XSIAM-Engineer XSIAM Platform Architecture And Deployment — Timed 30 Questions

Question 1

An administrator needs to install Cortex XDR agents across a fleet of Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation parameter is strictly required during the MSI execution to ensure the agent correctly pairs with the appropriate Cortex XSIAM tenant?

30 minute time limit — choose an answer to begin.

Accepted Answer

HANDLER_SERVER= TC_CUSTOM_ID=. The Cortex XDR agent MSI installation requires the HANDLER_SERVER parameter pointing to the tenant address and the TC_CUSTOM_ID parameter containing the installation token to correctly pair the agent with the Cortex XSIAM tenant. These two parameters establish the agent-to-tenant association during installation, enabling the endpoint to register and receive policies. Without them, the agent cannot identify which tenant to connect to.

Answer

CORIFY=1 TOKEN=<Installation_Token>

Answer

INSTALLDIR="C:\Program Files\Cortex" SERVER=tenant.xdr.local

Answer

/q /norestart WINDOWS_USERNAME=admin

Question 2

An administrator is configuring Role-Based Access Control (RBAC) in Cortex XSIAM and needs to grant a tier-1 SOC analyst the ability to view incidents and execute isolation commands on endpoints, but strictly prohibits them from modifying security policies or viewing sensitive user identity logs. How should this custom role be constructed?

Accepted Answer

Create a custom role with 'Incident Response' and 'Endpoint Control' permissions while omitting 'Policy Management' and 'Data Access Control' scopes for identity logs.. Cortex XSIAM RBAC is built from granular permission scopes, so the correct approach is to create a custom role that includes only the scopes needed for the job — 'Incident Response' for viewing/handling incidents and 'Endpoint Control' for isolation actions — while deliberately excluding 'Policy Management' and 'Data Access Control' for identity logs. This enforces least privilege precisely as the requirement describes. Built-in roles are too coarse and cannot be trimmed to this exact combination.

Answer

Grant 'Power User' access and rely on Cortex XDR profile exclusions to block policy edits.

Answer

Assign the 'App Role' for XSOAR automation and restrict network access via Security Groups.

Answer

Assign the built-in 'Administrator' role and manually remove permissions using the CLI.

Question 3

An administrator is troubleshooting an endpoint where the Cortex XDR agent is failing to report to the Cortex XSIAM tenant. The administrator reviews the agent status using the command line and needs to verify the currently configured server address. Which tool or command should be used on a Windows endpoint?

Accepted Answer

cytool agent query. The Cytool utility is the command-line interface for managing and troubleshooting Cortex XDR agents on endpoints, including checking connection status and configurations.

Answer

cytool dump agent_info

Answer

cytool runtime query

Answer

cytool fetch server_status

Question 4

Where within the Cortex XSIAM web interface can an administrator download the latest Broker VM OVA template and installation packages?

Accepted Answer

Settings > Configurations > Deployments. Deployment packages, including Broker VM templates and agent installers, are centralized under Settings > Configurations > Deployments or the appropriate download repository within the console.

Answer

Marketplace > Content Hub > Integrations

Answer

Incident Response > Case Management > Tools

Answer

Dashboards > Asset Management > Infrastructure

Question 5

An administrator needs to configure authentication for Cortex XSIAM administrators using a corporate SAML 2.0 Identity Provider (IdP). Where in the XSIAM web console must this integration be established?

Accepted Answer

Settings > Configurations > Single Sign-On. Identity Provider (IdP) and single sign-on (SAML) configurations for Cortex XSIAM user authentication are managed under Settings > Configurations > Single Sign-On.

Answer

Marketplace > Content Hub > SAML Connector

Answer

Incident Response > Integrations > Identity Providers

Answer

Dashboards > User Management > Authentication

Question 6

Which command is used on a Linux endpoint to verify the status and connectivity of the Cortex XDR agent?

Accepted Answer

cytool agent query. The 'cytool' utility is used across operating systems (with appropriate syntax) to check Cortex XDR agent status, including runtime and connection parameters.

