XSIAM-Engineer XSIAM Platform Architecture And Deployment Practice Test 6 — 15 Questions

Question 1

A security architect is planning a Cortex XSIAM deployment for a large enterprise. The organization wants to minimize the number of publicly exposed services and centralize log ingestion from remote sites. Which component should the architect deploy at each remote site to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cortex XSIAM Broker VM. The Broker VM is specifically designed for distributed log collection, allowing remote sites to forward logs to Cortex XSIAM without exposing additional public services. It acts as a secure intermediary, supports multiple ingestion methods, and reduces firewall complexity. Deploying Broker VMs at each site aligns with best practices for scalable, secure XSIAM deployments.

Answer

Cortex XDR agent

Answer

Cortex XSOAR appliance

Answer

Cortex XSIAM Engine

Question 2

An XSIAM engineer is planning the network requirements for a new Cortex XSIAM deployment that includes Broker VMs in a restricted DMZ. The security team requires that the Broker VMs initiate all connections outbound and that no inbound firewall rules be opened. Which statement correctly describes the connectivity model the engineer should document?

Accepted Answer

Broker VMs initiate outbound connections to Cortex XSIAM over TCP 443 and do not require any inbound firewall rules.. Cortex XSIAM Broker VMs communicate with the cloud tenant by initiating outbound TLS connections on TCP 443 for registration, configuration retrieval, and data forwarding. No inbound firewall rules are required for the Broker VM itself. Internal syslog sources deliver logs to the Broker within the local network, so the documented model is outbound-only, which matches the DMZ security policy.

Answer

Broker VMs must be placed behind a reverse proxy that accepts inbound connections from Cortex XSIAM and forwards them to the Broker.

Answer

Broker VMs require inbound UDP 514 to receive syslog from internal sources, so an inbound rule must be opened.

Answer

Broker VMs require inbound TCP 443 from the Cortex XSIAM tenant to receive configuration updates.

Question 3

A security architect is planning the deployment of Cortex XSIAM for a large enterprise. The organization has strict data residency requirements and wants to minimize egress costs by keeping as much log data on-premises as possible. They will ingest high volumes of logs from various sources. Which component should the architect deploy to meet these requirements while ensuring efficient data ingestion and processing?

Accepted Answer

Broker VM. Broker VM is the on-premises component that collects, processes, and forwards logs to Cortex XSIAM. It enables local parsing and filtering, reducing cloud egress and supporting data residency by keeping raw logs on-premises. The other components either operate in the cloud or are endpoint-focused, and do not meet the on-premises log processing requirement.

Answer

Cortex Data Lake

Answer

Cortex XDR agent

Answer

Cortex XSIAM Engine

Question 4

An engineer is deploying a Cortex XSIAM Broker VM on a VMware ESXi host. After importing the OVA, the engineer needs to assign a static IP address to the Broker VM. Which method should the engineer use to configure the network settings?

Accepted Answer

Use the console of the VM to run the network configuration wizard. The Broker VM's initial network configuration is performed through its local console using a text-based wizard. This wizard allows setting a static IP address, subnet mask, default gateway, and DNS servers. This method ensures the VM has network connectivity before any web-based management is possible. Editing VM files or using DHCP does not meet the static IP requirement.

Answer

Edit the VM's .vmx file to include the IP address

Answer

Use the Broker VM's web console to set the IP address

Answer

Configure a DHCP reservation on the DHCP server

Question 5

An XSIAM engineer is preparing to onboard a new Cortex XSIAM tenant for a large enterprise. The customer wants to understand which component is responsible for parsing and normalizing raw logs into the Cortex XSIAM data model before they are stored and made searchable. Which component should the engineer identify?

Accepted Answer

The Cortex XSIAM cloud data pipeline parses and normalizes raw logs into the Cortex XSIAM data model.. Cortex XSIAM ingests raw logs into its cloud data pipeline, which parses and normalizes them into the Cortex XSIAM data model using built-in and custom parsers. The normalized data is then stored and searchable via XQL. Broker VMs collect and forward, agents collect endpoint telemetry, and Engines provide local processing, but the cloud pipeline is the component responsible for normalization.

Answer

The Broker VM performs parsing and normalization of raw logs before forwarding them to the tenant.

Answer

The Cortex XSIAM Engine on-premises parses and normalizes all logs before they are sent to the cloud tenant.

Answer

The Cortex XDR agent on each endpoint parses logs from all network devices and normalizes them before upload.

Question 6

An administrator is planning the deployment of Cortex XSIAM for an organization with strict data residency requirements. The organization must ensure that all log data remains within a specific geographic region. Which deployment option should the administrator choose?

