XSIAM-Engineer Practice Questions

Question 1

An administrator wants to configure automated email notifications to be sent to external stakeholders whenever a Critical severity incident is created. Which feature should be configured?

Accepted Answer

Configure an Incident Notification profile or webhook integration under Settings > Integrations / Notifications.. Cortex XSIAM provides Incident Notification profiles and webhook integrations under Settings that allow administrators to define rules (e.g., severity = Critical) and send email notifications to external stakeholders. This is the native, supported way to automate email alerts for incidents. It can also integrate with ticketing systems and SIEM/SOAR tools via webhooks.

Answer

Enable Auto-Isolation rules on all endpoints.

Answer

Modify the Log Forwarding profile to send raw JSON syslog packets to the stakeholder's email address.

Answer

Set up a scheduled XQL query that emails CSV attachments every minute.

Question 2

An administrator is setting up custom Role-Based Access Control (RBAC) folders and permissions in Cortex XSIAM to segregate data access between regional security teams. Which TWO configuration steps are required when creating a new custom role and assigning data scopes? (Choose two)

Accepted Answer

Define the specific functional permissions (such as incident viewing, response actions, or configuration management) assigned to the role.. Option A is correct because a custom RBAC role in Cortex XSIAM must explicitly define its functional permissions, i.e., which actions members can perform such as viewing incidents, executing response actions, or managing configuration, since permissions are granted by the role and not inherited implicitly. Option D is correct because data scopes are the mechanism that restricts which incidents, alerts, or datasets a role can access, typically based on tags or criteria, which is exactly what is needed to segregate data between regional security teams. The other options do not belong: B is wrong because roles are created through the Cortex XSIAM management console or supported APIs, not by manually compiling source code into a JSON manifest; C is wrong because authorization is enforced centrally by the Cortex XSIAM platform, not by XSOAR engines on analyst workstations; and E is wrong because Broker VMs and log collectors handle data ingestion and forwarding, and rebooting them is not part of propagating role definitions.

Answer

Manually compile the source code of the role policy into a JSON manifest and push it via the REST API.

Answer

Install an additional XSOAR engine on each analyst workstation to enforce local authorization checks.

Answer

Reboot all Broker VMs in the region to propagate the new role definitions to local log collectors.

Question 3

During the infrastructure readiness assessment for Cortex XSIAM deployment, which outbound network connectivity requirement must be verified for the Broker VM to ensure proper communication with the XSIAM tenant?

Accepted Answer

Outbound TCP port 443 to the assigned Cortex XSIAM tenant URL and services.. The Broker VM must be able to reach the assigned Cortex XSIAM tenant URL and associated services over outbound TCP port 443. This TLS-based connectivity is how the Broker VM registers with the tenant, pulls configuration, and forwards collected telemetry to the XSIAM cloud.

Answer

Inbound TCP port 22 and TCP port 80 for remote SSH administration and unencrypted web traffic.

Answer

Bidirectional UDP port 514 for unencrypted syslog tunneling across the WAN.

Answer

Outbound TCP port 3389 for remote desktop management of the appliance.

Question 4

Which TWO components or methods are valid options for ingesting third-party log data into XSIAM? (Choose two)

Accepted Answer

Palo Alto Networks Broker VM log collectors. Option B is correct because the Palo Alto Networks Broker VM is the on-premises component that hosts log collectors and forwards third-party log data into XSIAM when direct cloud ingestion isn't possible. Option D is correct because XSIAM supports cloud-native data ingestion through integrations such as AWS SQS and Azure Event Hubs, which pull logs from cloud services into the platform. Option A is incorrect because XSIAM does not ingest third-party logs via manual CSV uploads on a user profile page. Option C is incorrect because XSIAM does not use direct SQL Server database replication as an ingestion method. Option E is incorrect because there is no physical serial cable connection to an XSIAM tenant gateway for log ingestion.

