XSIAM-Engineer XSIAM Platform Architecture And Deployment — All Questions With Answers

Question 1mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator needs to install Cortex XDR agents across a fleet of Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation parameter is strictly required during the MSI execution to ensure the agent correctly pairs with the appropriate Cortex XSIAM tenant?

Question 2hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is configuring Role-Based Access Control (RBAC) in Cortex XSIAM and needs to grant a tier-1 SOC analyst the ability to view incidents and execute isolation commands on endpoints, but strictly prohibits them from modifying security policies or viewing sensitive user identity logs. How should this custom role be constructed?

Question 3mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to report to the Cortex XSIAM tenant. The administrator reviews the agent status using the command line and needs to verify the currently configured server address. Which tool or command should be used on a Windows endpoint?

Question 4easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

Where within the Cortex XSIAM web interface can an administrator download the latest Broker VM OVA template and installation packages?

Question 5mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator needs to configure authentication for Cortex XSIAM administrators using a corporate SAML 2.0 Identity Provider (IdP). Where in the XSIAM web console must this integration be established?

Question 6easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

Which command is used on a Linux endpoint to verify the status and connectivity of the Cortex XDR agent?

Question 7hardmultiple choice

Read the full network assurance explanation →

An administrator is configuring a Broker VM to collect Syslog data from various network devices. Some devices transmit syslog over TCP while others use UDP. How should the Broker VM syslog collector be configured to handle both?

Question 8hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is configuring a custom role in Cortex XSIAM and needs to ensure that members of the Security Operations team can execute remote remediation actions (such as isolating a host or killing a process) on endpoints, but cannot change agent installation settings or uninstall security policies. Which permission category governs these remote endpoint actions?

Question 9hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An enterprise deployment engineer is troubleshooting agent connectivity issues across a diverse multi-OS environment. Which TWO logs or diagnostic tools are standard for investigating Cortex XDR agent registration and communication failures on endpoints? (Choose two)

Question 10hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is planning the network architecture and firewall rule base to support a new Cortex XSIAM deployment with Broker VMs and Cortex XDR agents. Which TWO network requirements must be established for proper communication? (Choose two)

Question 11hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An architect is designing a scalable Cortex XSIAM deployment across multiple geographically distributed corporate offices. Which THREE design considerations are critical when placing Broker VMs in remote locations? (Choose three)

Question 12hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is installing Cortex XDR agents on Windows endpoints using a software deployment tool. Which TWO configuration parameters or requirements are necessary for a successful unattended installation? (Choose two)

Question 13hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is preparing to deploy Cortex XDR agents across a fleet of Linux servers. Which TWO steps or checks should be completed as part of the readiness assessment? (Choose two)

Question 14hardmulti select

Read the full network assurance explanation →

An administrator is troubleshooting a Broker VM that is failing to ingest logs from an external syslog source. Which TWO diagnostic steps should the administrator perform on the Broker VM? (Choose two)

Question 15hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

During the deployment of Cortex XSIAM engines in an isolated network segment, the administrator notices that engines fail to establish an encrypted tunnel back to the Cortex XSIAM core cloud. Network security reviews confirm outbound TCP port 443 is allowed, but the connection still fails. Which underlying architectural requirement for XSIAM engines was likely missed?

Question 16hardmultiple choice

Read the full network assurance explanation →

An enterprise is evaluating infrastructure readiness for Cortex XSIAM and plans to ingest massive volumes of NetFlow and VPC flow logs. The deployment architect decides to route these streams through Broker VMs rather than sending them directly from cloud VPCs to the XSIAM cloud. What is the primary architectural advantage of using Broker VMs for this ingestion path?

Question 17easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization is establishing Role-Based Access Control (RBAC) within Cortex XSIAM to restrict SOC analysts from modifying tenant-wide integrations and security settings. Which predefined role should be assigned to these analysts to grant investigation capabilities while preventing administrative configuration changes?

Question 18hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is planning a Cortex XSIAM deployment for an organization that requires compliance with data residency regulations. Logs from European Union endpoints must remain within the EU, while analytics and incident management must be centralized in the United States. The organization has existing Cortex XDR agents in both regions. Which deployment approach best satisfies these requirements?

Question 19mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Broker VM in a high-security environment where outbound internet access is restricted. The Broker VM must communicate with the Cortex XSIAM tenant for configuration updates and log forwarding. Which network configuration is required to ensure successful communication?

Question 20mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is deploying a new Cortex XSIAM tenant and must ensure that all log ingestion and analytics data is retained for exactly 12 months to satisfy a regulatory audit. The compliance team will not approve any configuration that stores data beyond the required period. Which configuration in the Cortex XSIAM tenant should the engineer use to meet this requirement?

Question 21hardmulti select

Read the full network assurance explanation →

An engineer is deploying Cortex XSIAM in a large enterprise with multiple remote sites. The company wants to minimize internet bandwidth usage by having endpoints send telemetry to a local Broker VM instead of directly to the Cortex XSIAM tenant. Which TWO configurations are required to enable this setup? (Choose two.)

Question 22hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Broker VM in a high-security environment. The Broker VM will be used to collect logs from internal servers and forward them to Cortex XSIAM. The security team requires that all communication between the Broker VM and Cortex XSIAM be encrypted and authenticated. Which configuration should the engineer implement to meet this requirement?

Question 23mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is designing a Cortex XSIAM deployment for a company that has strict data residency requirements: all log data must remain within the country. The company operates its own data center and wants to minimize cloud dependencies. Which deployment model should the architect recommend?

Question 24mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM administrator needs to ensure that the platform can scale to handle increasing log volumes and query loads as the organization grows. The current deployment uses a single Broker VM for log ingestion. Which action should the administrator take to improve scalability and resilience of the log ingestion layer?

