XSIAM-Engineer Planning And Installation Practice Test 6 — 15 Questions

Question 1

An architect is planning the installation of a Broker VM in a high-security environment. The security team requires that all outbound communication from the Broker VM to the Cortex XSIAM tenant be encrypted and mutually authenticated. Which characteristic of the Broker VM's communication satisfies this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It uses TLS with mutual certificate authentication. Broker VM establishes a secure channel to the Cortex XSIAM tenant using TLS with mutual certificate authentication. This ensures encryption and verifies both parties, satisfying the high-security requirement. The other options describe encryption methods that lack mutual authentication or are not used by Broker VM for this purpose.

Answer

It uses HTTPS with server-side certificates only

Answer

It uses IPsec with pre-shared keys

Answer

It uses SSH tunneling with password authentication

Question 2

An architect is planning a large Cortex XSIAM deployment where the Broker VM will collect high-volume syslog from dozens of network devices. The architect must size the Broker VM appropriately. Which resource is most critical to evaluate when determining the Broker VM's ability to handle sustained log ingestion without dropping data?

Accepted Answer

Disk space and I/O. When the Broker VM handles high-volume syslog, it must buffer incoming messages locally, so disk space and I/O are the most critical sizing factors. Adequate storage lets the appliance queue logs during outages and forward them reliably. GPU, monitor, and USB characteristics do not influence ingestion throughput or buffering capacity in this scenario.

Answer

GPU capacity

Answer

USB controller version

Answer

Monitor resolution

Question 3

A security architect is designing the network flow for a Cortex XSIAM deployment that will ingest logs from on-premises firewalls. The firewalls cannot send logs directly to the internet. The architect plans to deploy a Broker VM in the DMZ. Which outbound connectivity requirement must be met for the Broker VM to forward logs to the Cortex XSIAM tenant?

Accepted Answer

The Broker VM must allow outbound TCP 443 to the tenant's specific fully qualified domain name (FQDN) or IP address range.. The Broker VM forwards logs to the Cortex XSIAM tenant over a secure HTTPS connection on TCP 443. During planning, firewall rules must allow outbound traffic from the Broker VM to the tenant's FQDN or published IP ranges. Other ports like UDP 514 are for inbound log reception, while TCP 22 and 8080 are not used for this communication.

Answer

The Broker VM must allow outbound TCP 8080 to the tenant's FQDN for proxy communication.

Answer

The Broker VM must allow outbound TCP 22 to the tenant's FQDN for secure shell (SSH) tunneling.

Answer

The Broker VM must allow outbound UDP 514 to the tenant's FQDN to forward syslog messages.

Question 4

A security engineer is planning the network requirements for a new Cortex XSIAM deployment. The organization uses a strict egress firewall policy. The engineer must ensure that the Broker VM can communicate with the Cortex XSIAM tenant. Which outbound connectivity requirement must be met?

Accepted Answer

The Broker VM must be able to reach the Cortex XSIAM tenant over TCP port 443.. The Broker VM initiates outbound connections to the Cortex XSIAM tenant using HTTPS on TCP port 443. This is the only required outbound port for data ingestion and management traffic. No inbound ports are needed from the internet to the Broker VM, which simplifies firewall configuration and enhances security. Other ports like UDP 514, TCP 22, or TCP 8080 are not used for this communication and would not satisfy the requirement.

Answer

The Broker VM must be able to reach the Cortex XSIAM tenant over TCP port 22.

Answer

The Broker VM must be able to reach the Cortex XSIAM tenant over TCP port 8080.

Answer

The Broker VM must be able to reach the Cortex XSIAM tenant over UDP port 514.

Question 5

An administrator is planning the initial onboarding of data sources into a new Cortex XSIAM tenant. When configuring a Broker VM to collect logs from on-premises sources, which TWO tasks are required to make the appliance operational and able to forward data to the tenant? (Choose two.)

Accepted Answer

Assign a static IP address or DHCP reservation to the Broker VM. To make a Broker VM operational, it must be registered with the tenant using an installation token, which establishes trust and enables configuration and data flow. It also needs stable network addressing so log sources can reach it and administrators can manage it. Inbound internet exposure, endpoint agents, and premature redundancy are not required onboarding steps.

