XSIAM-Engineer Quick Quiz — 10 Questions

Question 1

An administrator wants to configure automated email notifications to be sent to external stakeholders whenever a Critical severity incident is created. Which feature should be configured?

Accepted Answer

Configure an Incident Notification profile or webhook integration under Settings > Integrations / Notifications.. Cortex XSIAM provides Incident Notification profiles and webhook integrations under Settings that allow administrators to define rules (e.g., severity = Critical) and send email notifications to external stakeholders. This is the native, supported way to automate email alerts for incidents. It can also integrate with ticketing systems and SIEM/SOAR tools via webhooks.

Answer

Enable Auto-Isolation rules on all endpoints.

Answer

Modify the Log Forwarding profile to send raw JSON syslog packets to the stakeholder's email address.

Answer

Set up a scheduled XQL query that emails CSV attachments every minute.

Question 2

An administrator is setting up custom Role-Based Access Control (RBAC) folders and permissions in Cortex XSIAM to segregate data access between regional security teams. Which TWO configuration steps are required when creating a new custom role and assigning data scopes? (Choose two)

Accepted Answer

Define the specific functional permissions (such as incident viewing, response actions, or configuration management) assigned to the role.. Option A is correct because a custom RBAC role in Cortex XSIAM must explicitly define its functional permissions, i.e., which actions members can perform such as viewing incidents, executing response actions, or managing configuration, since permissions are granted by the role and not inherited implicitly. Option D is correct because data scopes are the mechanism that restricts which incidents, alerts, or datasets a role can access, typically based on tags or criteria, which is exactly what is needed to segregate data between regional security teams. The other options do not belong: B is wrong because roles are created through the Cortex XSIAM management console or supported APIs, not by manually compiling source code into a JSON manifest; C is wrong because authorization is enforced centrally by the Cortex XSIAM platform, not by XSOAR engines on analyst workstations; and E is wrong because Broker VMs and log collectors handle data ingestion and forwarding, and rebooting them is not part of propagating role definitions.

Answer

Manually compile the source code of the role policy into a JSON manifest and push it via the REST API.

Answer

Install an additional XSOAR engine on each analyst workstation to enforce local authorization checks.

Answer

Reboot all Broker VMs in the region to propagate the new role definitions to local log collectors.

Question 3

During the infrastructure readiness assessment for Cortex XSIAM deployment, which outbound network connectivity requirement must be verified for the Broker VM to ensure proper communication with the XSIAM tenant?

Accepted Answer

Outbound TCP port 443 to the assigned Cortex XSIAM tenant URL and services.. The Broker VM must be able to reach the assigned Cortex XSIAM tenant URL and associated services over outbound TCP port 443. This TLS-based connectivity is how the Broker VM registers with the tenant, pulls configuration, and forwards collected telemetry to the XSIAM cloud.

Answer

Inbound TCP port 22 and TCP port 80 for remote SSH administration and unencrypted web traffic.

Answer

Bidirectional UDP port 514 for unencrypted syslog tunneling across the WAN.

Answer

Outbound TCP port 3389 for remote desktop management of the appliance.

Question 4

Which TWO components or methods are valid options for ingesting third-party log data into XSIAM? (Choose two)

Accepted Answer

Palo Alto Networks Broker VM log collectors. Option B is correct because the Palo Alto Networks Broker VM is the on-premises component that hosts log collectors and forwards third-party log data into XSIAM when direct cloud ingestion isn't possible. Option D is correct because XSIAM supports cloud-native data ingestion through integrations such as AWS SQS and Azure Event Hubs, which pull logs from cloud services into the platform. Option A is incorrect because XSIAM does not ingest third-party logs via manual CSV uploads on a user profile page. Option C is incorrect because XSIAM does not use direct SQL Server database replication as an ingestion method. Option E is incorrect because there is no physical serial cable connection to an XSIAM tenant gateway for log ingestion.

Answer

Manual CSV file upload via the user profile page

Answer

Direct database replication via SQL Server Management Studio

Answer

Physical serial cable connection to the XSIAM tenant gateway

Question 5

A security architect is designing a Cortex XSIAM deployment for an organization with a primary data center and a disaster recovery site. The organization requires that if the primary site fails, the Cortex XSIAM tenant remains accessible and ingestion continues with minimal data loss. Which deployment approach should the architect recommend?

