XSIAM-Engineer Planning And Installation Practice Question
An organization is preparing to ingest Microsoft Windows Event Forwarding (WEF) logs into Cortex XSIAM via a Broker VM. Which THREE components or prerequisites are required for a successful WEF ingestion architecture? (Choose three)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Active Directory Group Policy Objects (GPOs) configuring workstations to forward events to the WEF server
Windows Event Forwarding requires a Windows Event Collector (WEF) server, proper Group Policy configurations on domain workstations to forward events, and a Broker VM configured to ingest the collected Windows events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Active Directory Group Policy Objects (GPOs) configuring workstations to forward events to the WEF server
Why this is correct
GPO settings are mandatory to instruct domain computers where and what events to forward.
- ✗
Direct installation of the Cortex XDR agent directly onto core network core routers
Why it's wrong here
Cortex XDR agents run on operating system endpoints, not network core routers.
- ✗
Converting all domain controllers to run Linux operating systems
Why it's wrong here
Active Directory domain controllers run Windows Server, not Linux.
- ✓
A configured Windows Event Collector (WEF) server infrastructure within the enterprise network
Why this is correct
WEF relies on a dedicated collector server to aggregate forwarded logs from domain endpoints.
- ✓
A Broker VM configured with a Windows Event Collector or WinRM ingestion collector to pull logs into XSIAM
Why this is correct
The Broker VM pulls or receives the forwarded logs from the WEF server into the XSIAM tenant.
About these practice questions
This XSIAM-Engineer question is part of Courseiva's 199-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This XSIAM-Engineer practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XSIAM-Engineer exam.