Operations And Lifecycle Management

An administrator wants to ensure that specific sensitive incident categories are restricted to a dedicated tier-2 response team. Which XSIAM construct should be configured to achieve this role-based operational segregation?

An enterprise is undergoing a security audit and requires proof of XSIAM system resilience and data integrity. Which THREE operational artifacts or features should the administrator provide to the auditors? (Choose three)

An administrator is troubleshooting a scenario where custom parsers are failing to correctly extract fields because the incoming log format changed slightly. What operational step should be taken to update the parser without disrupting active data ingestion?

An administrator is troubleshooting an issue where an endpoint agent is unable to connect to the XSIAM cloud management console, and local logs indicate certificate pinning verification failure. What is the most likely cause?

An administrator is configuring a webhook integration to forward XSIAM incidents to an external ticketing system. The remote server requires mutual TLS (mTLS) client certificate authentication. Where should the client certificate be uploaded in XSIAM?

An operations team is planning a routine maintenance window for Broker VMs. Which THREE best practices should be followed to ensure operational continuity? (Choose three)

An analyst wants to quickly search across all ingested logs for a specific IP address without writing a complex query from scratch. Which feature in XSIAM provides a rapid, centralized search interface?

An administrator configured a new API data collector to ingest threat intelligence feeds, but no data is appearing in XSIAM. Upon checking the Integration page, the status shows an authentication failure. What is the most likely cause and correct remediation?

An administrator is troubleshooting a custom BIOC (Behavioral Indicator of Compromise) rule that is not triggering alerts even though matching logs are present in the Cortex Data Lake. What is the most effective operational step to debug the rule?

An organization requires all audit logs generated within XSIAM to be exported to an external SIEM for long-term archiving. Which feature should the administrator configure?

An administrator needs to add a new user account to XSIAM and assign appropriate privileges. Where is user account creation and management performed?

An administrator needs to check the remaining license capacity and expiration date of the XSIAM subscription. Where should the administrator look?

An administrator is troubleshooting a Broker VM that has lost connectivity to the XSIAM management plane. After checking network routing and firewalls, the administrator suspects local Docker container network corruption on the Broker VM host. Which administrative utility script on the Broker VM can be used to restart and reset the container networking stack?

An administrator is configuring log collection from a cloud storage bucket (e.g., AWS S3) into XSIAM. Which TWO configuration steps are required to establish this ingestion pipeline? (Choose two)

An administrator is setting up external log forwarding from XSIAM to a third-party SIEM. Which TWO protocols are natively supported for log forwarding destinations? (Choose two)

An administrator is investigating a data discrepancy where certain security logs ingested via a Broker VM do not match the raw source timestamps. Where can timezone and timestamp normalization settings be reviewed or adjusted?

An administrator needs to modify the display name and description of a custom data collector instance. Where can this configuration be edited?

An XSIAM administrator needs to configure log forwarding from a Linux server to the XSIAM collector. Which action must be performed first on the endpoint before deploying the Collector service?

An administrator needs to troubleshoot why a Broker VM is failing to ingest logs from an internal syslog source. Which diagnostic utility available on the Broker VM console should the administrator use first?

An administrator is configuring a new syslog ingestion source on a Broker VM. The syslog messages use TCP with TLS encryption (Reliable Syslog). Where must the corresponding TLS server certificates for the Broker VM be configured?

An administrator is designing a custom incident triage workflow in XSIAM. Which THREE actions can be automated as part of incident management configuration? (Choose three)

An enterprise has multiple distinct business units, and the security operations team wants to ensure that analysts from Business Unit A can only investigate incidents assigned to their own unit, while global administrators can view everything. Which feature enables this multi-tenant or partitioned operational structure within a single XSIAM tenant?

An administrator notices that a particular correlation rule is generating a high volume of false positive incidents. What is the recommended operational step to refine the rule without disabling it entirely?

An administrator wants to create a custom dashboard displaying key SOC metrics such as open incidents by severity and top alerted hosts. Which section of XSIAM should the administrator use to build this dashboard?

An analyst reports that the XSIAM web interface session is timing out too quickly due to security policies. Where can an administrator modify the idle session timeout duration?

