Certified XSIAM Engineer (XSIAM-Engineer) (XSIAM-Engineer) — Questions 151–199

An administrator is troubleshooting a Broker VM that is showing a 'Disconnected' status in the Cortex XSIAM console. After verifying network routing and outbound HTTPS connectivity, the administrator checks the Broker VM system logs and discovers a system time synchronization failure. Why would a time sync failure cause disconnection?

An administrator needs to verify whether a newly deployed Broker VM is successfully forwarding logs to the Cortex XSIAM tenant. Which tool or menu within the XSIAM console allows the administrator to view real-time incoming log counts and ingestion rates?

When configuring integrations in Cortex XSIAM via Content Hub, which TWO actions can an administrator perform after installing an integration pack? (Choose two)

An organization wants to ensure that all sensitive personally identifiable information (PII) fields within ingested log datasets are automatically masked or hashed before being stored in the Cortex Data Lake. Which XSIAM capability should be configured?

An organization requires strict adherence to data governance policies. Which TWO configurations help ensure that sensitive data is handled properly within XSIAM? (Choose two)

An administrator is configuring a new Cortex XSIAM tenant and needs to ingest custom syslog data from a third-party firewall. Which component should be configured first to receive and parse this raw syslog data before it reaches the data lake?

An administrator is deploying Cortex XSIAM agents on a fleet of corporate servers and needs to ensure proper installation parameters and operational readiness. Which TWO methods are valid for deploying or managing agent installations in XSIAM? (Choose two)

An administrator needs to check the status of scheduled background reports and export tasks in XSIAM. Where can this task history be reviewed?

An automation engineer is writing a custom Python script for an XSIAM automation task and needs to query XSIAM incident data. Which integration library or command standard must be used to execute commands against the Cortex XSOAR/XSIAM engine?

Which THREE security considerations are critical when configuring third-party integrations and API keys in XSIAM? (Choose three)

An administrator is deploying the Broker VM via an OVA template on an ESXi hypervisor. After deployment, the administrator cannot access the Broker VM management web interface. Which initial configuration step must be performed via the hypervisor console to enable remote network access?

An XSIAM administrator is configuring a new API-based integration to ingest threat intelligence feeds. During configuration, what credential type is most commonly required by modern token-based REST API integrations?

An administrator is configuring data collection settings and incident rules in Cortex XSIAM. Which TWO configuration steps are required to ensure proper data parsing and alert generation for a newly added third-party firewall log source? (Choose two)

An organization is preparing to ingest Microsoft Windows Event Forwarding (WEF) logs into Cortex XSIAM via a Broker VM. Which THREE components or prerequisites are required for a successful WEF ingestion architecture? (Choose three)

An administrator is setting up a new Broker VM in an isolated network zone that requires all outbound HTTPS traffic to traverse an explicit corporate proxy server. Where must the proxy configuration be applied for the Broker VM to communicate with XSIAM?

An administrator notices that logs from a specific firewall are not appearing in Cortex XSIAM. The firewall is configured to send syslog to the Broker VM. Where should the administrator check first to determine if the Broker VM is receiving the raw syslog packets?

While configuring a Cortex XSOAR integration instance in XSIAM for automated enrichment, the test fails with a certificate validation error when communicating with an on-premises internal API. Where should the custom CA certificate be uploaded within XSIAM to resolve this?

An administrator needs to deploy Cortex XDR agents to Linux servers that have strict change management controls and cannot be rebooted. Which installation consideration is most critical for Linux deployments?

An organization requires high availability for its on-premises log ingestion architecture using Broker VMs. Which THREE architectural elements contribute to building a resilient log collection tier? (Choose three)

An administrator is reviewing infrastructure readiness for deploying Cortex XSIAM engines on-premises. Which TWO prerequisites must be validated on the host infrastructure before engine installation? (Choose two)

An administrator needs to update the Cortex XDR agent installation package across 5,000 endpoints without causing network saturation. Which feature should be utilized to manage this rollout effectively?

An administrator wants to ensure high availability and disaster recovery readiness for an XSIAM deployment relying on Broker VMs and cloud ingestion. Which THREE operational practices should be implemented? (Choose three)

An administrator needs to verify whether a newly created Correlation Rule is actively evaluating incoming telemetry. Where should the administrator check the rule's operational status and recent execution statistics?

