Courseiva

Certified XSIAM Engineer (XSIAM-Engineer) (XSIAM-Engineer) — Questions 1–75

199 questions total · 3pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 3

Page 2
1
MCQeasy

An administrator wants to ensure that specific sensitive incident categories are restricted to a dedicated tier-2 response team. Which XSIAM construct should be configured to achieve this role-based operational segregation?

A.Modify the global tenant retention policy to purge tier-1 logs automatically.
B.Deploy a separate Cortex XSOAR server to handle tier-2 escalations independently.
C.Configure User Roles and User Groups under Settings > Access Management to limit incident viewing permissions.
D.Write a BIOC rule to drop unauthorized access attempts at the ingestion layer.
AnswerC

Correct. Access management features including roles and groups govern what data and incidents users can view.

Why this answer

Role-Based Access Control (RBAC) in XSIAM allows administrators to create custom roles with restricted permissions and assign users to specific user groups to control visibility over incidents and data.

Full explanation →
2
MCQhard

An analyst wants to trigger an automated playbook in XSIAM immediately whenever a specific high-severity alert is generated by the Analytics engine. Where should the analyst configure this automated linkage?

A.Via the Data Stitching rules configuration page
B.By modifying the global XSOAR integration instance mapping parameters
C.Within the Correlation Rule or Analytics Rule definition under the Incident Handling or Automated Playbook section
D.Inside the Broker VM configuration file under the 'triggers' YAML block
AnswerC

Correlation and analytics rules in XSIAM allow you to directly attach a playbook that triggers automatically when the rule generates an alert.

Why this answer

In XSIAM, automated responses to alerts generated by analytics or correlation rules are configured via Incident/Alert Trigger rules or Automation configurations tied to the Alert Rule settings, rather than manual playbook runs.

Full explanation →
3
Multi-Selecthard

An administrator needs to configure secure access to the Cortex XSIAM web console for remote administrators. Which TWO security controls should be implemented? (Choose two)

Select 2 answers
A.Configure IP allowlisting policies or conditional access rules via the IdP/SAML configuration.
B.Disable all TLS encryption on the admin portal to speed up login times.
C.Enforce Multi-Factor Authentication (MFA) for all administrator accounts.
D.Publish administrator credentials in plaintext on the internal corporate wiki for easy team reference.
E.Configure guest accounts with unrestricted superuser privileges for external auditors.
AnswersA, C

Restricting access by IP or identity conditions protects the administrative console.

Why this answer

Securing access to the management console involves enforcing Multi-Factor Authentication (MFA) and restricting access via IP allowlisting or SAML SSO policies.

Full explanation →
4
MCQmedium

An administrator needs to integrate third-party threat intelligence feeds into Cortex XSIAM to enrich incoming security telemetry. Where should the administrator configure and manage these threat intelligence integrations within the XSIAM platform?

A.Endpoint Security > Policies > Threat Protection
B.Marketplace > Content Hub (or Settings > Integrations)
C.Settings > Configurations > Threat Intelligence > Feeds
D.XQL Search > Settings > Threat Feeds
AnswerB

Integrations for threat intelligence feeds are installed and configured via Content Hub and managed under Integrations.

Why this answer

Threat intelligence integrations and feeds in Cortex XSIAM are managed via the Content Hub and managed under the Settings or Integrations menus depending on the specific feed pack.

Full explanation →
5
Multi-Selecthard

An XSIAM engineer is configuring automated incident response playbooks that interact with third-party tools via Cortex XSOAR integration commands. Which THREE best practices should be followed when designing robust automation playbooks? (Choose three)

Select 3 answers
A.Design every playbook task to execute as a continuous infinite loop until manually terminated
B.Incorporate approval or notification gates (such as 'Send Email' or 'Ask' tasks) for destructive remediation actions
C.Hardcode API tokens directly inside script task parameters for portability
D.Use explicit task inputs and output mappings rather than relying solely on global context assumptions
E.Implement error-handling branches (such as using conditional tasks on the '${.Error}' context key)
AnswersB, D, E

Human-in-the-loop approval gates are critical safety measures before executing high-impact containment actions.

Why this answer

Robust playbooks should handle errors gracefully, use context variables correctly, and avoid hardcoding environment-specific sensitive values.

Full explanation →
6
Multi-Selecthard

An enterprise is undergoing a security audit and requires proof of XSIAM system resilience and data integrity. Which THREE operational artifacts or features should the administrator provide to the auditors? (Choose three)

Select 3 answers
A.Personal social media profiles of the SOC analysts.
B.Role-Based Access Control (RBAC) documentation and user role assignments.
C.Local employee cafeteria menu schedules.
D.The XSIAM Audit Trail logs showing administrative actions and configuration changes.
E.Configured Data Retention policies proving adherence to data lifecycle regulations.
AnswersB, D, E

Correct. RBAC documentation proves adherence to the principle of least privilege.

Why this answer

Auditors typically review system audit trails, data retention and compliance reports, and RBAC configuration documentation to verify security and data integrity.

Full explanation →
7
MCQhard

A security architect is aligning deployment objectives with Cortex XSIAM architecture for an organization migrating from a legacy SIEM. The organization requires continuous ingestion of custom application logs using HTTP. Which XSIAM architectural component should be configured to ingest these logs securely?

A.Palo Alto Networks Next-Gen Firewall configured as a syslog relay.
B.Broker VM with an enabled HTTP/HTTPS Collector service.
C.Cortex XDR Agent running in 'Collector Mode' on every application server.
D.Direct API integration from the application servers to the Cortex XSIAM query service without intermediary gateways.
AnswerB

The Broker VM acts as a log collector gateway for various protocols, including HTTP/HTTPS ingestion.

Why this answer

The Broker VM supports HTTP/HTTPS log collection collectors (such as HTTP Collector or Generic HTTP syslog endpoints) to ingest custom log streams securely into XSIAM.

Full explanation →
8
MCQhard

An organization has strict regulatory compliance mandates requiring all data ingested into Cortex XSIAM to be encrypted in transit and at rest using customer-managed encryption keys (CMEK). During the tenant initialization and planning phase, where must the administrator configure the CMEK parameters?

A.Directly inside the XSIAM web UI under Settings > Configurations > Security > Encryption
B.Within the Broker VM local hypervisor configuration console via CLI
C.Inside the Cortex XDR agent installation wizard command-line parameters
D.During the initial tenant provisioning workflow coordinated with Palo Alto Networks cloud operations and KMS integration
AnswerD

CMEK requires specialized backend setup between the cloud provider's KMS and the tenant's storage accounts during provisioning.

Why this answer

Customer-managed encryption keys (CMEK) integration for Cortex XSIAM is coordinated with Palo Alto Networks support and cloud provider key management services (such as AWS KMS or Azure Key Vault) during the initial tenant provisioning and onboarding workflow.

Full explanation →
9
MCQhard

An administrator configured a Microsoft Graph API integration to pull security alerts into XSIAM. The connection status shows 'Active', but no alerts are being pulled. Reviewing the integration instance configuration, which common misconfiguration typically causes this behavior while keeping the authentication valid?