Answer

Install the Cortex XDR agent on the Broker VM

Answer

Configure the Broker VM's local firewall to allow inbound TCP 443 from the internet

Answer

Deploy a second Broker VM for load balancing before any logs are collected

Question 6

An engineer is planning to deploy Cortex XDR agents to endpoints as part of a Cortex XSIAM rollout. The organization has a strict change management policy that requires a phased rollout with the ability to roll back if issues arise. Which Cortex XSIAM feature should the engineer use to control the agent version and rollout pace?

Accepted Answer

Agent Upgrade Rings. Agent Upgrade Rings are the designated feature for phased agent rollouts. They let you assign endpoints to rings and schedule upgrades per ring, enabling a controlled deployment with rollback capabilities. Other features like policy groups or HA are unrelated to agent version management.

Answer

Endpoint Policy Groups

Answer

Tenant Data Retention Settings

Answer

Broker VM High Availability

Question 7

A security administrator is planning to deploy Cortex XSIAM agents to endpoints across multiple operating systems. They need to ensure that the agents can communicate with the Cortex XSIAM tenant. Which statement accurately describes the agent communication requirement?

Accepted Answer

Agents must communicate with the Cortex XSIAM tenant over outbound TCP port 443.. Cortex XSIAM agents initiate outbound connections to the Cortex XSIAM tenant using HTTPS on TCP port 443. This is the standard and required configuration for agent communication. No inbound ports are needed on the endpoint. This outbound-only design simplifies firewall rules and enhances security by not exposing endpoints to inbound traffic from the internet. Other ports or protocols are not used for this purpose.

Answer

Agents must communicate with the Cortex XSIAM tenant over inbound TCP port 443.

Answer

Agents must communicate with the Cortex XSIAM tenant over outbound TCP port 8443.

Answer

Agents must communicate with the Cortex XSIAM tenant over outbound UDP port 443.

Question 8

An engineer is planning the initial deployment of Cortex XSIAM for a large enterprise that uses an on-premises data center with strict change control. The security team requires that no inbound firewall ports be opened to the internet. Which deployment component must be deployed to allow outbound-only communication from the data center to the Cortex XSIAM tenant?

Accepted Answer

Broker VM. The Broker VM is the on-premises component that establishes outbound-only connections to the Cortex XSIAM tenant, enabling log and data forwarding without inbound firewall rules. The Cortex XDR agent is endpoint software, Cortex Data Lake is a cloud service, and no component named XSIAM Collector exists in this architecture, so none of them fulfills the outbound-relay requirement.

Answer

Cortex Data Lake

Answer

XSIAM Collector

Answer

Cortex XDR agent

Question 9

A security architect is planning a Cortex XSIAM deployment for a company with a single data center and no existing Cortex products. The company wants to forward syslog from 40 network devices to Cortex XSIAM. Which component is required to receive and forward these logs to the Cortex XSIAM tenant?

Accepted Answer

Broker VM deployed in the data center. The Broker VM is the dedicated on-premises log collection component for Cortex XSIAM. It receives syslog and other data from local sources and forwards it to the Cortex XSIAM tenant. Without a Broker VM, the network devices cannot send their syslog directly to the cloud tenant in a supported manner. Therefore, deploying a Broker VM in the data center is the correct planning step.

Answer

Cortex XSOAR engine installed on a management server

Answer

Cortex Data Lake instance provisioned in the data center

Answer

Cortex XDR agent installed on each network device

Question 10

An architect is planning a Cortex XSIAM deployment for a company with strict change management. The company wants to validate the deployment in a non-production environment before rolling out to production endpoints. Which approach best supports this requirement while aligning with Cortex XSIAM deployment best practices?

Accepted Answer

Use a phased rollout starting with a small pilot group of endpoints and Broker VM sources. A phased rollout beginning with a pilot group allows validation of agents, log ingestion, and detection content on a limited scope before expanding. This limits risk and satisfies change management requirements. Separate tenants, disabled detections, and simultaneous full deployment do not provide the controlled validation the architect needs.

Answer

Disable all detection rules until the full rollout is complete

Answer

Deploy a separate Cortex XSIAM tenant for testing and later migrate all data to production

Answer

Deploy agents to all production endpoints simultaneously to gather the most data quickly

Question 11

An architect is planning the installation of a Broker VM in a high-security environment. The security team requires that all outbound communication from the Broker VM to the Cortex XSIAM tenant be encrypted and mutually authenticated. Which characteristic of the Broker VM's communication satisfies this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud-based log sources can send logs directly to the Cortex XSIAM tenant using the tenant's ingestion API, while on-premises sources require a Broker VM.. Cortex XSIAM supports direct ingestion from cloud sources via API and requires Broker VM for on-premises sources that cannot directly reach the tenant. This hybrid model provides flexibility and efficiency, allowing cloud sources to onboard quickly while on-premises sources use Broker VM for collection and forwarding.