An administrator needs to configure automated incident assignment so that all incidents originating from network firewall logs are automatically routed to the Network Security SOC team. Which XSIAM feature accomplishes this?

An administrator wants to customize the fields displayed in the Incident table view to better align with the SOC's operational workflow. How should this be accomplished?

An administrator needs to review all administrative actions (such as user logins, configuration changes, and role modifications) performed within the XSIAM tenant over the last 30 days. Where is this audit data located?

An administrator is troubleshooting an API integration that has stopped collecting data. Which THREE diagnostic steps should be performed? (Choose three)

During routine maintenance, an administrator notices that a custom parser is dropping incoming events from a newly integrated security appliance. Where should the administrator check to debug syntax and grok pattern failures in real time?

An organization is updating its internal Certificate Authority (CA). The administrator needs to update the trusted CA certificates used by the Broker VMs for secure syslog ingestion. Where must this certificate update be performed?

An administrator needs to restrict access to sensitive XSIAM incident data to specific compliance officers. Which TWO actions accomplish this requirement? (Choose two)

An administrator wants to view a chronological list of recent software updates and content pack releases applied to the XSIAM tenant. Where can this release history be checked?

An XSIAM tenant is approaching its licensed data ingestion volume limit. The operations team needs to identify which data sources are consuming the highest ingestion bandwidth. Where should the administrator check this information?

An administrator is investigating why an automated response playbook integrated via Cortex XSOAR failed to execute when triggered by an XSIAM incident. Where should the administrator check the integration communication logs?

An administrator wants to configure automated email notifications to be sent to external stakeholders whenever a Critical severity incident is created. Which feature should be configured?

An operations team needs to ensure that inactive user accounts are automatically locked out after 90 days of inactivity. Where is this security policy managed?

An administrator wants to optimize XQL search performance across large log datasets. Which TWO best practices should be applied when writing queries? (Choose two)

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux servers. Which THREE tasks should be performed during the planning and deployment phase? (Choose three)

An administrator needs to ensure that custom dashboards created by SOC analysts are backed up or migrated between environments. Which TWO options are available for content portability in XSIAM? (Choose two)

An organization wants to ensure that all sensitive personally identifiable information (PII) fields within ingested log datasets are automatically masked or hashed before being stored in the Cortex Data Lake. Which XSIAM capability should be configured?

An organization requires strict adherence to data governance policies. Which TWO configurations help ensure that sensitive data is handled properly within XSIAM? (Choose two)

An administrator needs to check the status of scheduled background reports and export tasks in XSIAM. Where can this task history be reviewed?

An administrator is setting up a new Broker VM in an isolated network zone that requires all outbound HTTPS traffic to traverse an explicit corporate proxy server. Where must the proxy configuration be applied for the Broker VM to communicate with XSIAM?

An administrator needs to update the Cortex XDR agent installation package across 5,000 endpoints without causing network saturation. Which feature should be utilized to manage this rollout effectively?

An administrator wants to ensure high availability and disaster recovery readiness for an XSIAM deployment relying on Broker VMs and cloud ingestion. Which THREE operational practices should be implemented? (Choose three)

An administrator needs to verify whether a newly created Correlation Rule is actively evaluating incoming telemetry. Where should the administrator check the rule's operational status and recent execution statistics?

An organization requires that all API access tokens used for programmatic interaction with XSIAM expire every 90 days. Where can API key expiration policies be configured?

An organization wants to integrate XSIAM user authentication with an external SAML 2.0 Identity Provider (IdP) such as Okta or Azure AD. Where is Single Sign-On (SSO) configured?

An analyst wants to export a list of active incidents to a CSV file for offline reporting. Which feature in the Incident view should be used?

An administrator is reviewing the health of endpoint agents across the enterprise. Which TWO statuses or metrics can be monitored in the Endpoint Management view? (Choose two)

An administrator notices high resource utilization on a Broker VM. Which THREE diagnostic steps or remediation actions should be taken? (Choose three)

An administrator needs to deploy a custom content pack containing specialized dashboards, parsers, and rules across multiple child tenants in a multi-tenant XSIAM environment. Where should the content pack be managed and distributed?

An organization mandates that specific log datasets must be retained for 400 days, exceeding the default retention period. Where should the administrator configure extended data retention rules?