A.Exceeding the Broker VM CPU capacity
B.Failure to install the Cortex XDR Agent on the Microsoft Graph server
C.Missing XQL parsing rules for Microsoft XDM mapping
D.Incorrect fetch query parameters or time filters excluding existing alerts
AnswerD

Correct. Misconfigured fetch parameters or time ranges prevent the integration from querying relevant alerts.

Why this answer

Fetching starts from a specific timestamp or incident ID; if misconfigured or if lookback parameters are incorrect, no historical data is retrieved. Alternatively, filtering parameters might exclude all alerts.

Full explanation →
10
MCQhard

During the planning of a Cortex XSIAM deployment in an environment utilizing strict network segmentation, an administrator must ensure that communication between the Broker VM and local log sources (such as firewalls and SIEM forwarders) uses supported protocols. Which protocol combination is natively supported by Broker VM collectors for incoming log ingestion?

A.Syslog (TCP/UDP), Syslog-TLS, and HTTPS/API collection
B.Direct SMB file shares, RDP clipboard sharing, and NetBIOS name resolution
C.IPsec VPN encapsulation and GRE tunneling directly to the agent kernel
D.SNMP v1 read-only polling and Telnet terminal scraping
AnswerA

Broker VMs natively ingest logs via Syslog variations, Syslog-TLS, and various REST API or webhook mechanisms.

Why this answer

Broker VMs support standard ingestion protocols including Syslog (TCP/UDP), Syslog-TLS, HTTP/HTTPS API collection, and secure file polling mechanisms.

Full explanation →
11
MCQmedium

An XSIAM architect is planning the deployment size for an enterprise environment generating 5 TB of raw telemetry data per day. During the capacity sizing phase, the architect must account for indexing, replication, and data retention requirements. Which architectural factor is primarily responsible for the baseline storage multiplier before long-term retention is applied?

A.The mandatory inclusion of Prisma Cloud posture data within the same storage quota
B.The inclusion of raw log retention alongside parsed dataset indices
C.The real-time synchronization of local syslog forwarder configurations to Panorama
D.The automatic generation of daily Cortex XDR agent binaries for endpoints
AnswerB

XSIAM retains both raw logs and normalized/indexed datasets, requiring a multiplier to account for original data plus indexed representations and replication.

Why this answer

Data parsed, normalized, and indexed into XSIAM typically incurs a storage footprint multiplier due to indices, metadata, and search optimization structures, alongside default high-availability replication factors.

Full explanation →
12
Multi-Selecthard

An enterprise environment requires high availability and scalability for log collection. Which TWO architectural best practices should an engineer follow when deploying Broker VMs for large-scale log ingestion? (Choose two)

Select 2 answers
A.Configure Broker VMs to store all raw logs locally on ephemeral storage for eternity without cloud forwarding.
B.Disable all logging on the Broker VMs to maximize CPU cycles for network packet forwarding.
C.Route all enterprise log traffic through a single Broker VM to simplify network troubleshooting.
D.Deploy multiple Broker VMs grouped behind a load balancer to distribute incoming syslog and HTTP traffic.
E.Size Broker VM instances according to Palo Alto Networks reference architecture guidelines for CPU, RAM, and storage.
AnswersD, E

Load balancing multiple Broker VMs ensures high availability and scales ingestion capacity.

Why this answer

Large-scale log ingestion benefits from horizontal scaling with multiple Broker VMs and placing them behind network load balancers.

Full explanation →
13
MCQhard

An administrator is configuring a Broker VM in a secured DMZ zone to collect logs from on-premises security devices. The network security team requires strict verification of outbound ports to the Cortex XSIAM tenant. Which exact combination of destination ports must be permitted outbound from the Broker VM to ensure proper operation and cloud communication?

A.TCP 443 and TCP 22 for secure tunneling and remote management
B.TCP 6514 and UDP 514 for syslog relay directly to the tenant database
C.TCP 443 outbound for cloud communication and log ingestion APIs
D.TCP 8443 and UDP 123 for internal heartbeat synchronization
AnswerC

Broker VMs require outbound TCP 443 access to communicate with the XSIAM tenant endpoints and ingest services securely.

Why this answer

Broker VMs communicate securely with the Cortex XSIAM cloud backend primarily over TCP port 443 (HTTPS) for API calls, management, and log ingestion.

Full explanation →
14
MCQeasy

When setting up a new Broker VM to collect logs, what is the initial deployment step required in the XSIAM console before downloading the virtual machine image?

A.Configure a Syslog listener on the cloud tenant gateway
B.Generate a Broker VM installation token and download package from Data Collection settings
C.Upload a custom SSL certificate to the Marketplace
D.Install the Cortex XDR Agent on the hypervisor host
AnswerB

Correct. Generating the token and downloading the image template is the prerequisite starting step.

Why this answer

Before deploying a Broker VM, you must generate a configuration and registration token in the XSIAM console under Data Collection.

Full explanation →
15
Multi-Selecthard

When setting up authentication and user management in Cortex XSIAM, which TWO features or protocols are supported for administrative access control? (Choose two)

Select 2 answers
A.Legacy Windows NT LAN Manager (NTLMv1) challenge-response authentication.
B.Local user accounts with mandatory multi-factor authentication (MFA).
C.SAML 2.0 Identity Provider (IdP) federation for single sign-on (SSO).
D.Plaintext Telnet authentication over port 23 for administrative CLI access.
E.Anonymous guest access tokens for public incident reviewing.
AnswersB, C

Local accounts combined with MFA are fully supported.

Why this answer

Cortex XSIAM supports SAML 2.0 Identity Provider federation and local user accounts with multi-factor authentication (MFA).

Full explanation →
16
MCQhard

An administrator is troubleshooting a scenario where custom parsers are failing to correctly extract fields because the incoming log format changed slightly. What operational step should be taken to update the parser without disrupting active data ingestion?

A.Edit the parser definition in Settings > Configurations > Data Collection > Parsers, update the grok pattern, and test with sample logs before saving.
B.Stop the entire XSIAM tenant, wipe the database, and re-import all log sources from scratch.
C.Disable data ingestion globally while rewriting the SQL database schema.
D.Deploy a local text-editor plugin to every Broker VM via SSH to modify underlying regex config files.
AnswerA

Correct. Parsers can be edited and tested iteratively in the UI before committing changes to production.

Why this answer

Custom parsers can be edited and tested in real-time within the Parsers configuration page, allowing administrators to refine grok patterns and save the updated parser version safely.

Full explanation →
17
MCQmedium

An XSIAM administrator has created a custom parsing rule using Logstash-like syntax within XSIAM to normalize a non-standard application log format. After saving and enabling the parsing rule, incoming logs still appear unparsed under the 'Default' vendor product type. What is the most likely reason for this behavior?

A.Parsing rules can only be applied to logs ingested via HTTP API, not Broker VM inputs.
B.Custom parsing rules require a mandatory XSOAR playbook to trigger the parsing pipeline.
C.The Broker VM service must be completely restarted for parsing rules to take effect.
D.The matching criteria or vendor/product identifiers in the parsing rule do not align with the incoming log header fields.
AnswerD

If the parsing rule's identification criteria fail to match the incoming log metadata, XSIAM defaults to the unparsed default schema.

