XSIAM-Engineer XSIAM Platform Architecture And Deployment Practice Test 5 — 15 Questions

Question 1

When aligning deployment objectives with Cortex XSIAM architecture, an organization decides to integrate external threat intelligence feeds. Which TWO methods are supported for incorporating threat intelligence into XSIAM? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Installing official threat intelligence integration content packs from the Cortex XSIAM Marketplace.. Threat intelligence can be integrated via native Cortex XSIAM Marketplace content packs/integrations and custom API connectors.

Answer

Mailing physical USB hard drives containing threat indicators to the Palo Alto Networks headquarters.

Answer

Writing raw binary machine code directly to the endpoint RAM using debuggers.

Answer

Manually editing the Broker VM BIOS firmware to include malicious IP blacklists.

Question 2

An enterprise environment requires high availability and scalability for log collection. Which TWO architectural best practices should an engineer follow when deploying Broker VMs for large-scale log ingestion? (Choose two)

Accepted Answer

Deploy multiple Broker VMs grouped behind a load balancer to distribute incoming syslog and HTTP traffic.. Option D is correct because deploying multiple Broker VMs behind a load balancer provides horizontal scalability and eliminates the single point of failure, allowing syslog (UDP/TCP 514) and HTTP (TCP 80/443) log traffic to be distributed across brokers for high availability. Option E is correct because sizing Broker VMs per Palo Alto Networks reference architecture guidelines ensures adequate CPU, RAM, and storage to handle the expected log ingestion rate and retention, preventing performance degradation or dropped logs at scale. Option A is wrong because storing raw logs only on ephemeral local storage without forwarding risks data loss on VM failure and does not meet enterprise retention or availability requirements. Option B is wrong because disabling logging on Broker VMs defeats their purpose as log collection infrastructure. Option C is wrong because funneling all traffic through a single Broker VM creates a bottleneck and a single point of failure, contradicting high availability and scalability goals.

Answer

Configure Broker VMs to store all raw logs locally on ephemeral storage for eternity without cloud forwarding.

Answer

Disable all logging on the Broker VMs to maximize CPU cycles for network packet forwarding.

Answer

Route all enterprise log traffic through a single Broker VM to simplify network troubleshooting.

Question 3

An administrator needs to configure secure access to the Cortex XSIAM web console for remote administrators. Which TWO security controls should be implemented? (Choose two)

Accepted Answer

Configure IP allowlisting policies or conditional access rules via the IdP/SAML configuration.. Option A is correct because configuring IP allowlisting policies or conditional access rules through the IdP/SAML configuration restricts console access to trusted networks or verified identity-provider conditions, adding a strong network- and identity-based control for remote administrators. Option C is correct because enforcing MFA for all administrator accounts adds a critical authentication factor, ensuring that stolen or guessed credentials alone cannot grant access to the Cortex XSIAM web console. Option B is wrong because disabling TLS encryption would expose credentials and session data to interception, directly undermining secure access. Option D is wrong because publishing credentials in plaintext violates basic credential-handling and confidentiality principles. Option E is wrong because granting guest accounts unrestricted superuser privileges violates least privilege and would create a severe access-control risk.

Answer

Disable all TLS encryption on the admin portal to speed up login times.

Answer

Publish administrator credentials in plaintext on the internal corporate wiki for easy team reference.

Answer

Configure guest accounts with unrestricted superuser privileges for external auditors.

Question 4

An administrator is preparing to deploy the Cortex XSIAM agent across a corporate network of Windows endpoints. Which infrastructure component must be successfully installed and registered first to facilitate secure communication and act as the local aggregator for agent logs before they reach the Cortex XSIAM tenant?

Accepted Answer

Broker VM. The Broker VM acts as the local intermediary and aggregator in the customer environment for agent communication, log forwarding, and threat intelligence ingestion when direct cloud connectivity is restricted or for local services.

