XSIAM-Engineer Planning And Installation Practice Test 5 — 15 Questions

Question 1

An administrator is configuring a new Cortex XSIAM tenant and needs to ingest custom syslog data from a third-party firewall. Which component should be configured first to receive and parse this raw syslog data before it reaches the data lake?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Broker VM configured with a Syslog collector. A Broker VM with a Syslog collector is the standard ingestion path for raw syslog from third-party devices into Cortex XSIAM. The Broker VM receives the syslog stream, and the associated parsing rules normalize the events before they are forwarded to the Cortex Data Lake for storage and analytics.

Answer

Direct API integration with the Cortex XSIAM Query Service

Answer

Cortex XSOAR mail listener integration

Answer

Traps Management Service global proxy

Question 2

During the sizing phase of a Cortex XSIAM deployment, an architect needs to estimate the required IOPS and storage retention footprint for endpoint telemetry. Which factor has the most direct impact on the raw ingestion volume calculation?

Accepted Answer

The frequency and depth of endpoint behavioral event generation and process telemetry. Raw ingestion volume for endpoint telemetry is driven primarily by how often endpoints generate behavioral events and process telemetry, and how deep that telemetry goes. More frequent and detailed event generation produces more data, which directly increases IOPS and storage retention requirements.

Answer

The configured frequency of Cortex XSOAR automated playbook execution

Answer

The total number of active directory user accounts synchronized via User-ID

Answer

The number of active firewall security rules enforced by Panorama

Question 3

An administrator is deploying the Cortex XSIAM agent via Microsoft Intune and needs to ensure that kernel-level extensions on macOS endpoints do not block the installation. Which preliminary step must be completed?

Accepted Answer

Pre-approve system extensions and network filters using an MDM configuration profile. On macOS, Cortex XSIAM agent installation requires kernel-level system extensions and network filters, which macOS blocks unless they are pre-approved via an MDM configuration profile. When deploying through Microsoft Intune, the administrator must push a configuration profile that pre-approves the XSIAM system extension and network filter identifiers before the agent package is installed.

Answer

Convert all macOS file systems to legacy HFS+ format

Answer

Disable SIP (System Integrity Protection) on all target macOS endpoints

Answer

Install the XSIAM agent manually using an interactive terminal session

Question 4

When preparing the network perimeter for a new Cortex XSIAM deployment, outbound connectivity from the Broker VM to the Cortex XSIAM cloud tenant must be established. Which standard network port and protocol are required for this outbound secure communication?

Accepted Answer

TCP port 443. The Broker VM communicates with the Cortex XSIAM cloud tenant over outbound TLS on TCP 443, the standard HTTPS port. All management, telemetry upload, and configuration traffic between on-prem components and the XSIAM SaaS backend uses this encrypted channel, so firewall rules must permit outbound 443 to the XSIAM tenant endpoints.

Answer

TCP port 389

Answer

UDP port 514

Answer

TCP port 22

Question 5

An organization requires strict data residency compliance, ensuring that all log data collected by Cortex XSIAM remains within the European Union. During tenant initialization, how must the administrator satisfy this requirement?

Accepted Answer

Select the appropriate EU-based cloud region during initial tenant provisioning and activation. Cortex XSIAM is delivered as a SaaS platform hosted in multiple regional cloud environments, and data residency is enforced at the tenant level by choosing the region where the tenant is provisioned. Selecting an EU-based region during initial tenant activation ensures all ingested telemetry, storage, and processing remain within EU boundaries. This is a provisioning-time decision that cannot be retroactively changed by local configuration.

Answer

Deploy an on-premises Hadoop data lake and configure XSIAM to forward all raw logs via API

Answer

Configure log forwarding profiles within the Cortex XSOAR settings menu

Answer

Modify the Broker VM local storage configuration file to encrypt data using EU-specific keys

Question 6

A security architect is planning agent installation rollouts and needs to ensure that endpoints in a high-security isolated zone can still receive policy updates without direct internet access. What is the recommended deployment pattern?

Accepted Answer

Deploy a local Broker VM within the isolated zone configured as an agent distribution and collection proxy. A Broker VM deployed within the isolated zone acts as a local agent distribution and collection proxy, allowing endpoints without direct internet access to receive policy updates and forward telemetry through the Broker VM to the XSIAM tenant. This is the recommended pattern for air-gapped or high-security network segments because it maintains a single controlled egress point.