Question 25hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying Cortex XSIAM in a hybrid environment where some logs are collected on-premises via Broker VM and some are sent directly to Cortex XSIAM from cloud services. The engineer must ensure that all logs are properly ingested, parsed, and available for querying. Which TWO configurations are required to achieve this? (Choose two.)

Question 26hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Broker VM in a high-availability configuration to ensure continuous log ingestion from critical on-premises sources. The engineer must configure the Broker VM cluster to meet the organization's resilience requirements. Which TWO of the following are required to achieve high availability for the Broker VM? (Choose two.)

Question 27hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is planning the network architecture for a Cortex XSIAM on-premises deployment. The design must ensure that the Cortex XSIAM Engine can communicate with the management console, Broker VMs, and external log sources. Which TWO network requirements must be met to support this architecture? (Choose two.)

Question 28mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is planning capacity for a new Cortex XSIAM tenant that will ingest 2 TB of raw logs per day from endpoint, network, and cloud sources. The organization requires that hot data remains searchable for 30 days, and cold data must be retained for 12 months. Which storage architecture component in Cortex XSIAM handles the separation of hot and cold data tiers?

Question 29easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security administrator is setting up Cortex XSIAM for a new deployment and needs to ensure that the platform can receive logs from a variety of sources, including firewalls, proxies, and cloud services. Which component in the XSIAM architecture is responsible for ingesting and normalizing data from these disparate sources?

Question 30mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is configuring high availability for a Broker VM deployment in a critical environment. The engineer wants to ensure that if the primary Broker VM fails, a secondary Broker VM can take over without manual intervention. Which feature should be configured to achieve this?

Question 31easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

During the infrastructure readiness assessment for Cortex XSIAM deployment, which outbound network connectivity requirement must be verified for the Broker VM to ensure proper communication with the XSIAM tenant?

Question 32mediummultiple choice

Study the full virtualization explanation →

An administrator is deploying a Broker VM on a VMware ESXi hypervisor. After deploying the OVA template, the administrator notices the Broker VM cannot reach the NTP server and fails activation. Which initial configuration step was likely missed?

Question 33mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A deployment engineer is sizing a Broker VM for a large enterprise environment with 20,000 Cortex XDR agents and multiple log collection sources. During the initial deployment, the administrator notices high CPU and memory utilization on the single Broker VM. What is the recommended architectural remedy for this scenario?

Question 34hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An enterprise environment has strict network segmentation where log sources in a secure DMZ cannot communicate directly with the primary Broker VM located in the corporate network. How should an architect design the log collection architecture to feed data into Cortex XSIAM?

Question 35easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

When establishing Role-Based Access Control (RBAC) in Cortex XSIAM, what is the purpose of assigning 'Folder' scopes to a custom role?

Question 36hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is aligning deployment objectives with Cortex XSIAM architecture for an organization migrating from a legacy SIEM. The organization requires continuous ingestion of custom application logs using HTTP. Which XSIAM architectural component should be configured to ingest these logs securely?

Question 37mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is preparing to deploy Cortex XDR agents across a large macOS fleet using a Mobile Device Management (MDM) solution such as Jamf Pro. Which configuration profile component is critical to deploy alongside the agent installation package on modern macOS versions?

Question 38easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

What is the primary function of the Broker VM in a Cortex XSIAM deployment architecture?

Question 39hardmultiple choice

Read the full network assurance explanation →

During an assessment of infrastructure readiness for Cortex XSIAM, an engineer calculates the required daily log ingestion volume and determines it exceeds the licensed capacity. What architectural feature or mechanism within XSIAM can the administrator configure to optimize data ingestion without losing critical security telemetry?

Question 40hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Engine on-premises to support high-throughput log parsing and query execution. During setup, the engine fails to register with the cloud tenant. Upon checking the engine logs, the engineer sees TLS certificate validation errors. What is the most likely root cause?

Question 41hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization has multiple business units sharing a single Cortex XSIAM tenant. Leadership requires that security analysts in Business Unit A can only view alerts and endpoints associated with their specific department, while global administrators retain full visibility. How must the deployment engineer configure access control to achieve this?

Question 42mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization is setting up Cortex XSIAM and wishes to restrict administrative access so that specific Tier-2 analysts can modify prevention policies but cannot create new user accounts or modify RBAC settings. How should this be configured?

Question 43mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

When planning a Cortex XSIAM deployment, what is the primary purpose of conducting an infrastructure readiness assessment?

Question 44easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

What is the recommended method for upgrading Broker VMs in a Cortex XSIAM deployment?

Question 45hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is troubleshooting an issue where a Broker VM fails to download content updates from the Cortex XSIAM cloud. The Broker VM has outbound internet access via an enterprise web proxy. Where must the proxy settings be configured on the Broker VM?

Question 46mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An enterprise security architect is aligning deployment objectives with Cortex XSIAM architecture. The organization requires low-latency threat detection across endpoints and network sensors. Which architectural component is primarily responsible for real-time analytics and behavioral threat detection in XSIAM?

Question 47easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

When deploying Cortex XDR agents across an enterprise, what is the primary role of an installation token?

Question 48mediummultiple choice

Read the full network assurance explanation →

An administrator notices that logs from a specific firewall are not appearing in Cortex XSIAM. The firewall is configured to send syslog to the Broker VM. Where should the administrator check first to determine if the Broker VM is receiving the raw syslog packets?

Question 49hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization requires that specific security analysts can run advanced XQL (XSIAM Query Language) queries across all datasets except for Human Resources (HR) log categories, which contain PII. How should the administrator configure this restriction in Cortex XSIAM?

Question 50mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

When setting up administrative access to Cortex XSIAM, what is the best practice regarding the use of the initial built-in superuser account?