Why this answer

Custom parsing rules in XSIAM require proper vendor and product identifier matching criteria (such as matching header keys or regex patterns) to hook incoming logs correctly. If the conditions do not match the incoming log structure, the parser is bypassed.

Full explanation →
18
Multi-Selecthard

An organization is preparing its internal firewall infrastructure and network architecture for a large-scale Cortex XSIAM deployment involving agents, Broker VMs, and cloud engines. Which THREE network traffic requirements must be verified and configured to ensure proper operational connectivity? (Choose three)

Select 3 answers
A.The Cortex XSIAM cloud tenant requires inbound administrative SSH access (TCP port 22) to all managed corporate endpoints.
B.Endpoints must have direct peer-to-peer multicast routing enabled across subnet boundaries for agent heartbeat broadcasting.
C.Endpoints and Broker VMs must have outbound HTTPS (TCP port 443) access to the assigned Cortex XSIAM tenant URL.
D.DNS resolution must be fully functional on Broker VMs and engines to resolve tenant FQDNs and external update repositories.
E.Broker VMs require inbound syslog ports (such as UDP/TCP 514 or custom ports) open from internal log sources.
AnswersC, D, E

Correct. Outbound HTTPS traffic to the cloud tenant is required for telemetry and management.

Why this answer

XSIAM components require specific outbound connectivity rules, secure ports, and DNS resolution paths to function correctly.

Full explanation →
19
Multi-Selectmedium

An administrator is configuring data ingestion in XSIAM and needs to ensure that logs from a custom internal application are correctly normalized. Which THREE components are essential parts of the XSIAM log ingestion and normalization pipeline? (Choose three)

Select 3 answers
A.Physical network firewall bypass rules
B.Manually executed SQL queries for every incoming log packet
C.XSIAM Data Lake schema targets
D.Parsing Rules / Normalization mapping
E.Log Collector (such as Broker VM or Agent)
AnswersC, D, E

Normalized logs are stored against defined data lake tables and schemas (e.g., authentication, network).

Why this answer

XSIAM ingestion relies on collectors/Broker VMs, parsing rules/parsers for normalization, and structured data schemas within the data lake.

Full explanation →
20
MCQhard

An administrator is troubleshooting an issue where an endpoint agent is unable to connect to the XSIAM cloud management console, and local logs indicate certificate pinning verification failure. What is the most likely cause?

A.An intermediate network security device or proxy is performing SSL decryption and re-signing traffic with an untrusted certificate.
B.The Cortex XDR agent version is too new for the cloud tenant and must be downgraded.
C.The local firewall is blocking UDP port 514 outbound from the endpoint.
D.The XSIAM tenant license has expired, causing all agents to enter a permanent lock state.
AnswerA

Correct. SSL decryption without proper CA trust installation on endpoints causes certificate pinning and verification failures.

Why this answer

Certificate pinning failures on endpoint agents usually indicate an SSL inspection appliance or proxy in the network is re-signing traffic with an untrusted root certificate, causing the agent to reject the connection.

Full explanation →
21
MCQhard

An administrator is configuring a webhook integration to forward XSIAM incidents to an external ticketing system. The remote server requires mutual TLS (mTLS) client certificate authentication. Where should the client certificate be uploaded in XSIAM?

A.Paste the certificate into the custom CSS styling box under Global Settings.
B.Upload the client certificate within the integration instance or certificate store settings for the webhook.
C.Store the certificate in the Broker VM local `/etc/passwd` file.
D.Install the certificate in the local browser certificate store of the analyst viewing the incident.
AnswerB

Correct. mTLS client certificates for integrations are managed within the integration or certificate settings.

Why this answer

Certificates used for integrations and webhooks requiring mTLS are managed within the Integrations configuration settings or Certificate Store in XSIAM.

Full explanation →
22
Multi-Selectmedium

An administrator is reviewing the prerequisites for deploying Cortex XDR agents across virtual desktop infrastructure (VDI) environments. Which TWO best practices should be considered for VDI golden image preparation? (Choose two)

Select 2 answers
A.Installing the agent as the final step in the golden image creation process before sealing the disk
B.Removing all network adapters from the virtual machine template
C.Enabling VDI mode in the agent installation parameters or profile to handle ephemeral virtual machines correctly
D.Disabling all security tamper protection permanently on the master image
E.Configuring the VDI master image with a static, hardcoded endpoint UUID that never changes
AnswersA, C

Installing the agent just before sealing ensures the image contains the latest configuration without generating unnecessary telemetry during build stages.

Why this answer

VDI deployments require specific agent configurations, such as enabling VDI mode to prevent duplicate endpoint entries and managing golden image persistence properly.

Full explanation →
23
MCQhard

An XSIAM administrator is configuring automated log ingestion filtering to drop high-volume, low-value informational events before they consume license quota. Which feature enables this capability?

A.XQL Query Scheduled Rules
B.Incident Enrichment Playbooks
C.Data Masking Policies
D.Ingestion Filtering Rules
AnswerD

Correct. Ingestion filters allow dropping or filtering out unwanted logs prior to licensing and storage.

Why this answer

Log filtering and dropping rules can be configured using ingestion filtering policies in XSIAM data collection settings.

Full explanation →
24
Multi-Selecthard

An operations team is planning a routine maintenance window for Broker VMs. Which THREE best practices should be followed to ensure operational continuity? (Choose three)

Select 3 answers
A.Manually delete all historical data in the Cortex Data Lake to free up buffer space.
B.Back up Broker VM configuration settings and snapshots before applying software upgrades.
C.Reinstall the underlying hypervisor operating system on every managed endpoint.
D.Deploy Broker VMs in clusters or high-availability pairs to prevent data collection gaps during maintenance.
E.Verify outbound HTTPS connectivity to the XSIAM cloud tenant after performing updates.
AnswersB, D, E

Correct. Backups and snapshots allow rapid rollback if an update encounters issues.

Why this answer

Broker VM maintenance best practices include ensuring high availability/clustering, verifying network connectivity before updates, and backing up configuration parameters.

Full explanation →
25
MCQeasy

An analyst wants to quickly search across all ingested logs for a specific IP address without writing a complex query from scratch. Which feature in XSIAM provides a rapid, centralized search interface?

A.Open the Endpoint Management > Search Host wizard.
B.Navigate to Settings > Configurations > Data Collection > Search.
C.Check the Incident Graph search filter.
D.Use the XQL Search interface to execute quick queries across all datasets.
AnswerD

Correct. XQL Search is the primary interface for searching and querying ingested logs.

Why this answer

The Query Library or Query Center (XQL Search) provides an intuitive interface for searching across all ingested datasets using XQL.

Full explanation →
26
MCQhard

An administrator configured a new API data collector to ingest threat intelligence feeds, but no data is appearing in XSIAM. Upon checking the Integration page, the status shows an authentication failure. What is the most likely cause and correct remediation?

A.The XQL query syntax used by the integration is malformed and requires rewriting the SQL statement.
B.The local firewall on the Cortex XDR agent is blocking outbound HTTPS requests to the threat intel feed.
C.The Broker VM container needs to be restarted via SSH to reload the routing table.
D.The API key or credentials have expired or are incorrect; update the integration instance configuration with valid credentials under Settings > Configurations > Data Collection > Integrations.
AnswerD

Correct. Authentication errors in data integrations require updating credentials in the Integrations configuration.

