XSIAM-Engineer XSIAM Platform Architecture And Deployment — 10 Questions

Question 1

An administrator needs to install Cortex XDR agents across a fleet of Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation parameter is strictly required during the MSI execution to ensure the agent correctly pairs with the appropriate Cortex XSIAM tenant?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

HANDLER_SERVER= TC_CUSTOM_ID=. The Cortex XDR agent MSI installation requires the HANDLER_SERVER parameter pointing to the tenant address and the TC_CUSTOM_ID parameter containing the installation token to correctly pair the agent with the Cortex XSIAM tenant. These two parameters establish the agent-to-tenant association during installation, enabling the endpoint to register and receive policies. Without them, the agent cannot identify which tenant to connect to.

Answer

CORIFY=1 TOKEN=<Installation_Token>

Answer

INSTALLDIR="C:\Program Files\Cortex" SERVER=tenant.xdr.local

Answer

/q /norestart WINDOWS_USERNAME=admin

Question 2

An administrator is configuring Role-Based Access Control (RBAC) in Cortex XSIAM and needs to grant a tier-1 SOC analyst the ability to view incidents and execute isolation commands on endpoints, but strictly prohibits them from modifying security policies or viewing sensitive user identity logs. How should this custom role be constructed?

Accepted Answer

Create a custom role with 'Incident Response' and 'Endpoint Control' permissions while omitting 'Policy Management' and 'Data Access Control' scopes for identity logs.. Cortex XSIAM RBAC is built from granular permission scopes, so the correct approach is to create a custom role that includes only the scopes needed for the job — 'Incident Response' for viewing/handling incidents and 'Endpoint Control' for isolation actions — while deliberately excluding 'Policy Management' and 'Data Access Control' for identity logs. This enforces least privilege precisely as the requirement describes. Built-in roles are too coarse and cannot be trimmed to this exact combination.

Answer

Grant 'Power User' access and rely on Cortex XDR profile exclusions to block policy edits.

Answer

Assign the 'App Role' for XSOAR automation and restrict network access via Security Groups.

Answer

Assign the built-in 'Administrator' role and manually remove permissions using the CLI.

Question 3

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to report to the Cortex XSIAM tenant. The administrator reviews the agent status using the command line and needs to verify the currently configured server address. Which tool or command should be used on a Windows endpoint?

Accepted Answer

cytool agent query. The Cytool utility is the command-line interface for managing and troubleshooting Cortex XDR agents on endpoints, including checking connection status and configurations.

Answer

cytool dump agent_info

Answer

cytool runtime query

Answer

cytool fetch server_status

Question 4

Where within the Cortex XSIAM web interface can an administrator download the latest Broker VM OVA template and installation packages?

Accepted Answer

Settings > Configurations > Deployments. Deployment packages, including Broker VM templates and agent installers, are centralized under Settings > Configurations > Deployments or the appropriate download repository within the console.

Answer

Marketplace > Content Hub > Integrations

Answer

Incident Response > Case Management > Tools

Answer

Dashboards > Asset Management > Infrastructure

Question 5

An administrator needs to configure authentication for Cortex XSIAM administrators using a corporate SAML 2.0 Identity Provider (IdP). Where in the XSIAM web console must this integration be established?

Accepted Answer

Settings > Configurations > Single Sign-On. Identity Provider (IdP) and single sign-on (SAML) configurations for Cortex XSIAM user authentication are managed under Settings > Configurations > Single Sign-On.

Answer

Marketplace > Content Hub > SAML Connector

Answer

Incident Response > Integrations > Identity Providers

Answer

Dashboards > User Management > Authentication

Question 6

Which command is used on a Linux endpoint to verify the status and connectivity of the Cortex XDR agent?

Accepted Answer

cytool agent query. The 'cytool' utility is used across operating systems (with appropriate syntax) to check Cortex XDR agent status, including runtime and connection parameters.

Answer

xdr-cli check-connection

Answer

systemctl verify xdr-agent

Answer

service cortex-xdr status

Question 7

An administrator is configuring a Broker VM to collect Syslog data from various network devices. Some devices transmit syslog over TCP while others use UDP. How should the Broker VM syslog collector be configured to handle both?

Accepted Answer

Configure the Broker VM Syslog collector instance to listen on the specified port for both TCP and UDP protocols.. The Broker VM Syslog collector can be configured to listen on a given port for both TCP and UDP simultaneously, so a single collector instance handles devices using either transport. This avoids unnecessary infrastructure duplication while meeting the mixed-protocol requirement. Administrators simply specify the port and enable both protocol listeners in the collector configuration.

Answer

Configure the Cortex XDR agent on the network devices to encapsulate syslog in TLS packets.

Answer

Deploy two separate Broker VMs, dedicating one exclusively to UDP syslog and the other to TCP syslog.

Answer

Convert all network device syslog traffic to HTTP using an external reverse proxy before it reaches the Broker VM.

Question 8

An administrator is configuring a custom role in Cortex XSIAM and needs to ensure that members of the Security Operations team can execute remote remediation actions (such as isolating a host or killing a process) on endpoints, but cannot change agent installation settings or uninstall security policies. Which permission category governs these remote endpoint actions?

Accepted Answer

Endpoint Response and Remediation Actions. Endpoint response actions (isolation, process termination, file quarantine) are managed under specific endpoint control and response permissions in XSIAM RBAC.

Answer

Data Access Control and Dataset Scoping

Answer

Marketplace and Content Hub Integration

Answer

Tenant Administration and License Management

Question 9

An enterprise deployment engineer is troubleshooting agent connectivity issues across a diverse multi-OS environment. Which TWO logs or diagnostic tools are standard for investigating Cortex XDR agent registration and communication failures on endpoints? (Choose two)

Accepted Answer

The 'cytool' command-line utility to query agent runtime status and server connections.. Agent troubleshooting relies on built-in tools like cytool and log gathering utilities such as logging packages (e.g., TrapsCollector or cytool dump).

Answer

The Broker VM kernel panic log (/var/log/kern.log).

Answer

The cloud-based XSOAR incident investigation playbook repository.

Answer

The XSIAM firewall packet capture utility for inspecting raw L2 Ethernet frames.

Question 10

An administrator is planning the network architecture and firewall rule base to support a new Cortex XSIAM deployment with Broker VMs and Cortex XDR agents. Which TWO network requirements must be established for proper communication? (Choose two)

Accepted Answer

Inbound UDP port 514 connectivity from log sources to the designated Broker VM syslog collectors.. Broker VMs and Cortex XDR agents require outbound HTTPS (TCP port 443) connectivity to the Cortex XSIAM tenant cloud. Inbound administrative ports are not required for standard cloud connectivity.

Answer

Inbound TCP port 22 connectivity from the Cortex XSIAM cloud to all endpoints for remote debugging.

Answer

Outbound TCP port 53 for DNS resolution of tenant URLs.

Answer

Bidirectional TCP port 3389 across the internet for direct cloud-to-Broker VM remote desktop management.