Answer

Expose the primary Cortex XSIAM cloud tenant public IP directly to the isolated subnet

Answer

Disable cloud updates and rely exclusively on quarterly USB-based manual package updates

Answer

Configure each isolated endpoint with a direct VPN tunnel back to the primary domain controller

Question 7

Which TWO prerequisites must be validated before deploying a Cortex XSIAM Broker VM in a VMware ESXi environment? (Choose two)

Accepted Answer

Network access allowing outbound HTTPS communication to the Cortex XSIAM cloud tenant. Option A is correct because the Broker VM must reach the Cortex XSIAM cloud tenant over outbound HTTPS (TCP 443) to register, receive configuration, and forward collected data, so validating that network path is a prerequisite. Option B is correct because the Broker VM is deployed as a virtual appliance on ESXi and must be given adequate CPU, RAM, and disk resources per Palo Alto's sizing guidelines to support its log collection and forwarding workload. Option C is wrong because the Broker VM is a standalone appliance and does not require a Cortex XSOAR Server instance on the same VM. Option D is wrong because the Broker VM does not need a local physical Fibre Channel attachment; it uses standard virtualized storage and network connectivity. Option E is wrong because the Broker VM is not an Active Directory domain controller and does not host that role.

Answer

An installed Cortex XSOAR Server instance running on the same virtual machine

Answer

A local physical Fibre Channel storage attachment for high-speed raw log archiving

Answer

An active Microsoft Active Directory domain controller role installed directly on the Broker VM appliance

Question 8

An administrator is reviewing log collection options during the initial planning phase of Cortex XSIAM. Which THREE sources can natively send logs to a Cortex XSIAM Broker VM collector profile? (Choose three)

Accepted Answer

Syslog streams from network security devices and servers. The Cortex XSIAM Broker VM collector profile natively supports three ingestion methods: Syslog streams (option A), which receive RFC 3164/5424 syslog from network security devices and servers over UDP/TCP port 514; HTTP/HTTPS JSON payloads (option B), which accept structured JSON from third-party security tools via the Broker VM's HTTP listener; and file-based collection (option C), which monitors local directories or ingests files dropped via SCP/SFTP. These three are the standard, documented collector types configured in a Broker VM collector profile during XSIAM deployment planning. Option D is incorrect because kernel memory dumps from unmanaged hypervisors over raw TCP sockets are not a supported native collector type. Option E is incorrect because BIOS firmware updates over ICMP echo requests are not a log transport mechanism and are not supported by the Broker VM.

Answer

Direct kernel memory dumps from unmanaged hypervisors via raw TCP sockets

Answer

Proprietary BIOS firmware updates streamed over ICMP echo requests

Question 9

A security architect is planning the network requirements for a new Cortex XSIAM tenant. The organization wants to ensure that the on-premises Broker VM can securely communicate with the Cortex XSIAM cloud services. Which outbound port must be allowed from the Broker VM to the Cortex XSIAM cloud for management and data plane traffic?

Accepted Answer

TCP 443. The Broker VM must be able to reach the Cortex XSIAM cloud over the internet. All communication is encrypted and uses standard HTTPS on TCP 443. This port is required for both management and data plane traffic, including log forwarding and policy updates. Without outbound TCP 443, the Broker VM cannot register or send data to the tenant.

Answer

TCP 8443

Answer

TCP 8080

Answer

TCP 22

Question 10

During a Cortex XSIAM deployment planning meeting, an architect must determine how endpoint telemetry will reach the tenant from a segmented OT network with no direct internet access. Which deployment component is explicitly designed to collect and forward endpoint data from restricted network segments to the Cortex XSIAM cloud?

Accepted Answer

Broker VM deployed in the restricted network segment. Broker VM is the Cortex XSIAM component purpose-built for restricted network segments. It collects endpoint and log data locally and forwards it to the tenant over an outbound connection, enabling visibility without direct internet access from endpoints. The other options describe cloud services or features that do not provide local data collection and forwarding in segmented environments.

