Certified XSIAM Engineer (XSIAM-Engineer) (XSIAM-Engineer) — Questions 76–150

An administrator needs to modify the display name and description of a custom data collector instance. Where can this configuration be edited?

An XSIAM administrator is troubleshooting an integration instance that is failing to connect to an external ticketing system. The administrator needs to verify whether the underlying API calls are failing due to invalid credentials or network timeouts. Where should the administrator review detailed debug logs for this specific integration instance?

Which TWO prerequisites must be validated before deploying a Cortex XSIAM Broker VM in a VMware ESXi environment? (Choose two)

An administrator wants to verify agent health and operational status across endpoints in Cortex XSIAM. Which TWO metrics or statuses can be viewed in the Endpoints inventory view? (Choose two)

An XSIAM administrator needs to configure log forwarding from a Linux server to the XSIAM collector. Which action must be performed first on the endpoint before deploying the Collector service?

What is the primary function of the Broker VM in a Cortex XSIAM deployment architecture?

An administrator is troubleshooting network connectivity between a Broker VM and the Cortex XSIAM cloud backend. Which THREE diagnostic checks or network requirements must be verified? (Choose three)

An organization requires that certain sensitive datasets ingested into Cortex XSIAM be automatically purged after a specific retention period shorter than the default tier. Where can an administrator configure custom retention policies for specific datasets?

An administrator needs to troubleshoot why a Broker VM is failing to ingest logs from an internal syslog source. Which diagnostic utility available on the Broker VM console should the administrator use first?

An administrator is configuring a new syslog ingestion source on a Broker VM. The syslog messages use TCP with TLS encryption (Reliable Syslog). Where must the corresponding TLS server certificates for the Broker VM be configured?

An administrator is designing a custom incident triage workflow in XSIAM. Which THREE actions can be automated as part of incident management configuration? (Choose three)

An administrator is preparing to deploy Cortex XDR agents across a large macOS fleet using a Mobile Device Management (MDM) solution such as Jamf Pro. Which configuration profile component is critical to deploy alongside the agent installation package on modern macOS versions?

Which TWO of the following actions can be performed within the Cortex XSIAM Marketplace?

An enterprise has multiple distinct business units, and the security operations team wants to ensure that analysts from Business Unit A can only investigate incidents assigned to their own unit, while global administrators can view everything. Which feature enables this multi-tenant or partitioned operational structure within a single XSIAM tenant?

An administrator notices that a particular correlation rule is generating a high volume of false positive incidents. What is the recommended operational step to refine the rule without disabling it entirely?

When planning an enterprise-wide rollout of Cortex XDR agents, administrators often utilize 'Upgrade Rings'. What is the primary purpose of an upgrade ring in Cortex XSIAM deployment strategy?

An administrator wants to create a custom dashboard displaying key SOC metrics such as open incidents by severity and top alerted hosts. Which section of XSIAM should the administrator use to build this dashboard?

An enterprise environment requires all outbound API traffic from XSIAM integrations to pass through an explicit corporate proxy server. Where is the global proxy configuration specified for integration instances?

When defining custom user roles and permissions in Cortex XSIAM, which TWO granular access controls can an administrator assign? (Choose two)

An analyst reports that the XSIAM web interface session is timing out too quickly due to security policies. Where can an administrator modify the idle session timeout duration?

An administrator needs to monitor the health and status of active data collection integrations in XSIAM. Which dashboard or menu provides visibility into data ingestion rates and agent/collector statuses?

An administrator needs to configure automated incident assignment so that all incidents originating from network firewall logs are automatically routed to the Network Security SOC team. Which XSIAM feature accomplishes this?

An administrator wants to customize the fields displayed in the Incident table view to better align with the SOC's operational workflow. How should this be accomplished?

An administrator is troubleshooting a newly configured API-based integration that is failing to ingest logs into Cortex XSIAM. The test connection fails with an authentication error, despite valid API credentials being entered. What is a common architectural oversight that causes this failure?

An administrator wants to install a new integration pack to automate ticket creation in ServiceNow. Where in the XSIAM interface should the administrator navigate to find and install this pack?

