XSIAM-Engineer XSIAM Platform Architecture And Deployment Practice Test 2 — 15 Questions

Question 1

During the deployment of Cortex XSIAM engines in an isolated network segment, the administrator notices that engines fail to establish an encrypted tunnel back to the Cortex XSIAM core cloud. Network security reviews confirm outbound TCP port 443 is allowed, but the connection still fails. Which underlying architectural requirement for XSIAM engines was likely missed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Engines require mutual TLS authentication and specific outbound gRPC traffic ports (typically TCP 443) enabled through intermediate stateful inspection firewalls with SSL decryption bypassed.. Cortex XSIAM engines require specific outbound connectivity including TCP port 443 and mutual TLS authentication utilizing valid certificates issued during engine registration to establish secure data paths.

Answer

Engines require an external DNS server configured to resolve internal Active Directory domain controllers.

Answer

Engines require inbound TCP port 22 to be open from the cloud tenant for configuration polling.

Answer

Engines must be assigned a publicly routable static IP address on their management interfaces.

Question 2

An organization is establishing Role-Based Access Control (RBAC) within Cortex XSIAM to restrict SOC analysts from modifying tenant-wide integrations and security settings. Which predefined role should be assigned to these analysts to grant investigation capabilities while preventing administrative configuration changes?

Accepted Answer

SOC Analyst. The Standard Analyst or equivalent non-administrative role provides view and investigation privileges without granting administrative rights to modify tenant settings.

Answer

Integration Architect

Answer

App Central Admin

Answer

Account Admin

Question 3

During the infrastructure readiness assessment for Cortex XSIAM deployment, which outbound network connectivity requirement must be verified for the Broker VM to ensure proper communication with the XSIAM tenant?

Accepted Answer

Outbound TCP port 443 to the assigned Cortex XSIAM tenant URL and services.. Broker VMs require outbound TCP port 443 connectivity to the Cortex XSIAM tenant URL and associated threat intelligence feeds for secure API communication and updates.

Answer

Inbound TCP port 22 and TCP port 80 for remote SSH administration and unencrypted web traffic.

Answer

Bidirectional UDP port 514 for unencrypted syslog tunneling across the WAN.

Answer

Outbound TCP port 3389 for remote desktop management of the appliance.

Question 4

An administrator is deploying a Broker VM on a VMware ESXi hypervisor. After deploying the OVA template, the administrator notices the Broker VM cannot reach the NTP server and fails activation. Which initial configuration step was likely missed?

Accepted Answer

Configuring the static IP address, subnet mask, default gateway, and DNS servers in the Broker VM console interface.. Network settings, including IP addressing, DNS, and gateway configurations, must be properly applied during the initial Broker VM console setup to ensure connectivity.

Answer

Allocating additional virtual CPU sockets to handle cryptographic handshakes.

Answer

Enabling SSH service access in the Cortex XSIAM tenant settings.

Answer

Installing the VMware Tools package inside the guest Linux operating system.

Question 5

A deployment engineer is sizing a Broker VM for a large enterprise environment with 20,000 Cortex XDR agents and multiple log collection sources. During the initial deployment, the administrator notices high CPU and memory utilization on the single Broker VM. What is the recommended architectural remedy for this scenario?

Accepted Answer

Deploy an additional Broker VM and group them logically to distribute agent check-ins and log forwarding workloads.. Deploying multiple Broker VMs in a cluster or behind a load balancer is the best practice to distribute the load of agent communication and log collection in large enterprise environments.

Answer

Configure the Cortex XDR agents to bypass the Broker VM and report directly to the Cortex XSIAM tenant cloud.

Answer

Upgrade the underlying hypervisor memory allocation for the single Broker VM beyond the maximum supported limit of 64GB.

Answer

Install a dedicated syslog forwarder daemon directly on every individual endpoint to reduce Broker VM processing overhead.