Question 51mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is planning the deployment of Broker VMs in a high-availability configuration. What is the recommended approach for handling Broker VM redundancy?

Question 52easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

What is the primary purpose of the Cortex XSIAM Content Hub?

Question 53hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An enterprise environment utilizes a strict certificate-based Proxy for all outbound internet connections. During the deployment of Cortex XDR agents via software deployment tools, the agents fail to establish a connection to the XSIAM tenant because they do not trust the proxy's interception certificate. How should this be resolved?

Question 54hardmultiple choice

Review the full routing breakdown →

An administrator is troubleshooting a Broker VM that is showing a 'Disconnected' status in the Cortex XSIAM console. After verifying network routing and outbound HTTPS connectivity, the administrator checks the Broker VM system logs and discovers a system time synchronization failure. Why would a time sync failure cause disconnection?

Question 55mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator needs to deploy Cortex XDR agents to Linux servers that have strict change management controls and cannot be rebooted. Which installation consideration is most critical for Linux deployments?

Question 56hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is preparing the infrastructure readiness assessment for integrating various log sources into Cortex XSIAM. Which THREE log collection methods or mechanisms are natively supported by the Broker VM architecture? (Choose three)

Question 57hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

When configuring Role-Based Access Control (RBAC) within Cortex XSIAM, an administrator needs to define custom roles using specific parameters and permission scopes. Which THREE capabilities can be assigned or restricted when building a custom role? (Choose three)

Question 58hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

When setting up authentication and user management in Cortex XSIAM, which TWO features or protocols are supported for administrative access control? (Choose two)

Question 59hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is reviewing infrastructure readiness for deploying Cortex XSIAM engines on-premises. Which TWO prerequisites must be validated on the host infrastructure before engine installation? (Choose two)

Question 60hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization is enforcing strict segregation of duties within Cortex XSIAM using Role-Based Access Control (RBAC). Which TWO administrative actions can be restricted so that standard security analysts cannot perform them? (Choose two)

Question 61hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

When aligning deployment objectives with Cortex XSIAM architecture, an organization decides to integrate external threat intelligence feeds. Which TWO methods are supported for incorporating threat intelligence into XSIAM? (Choose two)

Question 62hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An enterprise environment requires high availability and scalability for log collection. Which TWO architectural best practices should an engineer follow when deploying Broker VMs for large-scale log ingestion? (Choose two)

Question 63hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator needs to configure secure access to the Cortex XSIAM web console for remote administrators. Which TWO security controls should be implemented? (Choose two)

Question 64easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is preparing to deploy the Cortex XSIAM agent across a corporate network of Windows endpoints. Which infrastructure component must be successfully installed and registered first to facilitate secure communication and act as the local aggregator for agent logs before they reach the Cortex XSIAM tenant?

Question 65mediummultiple choice

Read the full network assurance explanation →

An administrator needs to configure secure log forwarding from an on-premises syslog source into Cortex XSIAM using a Broker VM. Which specific Broker VM app must be enabled and configured to receive these syslog messages?

Question 66mediummultiple choice

Study the full virtualization explanation →

An administrator is deploying the Broker VM via an OVA template on an ESXi hypervisor. After deployment, the administrator cannot access the Broker VM management web interface. Which initial configuration step must be performed via the hypervisor console to enable remote network access?

Question 67easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is configuring Active Directory synchronization within Cortex XSIAM using a Broker VM. Which prerequisite must be met on the domain controller and Broker VM to ensure successful user and group mapping ingestion?

Question 68mediummulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is setting up custom Role-Based Access Control (RBAC) folders and permissions in Cortex XSIAM to segregate data access between regional security teams. Which TWO configuration steps are required when creating a new custom role and assigning data scopes? (Choose two)

Question 69hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization is preparing its internal firewall infrastructure and network architecture for a large-scale Cortex XSIAM deployment involving agents, Broker VMs, and cloud engines. Which THREE network traffic requirements must be verified and configured to ensure proper operational connectivity? (Choose three)

Question 70mediummulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is deploying Cortex XSIAM agents on a fleet of corporate servers and needs to ensure proper installation parameters and operational readiness. Which TWO methods are valid for deploying or managing agent installations in XSIAM? (Choose two)

Question 71easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is planning a Cortex XSIAM deployment and must determine the minimum compute and storage resources needed for the Cortex XSIAM Engine to handle an expected ingest rate of 50,000 events per second (EPS). Which of the following is the correct sizing approach for the Engine?

Question 72mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is designing a Cortex XSIAM deployment for a company with a primary data center and a disaster recovery site. The company requires that the Cortex XSIAM tenant remains operational even if the primary data center becomes unavailable. Which deployment model should the architect choose to meet this requirement?

Question 73easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is planning the network requirements for a new Cortex XSIAM deployment. The company uses a strict firewall policy that only allows outbound traffic on specific ports. Which outbound port must be open to allow Cortex XDR agents to communicate with the Cortex XSIAM tenant?

Question 74mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM administrator needs to integrate an external threat intelligence feed that provides indicators of compromise (IOCs) in STIX/TAXII format. The administrator wants the IOCs to be automatically ingested and used for detection. Which component should be configured to achieve this?

Question 75hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is designing a Cortex XSIAM deployment for an organization with a primary data center and a disaster recovery site. The organization requires that if the primary site fails, the Cortex XSIAM tenant remains accessible and ingestion continues with minimal data loss. Which deployment approach should the architect recommend?

Question 76mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is planning a Cortex XSIAM deployment for a large enterprise. The organization wants to minimize the number of publicly exposed services and centralize log ingestion from remote sites. Which component should the architect deploy at each remote site to meet these requirements?