Answer

xdr-cli check-connection

Answer

systemctl verify xdr-agent

Answer

service cortex-xdr status

Question 7

An administrator is configuring a Broker VM to collect Syslog data from various network devices. Some devices transmit syslog over TCP while others use UDP. How should the Broker VM syslog collector be configured to handle both?

Accepted Answer

Configure the Broker VM Syslog collector instance to listen on the specified port for both TCP and UDP protocols.. The Broker VM Syslog collector can be configured to listen on a given port for both TCP and UDP simultaneously, so a single collector instance handles devices using either transport. This avoids unnecessary infrastructure duplication while meeting the mixed-protocol requirement. Administrators simply specify the port and enable both protocol listeners in the collector configuration.

Answer

Configure the Cortex XDR agent on the network devices to encapsulate syslog in TLS packets.

Answer

Deploy two separate Broker VMs, dedicating one exclusively to UDP syslog and the other to TCP syslog.

Answer

Convert all network device syslog traffic to HTTP using an external reverse proxy before it reaches the Broker VM.

Question 8

An administrator is configuring a custom role in Cortex XSIAM and needs to ensure that members of the Security Operations team can execute remote remediation actions (such as isolating a host or killing a process) on endpoints, but cannot change agent installation settings or uninstall security policies. Which permission category governs these remote endpoint actions?

Accepted Answer

Endpoint Response and Remediation Actions. Endpoint response actions (isolation, process termination, file quarantine) are managed under specific endpoint control and response permissions in XSIAM RBAC.

Answer

Data Access Control and Dataset Scoping

Answer

Marketplace and Content Hub Integration

Answer

Tenant Administration and License Management

Question 9

An enterprise deployment engineer is troubleshooting agent connectivity issues across a diverse multi-OS environment. Which TWO logs or diagnostic tools are standard for investigating Cortex XDR agent registration and communication failures on endpoints? (Choose two)

Accepted Answer

The 'cytool' command-line utility to query agent runtime status and server connections.. Agent troubleshooting relies on built-in tools like cytool and log gathering utilities such as logging packages (e.g., TrapsCollector or cytool dump).

Answer

The Broker VM kernel panic log (/var/log/kern.log).

Answer

The cloud-based XSOAR incident investigation playbook repository.

Answer

The XSIAM firewall packet capture utility for inspecting raw L2 Ethernet frames.

Question 10

An administrator is planning the network architecture and firewall rule base to support a new Cortex XSIAM deployment with Broker VMs and Cortex XDR agents. Which TWO network requirements must be established for proper communication? (Choose two)

Accepted Answer

Inbound UDP port 514 connectivity from log sources to the designated Broker VM syslog collectors.. Broker VMs and Cortex XDR agents require outbound HTTPS (TCP port 443) connectivity to the Cortex XSIAM tenant cloud. Inbound administrative ports are not required for standard cloud connectivity.

Answer

Inbound TCP port 22 connectivity from the Cortex XSIAM cloud to all endpoints for remote debugging.

Answer

Outbound TCP port 53 for DNS resolution of tenant URLs.

Answer

Bidirectional TCP port 3389 across the internet for direct cloud-to-Broker VM remote desktop management.

Question 11

An architect is designing a scalable Cortex XSIAM deployment across multiple geographically distributed corporate offices. Which THREE design considerations are critical when placing Broker VMs in remote locations? (Choose three)

Accepted Answer

Establishing appropriate firewall and routing rules between remote subnets and the regional Broker VM.. Option B is correct because Broker VMs in remote offices must be reachable by the local agents and log sources, which requires properly scoped firewall rules and routing between the remote subnets and the regional Broker VM so traffic does not hairpin through the data center. Option C is correct because deploying local syslog collection points (e.g., a Broker VM acting as a syslog receiver) lets remote devices send logs to a nearby collector, avoiding uncompressed log traffic crossing WAN links and reducing bandwidth consumption. Option E is correct because WAN circuits are typically the bottleneck in distributed designs, so reliable bandwidth plus log compression and filtering on the Broker VM are essential to prevent saturation and preserve agent communication. Option A is not appropriate because tape libraries are not a Cortex XSIAM Broker VM design element and local tape backup is unrelated to scalable log forwarding. Option D is not appropriate because streaming raw packet captures from every endpoint directly to the central cloud data lake over the public internet is neither scalable nor secure and is not how Broker VM log ingestion is designed.

