XSIAM-Engineer Planning And Installation Practice Test 4 — 15 Questions

Question 1

An architect is estimating storage capacity requirements for Cortex XSIAM. Which formula correctly represents the core calculation for raw daily log ingestion planning?

Accepted Answer

Average daily log volume (GB/day) multiplied by retention period (days), adjusted for indexing and replication multipliers. The core capacity planning formula for XSIAM multiplies average daily log volume in GB/day by the retention period in days, then applies indexing and replication multipliers to account for how the platform stores and duplicates data. This yields the raw storage estimate needed before factoring in compression and any additional datasets.

Answer

Number of active user accounts multiplied by active session duration

Answer

Number of endpoints multiplied by total RAM capacity

Answer

Total CPU cores on Broker VMs divided by network latency

Question 2

An administrator needs to configure granular access control so that junior SOC analysts can view incidents and run XQL queries, but cannot modify tenant settings or install integrations. Where should the administrator configure these permissions?

Accepted Answer

Settings > Configurations > Access Control > Roles. In Cortex XSIAM, role-based access control (RBAC) is configured under Settings > Configurations > Access Control > Roles, where administrators define roles with granular permissions for incidents, XQL queries, integrations, and tenant settings. Assigning junior SOC analysts a role that grants view/query permissions but denies configuration and integration management enforces least privilege. This is the centralized location for all RBAC configuration in XSIAM.

Answer

Endpoints > Policy > Access Control List

Answer

Investigate > Analysts > Permissions Manager

Answer

Marketplace > Content Hub > User Security Pack

Question 3

An organization is integrating Microsoft Entra ID (formerly Azure AD) sign-in logs into Cortex XSIAM. The architect decides to use an Event Hub integration model via a Content Hub pack. What is the architectural role of the Event Hub in this ingestion pipeline?

Accepted Answer

It acts as a scalable streaming buffer that temporarily holds log messages until pulled by the XSIAM integration collector. The Event Hub acts as a scalable, durable streaming buffer in Azure that receives Microsoft Entra ID sign-in logs (typically via diagnostic settings export) and holds them until the XSIAM integration collector pulls them. This decouples the log producer (Entra ID) from the consumer (XSIAM), allowing XSIAM to ingest at its own pace without backpressure on the source. The Content Hub pack provides the connector logic that authenticates to the Event Hub and reads messages from it.

Answer

It replaces the need for SSL certificates by enforcing unencrypted local network pipes

Answer

It translates Azure audit logs directly into native Cortex XDR agent binary commands

Answer

It acts as a local hypervisor running a containerized Broker VM instance in Azure

Question 4

An architect is planning the deployment prerequisites for a Broker VM in a customer environment. Which TWO infrastructure requirements must be verified before deploying the OVA template? (Choose two)

Accepted Answer

Outbound TCP port 443 connectivity to the Cortex XSIAM tenant cloud FQDNs. Option A is correct because the Broker VM must reach the Cortex XSIAM tenant over outbound TCP 443 to the cloud FQDNs so it can register, receive policy, and forward logs/telemetry to the tenant. Option D is correct because the OVA must be deployed on a supported hypervisor (e.g., VMware ESXi or Microsoft Hyper-V) with adequate CPU and RAM resources allocated to run the Broker VM reliably. Option B is incorrect because the Broker VM does not require an Active Directory Domain Controller role installed inside it; AD integration is not a deployment prerequisite for the appliance itself. Option C is incorrect because the Broker VM is administered through its management interface and does not require a local GUI desktop environment. Option E is incorrect because the Broker VM does not require a dedicated physical Fibre Channel storage array attached directly to the appliance.

