies the proxy address, port, and credentials so all outbound Broker traffic to the XSIAM cloud traverses the authenticated proxy.

Answer

Convert all syslog streams to ICMP tunneling packets to bypass proxy authentication

Answer

Install an external NTLM relay daemon directly onto the XSIAM cloud backend

Answer

Broker VMs do not support forward proxies and require a direct internet connection at all times

Question 10

An administrator is configuring data collection policies in Cortex XSIAM to optimize storage and ingestion costs. The organization wishes to exclude verbose, non-security-relevant informational logs from a specific firewall source. Which mechanism should the administrator configure?

Accepted Answer

Data Ingestion Filters / Drop Rules. Data Ingestion Filters (also called Drop Rules) in Cortex XSIAM allow administrators to filter or drop specific log types, fields, or sources before they are stored, reducing ingestion volume and cost without affecting detection coverage for security-relevant events. This is the correct mechanism to exclude verbose informational logs from a specific firewall source.

Answer

Endpoint isolation policies

Answer

XQL scheduled queries with automated table deletion

Answer

Agent upgrade rings

Question 11

An architect is designing the high-availability and disaster recovery (HA/DR) strategy for an on-premises log collection tier utilizing multiple Broker VMs. If Primary Broker VM 'A' fails completely, what happens to the log streams being sent to it from local security devices?

Accepted Answer

Log collection halts unless a network load balancer, DNS failover, or secondary forwarding destination is configured. Broker VMs do not natively cluster or share state, so if Primary Broker VM A fails, the syslog and log streams pointed at its IP address simply stop being received. Log collection resumes only if an external mechanism such as a network load balancer, DNS failover, or a secondary forwarding destination on the source devices redirects traffic to Broker VM B.

Answer

Broker VM 'B' automatically polls the local disk of Broker VM 'A' via SSH to retrieve uncollected logs

Answer

The Cortex XDR agent on endpoints takes over the local syslog listening port

Answer

The XSIAM cloud backend automatically reroutes local syslog streams via cloud-to-premises BGP peering

Question 12

An organization requires that certain sensitive datasets ingested into Cortex XSIAM be automatically purged after a specific retention period shorter than the default tier. Where can an administrator configure custom retention policies for specific datasets?

Accepted Answer

Settings > Configurations > Data Management > Retentions. Cortex XSIAM exposes dataset-level retention configuration under Settings > Configurations > Data Management > Retentions, where administrators can define custom retention periods per dataset that override the default tier. This allows sensitive datasets to be purged sooner than the standard retention window without affecting other data.

Answer

Marketplace > Content Hub > Retention Pack

Answer

Endpoint Security > Profiles > Storage Settings

Answer

Investigate > XQL Search > Retention Command

Question 13

During the planning of a Cortex XSIAM deployment in an environment utilizing strict network segmentation, an administrator must ensure that communication between the Broker VM and local log sources (such as firewalls and SIEM forwarders) uses supported protocols. Which protocol combination is natively supported by Broker VM collectors for incoming log ingestion?

Accepted Answer

Syslog (TCP/UDP), Syslog-TLS, and HTTPS/API collection. Broker VMs support standard ingestion protocols including Syslog (TCP/UDP), Syslog-TLS, HTTP/HTTPS API collection, and secure file polling mechanisms.

Answer

Direct SMB file shares, RDP clipboard sharing, and NetBIOS name resolution

Answer

IPsec VPN encapsulation and GRE tunneling directly to the agent kernel

Answer

SNMP v1 read-only polling and Telnet terminal scraping

Question 14

An administrator needs to verify whether a newly deployed Broker VM is successfully forwarding logs to the Cortex XSIAM tenant. Which tool or menu within the XSIAM console allows the administrator to view real-time incoming log counts and ingestion rates?

Accepted Answer

Dashboards > Data Ingestion (or Settings > Data Collection). The Dashboards > Data Ingestion view (also accessible via Settings > Data Collection) is the dedicated monitoring surface in Cortex XSIAM for tracking log flow from Brokers and other collectors into the tenant. It displays real-time incoming log counts, ingestion rates (events per second), and per-source breakdowns, allowing an administrator to confirm that a newly deployed Broker VM is actively forwarding data. This is the only option that surfaces ingestion telemetry rather than query, identity, or alerting data.

Answer

XQL Search > Incident Explorer

Answer

Cloud Identity > Users > Audit Trail

Answer

Incidents > Active Alerts

Question 15

An administrator is deploying Cortex XDR agents to a fleet of macOS endpoints using a Mobile Device Management (MDM) solution like Jamf Pro. What is required to ensure the agent has full disk access and system extension approvals on modern macOS versions without user prompting?

Accepted Answer

Deploying MDM configuration profiles containing System Extension and Full Disk Access payloads. On modern macOS (Catalina and later), kernel extensions are deprecated in favor of system extensions, and Full Disk Access (FDA) is a TCC (Transparency, Consent, and Control) permission that cannot be granted silently without MDM. Deploying MDM configuration profiles that include System Extension and Full Disk Access payloads allows the Cortex XDR agent to be approved and granted FDA without user interaction. This is the only supported method for zero-touch deployment at scale.

Answer

Manually running sudo commands via SSH on every Mac workstation

Answer

Disabling the macOS Gatekeeper security feature globally via terminal

Answer

Configuring an internal Broker VM to proxy macOS system calls