Answer

Installing physical tape backup libraries on each Broker VM for local disaster recovery.

Answer

Configuring every remote endpoint to stream raw packet captures directly to the central cloud data lake over public internet.

Question 12

An administrator is installing Cortex XDR agents on Windows endpoints using a software deployment tool. Which TWO configuration parameters or requirements are necessary for a successful unattended installation? (Choose two)

Accepted Answer

Silent execution command-line switches (e.g., /q or /quiet) to suppress GUI prompts.. Unattended (silent) installations require silent execution flags (like /q or /quiet) and valid tenant installation tokens/servers.

Answer

A physical USB dongle plugged into each endpoint to authorize the license key.

Answer

Local administrator privileges on the target endpoint during the installation process.

Answer

Interactive administrator credentials typed into a popup prompt during script execution.

Question 13

An administrator is preparing to deploy Cortex XDR agents across a fleet of Linux servers. Which TWO steps or checks should be completed as part of the readiness assessment? (Choose two)

Accepted Answer

Verify that the target Linux distributions and kernel versions are supported by the Cortex XDR agent release notes.. Linux agent deployments require verifying supported kernel versions, OS distributions, and ensuring dependent packages are installed.

Answer

Reformat the root file system to NTFS to ensure compatibility with Windows-based agent binaries.

Answer

Configure a local Windows Active Directory domain controller on every Linux server.

Question 14

An administrator is troubleshooting a Broker VM that is failing to ingest logs from an external syslog source. Which TWO diagnostic steps should the administrator perform on the Broker VM? (Choose two)

Accepted Answer

Verify firewall rules and routing between the log source and the Broker VM listening port.. Troubleshooting Broker VM log collection involves checking service status, reviewing collector logs, and verifying port binding using tools like netstat or diagnostic menus.

Answer

Recompile the Linux kernel of the Broker VM to enable raw socket packet routing.

Answer

Reinstall the Microsoft Windows Server operating system on the Broker VM virtual machine.

Question 15

During the deployment of Cortex XSIAM engines in an isolated network segment, the administrator notices that engines fail to establish an encrypted tunnel back to the Cortex XSIAM core cloud. Network security reviews confirm outbound TCP port 443 is allowed, but the connection still fails. Which underlying architectural requirement for XSIAM engines was likely missed?

Accepted Answer

Engines require mutual TLS authentication and specific outbound gRPC traffic ports (typically TCP 443) enabled through intermediate stateful inspection firewalls with SSL decryption bypassed.. Cortex XSIAM engines require specific outbound connectivity including TCP port 443 and mutual TLS authentication utilizing valid certificates issued during engine registration to establish secure data paths.

Answer

Engines require an external DNS server configured to resolve internal Active Directory domain controllers.

Answer

Engines require inbound TCP port 22 to be open from the cloud tenant for configuration polling.

Answer

Engines must be assigned a publicly routable static IP address on their management interfaces.

Question 16

An enterprise is evaluating infrastructure readiness for Cortex XSIAM and plans to ingest massive volumes of NetFlow and VPC flow logs. The deployment architect decides to route these streams through Broker VMs rather than sending them directly from cloud VPCs to the XSIAM cloud. What is the primary architectural advantage of using Broker VMs for this ingestion path?

Accepted Answer

Broker VMs perform local log normalization, compression, and buffering to optimize WAN bandwidth utilization and handle temporary cloud connectivity outages.. Broker VMs act as an on-premises or cloud-side aggregation tier that receives logs from multiple sources, normalizes and compresses them, buffers during outages, and forwards over a single optimized channel to the XSIAM cloud. For high-volume NetFlow and VPC flow logs, this reduces WAN bandwidth consumption and provides resilience against transient cloud connectivity loss, which is the primary architectural advantage.