Answer

Cortex Data Lake direct ingestion endpoint

Answer

Cortex XDR agent configured with a direct cloud connection

Answer

External dynamic list hosted on the tenant

Question 11

A security architect is planning a Cortex XSIAM deployment for a mid-sized enterprise. The CISO wants to know which component is responsible for collecting and forwarding logs from on-premises sources to the Cortex XSIAM tenant. Which component should the architect identify?

Accepted Answer

Broker VM. The Broker VM is the on-premises component that collects logs from local sources and forwards them to the Cortex XSIAM tenant. It is deployed in the customer environment and acts as the relay for data that cannot be sent directly to the cloud. Endpoint agents, cloud data storage, and the management console do not perform this local collection and forwarding role.

Answer

Cortex Data Lake

Answer

XSIAM management console

Answer

Cortex XDR agent

Question 12

An engineer is planning a Cortex XSIAM deployment and must ensure that the Broker VM can forward logs to the tenant even when the primary internet path is saturated. Which configuration should be verified on the Broker VM to allow it to use an alternate outbound path?

Accepted Answer

Enable proxy settings on the Broker VM for outbound connections. Broker VM supports outbound proxy configuration, which enables it to forward logs through an alternate path when direct connectivity is constrained. This is the supported mechanism for routing traffic via a proxy, ensuring resilience and adherence to network policies. Other options do not provide a functional alternate outbound path for log forwarding.

Answer

Configure the Broker VM to use DNS over HTTPS exclusively

Answer

Bind the Broker VM to a specific MAC address for failover

Answer

Configure a second default gateway on the Broker VM

Question 13

An engineer is preparing the network prerequisites for a new Cortex XSIAM deployment. The security team must allow outbound connectivity from the Broker VM to the Cortex XSIAM cloud tenant. Which destination port must be permitted for the Broker VM to establish and maintain its connection?

Accepted Answer

TCP 443. The Broker VM maintains an outbound connection to the Cortex XSIAM tenant over TCP 443. This port carries registration, heartbeats, configuration, and forwarded log data, so it must be permitted through the perimeter firewall. SSH, syslog, and alternative HTTPS ports serve different purposes and do not provide the required tenant connectivity.

Answer

TCP 8443

Answer

TCP 22

Answer

UDP 514

Question 14

A security architect is planning the initial deployment of Cortex XSIAM for a company with three geographically separated data centers. The architect wants to ensure that if the primary Cortex XSIAM tenant becomes unavailable, log ingestion continues without data loss. Which deployment model should the architect recommend?

Accepted Answer

A single Cortex XSIAM tenant with Broker VM high availability and local buffering at each data center.. The correct design uses Broker VM high availability with local buffering to maintain log ingestion during cloud outages. Cortex XSIAM is a SaaS platform, so on-premises or multi-tenant active-active options are not valid. Broker VMs act as the collection layer and can store logs temporarily if the tenant is unreachable.

Answer

Cortex XSIAM on-premises installation with redundant management servers and shared storage.

Answer

Cortex XSIAM tenant replication to a warm standby tenant in a different region using built-in replication.

Answer

Cortex XSIAM High Availability (HA) cluster with two tenants in active-active mode across data centers.

Question 15

An engineer is planning the initial deployment of a Cortex XSIAM tenant in a region where the corporate security policy requires all log data to remain within the country. The organization operates primarily in Germany and wants to minimize latency for data ingestion. Which deployment consideration should the engineer prioritize?

Accepted Answer

Deploy the tenant in the Europe (Frankfurt) region to meet data residency requirements and reduce ingestion latency.. Cortex XSIAM offers regional cloud tenants to address data residency and latency. For a German organization with strict in-country data storage policies, selecting the Europe (Frankfurt) region is the correct planning step. It ensures compliance and optimizes performance by keeping data close to the source. Other regions either violate policy or introduce unnecessary complexity.

Answer

Deploy the tenant in the Asia Pacific (Singapore) region and configure a local Broker VM in Germany to cache logs temporarily.

Answer

Deploy the tenant in the United States (Oregon) region and use a VPN to tunnel all log data back to Germany for storage.

Answer

Deploy the tenant in the Europe (Frankfurt) region but disable all cloud-based analytics to ensure data never leaves the local Broker VM.