Answer

Cortex XSOAR Engine

Answer

Cortex XDR Collector

Answer

Prisma Access Remote Network

Question 5

An administrator needs to configure secure log forwarding from an on-premises syslog source into Cortex XSIAM using a Broker VM. Which specific Broker VM app must be enabled and configured to receive these syslog messages?

Accepted Answer

Syslog App. The Syslog App on the Broker VM is the specific component that listens for incoming syslog messages (typically on UDP/TCP 514 or custom ports), parses them, and forwards them securely to the Cortex XSIAM tenant. It must be enabled and configured with the correct port, protocol, and parser for the source firewall.

Answer

PAN-OS Collector App

Answer

Active Directory App

Answer

Agent Proxy App

Question 6

An administrator is deploying the Broker VM via an OVA template on an ESXi hypervisor. After deployment, the administrator cannot access the Broker VM management web interface. Which initial configuration step must be performed via the hypervisor console to enable remote network access?

Accepted Answer

Log into the hypervisor console and configure the management IP address, netmask, gateway, and DNS settings via the initial setup CLI wizard.. When a Broker VM is deployed from an OVA on ESXi, it boots without a configured management IP, so the web UI is unreachable until the initial setup CLI wizard is run from the hypervisor console. That wizard prompts for management IP, netmask, gateway, and DNS, which are required for remote network access. Only after these values are set can the administrator reach the Broker VM management web interface.

Answer

Access the BIOS settings of the ESXi host to enable virtualization extensions for the Broker VM container engine.

Answer

Run the automated DHCP client script from an external USB drive plugged into the hypervisor.

Answer

Connect a physical serial cable to the ESXi host to provision the Broker VM routing tables.

Question 7

An administrator is configuring Active Directory synchronization within Cortex XSIAM using a Broker VM. Which prerequisite must be met on the domain controller and Broker VM to ensure successful user and group mapping ingestion?

Accepted Answer

The Broker VM must have the Active Directory App enabled and network connectivity established over LDAP/LDAPS ports to the domain controllers.. To synchronize Active Directory users and groups into Cortex XSIAM, the Broker VM must have the Active Directory app enabled and must be able to reach domain controllers over LDAP (port 389) or LDAPS (port 636). This allows the Broker VM to query AD for user and group objects and forward that identity data to the XSIAM tenant for mapping and enrichment.

Answer

The XSIAM cloud tenant must be granted Domain Administrator credentials via an Azure ExpressRoute connection.

Answer

The administrator must manually export CSV files of user lists daily and upload them via the XSIAM web console.

Answer

The Domain Controller must have the Cortex XSIAM agent installed directly on NTDS.dit.

Question 8

An administrator is setting up custom Role-Based Access Control (RBAC) folders and permissions in Cortex XSIAM to segregate data access between regional security teams. Which TWO configuration steps are required when creating a new custom role and assigning data scopes? (Choose two)

Accepted Answer

Define the specific functional permissions (such as incident viewing, response actions, or configuration management) assigned to the role.. Option A is correct because a custom RBAC role in Cortex XSIAM must explicitly define its functional permissions, i.e., which actions members can perform such as viewing incidents, executing response actions, or managing configuration, since permissions are granted by the role and not inherited implicitly. Option D is correct because data scopes are the mechanism that restricts which incidents, alerts, or datasets a role can access, typically based on tags or criteria, which is exactly what is needed to segregate data between regional security teams. The other options do not belong: B is wrong because roles are created through the Cortex XSIAM management console or supported APIs, not by manually compiling source code into a JSON manifest; C is wrong because authorization is enforced centrally by the Cortex XSIAM platform, not by XSOAR engines on analyst workstations; and E is wrong because Broker VMs and log collectors handle data ingestion and forwarding, and rebooting them is not part of propagating role definitions.

Answer

Manually compile the source code of the role policy into a JSON manifest and push it via the REST API.

Answer

Install an additional XSOAR engine on each analyst workstation to enforce local authorization checks.

Answer

Reboot all Broker VMs in the region to propagate the new role definitions to local log collectors.