When managing integrations in XSIAM, what is the purpose of the 'Test' button found in the integration instance configuration?

An administrator needs to review all administrative actions (such as user logins, configuration changes, and role modifications) performed within the XSIAM tenant over the last 30 days. Where is this audit data located?

An organization has multiple business units sharing a single Cortex XSIAM tenant. Leadership requires that security analysts in Business Unit A can only view alerts and endpoints associated with their specific department, while global administrators retain full visibility. How must the deployment engineer configure access control to achieve this?

You need to ensure that a specific integration uses a dedicated proxy server to communicate with the cloud. Where is this proxy configuration defined?

An administrator is preparing to deploy Cortex XDR agents across a heterogeneous enterprise network. Which THREE deployment methods are natively supported and commonly utilized for agent rollout? (Choose three)

An administrator is troubleshooting an API integration that has stopped collecting data. Which THREE diagnostic steps should be performed? (Choose three)

An XSIAM administrator wants to test connectivity to an external REST API integration without running a full playbook. Which feature in XSIAM allows direct testing of integration commands?

During routine maintenance, an administrator notices that a custom parser is dropping incoming events from a newly integrated security appliance. Where should the administrator check to debug syntax and grok pattern failures in real time?

When planning log collection and ingestion strategies in Cortex XSIAM, an architect can ingest data from multiple sources. Which THREE log sources are natively supported for direct or Broker VM-mediated ingestion? (Choose three)

An enterprise environment has deployed multiple Cortex XDR agents across diverse operating systems. The administrator wants to organize endpoints logically within XSIAM before assigning granular security policies. Which Cortex XSIAM feature should be used to dynamically group these endpoints based on criteria such as OS version, domain, or IP subnet?

Which TWO methods are supported in XSIAM for forwarding alerts or incident details to external SIEM or ticketing systems? (Choose two)

An administrator is configuring a Broker VM to collect Syslog data from various network devices. Some devices transmit syslog over TCP while others use UDP. How should the Broker VM syslog collector be configured to handle both?

An organization is updating its internal Certificate Authority (CA). The administrator needs to update the trusted CA certificates used by the Broker VMs for secure syslog ingestion. Where must this certificate update be performed?

Which THREE best practices should be followed when designing custom automation integrations and playbooks in XSIAM? (Choose three)

An architect is estimating storage capacity requirements for Cortex XSIAM. Which formula correctly represents the core calculation for raw daily log ingestion planning?

An architect is designing a multi-tenant XSIAM data ingestion pipeline where distinct business units must have isolated visibility and role-based access control over their respective log sources. Which XSIAM architectural construct should be configured to ensure strict data segregation between business units?

An engineer is mapping a non-standard third-party security log source into the XSIAM Common Data Model (XDM). Which tool within XSIAM should be used to define custom parsing rules and field mappings?

Which protocol is natively supported by the Broker VM Syslog collector for receiving log streams from network devices?

When planning an initial Cortex XSIAM deployment, an administrator must configure organizational settings. Which TWO configurations are typically established during the initial tenant setup phase? (Choose two)

When deploying Cortex XDR agents across an enterprise, what is the primary role of an installation token?

An administrator needs to restrict access to sensitive XSIAM incident data to specific compliance officers. Which TWO actions accomplish this requirement? (Choose two)

Which TWO of the following are valid ways to trigger an automation playbook in Cortex XSIAM?

An enterprise environment utilizes a strict certificate-based Proxy for all outbound internet connections. During the deployment of Cortex XDR agents via software deployment tools, the agents fail to establish a connection to the XSIAM tenant because they do not trust the proxy's interception certificate. How should this be resolved?

Which THREE of the following are benefits of using the XDM (eXtendable Data Model) in Cortex XSIAM?

An architect is planning the deployment prerequisites for a Broker VM in a customer environment. Which TWO infrastructure requirements must be verified before deploying the OVA template? (Choose two)

An administrator wants to view a chronological list of recent software updates and content pack releases applied to the XSIAM tenant. Where can this release history be checked?