Question 77mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is planning the network requirements for a new Cortex XSIAM deployment that includes Broker VMs in a restricted DMZ. The security team requires that the Broker VMs initiate all connections outbound and that no inbound firewall rules be opened. Which statement correctly describes the connectivity model the engineer should document?

Question 78mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is planning the deployment of Cortex XSIAM for a large enterprise. The organization has strict data residency requirements and wants to minimize egress costs by keeping as much log data on-premises as possible. They will ingest high volumes of logs from various sources. Which component should the architect deploy to meet these requirements while ensuring efficient data ingestion and processing?

Question 79easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Broker VM on a VMware ESXi host. After importing the OVA, the engineer needs to assign a static IP address to the Broker VM. Which method should the engineer use to configure the network settings?

Question 80easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is preparing to onboard a new Cortex XSIAM tenant for a large enterprise. The customer wants to understand which component is responsible for parsing and normalizing raw logs into the Cortex XSIAM data model before they are stored and made searchable. Which component should the engineer identify?

Question 81mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is planning the deployment of Cortex XSIAM for an organization with strict data residency requirements. The organization must ensure that all log data remains within a specific geographic region. Which deployment option should the administrator choose?

Question 82hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is deploying Cortex XSIAM for an organization that will collect logs from remote branch offices with limited bandwidth and intermittent connectivity. The engineer must ensure that logs are not lost during connectivity outages and that local collection continues. Which TWO deployment considerations should the engineer apply? (Choose two.)

Question 83hardmultiple choice

Read the full network assurance explanation →

A Cortex XSIAM administrator is configuring a new external syslog source to send logs to a Broker VM. The administrator wants to ensure that the logs are parsed correctly and mapped to the appropriate Cortex XSIAM data model. Which step must be taken after configuring the syslog source on the Broker VM?

Question 84hardmultiple choice

Read the full network assurance explanation →

A Cortex XSIAM engineer is troubleshooting a Broker VM that is not receiving logs from a syslog source. The Broker VM is reachable, and the syslog source is configured to send to the Broker VM's IP on port 514. Which action should the engineer take first to diagnose the issue?

Question 85mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is planning the storage layout for a new Cortex XSIAM tenant that will ingest 5 TB of raw logs per day and retain them for 12 months. The organization requires that hot data remain queryable within seconds for the most recent 30 days, while older data can tolerate slower query performance. Which XSIAM storage tier design should the architect implement to meet these requirements while controlling cost?

Question 86mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is deploying Cortex XSIAM in a multi-tenant environment. The organization requires that each tenant's event data be logically isolated and that queries from one tenant cannot access another tenant's data. Which of the following best describes how Cortex XSIAM achieves this isolation?

Question 87hardmultiple choice

Read the full network assurance explanation →

An engineer is configuring a Cortex XSIAM Broker VM to collect logs from a high-volume syslog source. The Broker VM is deployed on-premises and must forward logs to the Cortex XSIAM tenant. The engineer notices that logs are being dropped during peak traffic. Which of the following should the engineer adjust to increase the Broker VM's buffering capacity?

Question 88hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Broker VM in a high-security environment where the Broker VM must communicate with the Cortex XSIAM tenant over the internet. The security team requires that all outbound communication from the Broker VM be encrypted and authenticated using mutual TLS. Which component must be installed and configured on the Broker VM to enable this secure channel?

Question 89mediummultiple choice

Review the full subnetting walkthrough →

A Cortex XSIAM administrator needs to ensure that only specific IP addresses can access the Cortex XSIAM tenant's management console. The organization uses a corporate firewall and wants to restrict access to the SOC team's subnet. Which Cortex XSIAM feature should the administrator configure to enforce this restriction?

Question 90easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM administrator is preparing to deploy a new Broker VM to collect logs from a remote data center. The data center firewall team asks which TCP port the Broker VM uses to establish its initial registration and management connection to the Cortex XSIAM tenant. Which port should the administrator provide?

Question 91easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM administrator is preparing to deploy a Broker VM in a demilitarized zone (DMZ) to collect logs from internet-facing devices. The security policy requires that the Broker VM only initiate outbound connections to the Cortex XSIAM tenant and not accept any inbound connections from the internet. Which configuration should the administrator implement?

Question 92easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is planning the deployment of Cortex XSIAM in a hybrid environment where on-premises logs need to be ingested. The engineer must ensure that the on-premises components can communicate with the Cortex XSIAM tenant in the cloud. Which of the following is a required component for this communication?

Question 93hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying Cortex XSIAM in a high-availability configuration with two Cortex XSIAM Engines behind a load balancer. During testing, the engineer notices that logs are being duplicated in the tenant. What is the most likely cause of this duplication?

Question 94mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM engineer is designing the deployment for a multinational company with offices in North America, Europe, and Asia. Each region has its own security operations team, and the company wants to minimize cross-region latency for log ingestion while maintaining a single global tenant for centralized detection and response. Which deployment approach best meets these requirements?

Question 95mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM administrator needs to integrate an external threat intelligence feed that provides indicators of compromise (IOCs) in STIX format. The feed must be automatically ingested and used to generate alerts when IOCs match events in the tenant. Which component should the administrator configure to achieve this?

Question 96hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM engineer is validating the network requirements before deploying a new Broker VM in a DMZ segment. The security team wants to confirm which outbound destinations and protocols the Broker VM requires to function correctly. Which TWO statements accurately describe the required outbound connectivity for a Cortex XSIAM Broker VM? (Choose two.)

Question 97hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM engineer is designing a deployment for a multinational corporation with data residency requirements. The company must ensure that logs from European Union sources are stored and processed within the EU, while logs from other regions can be processed in the US. Which XSIAM deployment model should the engineer choose?