Question 9

An organization is preparing its internal firewall infrastructure and network architecture for a large-scale Cortex XSIAM deployment involving agents, Broker VMs, and cloud engines. Which THREE network traffic requirements must be verified and configured to ensure proper operational connectivity? (Choose three)

Accepted Answer

Endpoints and Broker VMs must have outbound HTTPS (TCP port 443) access to the assigned Cortex XSIAM tenant URL.. Option C is correct because Cortex XSIAM agents and Broker VMs initiate outbound TLS connections over TCP 443 to the tenant URL for registration, heartbeat, and data upload, so this egress path must be allowed through the firewall. Option D is correct because Broker VMs and cloud engines rely on DNS to resolve the tenant FQDN and external update/content repositories; without working name resolution, agent-broker communication and updates fail. Option E is correct because Broker VMs act as log collection points and must accept inbound syslog traffic (UDP/TCP 514 or custom ports) from internal log sources for ingestion into XSIAM. Option A is wrong because XSIAM does not require inbound SSH from the cloud tenant to every managed endpoint; agent communication is agent-initiated outbound, not inbound administrative access. Option B is wrong because XSIAM agents do not use peer-to-peer multicast heartbeat broadcasting across subnets; heartbeats are unicast HTTPS sessions to the tenant or Broker.

Answer

The Cortex XSIAM cloud tenant requires inbound administrative SSH access (TCP port 22) to all managed corporate endpoints.

Answer

Endpoints must have direct peer-to-peer multicast routing enabled across subnet boundaries for agent heartbeat broadcasting.

Question 10

An administrator is deploying Cortex XSIAM agents on a fleet of corporate servers and needs to ensure proper installation parameters and operational readiness. Which TWO methods are valid for deploying or managing agent installations in XSIAM? (Choose two)

Accepted Answer

Configuring automated agent upgrade profiles and installation packages directly from the Cortex XSIAM management console.. Option A is correct because the Cortex XSIAM management console provides built-in agent management capabilities, including creating installation packages and configuring automated upgrade profiles that push new agent versions to endpoints without manual intervention. Option E is correct because XSIAM agents can be deployed through third-party software distribution tools such as Microsoft SCCM or Jamf, where the installer package is executed with an installation token parameter that authenticates the endpoint to the XSIAM tenant during registration. Option B is incorrect because telnet on port 23 is an insecure legacy remote-shell protocol and is not a supported mechanism for triggering any XSIAM agent installer service. Option C is incorrect because XSIAM agents are user-space endpoint software, not BIOS-embedded kernel drivers, and firmware flashing is not a deployment method. Option D is incorrect because XSIAM does not use a physical USB-delivered master cryptographic key; agent authentication relies on installation tokens and tenant-issued credentials.

Answer

Manually telnetting into port 23 of every server to trigger the built-in operating system agent installer service.

Answer

Flashing the server BIOS with a specialized firmware image that contains the embedded XSIAM kernel driver.

Answer

Physically connecting a USB thumb drive containing the master cryptographic key to each server's motherboard.

Question 11

A security architect is planning a Cortex XSIAM deployment and must determine the minimum compute and storage resources needed for the Cortex XSIAM Engine to handle an expected ingest rate of 50,000 events per second (EPS). Which of the following is the correct sizing approach for the Engine?

Accepted Answer

Use the Cortex XSIAM sizing tool to calculate required vCPUs, memory, and storage based on the expected EPS and data retention period.. The Cortex XSIAM Engine must be sized according to expected event throughput and retention needs. The official sizing tool incorporates EPS and retention to recommend appropriate vCPU, RAM, and storage. Relying on agent count or maximum specs without analysis can result in poor performance or unnecessary cost.

Answer

Deploy a single Engine with 32 vCPUs and 128 GB RAM, as this is the maximum configuration supported and guarantees performance.

Answer

Size the Engine based on the number of Cortex XDR agents deployed, allocating 1 vCPU per 100 agents.