Answer

Manual CSV file upload via the user profile page

Answer

Direct database replication via SQL Server Management Studio

Answer

Physical serial cable connection to the XSIAM tenant gateway

Question 5

A security architect is designing a Cortex XSIAM deployment for an organization with a primary data center and a disaster recovery site. The organization requires that if the primary site fails, the Cortex XSIAM tenant remains accessible and ingestion continues with minimal data loss. Which deployment approach should the architect recommend?

Accepted Answer

Rely on the built-in high availability and redundancy of the Cortex XSIAM cloud service and deploy redundant Broker VMs at each site for local collection.. Cortex XSIAM is a cloud-delivered service, so tenant availability and redundancy are provided by Palo Alto Networks. Resilience for ingestion is achieved by placing redundant Broker VMs at each site so local collection continues during a site outage. Customer-managed second tenants, on-premises Engine failover, and standby appliances are not supported architectures for tenant high availability.

Answer

Deploy a Cortex XSIAM Engine on-premises at the disaster recovery site and configure it to take over ingestion during a primary site outage.

Answer

Configure a site-to-site VPN between the primary and disaster recovery sites and replicate all logs to a standby Cortex XSIAM appliance.

Answer

Deploy a second Cortex XSIAM tenant in the disaster recovery site and manually switch DNS records during failover.

Question 6

An operations team needs to ensure that inactive user accounts are automatically locked out after 90 days of inactivity. Where is this security policy managed?

Accepted Answer

Go to Settings > Access Management > Authentication / Security settings to configure password and account inactivity policies.. Account inactivity lockout policies in Cortex XSIAM are managed under Settings > Access Management > Authentication / Security settings, where password policies and account inactivity thresholds are configured. This is where administrators define how long an account can remain inactive before being locked. It is the correct location for enforcing a 90-day inactivity lockout.

Answer

Configure an Agent Protection policy under Endpoint Management.

Answer

Set up an automated correlation rule to detect inactive login tokens.

Answer

Modify the Log Forwarding rule timeout threshold.

Question 7

An administrator is verifying that firewall rules at the corporate perimeter permit outbound communication from Cortex XDR agents. Which destination criteria must be allowed for agent communication?

Accepted Answer

Outbound TCP port 443 to Palo Alto Networks XSIAM cloud FQDNs. Cortex XDR agents communicate with the Cortex XSIAM cloud over outbound TCP 443 to Palo Alto Networks cloud FQDNs. This encrypted channel carries telemetry, policy updates, and management traffic, so perimeter firewall rules must allow outbound 443 to those destinations.

Answer

Inbound TCP port 22 and 3389 for remote diagnostics

Answer

Outbound UDP port 514 for direct syslog streaming to the cloud

Answer

Inbound and outbound TCP port 80 for unencrypted configuration checks

Question 8

An analyst wants to export a list of active incidents to a CSV file for offline reporting. Which feature in the Incident view should be used?

Accepted Answer

Use the export option in the Incident view toolbar to download incidents as a CSV file.. The Incident view includes export options that allow exporting selected or all incident data into CSV format.

Answer

Run an automated ransomware remediation script.

Answer

Configure a Log Forwarding profile to dump CSV files to a local printer.

Answer

Open the Endpoint Management view and select Export Agents.

Question 9

An administrator is configuring data collection policies in Cortex XSIAM to optimize storage and ingestion costs. The organization wishes to exclude verbose, non-security-relevant informational logs from a specific firewall source. Which mechanism should the administrator configure?

Accepted Answer

Data Ingestion Filters / Drop Rules. Data Ingestion Filters (also called Drop Rules) in Cortex XSIAM allow administrators to filter or drop specific log types, fields, or sources before they are stored, reducing ingestion volume and cost without affecting detection coverage for security-relevant events. This is the correct mechanism to exclude verbose informational logs from a specific firewall source.