Answer

Broker VMs replace the requirement for Cortex XSIAM parser configuration by dynamically guessing schema definitions.

Answer

Broker VMs eliminate the need for any firewall rules or security group configurations in the cloud environment.

Answer

Broker VMs automatically convert all raw NetFlow packets into custom Python playbooks for instant XSOAR execution.

Question 17

An organization is establishing Role-Based Access Control (RBAC) within Cortex XSIAM to restrict SOC analysts from modifying tenant-wide integrations and security settings. Which predefined role should be assigned to these analysts to grant investigation capabilities while preventing administrative configuration changes?

Accepted Answer

SOC Analyst. The Standard Analyst or equivalent non-administrative role provides view and investigation privileges without granting administrative rights to modify tenant settings.

Answer

Integration Architect

Answer

App Central Admin

Answer

Account Admin

Question 18

A security architect is planning a Cortex XSIAM deployment for an organization that requires compliance with data residency regulations. Logs from European Union endpoints must remain within the EU, while analytics and incident management must be centralized in the United States. The organization has existing Cortex XDR agents in both regions. Which deployment approach best satisfies these requirements?

Accepted Answer

Deploy a single XSIAM tenant in the US and configure data localization policies to keep EU logs in an EU-based Broker VM before forwarding only metadata to the US tenant.. The correct approach uses a distributed Broker VM architecture where raw logs are stored locally in the EU, and only metadata is forwarded to the central US tenant. This satisfies data residency by keeping regulated data in-region while still enabling centralized analytics and incident management. The other options either violate residency, fragment management, or rely on unsupported synchronization methods.

Answer

Deploy two separate XSIAM tenants, one in the EU and one in the US, and manually synchronize incidents between them using the XSIAM API.

Answer

Deploy a single XSIAM tenant in the EU and have US analysts access it remotely over a secure VPN, ensuring all data remains in the EU.

Answer

Deploy a single XSIAM tenant in the US and enable full log forwarding from EU endpoints directly to the US tenant, relying on encryption to meet residency requirements.

Question 19

An engineer is deploying a Cortex XSIAM Broker VM in a high-security environment where outbound internet access is restricted. The Broker VM must communicate with the Cortex XSIAM tenant for configuration updates and log forwarding. Which network configuration is required to ensure successful communication?

Accepted Answer

Allow outbound TCP 443 to the XSIAM tenant's fully qualified domain name (FQDN) and to the Broker VM's management console URL.. The Broker VM must initiate secure connections to the XSIAM tenant over TCP 443 to receive configuration, send logs, and report health status. It also requires access to its own management console URL for updates. Allowing outbound TCP 443 to the tenant FQDN and management console URL ensures proper operation in a restricted network environment.

Answer

Allow outbound TCP 443 to the XSIAM tenant's FQDN and outbound UDP 123 for NTP synchronization.

Answer

Allow outbound UDP 514 to the XSIAM tenant's IP address and inbound TCP 22 for SSH management.

Answer

Allow outbound TCP 8443 to the XSIAM tenant's FQDN and inbound TCP 443 from the tenant to the Broker VM.

Question 20

An XSIAM engineer is deploying a new Cortex XSIAM tenant and must ensure that all log ingestion and analytics data is retained for exactly 12 months to satisfy a regulatory audit. The compliance team will not approve any configuration that stores data beyond the required period. Which configuration in the Cortex XSIAM tenant should the engineer use to meet this requirement?

Accepted Answer

Set the tenant data retention period to 12 months in the Cortex XSIAM Data Management settings.. Cortex XSIAM includes a tenant-level data retention configuration that governs how long ingested logs and analytics data are kept. Setting it to 12 months directly enforces the regulatory requirement. XQL cannot delete data, Broker VMs do not control retention, and manual external archiving does not purge tenant data, so the Data Management retention setting is the correct control.

Answer

Create a scheduled XQL query that deletes records older than 12 months from the Cortex Data Lake.

Answer

Enable hot storage for all datasets and manually archive older data to an external S3 bucket after 12 months.

Answer

Configure the Broker VM to forward only the last 12 months of logs to the Cortex XSIAM tenant.