Why this answer

API-based integrations in XSIAM require valid credentials, API keys, or OAuth tokens. If authentication fails, the administrator must update the integration configuration with valid, unexpired credentials.

Full explanation →
27
MCQhard

An administrator is troubleshooting a custom BIOC (Behavioral Indicator of Compromise) rule that is not triggering alerts even though matching logs are present in the Cortex Data Lake. What is the most effective operational step to debug the rule?

A.Use the BIOC rule test / simulation feature in the Analytics section to validate the rule logic against historical event data.
B.Change the tenant license key to an enterprise tier.
C.Reboot the XSIAM management cloud cluster master node via SSH.
D.Disable the default Cortex XDR agent prevention modules.
AnswerA

Correct. BIOC simulation tools allow testing rule logic against stored logs to verify triggers.

Why this answer

BIOC rules can be tested and debugged using the rule testing and simulation features within the Analytics configuration menu to verify syntax and matching logic against sample events.

Full explanation →
28
MCQhard

You are configuring a custom integration that requires sending an HTTP POST request to a legacy internal system. Which feature allows you to securely manage the connection credentials?

A.Hardcode the credentials in the Python script of the custom integration.
B.Set up a global environment variable in the Data Collector configuration.
C.Add the credentials as plain text in the playbook input fields.
D.Use the 'Credentials' module in the integration instance settings to store and reference the secret.
AnswerD

The Credentials module provides secure storage for API keys and passwords.

Why this answer

Integration instances use Credentials objects stored securely in the XSIAM vault to perform authenticated requests.

Full explanation →
29
MCQeasy

An engineer is tasked with reviewing the health and status of data collectors deployed across various remote sites. Within the Cortex XSIAM management console, which navigation path provides a consolidated view of all Broker VMs and their current operational status?

A.Settings > Configurations > Data Collection > Broker VM
B.Cloud Identity > Integrations > Status
C.Dashboards > Incident Management > Overview
D.Investigate > Endpoint Security > Collectors
AnswerA

This specific path displays all registered Broker VMs, version information, resource usage, and connectivity status.

Why this answer

Broker VM health and status are monitored under Settings > Configurations > Data Collection > Broker VM.

Full explanation →
30
Multi-Selecthard

When planning identity and access management integration for Cortex XSIAM administration, which THREE authentication or directory methods are natively supported? (Choose three)

Select 3 answers
A.Local administrator accounts managed directly within the Cortex XSIAM platform
B.Direct Kerberos ticket-granting ticket (TGT) exchange without an intermediary IdP
C.SAML 2.0 based Single Sign-On (SSO) with enterprise Identity Providers like Okta or Azure AD
D.API keys generated within Cortex XSIAM for programmatic and external tool access
E.Legacy Windows NT LAN Manager (NTLMv1) direct challenge-response authentication
AnswersA, C, D

Local accounts can be created and managed inside the platform for administrative access.

Why this answer

Cortex XSIAM supports standard enterprise identity providers using SAML 2.0 as well as local user management and API keys.

Full explanation →
31
Multi-Selectmedium

An administrator is reviewing log collection options during the initial planning phase of Cortex XSIAM. Which THREE sources can natively send logs to a Cortex XSIAM Broker VM collector profile? (Choose three)

Select 3 answers
A.Syslog streams from network security devices and servers
B.HTTP/HTTPS JSON payloads from third-party security tools
C.Files collected via local directory monitoring or SCP/SFTP drops
D.Direct kernel memory dumps from unmanaged hypervisors via raw TCP sockets
E.Proprietary BIOS firmware updates streamed over ICMP echo requests
AnswersA, B, C

Syslog is a primary ingestion method supported by Broker VM collector profiles.

Why this answer

Broker VM collector profiles support various standard protocols including syslog, HTTP/HTTPS, and specific API integrations.

Full explanation →
32
MCQeasy

When planning the installation of Cortex XSIAM content packs from the Marketplace, what prerequisite check must an administrator perform to ensure successful installation and utilization?

A.Verify that the administrator account has Content Administrator or equivalent privileges and check license entitlements
B.Manually compile source code files using the XQL command line
C.Reboot all deployed Broker VMs simultaneously
D.Disable all active endpoint security policies temporarily
AnswerA

Installing content packs requires appropriate administrative privileges and active content/integration licenses.

Why this answer

Administrators must verify that the user account holds the necessary administrative role permissions (such as Superuser or Content Administrator) and that the tenant has sufficient licensing entitlement.

Full explanation →
33
MCQeasy

When preparing the network perimeter for a new Cortex XSIAM deployment, outbound connectivity from the Broker VM to the Cortex XSIAM cloud tenant must be established. Which standard network port and protocol are required for this outbound secure communication?

A.TCP port 443
B.TCP port 389
C.UDP port 514
D.TCP port 22
AnswerA

Outbound HTTPS on TCP port 443 is required for secure communication to the Cortex XSIAM cloud tenant.

Why this answer

Cortex XSIAM communication relies on outbound HTTPS traffic over TCP port 443.

Full explanation →
34
MCQeasy

An administrator is configuring a new syslog data source in XSIAM to ingest logs from a third-party firewall. Which component must be deployed on-premises to securely receive and forward these logs to the XSIAM tenant?

A.Panorama Virtual Appliance
B.Cortex XDR Agent
C.Palo Alto Networks Broker VM
D.XSIAM Management Server
AnswerC

Correct. The Broker VM hosts the necessary log collector modules to ingest syslog traffic.

Why this answer

A Broker VM is the designated on-premises component used by XSIAM to host log collectors, such as syslog, agentless vulnerability assessment, and other data forwarders.

Full explanation →
35
Multi-Selectmedium

An administrator is planning the deployment of Broker VMs to support data ingestion across multiple isolated network segments. Which TWO considerations are critical for proper Broker VM architecture and sizing? (Choose two)

Select 2 answers
A.Ensuring the Broker VM has local administrative write access to all ingested network switches
B.Configuring local XSOAR database persistence exceeding 50 Terabytes on the Broker VM
C.The expected Events Per Second (EPS) volume traversing the specific Broker VM instance
D.Deploying a separate Windows Active Directory domain controller on each Broker VM
E.Outbound network connectivity from the Broker VM to the XSIAM tenant URL over HTTPS (Port 443)
AnswersC, E

Sizing CPU, RAM, and disk for a Broker VM depends directly on the volume of log traffic it handles.

Why this answer

Broker VMs require adequate sizing based on EPS (Events Per Second) throughput and must have appropriate outbound firewall access to reach the XSIAM cloud tenant.

Full explanation →
36
MCQhard

An architect is designing an automated deployment script for rolling out Cortex XDR agents across thousands of Linux servers using an enterprise configuration management tool (e.g., Ansible). To ensure silent installation and proper initial group assignment, what must be included in the installation command parameters?

