Sample questions
Certified XSIAM Engineer (XSIAM-Engineer) practice questions
An automation engineer is writing a custom Python script for an XSIAM automation task and needs to query XSIAM incident data. Which integration library or command standard must be…
An XSIAM engineer is troubleshooting a newly configured AWS CloudTrail integration. Log data is not appearing in the XSIAM query builder. Which log collection method is natively ut…
Which TWO methods are supported in XSIAM for forwarding alerts or incident details to external SIEM or ticketing systems? (Choose two)
An XSIAM administrator is configuring a new API-based integration to ingest threat intelligence feeds. During configuration, what credential type is most commonly required by moder…
An automation engineer needs to ensure that a specific integration command runs with restricted permissions. Where are integration command execution permissions or role-based acces…
Which TWO components or methods are valid options for ingesting third-party log data into XSIAM? (Choose two)
An engineer is configuring a webhook integration to forward XSIAM alerts to an external ticketing platform. The external system requires custom HTTP headers for authentication. Whe…
Which protocol is natively supported by the Broker VM Syslog collector for receiving log streams from network devices?
An XSIAM administrator wants to test connectivity to an external REST API integration without running a full playbook. Which feature in XSIAM allows direct testing of integration c…
An XSIAM administrator is configuring automated log ingestion filtering to drop high-volume, low-value informational events before they consume license quota. Which feature enables…
An administrator needs to update the Cortex XDR agent installation package across 5,000 endpoints without causing network saturation. Which feature should be utilized to manage thi…
An engineer needs to ingest custom JSON-formatted logs from an internal application using an HTTP API. Which XSIAM feature should be configured to receive these incoming webhook pa…
When setting up a new Broker VM to collect logs, what is the initial deployment step required in the XSIAM console before downloading the virtual machine image?
An XSIAM engineer is configuring automated incident response playbooks that interact with third-party tools via Cortex XSOAR integration commands. Which THREE best practices should…
Which THREE parameters can be configured when setting up a log ingestion parsing rule in XSIAM? (Choose three)
An administrator is setting up an integration with a third-party threat intelligence platform using Cortex XSOAR capabilities embedded within XSIAM. The integration instance requir…
An administrator is planning the deployment of Broker VMs to support data ingestion across multiple isolated network segments. Which TWO considerations are critical for proper Brok…
An enterprise environment requires all outbound API traffic from XSIAM integrations to pass through an explicit corporate proxy server. Where is the global proxy configuration spec…
An automation playbook fails because the JSON response from an API call contains nested objects that are not being parsed correctly. What is the best way to handle this in a playbo…
An XSIAM tenant is approaching its licensed data ingestion volume limit. The operations team needs to identify which data sources are consuming the highest ingestion bandwidth. Whe…
An administrator wants to customize the fields displayed in the Incident table view to better align with the SOC's operational workflow. How should this be accomplished?
An administrator is troubleshooting a scenario where custom parsers are failing to correctly extract fields because the incoming log format changed slightly. What operational step…
Which TWO actions can an administrator perform when managing integration instances within XSIAM? (Choose two)
Which THREE security considerations are critical when configuring third-party integrations and API keys in XSIAM? (Choose three)