Question 1mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator needs to install Cortex XDR agents across a fleet of Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation parameter is strictly required during the MSI execution to ensure the agent correctly pairs with the appropriate Cortex XSIAM tenant?

Question 2hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is configuring Role-Based Access Control (RBAC) in Cortex XSIAM and needs to grant a tier-1 SOC analyst the ability to view incidents and execute isolation commands on endpoints, but strictly prohibits them from modifying security policies or viewing sensitive user identity logs. How should this custom role be constructed?

Question 3mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to report to the Cortex XSIAM tenant. The administrator reviews the agent status using the command line and needs to verify the currently configured server address. Which tool or command should be used on a Windows endpoint?

Question 4easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

Where within the Cortex XSIAM web interface can an administrator download the latest Broker VM OVA template and installation packages?

Question 5mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator needs to configure authentication for Cortex XSIAM administrators using a corporate SAML 2.0 Identity Provider (IdP). Where in the XSIAM web console must this integration be established?

Question 6easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

Which command is used on a Linux endpoint to verify the status and connectivity of the Cortex XDR agent?

Question 7hardmultiple choice

Read the full network assurance explanation →

An administrator is configuring a Broker VM to collect Syslog data from various network devices. Some devices transmit syslog over TCP while others use UDP. How should the Broker VM syslog collector be configured to handle both?

Question 8hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is configuring a custom role in Cortex XSIAM and needs to ensure that members of the Security Operations team can execute remote remediation actions (such as isolating a host or killing a process) on endpoints, but cannot change agent installation settings or uninstall security policies. Which permission category governs these remote endpoint actions?

Question 9hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An enterprise deployment engineer is troubleshooting agent connectivity issues across a diverse multi-OS environment. Which TWO logs or diagnostic tools are standard for investigating Cortex XDR agent registration and communication failures on endpoints? (Choose two)

Question 10hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is planning the network architecture and firewall rule base to support a new Cortex XSIAM deployment with Broker VMs and Cortex XDR agents. Which TWO network requirements must be established for proper communication? (Choose two)

Question 11hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An architect is designing a scalable Cortex XSIAM deployment across multiple geographically distributed corporate offices. Which THREE design considerations are critical when placing Broker VMs in remote locations? (Choose three)

Question 12hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is installing Cortex XDR agents on Windows endpoints using a software deployment tool. Which TWO configuration parameters or requirements are necessary for a successful unattended installation? (Choose two)

Question 13hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is preparing to deploy Cortex XDR agents across a fleet of Linux servers. Which TWO steps or checks should be completed as part of the readiness assessment? (Choose two)

Question 14hardmulti select

Read the full network assurance explanation →

An administrator is troubleshooting a Broker VM that is failing to ingest logs from an external syslog source. Which TWO diagnostic steps should the administrator perform on the Broker VM? (Choose two)

Question 15hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

During the deployment of Cortex XSIAM engines in an isolated network segment, the administrator notices that engines fail to establish an encrypted tunnel back to the Cortex XSIAM core cloud. Network security reviews confirm outbound TCP port 443 is allowed, but the connection still fails. Which underlying architectural requirement for XSIAM engines was likely missed?

Question 16hardmultiple choice

Read the full network assurance explanation →

An enterprise is evaluating infrastructure readiness for Cortex XSIAM and plans to ingest massive volumes of NetFlow and VPC flow logs. The deployment architect decides to route these streams through Broker VMs rather than sending them directly from cloud VPCs to the XSIAM cloud. What is the primary architectural advantage of using Broker VMs for this ingestion path?

Question 17easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization is establishing Role-Based Access Control (RBAC) within Cortex XSIAM to restrict SOC analysts from modifying tenant-wide integrations and security settings. Which predefined role should be assigned to these analysts to grant investigation capabilities while preventing administrative configuration changes?

Question 18hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is planning a Cortex XSIAM deployment for an organization that requires compliance with data residency regulations. Logs from European Union endpoints must remain within the EU, while analytics and incident management must be centralized in the United States. The organization has existing Cortex XDR agents in both regions. Which deployment approach best satisfies these requirements?

Question 19mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Broker VM in a high-security environment where outbound internet access is restricted. The Broker VM must communicate with the Cortex XSIAM tenant for configuration updates and log forwarding. Which network configuration is required to ensure successful communication?

Question 20mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is deploying a new Cortex XSIAM tenant and must ensure that all log ingestion and analytics data is retained for exactly 12 months to satisfy a regulatory audit. The compliance team will not approve any configuration that stores data beyond the required period. Which configuration in the Cortex XSIAM tenant should the engineer use to meet this requirement?

Question 21hardmulti select

Read the full network assurance explanation →

An engineer is deploying Cortex XSIAM in a large enterprise with multiple remote sites. The company wants to minimize internet bandwidth usage by having endpoints send telemetry to a local Broker VM instead of directly to the Cortex XSIAM tenant. Which TWO configurations are required to enable this setup? (Choose two.)

Question 22hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Broker VM in a high-security environment. The Broker VM will be used to collect logs from internal servers and forward them to Cortex XSIAM. The security team requires that all communication between the Broker VM and Cortex XSIAM be encrypted and authenticated. Which configuration should the engineer implement to meet this requirement?

Question 23mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is designing a Cortex XSIAM deployment for a company that has strict data residency requirements: all log data must remain within the country. The company operates its own data center and wants to minimize cloud dependencies. Which deployment model should the architect recommend?

Question 24mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM administrator needs to ensure that the platform can scale to handle increasing log volumes and query loads as the organization grows. The current deployment uses a single Broker VM for log ingestion. Which action should the administrator take to improve scalability and resilience of the log ingestion layer?