A.A manual SSH key exchange with the Cortex XSIAM cloud backend
B.The silent installation flag along with the correct installation token (ID) and optional group parameters
C.The interactive GUI installer switch combined with root password prompting
D.Pre-formatting the Linux root file system with XSIAM-specific journaling
AnswerB

Silent flags and valid installation tokens are mandatory for unattended automated deployments on Linux.

Why this answer

Linux silent installations require specific command-line arguments, including the installation token (auth-code or customer ID) and optionally the initial group tag to ensure proper onboarding without user prompts.

Full explanation →
37
MCQmedium

You are writing a custom XQL query to filter logs, but you find that the field names are inconsistent across your data sources. How can you standardize these fields for your automation?

A.Rely on the raw log field names and map them manually in the playbook.
B.Use the 'Rename' function in every XQL query.
C.Use an external script to rewrite the logs before they reach XSIAM.
D.Ensure proper XDM mapping is applied to the ingestion source.
AnswerD

XDM mapping normalizes disparate log fields into a unified schema.

Why this answer

XDM (eXtendable Data Model) mapping ensures that logs from different sources are normalized into common field names, making queries more robust.

Full explanation →
38
MCQmedium

An organization requires that all log data ingested from a specific cloud service provider be enriched with asset metadata before being evaluated by XSIAM correlation rules. Which XSIAM feature should be configured to accomplish this data enrichment during the ingestion pipeline?

A.Data Retention Policies
B.XSOAR Incident Layouts
C.Agent Upgrade Profiles
D.Lookup Tables and Enrichment rules
AnswerD

Lookup tables allow administrators to append contextual asset or threat data to logs during ingestion and parsing.

Why this answer

Lookup tables or Enrichment rules in XSIAM allow administrators to map ingested log fields against reference datasets or threat intel feeds to enrich logs during processing.

Full explanation →
39
MCQeasy

A deployment team is planning the rollout of Cortex XSIAM agents across a heterogeneous environment containing Windows, macOS, and Linux endpoints. Which core architectural component must be provisioned and accessible from all endpoints to ensure successful agent registration and policy synchronization?

A.Prisma Access Remote Network
B.Panorama Management Server
C.Cortex XSIAM Broker VM
D.Cortex XSOAR Engine Cluster
AnswerC

The Broker VM is required for internal network agent communication, log collection, and act as a regional proxy.

Why this answer

The Cortex XSIAM Broker VM acts as the intermediary for agent communications, acting as a proxy and distribution point for agents deployed across the network.

Full explanation →
40
Multi-Selectmedium

Which THREE configuration steps are typically required when setting up a new Broker VM instance in XSIAM? (Choose three)

Select 3 answers
A.Deploy the OVA image on an on-premises hypervisor (e.g., VMware ESXi)
B.Manually compile the Linux kernel on the Broker VM
C.Generate a registration token from the XSIAM console
D.Install the Cortex XDR Agent on the Broker VM host machine
E.Configure network settings and optional proxy parameters during initial setup
AnswersA, C, E

Correct. Broker VMs are provided as virtual appliance images (OVA) for on-premises deployment.

Why this answer

Setting up a Broker VM involves generating a registration token, deploying the OVA image to a hypervisor, and configuring the network and proxy settings.

Full explanation →
41
MCQmedium

A customer wants to forward alerts from XSIAM to an external SIEM. Which method provides the most efficient way to achieve this continuously?

A.Manual API requests for alert history.
B.Configuring an 'External Log Forwarding' profile in XSIAM.
C.Scheduled XQL report exports via email.
D.Using a playbook to copy every alert into a text file.
AnswerB

This is the native feature designed for streaming XSIAM logs to external systems.

Why this answer

The Log Forwarding configuration in XSIAM allows for real-time streaming of alert data to external destinations.

Full explanation →
42
MCQmedium

An administrator is deploying the Cortex XSIAM agent via Microsoft Intune and needs to ensure that kernel-level extensions on macOS endpoints do not block the installation. Which preliminary step must be completed?

A.Pre-approve system extensions and network filters using an MDM configuration profile
B.Convert all macOS file systems to legacy HFS+ format
C.Disable SIP (System Integrity Protection) on all target macOS endpoints
D.Install the XSIAM agent manually using an interactive terminal session
AnswerA

macOS requires MDM payloads to pre-approve system and network extensions to avoid user prompting and installation failure.

Why this answer

macOS deployments require MDM configuration profiles (such as System Extensions and Network Extensions) to be approved prior to agent rollout.

Full explanation →
43
MCQmedium

An administrator is deploying a Broker VM on a VMware ESXi hypervisor. After deploying the OVA template, the administrator notices the Broker VM cannot reach the NTP server and fails activation. Which initial configuration step was likely missed?

A.Allocating additional virtual CPU sockets to handle cryptographic handshakes.
B.Enabling SSH service access in the Cortex XSIAM tenant settings.
C.Configuring the static IP address, subnet mask, default gateway, and DNS servers in the Broker VM console interface.
D.Installing the VMware Tools package inside the guest Linux operating system.
AnswerC

Without proper network configuration, the VM lacks routing to reach NTP and the XSIAM cloud.

Why this answer

Network settings, including IP addressing, DNS, and gateway configurations, must be properly applied during the initial Broker VM console setup to ensure connectivity.

Full explanation →
44
MCQmedium

An engineer needs to ingest custom JSON-formatted logs from an internal application using an HTTP API. Which XSIAM feature should be configured to receive these incoming webhook payloads?

A.Cortex XDR REST API direct ingestion
B.Syslog over TCP/UDP Collector
C.Broker VM HTTP API Collector
D.XPANSE Attack Surface Management feed
AnswerC

Correct. The HTTP API collector on the Broker VM exposes an endpoint to receive incoming webhooks and JSON logs.

Why this answer

The HTTP API log collector on the Broker VM allows external applications to push JSON payloads directly into XSIAM.

Full explanation →
45
MCQmedium

An administrator is planning network changes for an environment where endpoints communicate through a corporate HTTP proxy. To ensure Cortex XDR agents maintain continuous connectivity to the XSIAM tenant, what must the administrator verify regarding the proxy configuration?

A.The proxy must allow outbound HTTPS traffic to XSIAM FQDNs and support websocket connections without SSL inspection
B.The proxy server must run a local Broker VM instance to cache agent heartbeat signals
C.The proxy must translate all UDP syslog packets into TCP streams before forwarding
D.The proxy must perform full SSL decryption on all agent-to-cloud traffic to inspect security payloads
AnswerA

Agents require uninterrupted HTTPS and websocket communication to the cloud backend, which fails if SSL inspection is applied.

Why this answer

Cortex XDR agents must be configured with the correct proxy settings (either via installer properties or agent settings) and the proxy must allow outbound HTTPS traffic to the required XSIAM FQDNs without SSL decryption interference.

Full explanation →
46
MCQeasy

An organization requires all audit logs generated within XSIAM to be exported to an external SIEM for long-term archiving. Which feature should the administrator configure?

A.Enable Cortex XSOAR playbook automation to execute a daily database backup.
B.Set up a BIOC alert rule to email CSV exports every 24 hours.
C.Modify the Data Retention profile to replicate raw blocks to an external S3 bucket automatically.
D.Configure a Log Forwarding profile under Settings > Configurations > Data Collection > Log Forwarding.
AnswerD

Correct. Log Forwarding profiles allow exporting XSIAM ingested data and audit logs to external destinations.