Answer

An active Microsoft Active Directory Domain Controller role installed inside the VM

Answer

A local graphical user interface (GUI) desktop environment enabled for administrative troubleshooting

Answer

A dedicated physical fiber channel storage array attached directly to the appliance

Question 5

When planning log collection and ingestion strategies in Cortex XSIAM, an architect can ingest data from multiple sources. Which THREE log sources are natively supported for direct or Broker VM-mediated ingestion? (Choose three)

Accepted Answer

Cloud provider audit logs (such as AWS CloudTrail and Azure Activity Logs). Option C is correct because Cortex XSIAM natively supports ingesting cloud audit and activity logs, including AWS CloudTrail and Azure Activity Logs, through built-in cloud integrations and data sources. Option D is correct because standard Syslog streams from third-party security devices and network switches are a core supported ingestion method, typically collected directly or via a Broker VM acting as a Syslog receiver. Option E is correct because Palo Alto Networks Next-Generation Firewalls running PAN-OS are first-party sources whose logs (traffic, threat, URL, etc.) are natively ingested into Cortex XSIAM directly or through Broker VM log forwarding. Option A does not belong because analog audio streams from telephone switchboards are not a supported log source type in XSIAM. Option B does not belong because SNMP v1 printer ink level broadcasts are not a natively supported log ingestion source for Cortex XSIAM.

Answer

Direct analog audio streams from corporate telephone switchboards

Answer

Local printer ink level status notifications via SNMP v1 broadcast

Question 6

An administrator is configuring data collection settings and incident rules in Cortex XSIAM. Which TWO configuration steps are required to ensure proper data parsing and alert generation for a newly added third-party firewall log source? (Choose two)

Accepted Answer

Ensuring the corresponding vendor content pack is installed and active to correctly parse and normalize logs into the XSIAM schema. Option C is correct because Cortex XSIAM relies on vendor-specific content packs (parsers and data models) to correctly parse and normalize third-party firewall logs into the XSIAM schema, which is a prerequisite for meaningful alert generation. Option D is correct because logs must first be ingested through the proper collection mechanism — a Broker VM receiver (e.g., Syslog/CEF receiver) or an API integration instance — before parsing and alerting can occur. Option A is incorrect because recompiling the Cortex XDR agent kernel extension relates to endpoint agent functionality, not to ingesting or parsing third-party firewall logs. Option B is incorrect because flushing SOC analysts' browser caches has no effect on data collection, parsing, or incident rule evaluation. Option E is incorrect because the cloud data lake is a managed service; manually modifying its kernel source via SSH is neither supported nor required for log onboarding.

Answer

Recompiling the Cortex XDR agent kernel extension on all endpoints

Answer

Flushing the browser cache of all SOC analysts

Answer

Manually modifying the cloud data lake kernel source code via SSH

Question 7

When defining custom user roles and permissions in Cortex XSIAM, which TWO granular access controls can an administrator assign? (Choose two)

Accepted Answer

Dataset-level access restrictions and query scopes. Option C is correct because Cortex XSIAM role-based access control (RBAC) lets administrators scope what data an analyst can see and query, so dataset-level restrictions and query scopes are assignable granular controls. Option D is correct because XSIAM roles can include administrative permissions covering user management, integration/broker configuration, and tenant-level settings, which are exactly the kind of privileged actions RBAC governs. Options A, B, and E are incorrect because the physical location of a workstation, a local BIOS password, and firewall brand/model are endpoint or hardware attributes, not identity/permission constructs that XSIAM custom roles can assign.

Answer

The physical geographic location of the analyst's workstation hardware

Answer

The local BIOS password of the analyst's endpoint device

Answer

The brand and model of the corporate firewall protecting the analyst

Question 8

An administrator is troubleshooting network connectivity between a Broker VM and the Cortex XSIAM cloud backend. Which THREE diagnostic checks or network requirements must be verified? (Choose three)

Accepted Answer

Verification that DNS resolution correctly resolves the XSIAM tenant cloud FQDNs. Option B is correct because the Broker VM must resolve the Cortex XSIAM tenant cloud FQDNs (for example, the tenant-specific *.xdr.<region>.paloaltonetworks.com endpoints) so it can locate and connect to the correct backend services; failed or incorrect DNS resolution breaks connectivity even if routing and firewall rules are fine. Option D is correct because Broker VM-to-XSIAM communication uses outbound TLS over TCP 443 to the cloud backend, so all firewalls, proxies, and SSL inspection devices must allow that outbound traffic for telemetry and management channels to work. Option E is correct because TLS certificate validation depends on accurate system time; if NTP synchronization is skewed, the Broker VM may reject the XSIAM backend's certificates as expired or not-yet-valid, causing connection failures. Option A is not required because ICMP ping being disabled on enterprise routers does not prevent the Broker VM's TCP/TLS-based communication with the XSIAM cloud backend. Option C is not required because inbound TCP 22 from the public internet is not a documented requirement for Broker VM telemetry streaming; the Broker VM initiates outbound connections rather than accepting inbound SSH from the internet.