Question 25hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying Cortex XSIAM in a hybrid environment where some logs are collected on-premises via Broker VM and some are sent directly to Cortex XSIAM from cloud services. The engineer must ensure that all logs are properly ingested, parsed, and available for querying. Which TWO configurations are required to achieve this? (Choose two.)

Question 26hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Broker VM in a high-availability configuration to ensure continuous log ingestion from critical on-premises sources. The engineer must configure the Broker VM cluster to meet the organization's resilience requirements. Which TWO of the following are required to achieve high availability for the Broker VM? (Choose two.)

Question 27hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is planning the network architecture for a Cortex XSIAM on-premises deployment. The design must ensure that the Cortex XSIAM Engine can communicate with the management console, Broker VMs, and external log sources. Which TWO network requirements must be met to support this architecture? (Choose two.)

Question 28mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is planning capacity for a new Cortex XSIAM tenant that will ingest 2 TB of raw logs per day from endpoint, network, and cloud sources. The organization requires that hot data remains searchable for 30 days, and cold data must be retained for 12 months. Which storage architecture component in Cortex XSIAM handles the separation of hot and cold data tiers?

Question 29easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security administrator is setting up Cortex XSIAM for a new deployment and needs to ensure that the platform can receive logs from a variety of sources, including firewalls, proxies, and cloud services. Which component in the XSIAM architecture is responsible for ingesting and normalizing data from these disparate sources?

Question 30mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is configuring high availability for a Broker VM deployment in a critical environment. The engineer wants to ensure that if the primary Broker VM fails, a secondary Broker VM can take over without manual intervention. Which feature should be configured to achieve this?

Question 31easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

During the infrastructure readiness assessment for Cortex XSIAM deployment, which outbound network connectivity requirement must be verified for the Broker VM to ensure proper communication with the XSIAM tenant?

Question 32mediummultiple choice

Study the full virtualization explanation →

An administrator is deploying a Broker VM on a VMware ESXi hypervisor. After deploying the OVA template, the administrator notices the Broker VM cannot reach the NTP server and fails activation. Which initial configuration step was likely missed?

Question 33mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A deployment engineer is sizing a Broker VM for a large enterprise environment with 20,000 Cortex XDR agents and multiple log collection sources. During the initial deployment, the administrator notices high CPU and memory utilization on the single Broker VM. What is the recommended architectural remedy for this scenario?

Question 34hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An enterprise environment has strict network segmentation where log sources in a secure DMZ cannot communicate directly with the primary Broker VM located in the corporate network. How should an architect design the log collection architecture to feed data into Cortex XSIAM?

Question 35easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

When establishing Role-Based Access Control (RBAC) in Cortex XSIAM, what is the purpose of assigning 'Folder' scopes to a custom role?

Question 36hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is aligning deployment objectives with Cortex XSIAM architecture for an organization migrating from a legacy SIEM. The organization requires continuous ingestion of custom application logs using HTTP. Which XSIAM architectural component should be configured to ingest these logs securely?

Question 37mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is preparing to deploy Cortex XDR agents across a large macOS fleet using a Mobile Device Management (MDM) solution such as Jamf Pro. Which configuration profile component is critical to deploy alongside the agent installation package on modern macOS versions?

Question 38easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

What is the primary function of the Broker VM in a Cortex XSIAM deployment architecture?

Question 39hardmultiple choice

Read the full network assurance explanation →

During an assessment of infrastructure readiness for Cortex XSIAM, an engineer calculates the required daily log ingestion volume and determines it exceeds the licensed capacity. What architectural feature or mechanism within XSIAM can the administrator configure to optimize data ingestion without losing critical security telemetry?

Question 40hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Engine on-premises to support high-throughput log parsing and query execution. During setup, the engine fails to register with the cloud tenant. Upon checking the engine logs, the engineer sees TLS certificate validation errors. What is the most likely root cause?

Question 41hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization has multiple business units sharing a single Cortex XSIAM tenant. Leadership requires that security analysts in Business Unit A can only view alerts and endpoints associated with their specific department, while global administrators retain full visibility. How must the deployment engineer configure access control to achieve this?

Question 42mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization is setting up Cortex XSIAM and wishes to restrict administrative access so that specific Tier-2 analysts can modify prevention policies but cannot create new user accounts or modify RBAC settings. How should this be configured?

Question 43mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

When planning a Cortex XSIAM deployment, what is the primary purpose of conducting an infrastructure readiness assessment?

Question 44easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

What is the recommended method for upgrading Broker VMs in a Cortex XSIAM deployment?

Question 45hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is troubleshooting an issue where a Broker VM fails to download content updates from the Cortex XSIAM cloud. The Broker VM has outbound internet access via an enterprise web proxy. Where must the proxy settings be configured on the Broker VM?

Question 46mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An enterprise security architect is aligning deployment objectives with Cortex XSIAM architecture. The organization requires low-latency threat detection across endpoints and network sensors. Which architectural component is primarily responsible for real-time analytics and behavioral threat detection in XSIAM?

Question 47easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

When deploying Cortex XDR agents across an enterprise, what is the primary role of an installation token?

Question 48mediummultiple choice

Read the full network assurance explanation →

An administrator notices that logs from a specific firewall are not appearing in Cortex XSIAM. The firewall is configured to send syslog to the Broker VM. Where should the administrator check first to determine if the Broker VM is receiving the raw syslog packets?

Question 49hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization requires that specific security analysts can run advanced XQL (XSIAM Query Language) queries across all datasets except for Human Resources (HR) log categories, which contain PII. How should the administrator configure this restriction in Cortex XSIAM?

Question 50mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

When setting up administrative access to Cortex XSIAM, what is the best practice regarding the use of the initial built-in superuser account?

Question 51mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is planning the deployment of Broker VMs in a high-availability configuration. What is the recommended approach for handling Broker VM redundancy?