Question 6

An enterprise environment has strict network segmentation where log sources in a secure DMZ cannot communicate directly with the primary Broker VM located in the corporate network. How should an architect design the log collection architecture to feed data into Cortex XSIAM?

Accepted Answer

Deploy a secondary Broker VM within the DMZ configured to forward logs securely to the primary Broker VM or directly to the XSIAM tenant.. Deploying a dedicated Broker VM inside the DMZ zone allows local log collection from DMZ sources while securely forwarding normalized logs to the XSIAM backend or through authorized firewalls.

Answer

Configure a port-mirroring session on the core firewall to duplicate all DMZ traffic to the Broker VM via local loopback.

Answer

Install the Cortex XDR agent on all network routers and switches in the DMZ to capture syslog locally.

Answer

Open bidirectional UDP port 514 across the internal corporate firewall to allow DMZ devices to stream raw syslog directly.

Question 7

When establishing Role-Based Access Control (RBAC) in Cortex XSIAM, what is the purpose of assigning 'Folder' scopes to a custom role?

Accepted Answer

To limit visibility and management capabilities to specific subsets of endpoints and data sources organized within the folder hierarchy.. Folder scopes allow organizations to delegate administrative or analyst permissions based on logical asset groupings, ensuring users only see data and endpoints relevant to their assigned business unit or geographic region.

Answer

To specify the directory path where agent installation logs are written on endpoints.

Answer

To restrict which log files are stored on the local Broker VM disk storage.

Answer

To determine which software packages can be downloaded from the Cortex XSIAM Marketplace.

Question 8

An administrator needs to install Cortex XDR agents across a fleet of Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation parameter is strictly required during the MSI execution to ensure the agent correctly pairs with the appropriate Cortex XSIAM tenant?

Accepted Answer

HANDLER_SERVER= TC_CUSTOM_ID=. When deploying agents via scripts, GPO, or enterprise tools, the installation parameters must include the server address and the unique installation token (CustomerID).

Answer

CORIFY=1 TOKEN=<Installation_Token>

Answer

INSTALLDIR="C:\Program Files\Cortex" SERVER=tenant.xdr.local

Answer

/q /norestart WINDOWS_USERNAME=admin

Question 9

An administrator is configuring Role-Based Access Control (RBAC) in Cortex XSIAM and needs to grant a tier-1 SOC analyst the ability to view incidents and execute isolation commands on endpoints, but strictly prohibits them from modifying security policies or viewing sensitive user identity logs. How should this custom role be constructed?

Accepted Answer

Create a custom role with 'Incident Response' and 'Endpoint Control' permissions while omitting 'Policy Management' and 'Data Access Control' scopes for identity logs.. RBAC in Cortex XSIAM requires granular permission assignments. Incident viewing and endpoint response actions (like isolation) can be grouped, while policy modification and specific dataset read permissions are withheld.

Answer

Grant 'Power User' access and rely on Cortex XDR profile exclusions to block policy edits.

Answer

Assign the 'App Role' for XSOAR automation and restrict network access via Security Groups.

Answer

Assign the built-in 'Administrator' role and manually remove permissions using the CLI.

Question 10

A security architect is aligning deployment objectives with Cortex XSIAM architecture for an organization migrating from a legacy SIEM. The organization requires continuous ingestion of custom application logs using HTTP. Which XSIAM architectural component should be configured to ingest these logs securely?

Accepted Answer

Broker VM with an enabled HTTP/HTTPS Collector service.. The Broker VM supports HTTP/HTTPS log collection collectors (such as HTTP Collector or Generic HTTP syslog endpoints) to ingest custom log streams securely into XSIAM.

Answer

Palo Alto Networks Next-Gen Firewall configured as a syslog relay.

Answer

Cortex XDR Agent running in 'Collector Mode' on every application server.

Answer

Direct API integration from the application servers to the Cortex XSIAM query service without intermediary gateways.