Answer

Verifying that local ICMP ping is disabled across all enterprise routers

Answer

Ensuring inbound TCP port 22 is open to the public internet for continuous remote telemetry streaming

Question 9

An administrator is reviewing the prerequisites for deploying Cortex XDR agents across virtual desktop infrastructure (VDI) environments. Which TWO best practices should be considered for VDI golden image preparation? (Choose two)

Accepted Answer

Installing the agent as the final step in the golden image creation process before sealing the disk. Option A is correct because the Cortex XDR agent must be installed as the last step in the golden image creation process, right before sealing the disk, so that the agent captures the finalized system state and does not register stale or duplicate endpoint identities when the image is cloned. Option C is correct because enabling VDI mode (via installation parameters or the agent profile) is specifically designed for non-persistent/ephemeral virtual desktops, allowing the agent to properly handle unique host identification and avoid license or registration conflicts across cloned VMs. Option B is incorrect because removing network adapters from the template would prevent the deployed VMs from communicating with the Cortex XDR management server and receiving policies. Option D is incorrect because permanently disabling tamper protection on the master image weakens endpoint security and is not a supported VDI best practice. Option E is incorrect because hardcoding a static endpoint UUID would cause all cloned VMs to share the same identity, breaking management and reporting in Cortex XDR.

Answer

Removing all network adapters from the virtual machine template

Answer

Disabling all security tamper protection permanently on the master image

Answer

Configuring the VDI master image with a static, hardcoded endpoint UUID that never changes

Question 10

When planning an initial Cortex XSIAM deployment, an administrator must configure organizational settings. Which TWO configurations are typically established during the initial tenant setup phase? (Choose two)

Accepted Answer

Defining initial administrator user accounts and assigning baseline roles. Option C is correct because initial tenant setup in Cortex XSIAM requires creating the first administrator accounts and assigning baseline RBAC roles so that the platform can be administered securely from day one. Option E is correct because configuring SSO with a SAML identity provider is a standard part of organizational/tenant settings, enabling centralized authentication and role mapping for administrative access. Options A, B, and D are not part of XSIAM tenant configuration: writing Linux kernel modules, setting up analog modem dial-up backups, and manually soldering HSMs are not supported or relevant tasks in the initial setup phase.

Answer

Writing custom Linux kernel modules for client workstations

Answer

Configuring analog modem dial-up backup connections for alert notifications

Answer

Manually soldering hardware security modules (HSMs) into tenant cloud racks

Question 11

An administrator wants to verify agent health and operational status across endpoints in Cortex XSIAM. Which TWO metrics or statuses can be viewed in the Endpoints inventory view? (Choose two)

Accepted Answer

Agent connection status (connected vs. disconnected) and software version. Option A is correct because the Endpoints inventory view in Cortex XSIAM displays each endpoint's agent connection status (connected vs. disconnected) along with the installed agent software version, which are core indicators of agent health and operational status. Option C is correct because the same inventory view shows the endpoint's operating system type and its assigned Endpoint Group membership, which help administrators confirm proper grouping and platform coverage. Options B, D, and E are incorrect because power grid frequency, room temperature/humidity, and personal browsing history or banking credentials are not telemetry fields exposed in the Endpoints inventory view; they are either environmental data outside the product's scope or sensitive user data unrelated to agent health.