Answer

Allocate storage based solely on the number of days of log retention, ignoring EPS, because storage is the only constrained resource.

Question 12

A security architect is designing a Cortex XSIAM deployment for a company with a primary data center and a disaster recovery site. The company requires that the Cortex XSIAM tenant remains operational even if the primary data center becomes unavailable. Which deployment model should the architect choose to meet this requirement?

Accepted Answer

Deploy Cortex XSIAM as a cloud-hosted tenant, leveraging the built-in high availability and disaster recovery provided by the Cortex XSIAM cloud service.. Cortex XSIAM is a cloud-native platform where the tenant is hosted and managed by Palo Alto Networks. High availability and disaster recovery are inherent to the service, so customers do not need to design failover for the tenant itself. The correct choice recognizes that the cloud service provides the required resilience, while other options incorrectly place the tenant on-premises or assume unsupported multi-region failover.

Answer

Deploy Cortex XSIAM with Cortex XDR agents reporting to a Broker VM in the primary data center and a second Broker VM in the disaster recovery site, configured for high availability.

Answer

Deploy Cortex XSIAM with a single tenant in the primary data center and rely on manual failover to the disaster recovery site.

Answer

Deploy Cortex XSIAM with a multi-region tenant configuration, ensuring data replication and automatic failover between regions.

Question 13

An engineer is planning the network requirements for a new Cortex XSIAM deployment. The company uses a strict firewall policy that only allows outbound traffic on specific ports. Which outbound port must be open to allow Cortex XDR agents to communicate with the Cortex XSIAM tenant?

Accepted Answer

TCP 443. Cortex XDR agents use HTTPS over TCP 443 to communicate with the Cortex XSIAM tenant. This port must be allowed outbound from endpoints to the internet or to a Broker VM if used for proxying. Other ports listed are either used for different services or not used at all. Ensuring TCP 443 is open is a fundamental network requirement for XSIAM deployment.

Answer

TCP 8443

Answer

UDP 514

Answer

TCP 22

Question 14

A Cortex XSIAM administrator needs to integrate an external threat intelligence feed that provides indicators of compromise (IOCs) in STIX/TAXII format. The administrator wants the IOCs to be automatically ingested and used for detection. Which component should be configured to achieve this?

Accepted Answer

Cortex XSIAM Threat Intelligence Management. Threat Intelligence Management is the Cortex XSIAM component responsible for ingesting and managing external threat intelligence, including STIX/TAXII feeds. It automates the collection of IOCs and makes them available for detection engines. Other components like Data Sources handle log ingestion, Broker VMs handle local collection, and Correlation Rules define detection logic, but none of these directly ingest threat intelligence feeds.

Answer

Cortex XSIAM Broker VM

Answer

Cortex XSIAM Correlation Rules

Answer

Cortex XSIAM Data Sources

Question 15

A security architect is designing a Cortex XSIAM deployment for an organization with a primary data center and a disaster recovery site. The organization requires that if the primary site fails, the Cortex XSIAM tenant remains accessible and ingestion continues with minimal data loss. Which deployment approach should the architect recommend?

Accepted Answer

Rely on the built-in high availability and redundancy of the Cortex XSIAM cloud service and deploy redundant Broker VMs at each site for local collection.. Cortex XSIAM is a cloud-delivered service, so tenant availability and redundancy are provided by Palo Alto Networks. Resilience for ingestion is achieved by placing redundant Broker VMs at each site so local collection continues during a site outage. Customer-managed second tenants, on-premises Engine failover, and standby appliances are not supported architectures for tenant high availability.

Answer

Deploy a Cortex XSIAM Engine on-premises at the disaster recovery site and configure it to take over ingestion during a primary site outage.

Answer

Configure a site-to-site VPN between the primary and disaster recovery sites and replicate all logs to a standby Cortex XSIAM appliance.

Answer

Deploy a second Cortex XSIAM tenant in the disaster recovery site and manually switch DNS records during failover.