Why this answer

External log forwarding rules can be configured in XSIAM to stream logs, including audit and security events, to third-party destinations via standard protocols like syslog or HTTP.

Full explanation →
47
Multi-Selecthard

An architect is designing a scalable Cortex XSIAM deployment across multiple geographically distributed corporate offices. Which THREE design considerations are critical when placing Broker VMs in remote locations? (Choose three)

Select 3 answers
A.Installing physical tape backup libraries on each Broker VM for local disaster recovery.
B.Establishing appropriate firewall and routing rules between remote subnets and the regional Broker VM.
C.Configuring local syslog collection points so remote devices do not traverse WAN links uncompressed.
D.Configuring every remote endpoint to stream raw packet captures directly to the central cloud data lake over public internet.
E.Ensuring reliable WAN bandwidth and configuring log compression or filtering to prevent network saturation.
AnswersB, C, E

Network reachability to the local Broker VM is essential for agents and log sources.

Why this answer

Placing Broker VMs in remote sites requires evaluating local network bandwidth, setting up local log buffering/forwarding, and ensuring proper firewall and DNS configuration.

Full explanation →
48
MCQhard

An organization requires strict data residency compliance, ensuring that all log data collected by Cortex XSIAM remains within the European Union. During tenant initialization, how must the administrator satisfy this requirement?

A.Deploy an on-premises Hadoop data lake and configure XSIAM to forward all raw logs via API
B.Select the appropriate EU-based cloud region during initial tenant provisioning and activation
C.Configure log forwarding profiles within the Cortex XSOAR settings menu
D.Modify the Broker VM local storage configuration file to encrypt data using EU-specific keys
AnswerB

Data residency boundaries are established when the tenant is provisioned in the designated regional cloud.

Why this answer

Tenant region and data residency are determined at the time of initial tenant provisioning and selection by Palo Alto Networks support/activation.

Full explanation →
49
MCQeasy

An administrator needs to add a new user account to XSIAM and assign appropriate privileges. Where is user account creation and management performed?

A.Check the Endpoint Management > Add Device wizard.
B.Go to License Management and click Allocate Seat.
C.Open the Incident Response dashboard and click New Analyst.
D.Navigate to Settings > Access Management > Users to add new user accounts and assign roles.
AnswerD

Correct. User accounts and role assignments are managed in Access Management.

Why this answer

User account creation and privilege assignment are managed under Settings > Access Management > Users.

Full explanation →
50
MCQeasy

An XSIAM administrator is configuring a new syslog data source to ingest security logs from an on-premises Linux firewall. Which Collector component must be deployed within the network perimeter to securely forward these logs to the XSIAM tenant?

A.Panorama Forwarder
B.Broker VM
C.XSOAR Engine
D.Cortex XDR Agent
AnswerB

The Broker VM is the designated virtual appliance used to collect third-party logs such as syslog and forward them to XSIAM.

Why this answer

The Cortex XDR Collector (or Broker VM) acts as an intermediary agent deployed within the customer's network to ingest logs via syslog and securely forward them to the XSIAM cloud backend.

Full explanation →
51
MCQeasy

An administrator needs to check the remaining license capacity and expiration date of the XSIAM subscription. Where should the administrator look?

A.Check the Incident Graph summary panel.
B.Navigate to Settings > License Management to view subscription status and capacity.
C.Review the XQL query execution history log.
D.Open the Endpoint Management > Agent Status tab.
AnswerB

Correct. License Management provides details on subscription validity and data consumption limits.

Why this answer

Subscription details, license capacity, and expiration dates are located in XSIAM under Settings > License Management.

Full explanation →
52
MCQhard

An administrator is troubleshooting a Broker VM that has lost connectivity to the XSIAM management plane. After checking network routing and firewalls, the administrator suspects local Docker container network corruption on the Broker VM host. Which administrative utility script on the Broker VM can be used to restart and reset the container networking stack?

A.Access the Broker VM administrative console CLI to execute service restart and network reset utilities.
B.Modify the global tenant encryption keys under General Settings.
C.Execute an XQL query with the `reset_broker` command.
D.Run the `xdrctl uninstall` command on every managed Windows endpoint.
AnswerA

Correct. Broker VM management CLI provides built-in utilities to restart services and reset local networking.

Why this answer

Broker VMs provide administrative utility scripts and management menus (accessible via CLI) to restart services, reset networking, and manage container states.

Full explanation →
53
Multi-Selectmedium

An administrator is configuring log collection from a cloud storage bucket (e.g., AWS S3) into XSIAM. Which TWO configuration steps are required to establish this ingestion pipeline? (Choose two)

Select 2 answers
A.Specify the target bucket name and region in the XSIAM Data Collection configuration.
B.Deploy a physical hardware appliance in every AWS Availability Zone.
C.Configure the local Windows registry on the administrator workstation to route AWS traffic.
D.Manually install the Cortex XDR Agent on the AWS S3 root server.
E.Configure the cloud storage integration instance with appropriate authentication credentials (IAM role/keys) in XSIAM.
AnswersA, E

Correct. The collector requires the specific bucket name and region parameters to poll or receive notifications.

Why this answer

Cloud storage bucket ingestion requires setting up cloud integration credentials (IAM roles/keys) and configuring the data collection instance in XSIAM specifying the bucket details.

Full explanation →
54
MCQhard

An organization is integrating Microsoft Entra ID (formerly Azure AD) sign-in logs into Cortex XSIAM. The architect decides to use an Event Hub integration model via a Content Hub pack. What is the architectural role of the Event Hub in this ingestion pipeline?

A.It replaces the need for SSL certificates by enforcing unencrypted local network pipes
B.It acts as a scalable streaming buffer that temporarily holds log messages until pulled by the XSIAM integration collector
C.It translates Azure audit logs directly into native Cortex XDR agent binary commands
D.It acts as a local hypervisor running a containerized Broker VM instance in Azure
AnswerB

Event Hub buffers log streams for reliable consumption by external SIEM/XSIAM connectors.

Why this answer

Azure Event Hub acts as a scalable streaming message broker that collects logs from Entra ID and holds them until the Cortex XSIAM integration pulls them for parsing and ingestion.

Full explanation →
55
MCQmedium

An administrator needs to configure secure log forwarding from an on-premises syslog source into Cortex XSIAM using a Broker VM. Which specific Broker VM app must be enabled and configured to receive these syslog messages?

A.PAN-OS Collector App
B.Active Directory App
C.Syslog App
D.Agent Proxy App
AnswerC

Correct. The Syslog app on the Broker VM receives raw syslog data from third-party security devices and forwards it to XSIAM.

Why this answer

The Syslog app on the Broker VM must be configured to ingest syslog data from external log sources and forward it to the Cortex XSIAM tenant.