Answer

The local power grid frequency supplying the endpoint's AC adapter

Answer

The physical room temperature and humidity of the workstation's office

Answer

The personal browsing history and banking credentials of the user

Question 12

An architect is designing an enterprise deployment strategy for Cortex XSIAM in an environment with strict change management windows. Which THREE planning considerations are critical for a successful rollout? (Choose three)

Accepted Answer

Defining data ingestion scopes and filtering rules to manage storage quotas and costs. Option A is correct because defining data ingestion scopes and filtering rules directly controls how much telemetry is parsed, indexed, and retained in Cortex XSIAM, which governs storage quota consumption and licensing costs in an enterprise rollout. Option B is correct because establishing pilot testing groups (upgrade rings) lets the organization validate agent versions and content pack updates in a limited cohort before broad deployment, which is essential when changes must fit strict change management windows. Option D is correct because XSIAM agents and brokers must reach Cortex XSIAM service endpoints over outbound TCP 443, so firewall and proxy egress rules must be updated to allow the required XSIAM FQDNs or endpoints will fail to register and report. Option C is not a legitimate planning consideration because rewriting local OS kernels is neither required nor supported by Cortex XSIAM and is unrelated to deployment strategy. Option E is also incorrect because replacing physical network switches with fiber-optic hubs is not a XSIAM deployment requirement and hubs are obsolete, collision-prone devices that would degrade rather than enable the rollout.

Answer

Requiring all end users to manually rewrite their local operating system kernels

Answer

Replacing all physical network switches with fiber-optic hubs

Question 13

When configuring integrations in Cortex XSIAM via Content Hub, which TWO actions can an administrator perform after installing an integration pack? (Choose two)

Accepted Answer

Test the connection to ensure valid communication between XSIAM and the external service. Option A is correct because after installing an integration pack from Content Hub, the administrator can run a connection test (the "Test" button on the integration instance) to verify that XSIAM can successfully reach and authenticate with the external service before relying on it in playbooks. Option C is correct because installed packs expose integration instances that the administrator must configure and enable, supplying required parameters such as API keys, usernames/passwords, and endpoint URLs, and toggling the instance to enabled so its commands become usable. The remaining options are not valid administrative actions in this context: B and D describe physical hardware tampering (soldering USB encryption keys into Broker VM motherboards, rewiring rack power supplies) that is neither a Content Hub task nor a supported procedure, and E describes deleting underlying system databases, which is a destructive action unrelated to configuring integrations and would not be performed to set up a pack.

Answer

Manually solder USB encryption keys into Broker VM motherboards

Answer

Physically rewire the cloud data center rack power supplies

Answer

Delete all underlying system databases to force a clean slate

Question 14

A deployment team is planning the rollout of Cortex XSIAM agents across a heterogeneous environment containing Windows, macOS, and Linux endpoints. Which core architectural component must be provisioned and accessible from all endpoints to ensure successful agent registration and policy synchronization?

Accepted Answer

Cortex XSIAM Broker VM. The Cortex XSIAM Broker VM is the core architectural component that endpoints must reach for agent registration, policy synchronization, and telemetry forwarding. It acts as the on-premises bridge between endpoints and the XSIAM cloud tenant, and it must be provisioned and network-accessible from all endpoint OS platforms.

Answer

Prisma Access Remote Network

Answer

Panorama Management Server

Answer

Cortex XSOAR Engine Cluster

Question 15

An organization requires high availability for its on-premises log ingestion architecture using Broker VMs. Which THREE architectural elements contribute to building a resilient log collection tier? (Choose three)

Accepted Answer

Configuring local log caching and queuing on Broker VMs to handle temporary cloud connectivity interruptions. Option A is correct because local log caching and queuing on the Broker VMs lets them buffer events when cloud connectivity is temporarily lost, preventing data loss and allowing replay once the connection is restored, which is essential for a resilient ingestion tier. Option D is correct because deploying multiple Broker VMs behind a load balancer or DNS failover mechanism distributes syslog streams across brokers and removes the single point of failure, ensuring continued ingestion if one VM fails. Option E is correct because proactive monitoring of Broker VM resource utilization (CPU, memory, disk) and connectivity health dashboards in XSIAM enables early detection of degradation or outages so remediation can occur before ingestion is impacted. Option B is not appropriate because disabling network encryption weakens security and does not meaningfully improve resilience. Option C is not appropriate because routing all log traffic through a single unmanaged home router introduces a single point of failure and is not an enterprise-grade high-availability design.

Answer

Disabling all network encryption to maximize packet forwarding speed

Answer

Routing all log traffic through a single unmanaged home router