Question 52easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

What is the primary purpose of the Cortex XSIAM Content Hub?

Question 53hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An enterprise environment utilizes a strict certificate-based Proxy for all outbound internet connections. During the deployment of Cortex XDR agents via software deployment tools, the agents fail to establish a connection to the XSIAM tenant because they do not trust the proxy's interception certificate. How should this be resolved?

Question 54hardmultiple choice

Review the full routing breakdown →

An administrator is troubleshooting a Broker VM that is showing a 'Disconnected' status in the Cortex XSIAM console. After verifying network routing and outbound HTTPS connectivity, the administrator checks the Broker VM system logs and discovers a system time synchronization failure. Why would a time sync failure cause disconnection?

Question 55mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator needs to deploy Cortex XDR agents to Linux servers that have strict change management controls and cannot be rebooted. Which installation consideration is most critical for Linux deployments?

Question 56hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is preparing the infrastructure readiness assessment for integrating various log sources into Cortex XSIAM. Which THREE log collection methods or mechanisms are natively supported by the Broker VM architecture? (Choose three)

Question 57hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

When configuring Role-Based Access Control (RBAC) within Cortex XSIAM, an administrator needs to define custom roles using specific parameters and permission scopes. Which THREE capabilities can be assigned or restricted when building a custom role? (Choose three)

Question 58hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

When setting up authentication and user management in Cortex XSIAM, which TWO features or protocols are supported for administrative access control? (Choose two)

Question 59hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is reviewing infrastructure readiness for deploying Cortex XSIAM engines on-premises. Which TWO prerequisites must be validated on the host infrastructure before engine installation? (Choose two)

Question 60hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization is enforcing strict segregation of duties within Cortex XSIAM using Role-Based Access Control (RBAC). Which TWO administrative actions can be restricted so that standard security analysts cannot perform them? (Choose two)

Question 61hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

When aligning deployment objectives with Cortex XSIAM architecture, an organization decides to integrate external threat intelligence feeds. Which TWO methods are supported for incorporating threat intelligence into XSIAM? (Choose two)

Question 62hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An enterprise environment requires high availability and scalability for log collection. Which TWO architectural best practices should an engineer follow when deploying Broker VMs for large-scale log ingestion? (Choose two)

Question 63hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator needs to configure secure access to the Cortex XSIAM web console for remote administrators. Which TWO security controls should be implemented? (Choose two)

Question 64easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is preparing to deploy the Cortex XSIAM agent across a corporate network of Windows endpoints. Which infrastructure component must be successfully installed and registered first to facilitate secure communication and act as the local aggregator for agent logs before they reach the Cortex XSIAM tenant?

Question 65mediummultiple choice

Read the full network assurance explanation →

An administrator needs to configure secure log forwarding from an on-premises syslog source into Cortex XSIAM using a Broker VM. Which specific Broker VM app must be enabled and configured to receive these syslog messages?

Question 66mediummultiple choice

Study the full virtualization explanation →

An administrator is deploying the Broker VM via an OVA template on an ESXi hypervisor. After deployment, the administrator cannot access the Broker VM management web interface. Which initial configuration step must be performed via the hypervisor console to enable remote network access?

Question 67easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is configuring Active Directory synchronization within Cortex XSIAM using a Broker VM. Which prerequisite must be met on the domain controller and Broker VM to ensure successful user and group mapping ingestion?

Question 68mediummulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is setting up custom Role-Based Access Control (RBAC) folders and permissions in Cortex XSIAM to segregate data access between regional security teams. Which TWO configuration steps are required when creating a new custom role and assigning data scopes? (Choose two)

Question 69hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An organization is preparing its internal firewall infrastructure and network architecture for a large-scale Cortex XSIAM deployment involving agents, Broker VMs, and cloud engines. Which THREE network traffic requirements must be verified and configured to ensure proper operational connectivity? (Choose three)

Question 70mediummulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is deploying Cortex XSIAM agents on a fleet of corporate servers and needs to ensure proper installation parameters and operational readiness. Which TWO methods are valid for deploying or managing agent installations in XSIAM? (Choose two)

Question 71easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is planning a Cortex XSIAM deployment and must determine the minimum compute and storage resources needed for the Cortex XSIAM Engine to handle an expected ingest rate of 50,000 events per second (EPS). Which of the following is the correct sizing approach for the Engine?

Question 72mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is designing a Cortex XSIAM deployment for a company with a primary data center and a disaster recovery site. The company requires that the Cortex XSIAM tenant remains operational even if the primary data center becomes unavailable. Which deployment model should the architect choose to meet this requirement?

Question 73easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is planning the network requirements for a new Cortex XSIAM deployment. The company uses a strict firewall policy that only allows outbound traffic on specific ports. Which outbound port must be open to allow Cortex XDR agents to communicate with the Cortex XSIAM tenant?

Question 74mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM administrator needs to integrate an external threat intelligence feed that provides indicators of compromise (IOCs) in STIX/TAXII format. The administrator wants the IOCs to be automatically ingested and used for detection. Which component should be configured to achieve this?

Question 75hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is designing a Cortex XSIAM deployment for an organization with a primary data center and a disaster recovery site. The organization requires that if the primary site fails, the Cortex XSIAM tenant remains accessible and ingestion continues with minimal data loss. Which deployment approach should the architect recommend?

Question 76mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is planning a Cortex XSIAM deployment for a large enterprise. The organization wants to minimize the number of publicly exposed services and centralize log ingestion from remote sites. Which component should the architect deploy at each remote site to meet these requirements?

Question 77mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is planning the network requirements for a new Cortex XSIAM deployment that includes Broker VMs in a restricted DMZ. The security team requires that the Broker VMs initiate all connections outbound and that no inbound firewall rules be opened. Which statement correctly describes the connectivity model the engineer should document?