Accepted Answer

Rely on the built-in high availability and redundancy of the Cortex XSIAM cloud service and deploy redundant Broker VMs at each site for local collection.. Cortex XSIAM is a cloud-delivered service, so tenant availability and redundancy are provided by Palo Alto Networks. Resilience for ingestion is achieved by placing redundant Broker VMs at each site so local collection continues during a site outage. Customer-managed second tenants, on-premises Engine failover, and standby appliances are not supported architectures for tenant high availability.

Answer

Deploy a Cortex XSIAM Engine on-premises at the disaster recovery site and configure it to take over ingestion during a primary site outage.

Answer

Configure a site-to-site VPN between the primary and disaster recovery sites and replicate all logs to a standby Cortex XSIAM appliance.

Answer

Deploy a second Cortex XSIAM tenant in the disaster recovery site and manually switch DNS records during failover.

Question 6

An operations team needs to ensure that inactive user accounts are automatically locked out after 90 days of inactivity. Where is this security policy managed?

Accepted Answer

Go to Settings > Access Management > Authentication / Security settings to configure password and account inactivity policies.. Account inactivity lockout policies in Cortex XSIAM are managed under Settings > Access Management > Authentication / Security settings, where password policies and account inactivity thresholds are configured. This is where administrators define how long an account can remain inactive before being locked. It is the correct location for enforcing a 90-day inactivity lockout.

Answer

Configure an Agent Protection policy under Endpoint Management.

Answer

Set up an automated correlation rule to detect inactive login tokens.

Answer

Modify the Log Forwarding rule timeout threshold.

Question 7

An administrator is verifying that firewall rules at the corporate perimeter permit outbound communication from Cortex XDR agents. Which destination criteria must be allowed for agent communication?

Accepted Answer

Outbound TCP port 443 to Palo Alto Networks XSIAM cloud FQDNs. Cortex XDR agents communicate with the Cortex XSIAM cloud over outbound TCP 443 to Palo Alto Networks cloud FQDNs. This encrypted channel carries telemetry, policy updates, and management traffic, so perimeter firewall rules must allow outbound 443 to those destinations.

Answer

Inbound TCP port 22 and 3389 for remote diagnostics

Answer

Outbound UDP port 514 for direct syslog streaming to the cloud

Answer

Inbound and outbound TCP port 80 for unencrypted configuration checks

Question 8

An analyst wants to export a list of active incidents to a CSV file for offline reporting. Which feature in the Incident view should be used?

Accepted Answer

Use the export option in the Incident view toolbar to download incidents as a CSV file.. The Incident view includes export options that allow exporting selected or all incident data into CSV format.

Answer

Run an automated ransomware remediation script.

Answer

Configure a Log Forwarding profile to dump CSV files to a local printer.

Answer

Open the Endpoint Management view and select Export Agents.

Question 9

An administrator is configuring data collection policies in Cortex XSIAM to optimize storage and ingestion costs. The organization wishes to exclude verbose, non-security-relevant informational logs from a specific firewall source. Which mechanism should the administrator configure?

Accepted Answer

Data Ingestion Filters / Drop Rules. Data Ingestion Filters (also called Drop Rules) in Cortex XSIAM allow administrators to filter or drop specific log types, fields, or sources before they are stored, reducing ingestion volume and cost without affecting detection coverage for security-relevant events. This is the correct mechanism to exclude verbose informational logs from a specific firewall source.

Answer

Endpoint isolation policies

Answer

XQL scheduled queries with automated table deletion

Answer

Agent upgrade rings

Question 10

A security architect is planning the network requirements for a new Cortex XSIAM tenant. The organization wants to ensure that the on-premises Broker VM can securely communicate with the Cortex XSIAM cloud services. Which outbound port must be allowed from the Broker VM to the Cortex XSIAM cloud for management and data plane traffic?

Accepted Answer

TCP 443. The Broker VM must be able to reach the Cortex XSIAM cloud over the internet. All communication is encrypted and uses standard HTTPS on TCP 443. This port is required for both management and data plane traffic, including log forwarding and policy updates. Without outbound TCP 443, the Broker VM cannot register or send data to the tenant.

Answer

TCP 8443

Answer

TCP 8080

Answer

TCP 22