Answer

All log sources, whether cloud or on-premises, must forward logs through a Broker VM to ensure data normalization.

Answer

On-premises log sources can send logs directly to the Cortex XSIAM tenant if they have outbound TCP 443 access, eliminating the need for a Broker VM.

Answer

Cloud log sources must be configured with a site-to-site VPN to the Cortex XSIAM tenant to ensure secure ingestion.

Question 12

An architect is planning the installation of a Broker VM in a high-security environment. The security team requires that all outbound communication from the Broker VM to the Cortex XSIAM tenant be encrypted and mutually authenticated. Which characteristic of the Broker VM's communication satisfies this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The region selected during the Cortex XSIAM tenant provisioning process in the Customer Support Portal.. Data residency for Cortex XSIAM is determined by the region selected when the tenant is provisioned in the Customer Support Portal. The region cannot be changed later, so it must be chosen carefully to comply with regulations. Broker VM location, DNS, and license type do not influence where tenant data is stored.

Answer

The license type purchased, such as Cortex XSIAM Enterprise or Cortex XSIAM Pro.

Answer

The physical location of the Broker VM that forwards the logs to the tenant.

Answer

The configuration of the DNS server that resolves the Cortex XSIAM tenant FQDN.

Question 13

A security engineer is preparing to deploy Cortex XSIAM in a new environment. The engineer needs to ensure that the Cortex XSIAM tenant can receive data from the Broker VM. Which outbound connectivity requirement must be met from the Broker VM?

Accepted Answer

The Broker VM must be able to reach the Cortex XSIAM tenant over outbound TCP 443.. The Broker VM establishes outbound connections to the Cortex XSIAM tenant over TCP 443. This design avoids the need for inbound firewall rules and ensures that data is transmitted securely. Planning must verify that the Broker VM's network segment allows outbound traffic to the tenant's cloud endpoints. Without this connectivity, log forwarding will fail.

Answer

The Broker VM must allow inbound TCP 443 from the Cortex XSIAM tenant.

Answer

The Broker VM must have a public IP address and allow inbound UDP 514.

Answer

The Broker VM must connect to the tenant using outbound TCP 22 for secure shell.

Question 14

A security engineer is preparing to install a Broker VM in a Demilitarized Zone (DMZ) to collect logs from internet-facing devices. The engineer needs to ensure the Broker VM can receive syslog data. Which configuration should be applied on the firewall?

Accepted Answer

Allow inbound UDP port 514 from the internet-facing devices to the Broker VM.. The Broker VM listens for syslog on UDP port 514 by default. To collect logs from internet-facing devices, the firewall must allow inbound UDP 514 from those devices to the Broker VM. The Broker VM then forwards the data to the Cortex XSIAM tenant over outbound TCP 443. Outbound rules, TCP 514, or inbound TCP 443 are not correct for this purpose. This configuration ensures that syslog data reaches the Broker VM securely.

Answer

Allow inbound TCP port 514 from the internet-facing devices to the Broker VM.

Answer

Allow inbound TCP port 443 from the internet-facing devices to the Broker VM.

Answer

Allow outbound UDP port 514 from the Broker VM to the internet-facing devices.

Question 15

A security architect is planning the network requirements for a new Cortex XSIAM deployment. The organization uses an explicit forward proxy for all outbound internet traffic. Which configuration must be applied to the Broker VM to ensure it can reach the Cortex XSIAM tenant through the proxy?

Accepted Answer

Set the proxy address and port in the Broker VM network settings.. In environments that mandate an explicit forward proxy, the Broker VM must be configured with the proxy address and port so that its outbound connections to the Cortex XSIAM tenant are sent through the proxy. Static routes, PAC files on the tenant, and NAT reflection do not provide the required proxy configuration and would leave the Broker VM unable to communicate through the mandated path.

Answer

Enable NAT reflection on the perimeter firewall for Broker VM traffic.

Answer

Configure the Broker VM with a static route to the proxy and enable transparent interception.

Answer

Install a PAC file on the Cortex XSIAM tenant to redirect Broker VM traffic.