Accepted Answer

Cortex XSIAM SaaS hosted in the required region. Cortex XSIAM is a cloud-delivered service, and data residency is achieved by selecting a SaaS region that aligns with the required geography. The administrator should choose the appropriate region during tenant provisioning. On-premises or private cloud deployments of the full platform are not available, and hybrid models still rely on the cloud tenant for storage and processing.

Answer

Cortex XSIAM on-premises deployment

Answer

Cortex XSIAM hybrid deployment with local data storage

Answer

Cortex XSIAM deployed on a private cloud within the organization's data center

Question 7

An XSIAM engineer is deploying Cortex XSIAM for an organization that will collect logs from remote branch offices with limited bandwidth and intermittent connectivity. The engineer must ensure that logs are not lost during connectivity outages and that local collection continues. Which TWO deployment considerations should the engineer apply? (Choose two.)

Accepted Answer

Size the Broker VM storage and memory to accommodate the expected log volume during the longest anticipated outage.. Broker VMs deployed at each branch office collect logs locally and buffer them when the connection to Cortex XSIAM is unavailable, preventing log loss during outages. Sizing Broker VM storage and memory for the longest anticipated outage ensures the buffer does not fill and drop data. Direct cloud sending, firewall compression, and a single centralized Broker do not provide local buffering or resilience for intermittent branch connectivity.

Answer

Configure all branch devices to send logs directly to the Cortex XSIAM cloud tenant over the internet without a local collector.

Answer

Use a single centralized Broker VM at the data center to collect logs from all branch offices over the WAN.

Answer

Enable compression and deduplication on the branch firewall to reduce log volume before forwarding to the Broker VM.

Question 8

A Cortex XSIAM administrator is configuring a new external syslog source to send logs to a Broker VM. The administrator wants to ensure that the logs are parsed correctly and mapped to the appropriate Cortex XSIAM data model. Which step must be taken after configuring the syslog source on the Broker VM?

Accepted Answer

Create a new data source in Cortex XSIAM and select the appropriate log type and parser.. Creating a data source in Cortex XSIAM is essential after setting up the syslog source on the Broker VM. The data source specifies the log type and parser, which enables the platform to normalize and map the logs to its data model. Without this, logs may be collected but remain unparsed and unusable for analytics. Other options do not achieve the required parsing and mapping.

Answer

Enable auto-discovery of log sources in the Broker VM settings.

Answer

Install a Cortex XDR agent on the syslog source to forward logs directly to the tenant.

Answer

Configure a correlation rule to parse the syslog messages.

Question 9

A Cortex XSIAM engineer is troubleshooting a Broker VM that is not receiving logs from a syslog source. The Broker VM is reachable, and the syslog source is configured to send to the Broker VM's IP on port 514. Which action should the engineer take first to diagnose the issue?

Accepted Answer

Check the Broker VM's syslog listener status and logs. The most efficient first step is to check the Broker VM's syslog listener status and logs. This directly verifies whether the Broker VM is ready to receive logs on the expected port. If the listener is not running, the engineer can start or reconfigure it. Other steps like restarting the source or checking firewall rules are secondary and should be done after confirming the listener state.

Answer

Verify firewall rules between the syslog source and the Broker VM

Answer

Restart the syslog source device

Answer

Re-register the Broker VM with Cortex XSIAM

Question 10

A security architect is planning the storage layout for a new Cortex XSIAM tenant that will ingest 5 TB of raw logs per day and retain them for 12 months. The organization requires that hot data remain queryable within seconds for the most recent 30 days, while older data can tolerate slower query performance. Which XSIAM storage tier design should the architect implement to meet these requirements while controlling cost?

Accepted Answer

Use the Cortex XSIAM hot storage tier for the most recent 30 days and configure the cold storage tier for data older than 30 days.. Cortex XSIAM uses a tiered storage model where recent data resides in hot storage for fast queries and older data moves to cold storage for cost efficiency. The scenario's 30-day fast-query requirement aligns exactly with the hot tier boundary, while the remaining 11 months can be served from cold storage. This design meets performance needs without paying hot-tier costs for data that does not require sub-second access.

Answer

Deploy an external Amazon S3 bucket as the primary data store and point Cortex XSIAM to it using the S3 data integration.

Answer

Configure the Cortex Data Lake with a single hot tier and rely on Cortex XSIAM's built-in compression to reduce storage costs for all 12 months of data.

Answer

Increase the Broker VM disk size to 20 TB and store all raw logs locally on the Broker VM for the full retention period.