Question 11

An administrator is preparing to deploy Cortex XDR agents across a large macOS fleet using a Mobile Device Management (MDM) solution such as Jamf Pro. Which configuration profile component is critical to deploy alongside the agent installation package on modern macOS versions?

Accepted Answer

Transparency, Consent, and Control (TCC) profiles and System Extension pre-authorization configurations.. Modern macOS versions require System Extensions and Full Disk Access permissions to be explicitly pre-approved via MDM configuration profiles for security agents like Cortex XDR to function correctly without user prompts.

Answer

Kernel extension bypass and legacy daemon authorization profiles.

Answer

SSH key exchange profiles and dynamic DNS registration certificates.

Answer

Active Directory domain join credentials and Kerberos ticket-granting tickets.

Question 12

What is the primary function of the Broker VM in a Cortex XSIAM deployment architecture?

Accepted Answer

To serve as an intermediary proxy for agent communications, log collection, and infrastructure integration with Cortex XSIAM.. The Broker VM acts as an intermediary appliance for agent communication proxying, identity data collection, and log forwarding from various network and security sources into Cortex XSIAM.

Answer

To replace the organization's enterprise SIEM storage database for long-term cold storage.

Answer

To act as a localized security orchestration and automated response (XSOAR) execution engine.

Answer

To enforce inline firewall filtering and threat prevention on all internet-bound traffic.

Question 13

During an assessment of infrastructure readiness for Cortex XSIAM, an engineer calculates the required daily log ingestion volume and determines it exceeds the licensed capacity. What architectural feature or mechanism within XSIAM can the administrator configure to optimize data ingestion without losing critical security telemetry?

Accepted Answer

Configure log filtering and drop rules on the Broker VM collectors to exclude unneeded verbose log events before they reach the XSIAM cloud.. XSIAM allows administrators to configure log parsing and filtering rules on the Broker VM or ingestion pipeline to drop redundant or low-value logs before ingestion, optimizing licensed capacity.

Answer

Increase the retention period in the data lake storage settings from 90 days to 365 days.

Answer

Enable automatic data compression on the Cortex XDR agent to reduce network packet size by 90%.

Answer

Deploy secondary XSIAM tenants in different geographic regions to split the log parsing load.

Question 14

An engineer is deploying a Cortex XSIAM Engine on-premises to support high-throughput log parsing and query execution. During setup, the engine fails to register with the cloud tenant. Upon checking the engine logs, the engineer sees TLS certificate validation errors. What is the most likely root cause?

Accepted Answer

The engine host is missing the root Certificate Authority (CA) certificate required to trust the SSL inspection proxy or tenant endpoint.. Engine-to-cloud communication relies on mutual TLS (mTLS) and valid certificate trust chains. If an SSL inspection proxy or corporate firewall is intercepting TLS traffic without proper root certificate installation on the engine host, registration fails.

Answer

UDP port 514 is blocked by the local host firewall, preventing certificate handshake packets.

Answer

The Broker VM has exceeded its maximum concurrent engine connection limit.

Answer

The engine software version is newer than the Cortex XSIAM tenant cloud version.

Question 15

An organization has multiple business units sharing a single Cortex XSIAM tenant. Leadership requires that security analysts in Business Unit A can only view alerts and endpoints associated with their specific department, while global administrators retain full visibility. How must the deployment engineer configure access control to achieve this?

Accepted Answer

Configure custom roles combined with folder-based access control, ensuring Business Unit A users are assigned to a role scoped exclusively to their designated folders.. Achieving strict data separation and analyst restriction within a single XSIAM tenant involves creating custom roles mapped to specific folder hierarchies and assigning users accordingly.

Answer

Utilize XSOAR playbooks to automatically hide incidents belonging to Business Unit B from analysts' UI views.

Answer

Create separate Cortex XSIAM tenants for each business unit and interconnect them using cross-tenant log forwarding.

Answer

Modify the Broker VM configuration file to filter out logs from Business Unit B before sending them to the cloud.