Question 78mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is planning the deployment of Cortex XSIAM for a large enterprise. The organization has strict data residency requirements and wants to minimize egress costs by keeping as much log data on-premises as possible. They will ingest high volumes of logs from various sources. Which component should the architect deploy to meet these requirements while ensuring efficient data ingestion and processing?

Question 79easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Broker VM on a VMware ESXi host. After importing the OVA, the engineer needs to assign a static IP address to the Broker VM. Which method should the engineer use to configure the network settings?

Question 80easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is preparing to onboard a new Cortex XSIAM tenant for a large enterprise. The customer wants to understand which component is responsible for parsing and normalizing raw logs into the Cortex XSIAM data model before they are stored and made searchable. Which component should the engineer identify?

Question 81mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An administrator is planning the deployment of Cortex XSIAM for an organization with strict data residency requirements. The organization must ensure that all log data remains within a specific geographic region. Which deployment option should the administrator choose?

Question 82hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

An XSIAM engineer is deploying Cortex XSIAM for an organization that will collect logs from remote branch offices with limited bandwidth and intermittent connectivity. The engineer must ensure that logs are not lost during connectivity outages and that local collection continues. Which TWO deployment considerations should the engineer apply? (Choose two.)

Question 83hardmultiple choice

Read the full network assurance explanation →

A Cortex XSIAM administrator is configuring a new external syslog source to send logs to a Broker VM. The administrator wants to ensure that the logs are parsed correctly and mapped to the appropriate Cortex XSIAM data model. Which step must be taken after configuring the syslog source on the Broker VM?

Question 84hardmultiple choice

Read the full network assurance explanation →

A Cortex XSIAM engineer is troubleshooting a Broker VM that is not receiving logs from a syslog source. The Broker VM is reachable, and the syslog source is configured to send to the Broker VM's IP on port 514. Which action should the engineer take first to diagnose the issue?

Question 85mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is planning the storage layout for a new Cortex XSIAM tenant that will ingest 5 TB of raw logs per day and retain them for 12 months. The organization requires that hot data remain queryable within seconds for the most recent 30 days, while older data can tolerate slower query performance. Which XSIAM storage tier design should the architect implement to meet these requirements while controlling cost?

Question 86mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A security architect is deploying Cortex XSIAM in a multi-tenant environment. The organization requires that each tenant's event data be logically isolated and that queries from one tenant cannot access another tenant's data. Which of the following best describes how Cortex XSIAM achieves this isolation?

Question 87hardmultiple choice

Read the full network assurance explanation →

An engineer is configuring a Cortex XSIAM Broker VM to collect logs from a high-volume syslog source. The Broker VM is deployed on-premises and must forward logs to the Cortex XSIAM tenant. The engineer notices that logs are being dropped during peak traffic. Which of the following should the engineer adjust to increase the Broker VM's buffering capacity?

Question 88hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying a Cortex XSIAM Broker VM in a high-security environment where the Broker VM must communicate with the Cortex XSIAM tenant over the internet. The security team requires that all outbound communication from the Broker VM be encrypted and authenticated using mutual TLS. Which component must be installed and configured on the Broker VM to enable this secure channel?

Question 89mediummultiple choice

Review the full subnetting walkthrough →

A Cortex XSIAM administrator needs to ensure that only specific IP addresses can access the Cortex XSIAM tenant's management console. The organization uses a corporate firewall and wants to restrict access to the SOC team's subnet. Which Cortex XSIAM feature should the administrator configure to enforce this restriction?

Question 90easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM administrator is preparing to deploy a new Broker VM to collect logs from a remote data center. The data center firewall team asks which TCP port the Broker VM uses to establish its initial registration and management connection to the Cortex XSIAM tenant. Which port should the administrator provide?

Question 91easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM administrator is preparing to deploy a Broker VM in a demilitarized zone (DMZ) to collect logs from internet-facing devices. The security policy requires that the Broker VM only initiate outbound connections to the Cortex XSIAM tenant and not accept any inbound connections from the internet. Which configuration should the administrator implement?

Question 92easymultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is planning the deployment of Cortex XSIAM in a hybrid environment where on-premises logs need to be ingested. The engineer must ensure that the on-premises components can communicate with the Cortex XSIAM tenant in the cloud. Which of the following is a required component for this communication?

Question 93hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

An engineer is deploying Cortex XSIAM in a high-availability configuration with two Cortex XSIAM Engines behind a load balancer. During testing, the engineer notices that logs are being duplicated in the tenant. What is the most likely cause of this duplication?

Question 94mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM engineer is designing the deployment for a multinational company with offices in North America, Europe, and Asia. Each region has its own security operations team, and the company wants to minimize cross-region latency for log ingestion while maintaining a single global tenant for centralized detection and response. Which deployment approach best meets these requirements?

Question 95mediummultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM administrator needs to integrate an external threat intelligence feed that provides indicators of compromise (IOCs) in STIX format. The feed must be automatically ingested and used to generate alerts when IOCs match events in the tenant. Which component should the administrator configure to achieve this?

Question 96hardmulti select

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM engineer is validating the network requirements before deploying a new Broker VM in a DMZ segment. The security team wants to confirm which outbound destinations and protocols the Broker VM requires to function correctly. Which TWO statements accurately describe the required outbound connectivity for a Cortex XSIAM Broker VM? (Choose two.)

Question 97hardmultiple choice

Read the full XSIAM Platform Architecture And Deployment explanation →

A Cortex XSIAM engineer is designing a deployment for a multinational corporation with data residency requirements. The company must ensure that logs from European Union sources are stored and processed within the EU, while logs from other regions can be processed in the US. Which XSIAM deployment model should the engineer choose?