Question 11

A security architect is deploying Cortex XSIAM in a multi-tenant environment. The organization requires that each tenant's event data be logically isolated and that queries from one tenant cannot access another tenant's data. Which of the following best describes how Cortex XSIAM achieves this isolation?

Accepted Answer

The platform uses a shared data lake with tenant-specific identifiers and access controls to enforce isolation.. Cortex XSIAM is built as a multi-tenant platform where a single instance serves multiple tenants. Data isolation is enforced logically through tenant identifiers and role-based access controls, allowing efficient resource utilization while preventing cross-tenant data access. This design supports scalability and centralized management without requiring separate physical infrastructure for each tenant.

Answer

Each tenant is assigned a dedicated Cortex XSIAM engine that processes and stores data separately.

Answer

Isolation is achieved by deploying separate Cortex XSIAM instances for each tenant in different regions.

Answer

Tenant data is stored in separate physical databases on distinct hardware to ensure complete separation.

Question 12

An engineer is configuring a Cortex XSIAM Broker VM to collect logs from a high-volume syslog source. The Broker VM is deployed on-premises and must forward logs to the Cortex XSIAM tenant. The engineer notices that logs are being dropped during peak traffic. Which of the following should the engineer adjust to increase the Broker VM's buffering capacity?

Accepted Answer

Modify the Broker VM's disk buffer size in the Broker VM configuration settings.. When a Broker VM drops logs during high traffic, it often means the internal buffer is too small to hold incoming logs while forwarding to Cortex XSIAM. The Broker VM provides a configurable disk buffer that can be increased to accommodate larger bursts. Modifying this setting allows the Broker VM to queue more logs, preventing drops until the forwarding catches up. Other options address different bottlenecks like CPU or bandwidth, but not buffer capacity.

Answer

Increase the number of vCPUs assigned to the Broker VM.

Answer

Increase the syslog receiving rate limit on the source device.

Answer

Enable compression on the syslog forwarder to reduce bandwidth usage.

Question 13

An engineer is deploying a Cortex XSIAM Broker VM in a high-security environment where the Broker VM must communicate with the Cortex XSIAM tenant over the internet. The security team requires that all outbound communication from the Broker VM be encrypted and authenticated using mutual TLS. Which component must be installed and configured on the Broker VM to enable this secure channel?

Accepted Answer

The Cortex XSIAM Broker VM app, which establishes a mutual TLS connection to the tenant using an embedded client certificate and tenant-specific configuration.. Cortex XSIAM Broker VMs communicate with the tenant through the Broker VM app, which performs registration and establishes a mutually authenticated TLS session. The app uses tenant-issued credentials and a client certificate, so both sides verify each other's identity. This is the only supported method for Broker-to-tenant communication and directly delivers the mutual TLS requirement described in the scenario.

Answer

An IPsec VPN tunnel between the Broker VM and the Cortex XSIAM cloud gateway, configured with pre-shared keys.

Answer

A forward proxy configured with NTLM authentication to relay Broker VM traffic through the corporate web gateway.

Answer

A reverse proxy certificate signed by the internal certificate authority and bound to the Broker VM's management interface.

Question 14

A Cortex XSIAM administrator needs to ensure that only specific IP addresses can access the Cortex XSIAM tenant's management console. The organization uses a corporate firewall and wants to restrict access to the SOC team's subnet. Which Cortex XSIAM feature should the administrator configure to enforce this restriction?

Accepted Answer

Allowed IP addresses list in the Cortex XSIAM tenant settings.. To restrict management console access by IP, Cortex XSIAM offers an allowed IP addresses list in the tenant settings. This allowlist ensures that only connections from specified IP ranges are accepted, providing a network-level security control. RBAC handles user permissions, SAML handles authentication, and engine firewalls are for engine traffic, so none of those directly enforce IP restrictions on the console.

Answer

Role-Based Access Control (RBAC) with IP-based conditions.

Answer

Cortex XSIAM engine firewall rules on the local host.

Answer

SAML 2.0 identity provider (IdP) with network policies.

Question 15

A Cortex XSIAM administrator is preparing to deploy a new Broker VM to collect logs from a remote data center. The data center firewall team asks which TCP port the Broker VM uses to establish its initial registration and management connection to the Cortex XSIAM tenant. Which port should the administrator provide?

Accepted Answer

TCP 443. Broker VM registration and ongoing management traffic to the Cortex XSIAM tenant travels over outbound TCP 443. This is consistent with the platform's use of mutual TLS over HTTPS for secure communication. Firewall rules must permit outbound 443 from the Broker VM to the tenant endpoints so that registration succeeds and the management channel remains available.

Answer

TCP 8443

Answer

TCP 22

Answer

TCP 514