An organization is deploying Cortex XSIAM in an environment with strict data residency requirements. The tenant is provisioned in the European Union (EU) region. During the deployment of Broker VMs and API integrations, what must the architect ensure regarding endpoint and collector configurations?

An organization requires that all API access tokens used for programmatic interaction with XSIAM expire every 90 days. Where can API key expiration policies be configured?

An administrator needs to configure granular access control so that junior SOC analysts can view incidents and run XQL queries, but cannot modify tenant settings or install integrations. Where should the administrator configure these permissions?

An organization wants to integrate XSIAM user authentication with an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is Single Sign-On (SSO) configured?

What is the primary purpose of the Cortex XSIAM Content Hub?

A security engineer needs to ingest custom syslog data from an on-premises legacy firewall into Cortex XSIAM. No native content pack exists for this specific legacy device. What is the recommended approach to ingest and correctly parse this unstructured log data?

A deployment engineer is sizing a Broker VM for a large enterprise environment with 20,000 Cortex XDR agents and multiple log collection sources. During the initial deployment, the administrator notices high CPU and memory utilization on the single Broker VM. What is the recommended architectural remedy for this scenario?

An organization plans to ingest cloud audit logs from Amazon Web Services (AWS) into Cortex XSIAM using an automated collector architecture. Which native AWS service integration mechanism is typically recommended and supported by XSIAM for scalable log collection?

An analyst wants to export a list of active incidents to a CSV file for offline reporting. Which feature in the Incident view should be used?

An architect is designing an automated log forwarding pipeline where Cortex XSIAM forwards specific enriched telemetry or incidents to an external destination (such as a third-party SIEM or data lake). Which THREE mechanisms or integrations are available for exporting data out of XSIAM? (Choose three)

A security architect is planning agent installation rollouts and needs to ensure that endpoints in a high-security isolated zone can still receive policy updates without direct internet access. What is the recommended deployment pattern?

An automation playbook fails because the JSON response from an API call contains nested objects that are not being parsed correctly. What is the best way to handle this in a playbook?

You are configuring a new ingestion integration for a cloud provider via API. You notice that data is not arriving in Cortex XSIAM despite the integration being marked as 'Active'. Where should you first verify the ingestion status and potential API credential errors?

When planning a Cortex XSIAM deployment, what is the primary purpose of conducting an infrastructure readiness assessment?

An administrator is reviewing the health of endpoint agents across the enterprise. Which TWO statuses or metrics can be monitored in the Endpoint Management view? (Choose two)

An administrator notices high resource utilization on a Broker VM. Which THREE diagnostic steps or remediation actions should be taken? (Choose three)

An administrator needs to deploy a custom content pack containing specialized dashboards, parsers, and rules across multiple child tenants in a multi-tenant XSIAM environment. Where should the content pack be managed and distributed?

Which THREE parameters can be configured when setting up a log ingestion parsing rule in XSIAM? (Choose three)

An engineer is deploying a Cortex XSIAM Engine on-premises to support high-throughput log parsing and query execution. During setup, the engine fails to register with the cloud tenant. Upon checking the engine logs, the engineer sees TLS certificate validation errors. What is the most likely root cause?

When configuring Role-Based Access Control (RBAC) within Cortex XSIAM, an administrator needs to define custom roles using specific parameters and permission scopes. Which THREE capabilities can be assigned or restricted when building a custom role? (Choose three)

An administrator is troubleshooting an issue where a Broker VM fails to download content updates from the Cortex XSIAM cloud. The Broker VM has outbound internet access via an enterprise web proxy. Where must the proxy settings be configured on the Broker VM?

An engineer wants to verify the version and resource utilization of a running Broker VM. Where in the Cortex XSIAM user interface can this operational metric be inspected?

An architect is designing the high-availability and disaster recovery (HA/DR) strategy for an on-premises log collection tier utilizing multiple Broker VMs. If Primary Broker VM 'A' fails completely, what happens to the log streams being sent to it from local security devices?

An administrator is configuring Active Directory synchronization within Cortex XSIAM using a Broker VM. Which prerequisite must be met on the domain controller and Broker VM to ensure successful user and group mapping ingestion?

An organization mandates that specific log datasets must be retained for 400 days, exceeding the default retention period. Where should the administrator configure extended data retention rules?

A security analyst needs to automate a recurring task that involves enriching alerts with data from a third-party threat intelligence platform. Which component of XSIAM is specifically designed for this cross-platform workflow?