XSIAM-Engineer Timed Practice Test 2 — 10 Questions

Question 1

An administrator needs to update the Cortex XDR agent installation package across 5,000 endpoints without causing network saturation. Which feature should be utilized to manage this rollout effectively?

10 minute time limit — choose an answer to begin.

Accepted Answer

Configure an Agent Upgrade schedule and phased deployment profile within Endpoint Management > Agent Settings.. Agent software updates can be controlled using Agent Settings and deployment profiles where administrators can set distribution rules, throttling, and phased rollouts.

Answer

Manually push the MSI package via Active Directory Group Policy Objects using an external script.

Answer

Execute an XQL remediation action with the `upgrade_agent` command across all active sessions.

Answer

Set up a global Log Forwarding profile to broadcast the binary over syslog.

Question 2

An engineer needs to ingest custom JSON-formatted logs from an internal application using an HTTP API. Which XSIAM feature should be configured to receive these incoming webhook payloads?

Accepted Answer

Broker VM HTTP API Collector. The HTTP API log collector on the Broker VM allows external applications to push JSON payloads directly into XSIAM.

Answer

Cortex XDR REST API direct ingestion

Answer

Syslog over TCP/UDP Collector

Answer

XPANSE Attack Surface Management feed

Question 3

When setting up a new Broker VM to collect logs, what is the initial deployment step required in the XSIAM console before downloading the virtual machine image?

Accepted Answer

Generate a Broker VM installation token and download package from Data Collection settings. Before deploying a Broker VM, you must generate a configuration and registration token in the XSIAM console under Data Collection.

Answer

Configure a Syslog listener on the cloud tenant gateway

Answer

Upload a custom SSL certificate to the Marketplace

Answer

Install the Cortex XDR Agent on the hypervisor host

Question 4

An XSIAM engineer is configuring automated incident response playbooks that interact with third-party tools via Cortex XSOAR integration commands. Which THREE best practices should be followed when designing robust automation playbooks? (Choose three)

Accepted Answer

Incorporate approval or notification gates (such as 'Send Email' or 'Ask' tasks) for destructive remediation actions. Robust playbooks should handle errors gracefully, use context variables correctly, and avoid hardcoding environment-specific sensitive values.

Answer

Design every playbook task to execute as a continuous infinite loop until manually terminated

Answer

Hardcode API tokens directly inside script task parameters for portability

Question 5

Which THREE parameters can be configured when setting up a log ingestion parsing rule in XSIAM? (Choose three)

Accepted Answer

Target vendor and product mapping. Parsing rules allow specifying the target vendor/product, defining transformation logic to XDM, and applying rules to specific log streams or data streams.

Answer

Broker VM hardware CPU allocation limits

Answer

Automatic remediation playbook execution ID

Question 6

An administrator is setting up an integration with a third-party threat intelligence platform using Cortex XSOAR capabilities embedded within XSIAM. The integration instance requires periodic polling to fetch newly published Indicators of Compromise (IoCs). Where should the administrator configure the fetch interval?

Accepted Answer

Inside the specific integration instance configuration settings. In Cortex XSOAR integration instances, the fetch interval determines how often the integration queries the external source for new data and is configured directly inside the integration instance configuration settings.

Answer

Inside the automated playbook task parameters

Answer

Via the Server Configuration (Settings > About > Server Configuration) global key-value pair

Answer

Within the Threat Intelligence module feeds mapping rules

Question 7

An administrator is planning the deployment of Broker VMs to support data ingestion across multiple isolated network segments. Which TWO considerations are critical for proper Broker VM architecture and sizing? (Choose two)

Accepted Answer

The expected Events Per Second (EPS) volume traversing the specific Broker VM instance. Broker VMs require adequate sizing based on EPS (Events Per Second) throughput and must have appropriate outbound firewall access to reach the XSIAM cloud tenant.

Answer

Ensuring the Broker VM has local administrative write access to all ingested network switches

Answer

Configuring local XSOAR database persistence exceeding 50 Terabytes on the Broker VM

Answer

Deploying a separate Windows Active Directory domain controller on each Broker VM

Question 8

An enterprise environment requires all outbound API traffic from XSIAM integrations to pass through an explicit corporate proxy server. Where is the global proxy configuration specified for integration instances?

Accepted Answer

Settings > Configurations > Integrations > Server Configurations. Global proxy settings for integrations are managed under Settings > Configurations > Integrations > Servers and Services or global integration settings.

Answer

Incident Response > Automation > Global Variables

Answer

XSIAM User Preferences > Network Profile

Answer

Data Collection > Broker VM > Network Settings

Question 9

An automation playbook fails because the JSON response from an API call contains nested objects that are not being parsed correctly. What is the best way to handle this in a playbook?

Accepted Answer

Use transformation steps in the playbook to parse nested JSON fields.. Using the 'Extract' or 'JSON transform' steps within a playbook allows for the parsing of nested structures for downstream processing.

Answer

Change the integration to use XML instead of JSON.

Answer

Increase the timeout setting for the integration.

Answer

Delete the integration and reinstall it.

Question 10

An XSIAM tenant is approaching its licensed data ingestion volume limit. The operations team needs to identify which data sources are consuming the highest ingestion bandwidth. Where should the administrator check this information?

Accepted Answer

Go to Settings > Configurations > License Management to view data ingestion breakdown by source and vendor.. License utilization and ingestion volume by data source can be monitored in XSIAM under Settings > License Management or the License Usage dashboard.

Answer

Review the Audit Trail dashboard for high-frequency API polling events.

Answer

Execute an XQL query using the `dataset = host_inventory` command and group by storage size.

Answer

Check the Cortex XDR Agent health status page under Endpoint Management.