Full explanation →
56
Multi-Selectmedium

An administrator is setting up external log forwarding from XSIAM to a third-party SIEM. Which TWO protocols are natively supported for log forwarding destinations? (Choose two)

Select 2 answers
A.Direct FTP file upload of raw database blocks
B.Direct SMB file share mapping to the XSIAM cloud backend storage
C.Syslog (TCP or UDP)
D.HTTP / HTTPS (JSON payload via webhooks)
E.Local Bluetooth serial cable connection
AnswersC, D

Correct. Syslog is natively supported for streaming logs to external SIEMs.

Why this answer

XSIAM log forwarding profiles support industry standard streaming protocols such as Syslog and HTTP/HTTPS (Webhooks).

Full explanation →
57
MCQhard

You are troubleshooting a parsing error where logs from a custom application are not being mapped correctly to the XDM schema. What is the recommended approach to debug the transformation process?

A.Create a new playbook to manually map the fields in the alert.
B.Modify the ingestion configuration to change the vendor product type.
C.Use the XDM Parsing tool to test the log sample against the existing parser and view validation errors.
D.Update the Data Collector version on the server.
AnswerC

This is the native tool for debugging field mapping.

Why this answer

The XDM parsing tool allows for testing log samples against parser definitions to identify mapping failures.

Full explanation →
58
Multi-Selecthard

An administrator is preparing the infrastructure readiness assessment for integrating various log sources into Cortex XSIAM. Which THREE log collection methods or mechanisms are natively supported by the Broker VM architecture? (Choose three)

Select 3 answers
A.Direct fiber-optic tap connection into the Broker VM PCI bus for inline packet decoding.
B.API-based log polling integrations for cloud services and SaaS applications.
C.Raw magnetic tape drive mounting for legacy mainframe log ingestion.
D.Syslog over UDP and TCP for network devices and security appliances.
E.HTTP/HTTPS log ingestion collectors for custom application log streams.
AnswersB, D, E

API pollers and collectors run on Broker VMs or cloud connectors.

Why this answer

Broker VMs support multiple ingestion methods including Syslog (UDP/TCP), HTTP/HTTPS collectors, and API-based pollers or integrations.

Full explanation →
59
MCQeasy

During the initial onboarding phase of a Cortex XSIAM tenant, an administrator needs to download and deploy the Broker VM OVA template. Where within the Cortex XSIAM UI can the administrator find the Broker VM image download link and deployment tokens?

A.Marketplace > Content Hub > Broker VM Management
B.Incidents > Response > Integrations > Broker VM
C.Dashboards > System Status > Virtual Appliances
D.Settings > Configurations > Data Collection > Broker VM
AnswerD

The Broker VM management section under Data Collection provides the OVA image downloads, registration tokens, and deployment status.

Why this answer

The Broker VM images and deployment tokens are located under Settings > Configurations > Data Collection > Broker VM in the XSIAM management console.

Full explanation →
60
Multi-Selecthard

When troubleshooting a failing integration instance in XSIAM, which THREE tools or logs are most useful for diagnosing the root cause? (Choose three)

Select 3 answers
A.Cortex XDR Agent endpoint quarantine logs
B.System Audit logs for administrative actions
C.The CLI command execution output for test commands
D.Integration instance execution and debug logs
E.The local BIOS event log of the client workstation
AnswersB, C, D

Correct. Audit logs track configuration changes and credential updates.

Why this answer

Troubleshooting integrations involves checking the Audit logs, the Automation Debug / Integration logs, and testing connectivity via CLI.

Full explanation →
61
Multi-Selecthard

Which THREE of the following are critical components required for a successful data ingestion integration in XSIAM?

Select 3 answers
A.A defined XDM parser to normalize the incoming data.
B.A dedicated XQL dashboard for every integration.
C.Valid API credentials or authentication tokens.
D.An active and healthy Data Collector group.
E.A pre-configured firewall rule for all internal traffic.
AnswersA, C, D

Normalization is necessary for XSIAM to understand and query the data.

Why this answer

Successful integration requires an active collector, valid credentials, and properly configured parsing logic.

Full explanation →
62
MCQhard

An enterprise is evaluating infrastructure readiness for Cortex XSIAM and plans to ingest massive volumes of NetFlow and VPC flow logs. The deployment architect decides to route these streams through Broker VMs rather than sending them directly from cloud VPCs to the XSIAM cloud. What is the primary architectural advantage of using Broker VMs for this ingestion path?

A.Broker VMs replace the requirement for Cortex XSIAM parser configuration by dynamically guessing schema definitions.
B.Broker VMs perform local log normalization, compression, and buffering to optimize WAN bandwidth utilization and handle temporary cloud connectivity outages.
C.Broker VMs eliminate the need for any firewall rules or security group configurations in the cloud environment.
D.Broker VMs automatically convert all raw NetFlow packets into custom Python playbooks for instant XSOAR execution.
AnswerB

Correct. Using Broker VMs provides buffering during network outages and optimizes ingestion traffic toward the XSIAM cloud.

Why this answer

Broker VMs act as local collectors that can perform preprocessing, buffering, and secure batch forwarding, reducing direct cloud exposure and optimizing bandwidth.

Full explanation →
63
MCQmedium

An XSIAM engineer is troubleshooting a newly configured AWS CloudTrail integration. Log data is not appearing in the XSIAM query builder. Which log collection method is natively utilized by XSIAM to pull AWS CloudTrail logs?

A.Amazon SQS queue polling via an integration instance
B.Direct Syslog forwarding from AWS VPC to Broker VM
C.Scheduled SCP file transfer to a Broker VM SFTP directory
D.Cortex XDR Agent polling AWS metadata
AnswerA

Correct. AWS integrations typically rely on SQS queues and IAM roles for reliable event streaming.

Why this answer

XSIAM uses the SQS-based architecture where AWS services push notifications to an SQS queue, and the integration pulls from that queue.

Full explanation →
64
MCQhard

An enterprise environment has strict network segmentation where log sources in a secure DMZ cannot communicate directly with the primary Broker VM located in the corporate network. How should an architect design the log collection architecture to feed data into Cortex XSIAM?

A.Configure a port-mirroring session on the core firewall to duplicate all DMZ traffic to the Broker VM via local loopback.
B.Install the Cortex XDR agent on all network routers and switches in the DMZ to capture syslog locally.
C.Deploy a secondary Broker VM within the DMZ configured to forward logs securely to the primary Broker VM or directly to the XSIAM tenant.
D.Open bidirectional UDP port 514 across the internal corporate firewall to allow DMZ devices to stream raw syslog directly.
AnswerC

Placing a Broker VM in the DMZ isolates the network zones while maintaining ingestion pipelines.

Why this answer

Deploying a dedicated Broker VM inside the DMZ zone allows local log collection from DMZ sources while securely forwarding normalized logs to the XSIAM backend or through authorized firewalls.

Full explanation →
65
MCQmedium

An automation engineer needs to ensure that a specific integration command runs with restricted permissions. Where are integration command execution permissions or role-based access controls managed in XSIAM?

A.Marketplace > Installed Integrations > Security
B.Settings > Access Management > Roles
C.Data Collection > Broker VM > Security Policy
D.Incident Response > Playbooks > Permissions tab
AnswerB

Correct. Access Management roles define what API integrations and users are authorized to execute.

Why this answer

Integration and automation execution permissions, such as API keys and role mappings, are managed under User Roles and Integration service accounts.