An administrator is deploying Cortex XDR agents to a fleet of macOS endpoints using a Mobile Device Management (MDM) solution like Jamf Pro. What is required to ensure the agent has full disk access and system extension approvals on modern macOS versions without user prompting?

An architect is designing an enterprise deployment strategy for Cortex XSIAM in an environment with strict change management windows. Which THREE planning considerations are critical for a successful rollout? (Choose three)

When setting up a new Data Collector, you need to ensure high availability for log collection from a remote site. What is the best practice for deploying the collectors?

During an assessment of infrastructure readiness for Cortex XSIAM, an engineer calculates the required daily log ingestion volume and determines it exceeds the licensed capacity. What architectural feature or mechanism within XSIAM can the administrator configure to optimize data ingestion without losing critical security telemetry?

An XSIAM tenant is approaching its licensed data ingestion volume limit. The operations team needs to identify which data sources are consuming the highest ingestion bandwidth. Where should the administrator check this information?

An enterprise security team wants to ensure that all data ingested from a specific untrusted data source is automatically tagged with a specific tag for downstream analytics. Where can this automatic tagging rule be applied during integration setup?

An administrator is investigating why an automated response playbook integrated via Cortex XSOAR failed to execute when triggered by an XSIAM incident. Where should the administrator check the integration communication logs?

During a high-availability planning session for an on-premises Broker VM deployment, an architect considers deploying multiple Broker VMs behind a load balancer to handle syslog collection from thousands of network devices. What is a critical architectural limitation or consideration when placing Broker VMs behind a load balancer for syslog collection?

An administrator is configuring Role-Based Access Control (RBAC) in Cortex XSIAM and needs to grant a tier-1 SOC analyst the ability to view incidents and execute isolation commands on endpoints, but strictly prohibits them from modifying security policies or viewing sensitive user identity logs. How should this custom role be constructed?

An administrator wants to configure automated email notifications to be sent to external stakeholders whenever a Critical severity incident is created. Which feature should be configured?

During the sizing phase of a Cortex XSIAM deployment, an architect needs to estimate the required IOPS and storage retention footprint for endpoint telemetry. Which factor has the most direct impact on the raw ingestion volume calculation?

An administrator is setting up custom Role-Based Access Control (RBAC) folders and permissions in Cortex XSIAM to segregate data access between regional security teams. Which TWO configuration steps are required when creating a new custom role and assigning data scopes? (Choose two)

During the infrastructure readiness assessment for Cortex XSIAM deployment, which outbound network connectivity requirement must be verified for the Broker VM to ensure proper communication with the XSIAM tenant?

Which TWO components or methods are valid options for ingesting third-party log data into XSIAM? (Choose two)

An organization is enforcing strict segregation of duties within Cortex XSIAM using Role-Based Access Control (RBAC). Which TWO administrative actions can be restricted so that standard security analysts cannot perform them? (Choose two)

Which TWO actions can an administrator perform when managing integration instances within XSIAM? (Choose two)

An operations team needs to ensure that inactive user accounts are automatically locked out after 90 days of inactivity. Where is this security policy managed?

An administrator is verifying that firewall rules at the corporate perimeter permit outbound communication from Cortex XDR agents. Which destination criteria must be allowed for agent communication?

An administrator is configuring data collection policies in Cortex XSIAM to optimize storage and ingestion costs. The organization wishes to exclude verbose, non-security-relevant informational logs from a specific firewall source. Which mechanism should the administrator configure?

When establishing Role-Based Access Control (RBAC) in Cortex XSIAM, what is the purpose of assigning 'Folder' scopes to a custom role?

An administrator is setting up an integration with a third-party threat intelligence platform using Cortex XSOAR capabilities embedded within XSIAM. The integration instance requires periodic polling to fetch newly published Indicators of Compromise (IoCs). Where should the administrator configure the fetch interval?

An administrator wants to optimize XQL search performance across large log datasets. Which TWO best practices should be applied when writing queries? (Choose two)

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux servers. Which THREE tasks should be performed during the planning and deployment phase? (Choose three)

An administrator needs to ensure that custom dashboards created by SOC analysts are backed up or migrated between environments. Which TWO options are available for content portability in XSIAM? (Choose two)