XSIAM-Engineer Timed Practice Test 1 — 10 Questions

Question 1

An automation engineer is writing a custom Python script for an XSIAM automation task and needs to query XSIAM incident data. Which integration library or command standard must be used to execute commands against the Cortex XSOAR/XSIAM engine?

10 minute time limit — choose an answer to begin.

Accepted Answer

The demisto Python library. Custom Python scripts in XSIAM automation use the demisto class library to interact with the system context and execute commands.

Answer

The paloalto_xsiam SDK

Answer

The pan-os-python library

Answer

The requests module with direct tenant URL authentication

Question 2

An XSIAM engineer is troubleshooting a newly configured AWS CloudTrail integration. Log data is not appearing in the XSIAM query builder. Which log collection method is natively utilized by XSIAM to pull AWS CloudTrail logs?

Accepted Answer

Amazon SQS queue polling via an integration instance. XSIAM uses the SQS-based architecture where AWS services push notifications to an SQS queue, and the integration pulls from that queue.

Answer

Direct Syslog forwarding from AWS VPC to Broker VM

Answer

Scheduled SCP file transfer to a Broker VM SFTP directory

Answer

Cortex XDR Agent polling AWS metadata

Question 3

Which TWO methods are supported in XSIAM for forwarding alerts or incident details to external SIEM or ticketing systems? (Choose two)

Accepted Answer

Using native SIEM forwarding integration packs (e.g., Splunk, ServiceNow). XSIAM supports forwarding incidents and alerts using outbound webhook integrations and native SIEM forwarding connectors.

Answer

Using the Cortex XDR Agent to mirror network traffic to external collectors

Answer

Directly mounting the XSIAM cloud storage bucket via NFS on-premises

Answer

Installing a local database client to query the multi-tenant XSIAM SQL database directly

Question 4

An XSIAM administrator is configuring a new API-based integration to ingest threat intelligence feeds. During configuration, what credential type is most commonly required by modern token-based REST API integrations?

Accepted Answer

API Key or OAuth2 credentials. Most modern cloud-native REST API integrations in XSIAM utilize API keys or OAuth2 tokens provided securely within the integration instance configuration.

Answer

SNMP v1 Community strings

Answer

Local Windows Administrator account passwords

Answer

Interactive SSH private keys

Question 5

An automation engineer needs to ensure that a specific integration command runs with restricted permissions. Where are integration command execution permissions or role-based access controls managed in XSIAM?

Accepted Answer

Settings > Access Management > Roles. Integration and automation execution permissions, such as API keys and role mappings, are managed under User Roles and Integration service accounts.

Answer

Marketplace > Installed Integrations > Security

Answer

Data Collection > Broker VM > Security Policy

Answer

Incident Response > Playbooks > Permissions tab

Question 6

Which TWO components or methods are valid options for ingesting third-party log data into XSIAM? (Choose two)

Accepted Answer

Palo Alto Networks Broker VM log collectors. XSIAM supports log ingestion primarily through Broker VM collectors (such as Syslog and HTTP API) and cloud-native integrations (such as AWS SQS or Azure Event Hubs).

Answer

Manual CSV file upload via the user profile page

Answer

Direct database replication via SQL Server Management Studio

Answer

Physical serial cable connection to the XSIAM tenant gateway

Question 7

An engineer is configuring a webhook integration to forward XSIAM alerts to an external ticketing platform. The external system requires custom HTTP headers for authentication. Where can these custom headers be configured within the integration instance?

Accepted Answer

In the integration instance configuration parameter fields. Integration instances in XSIAM often include instance configuration parameters where custom headers, credentials, and API keys are specified.

Answer

Within the Broker VM local firewall rules

Answer

Inside the incident layout designer

Answer

In the XSIAM Global Server proxy configuration file

Question 8

Which protocol is natively supported by the Broker VM Syslog collector for receiving log streams from network devices?

Accepted Answer

Syslog over TCP and UDP. Broker VM Syslog collectors support standard syslog streaming over both TCP and UDP protocols.

Answer

Netflow v9 and IPFIX only

Answer

SNMP Trap v2c and v3

Answer

WMI and RPC protocols

Question 9

An XSIAM administrator wants to test connectivity to an external REST API integration without running a full playbook. Which feature in XSIAM allows direct testing of integration commands?

Accepted Answer

The XSIAM CLI (Command Line Interface) in the Incident Response view. The CLI (Command Line Interface) within the XSIAM incident response module allows administrators to execute integration commands directly.

Answer

Settings > Configurations > API Keys > Test button

Answer

The XQL Sandbox query execution button

Answer

Marketplace instance verification utility

Question 10

An XSIAM administrator is configuring automated log ingestion filtering to drop high-volume, low-value informational events before they consume license quota. Which feature enables this capability?

Accepted Answer

Ingestion Filtering Rules. Log filtering and dropping rules can be configured using ingestion filtering policies in XSIAM data collection settings.

Answer

XQL Query Scheduled Rules

Answer

Incident Enrichment Playbooks

Answer

Data Masking Policies