Full explanation →
66
MCQmedium

An organization is setting up Cortex XSIAM and wishes to restrict administrative access so that specific Tier-2 analysts can modify prevention policies but cannot create new user accounts or modify RBAC settings. How should this be configured?

A.Grant full administrator access and use audit logs to monitor unauthorized changes.
B.Create a custom role with 'Policy Management' permissions enabled and 'User Management' permissions disabled.
C.Assign the built-in 'Power User' role and rely on organizational policy guidelines.
D.Use Active Directory group mapping to restrict menu items via CSS injection.
AnswerB

Custom roles enable granular separation of administrative duties.

Why this answer

Custom roles in Cortex XSIAM allow precise selection of permissions, granting policy management rights while withholding user management and RBAC administration privileges.

Full explanation →
67
MCQmedium

An administrator is planning the deployment of Broker VMs in a high-availability configuration. What is the recommended approach for handling Broker VM redundancy?

A.Install two instances of the Broker VM software on the exact same virtual machine instance.
B.Configure the Cortex XDR agents with a single hardcoded IP address and rely on BGP Anycast for failover.
C.Deploy multiple Broker VMs in a clustered group or behind a network load balancer to ensure seamless failover and load distribution.
D.Configure active-passive clustering using Microsoft Windows Failover Clustering inside the Broker VM guest OS.
AnswerC

High availability is achieved by deploying redundant Broker VMs to share the load.

Why this answer

Deploying multiple Broker VMs behind a load balancer or as a logical cluster ensures high availability and failover capabilities for agent check-ins and log forwarding.

Full explanation →
68
MCQeasy

What is the recommended method for upgrading Broker VMs in a Cortex XSIAM deployment?

A.Executing an 'apt-get upgrade' command via SSH on every Broker VM instance.
B.Manually downloading ISO images from the Palo Alto Networks Customer Support Portal and burning them to physical media.
C.Initiating the upgrade directly from the Cortex XSIAM web management console under Broker VM settings.
D.Re-deploying a brand-new OVA template for every minor software release.
AnswerC

Centralized management allows administrators to trigger Broker VM upgrades seamlessly from the tenant UI.

Why this answer

Broker VMs are upgraded centrally from the Cortex XSIAM web interface under the deployments or infrastructure management menu, ensuring version compatibility.

Full explanation →
69
MCQmedium

An administrator needs to install Cortex XDR agents across a fleet of Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation parameter is strictly required during the MSI execution to ensure the agent correctly pairs with the appropriate Cortex XSIAM tenant?

A.CORIFY=1 TOKEN=<Installation_Token>
B.INSTALLDIR="C:\Program Files\Cortex" SERVER=tenant.xdr.local
C.HANDLER_SERVER=<tenant_address> TC_CUSTOM_ID=<installation_token>
D./q /norestart WINDOWS_USERNAME=admin
AnswerC

Using the correct installer properties ensures the agent registers to the correct tenant.

Why this answer

When deploying agents via scripts, GPO, or enterprise tools, the installation parameters must include the server address and the unique installation token (CustomerID).

Full explanation →
70
MCQhard

An administrator is investigating a data discrepancy where certain security logs ingested via a Broker VM do not match the raw source timestamps. Where can timezone and timestamp normalization settings be reviewed or adjusted?

A.Change the system clock on the local administrator workstation.
B.Review and adjust parser extraction rules and timezone configurations in Settings > Configurations > Data Collection > Parsers.
C.Reinstall the Cortex XDR Agent on all network switches.
D.Purge the entire Cortex Data Lake to reset cloud time servers.
AnswerB

Correct. Parsers handle timestamp extraction and normalization during log ingestion.

Why this answer

Timestamp parsing and normalization rules can be reviewed and adjusted within custom parser definitions or ingestion settings in XSIAM.

Full explanation →
71
Multi-Selectmedium

Which TWO of the following features help maintain data security during the integration process?

Select 2 answers
A.Automatic public IP assignment for every collector.
B.Full administrative rights for every integration service account.
C.Encrypted credential vaulting for API keys.
D.RBAC (Role-Based Access Control) for integration management.
E.Disabling all logs for third-party integrations.
AnswersC, D

Vaulting ensures sensitive data is not exposed.

Why this answer

Role-based access and secure credential storage are essential for maintaining the security of integrations.

Full explanation →
72
MCQeasy

An administrator is preparing to deploy the Cortex XDR agent on Windows workstations via an Active Directory Group Policy Object (GPO). Which file format must the administrator download from the XSIAM console for this deployment method?

A..exe
B..tar.gz
C..msi
D..ova
AnswerC

Active Directory GPO natively supports deploying software packages packaged in .msi format.

Why this answer

Active Directory GPO software installation deployments require an MSI (Microsoft Installer) package format.

Full explanation →
73
MCQmedium

An engineer is configuring a webhook integration to forward XSIAM alerts to an external ticketing platform. The external system requires custom HTTP headers for authentication. Where can these custom headers be configured within the integration instance?

A.Within the Broker VM local firewall rules
B.In the integration instance configuration parameter fields
C.Inside the incident layout designer
D.In the XSIAM Global Server proxy configuration file
AnswerB

Correct. Instance-specific parameters allow specifying custom headers, proxy settings, and credentials.

Why this answer

Integration instances in XSIAM often include instance configuration parameters where custom headers, credentials, and API keys are specified.

Full explanation →
74
Multi-Selecthard

An enterprise environment is planning to ingest threat intelligence feeds into Cortex XSIAM. Which THREE threat intelligence formats or integration methods are natively supported by XSIAM content packs? (Choose three)

Select 3 answers
A.Direct file uploads of CSV or IOC list files via marketplace integration content packs
B.Broadcasting IOCs over analog radio frequency (RF) channels
C.TAXII (Automated Exchange of Intelligence Information) servers and STIX format feeds
D.Custom REST API integrations with third-party threat intelligence platform (TIP) providers
E.Manual entry of indicators carved onto physical punch cards
AnswersA, C, D

Static indicator lists (CSV/TXT) can be ingested via file-based threat intel content packs.

Why this answer

Cortex XSIAM supports various threat intelligence ingestion methods, including TAXII servers, STIX feeds, and custom API-based threat intelligence integrations.

Full explanation →
75
MCQmedium

An administrator needs to modify the display name and description of a custom data collector instance. Where can this configuration be edited?

A.Modify the global DNS zone file on the primary nameserver.
B.Navigate to Settings > Configurations > Data Collection > Collectors, select the instance, and edit its configuration.
C.Open the Endpoint Management > Agent Details screen.
D.Run an XQL update command against the `collector_metadata` system table.
AnswerB

Correct. Collector instance settings can be edited directly in the Data Collection configuration menu.

Why this answer

Data collector instances and their metadata can be edited under Settings > Configurations > Data Collection > Collectors.

Full explanation →

Page 1 of 3

Page 2

All pages

123

Practice XSIAM-Engineer by domain

Target a specific domain to shore up weak areas.

Operations And Lifecycle ManagementPlanning And InstallationIntegration And AutomationXSIAM Platform Architecture And Deployment
See all domains with question counts →