Answer

Endpoint isolation policies

Answer

XQL scheduled queries with automated table deletion

Answer

Agent upgrade rings

Question 10

A security architect is planning the network requirements for a new Cortex XSIAM tenant. The organization wants to ensure that the on-premises Broker VM can securely communicate with the Cortex XSIAM cloud services. Which outbound port must be allowed from the Broker VM to the Cortex XSIAM cloud for management and data plane traffic?

Accepted Answer

TCP 443. The Broker VM must be able to reach the Cortex XSIAM cloud over the internet. All communication is encrypted and uses standard HTTPS on TCP 443. This port is required for both management and data plane traffic, including log forwarding and policy updates. Without outbound TCP 443, the Broker VM cannot register or send data to the tenant.

Answer

TCP 8443

Answer

TCP 8080

Answer

TCP 22

Question 11

An administrator needs to troubleshoot why a Broker VM is failing to ingest logs from an internal syslog source. Which diagnostic utility available on the Broker VM console should the administrator use first?

Accepted Answer

Access the Broker VM management console to check service status, connectivity test tools, and container logs.. Broker VMs include management interfaces and troubleshooting utilities (such as system status checks, service health monitoring, and log collection tools) accessible via its local administrative CLI or web interface.

Answer

Run the `xdrctl troubleshoot` command from any managed Windows endpoint agent console.

Answer

Reset the cloud tenant encryption keys under General Settings.

Answer

Open the XSIAM Incident Graph to view packet captures from the Broker VM IP.

Question 12

An administrator is deploying the Cortex XSIAM agent via Microsoft Intune and needs to ensure that kernel-level extensions on macOS endpoints do not block the installation. Which preliminary step must be completed?

Accepted Answer

Pre-approve system extensions and network filters using an MDM configuration profile. On macOS, Cortex XSIAM agent installation requires kernel-level system extensions and network filters, which macOS blocks unless they are pre-approved via an MDM configuration profile. When deploying through Microsoft Intune, the administrator must push a configuration profile that pre-approves the XSIAM system extension and network filter identifiers before the agent package is installed.

Answer

Convert all macOS file systems to legacy HFS+ format

Answer

Disable SIP (System Integrity Protection) on all target macOS endpoints

Answer

Install the XSIAM agent manually using an interactive terminal session

Question 13

An administrator wants to optimize XQL search performance across large log datasets. Which TWO best practices should be applied when writing queries? (Choose two)

Accepted Answer

Specify the dataset early in the query using the `dataset = ...` clause to narrow the search scope.. Option A is correct because specifying the dataset early with the `dataset = ...` clause restricts the XQL search to only the relevant data, reducing the volume of records scanned and improving query performance. Option E is correct because limiting the time range to the smallest necessary window minimizes the amount of historical data processed, which is a core optimization for large log datasets. Options B and C are incorrect because querying all historical data without time limits and avoiding filters both increase the data scanned and degrade performance. Option D is incorrect because raw regex parsing on unparsed datasets is expensive and less efficient than using parsed fields and structured filters.

Answer

Always query all historical datasets without time limits to ensure completeness.

Answer

Avoid using any filters and sort by random strings.

Answer

Execute all searches using raw regex parsing on unparsed datasets.

Question 14

An XSIAM engineer wants to test a new automation script that parses indicators from an external threat feed. The script should run automatically every hour. Which XSIAM feature should be used to schedule this script?

Accepted Answer

Automation Engine scheduled task. The Automation Engine scheduled task is designed to run scripts or playbooks on a recurring schedule using cron expressions. It provides a centralized way to manage and monitor scheduled executions, making it the correct choice for running a script every hour. Other features like playbook triggers or incident timers are not intended for standalone script scheduling.

Answer

War Room CLI command '!schedule' with a script name

Answer

Playbook trigger with 'scheduled' type

Answer

Incident type 'timer' with a script action

Question 15

When setting up a new Data Collector, you need to ensure high availability for log collection from a remote site. What is the best practice for deploying the collectors?

Accepted Answer

Install multiple collectors and assign them to the same Collector Group.. Grouping collectors allows for load balancing and fault tolerance within the XSIAM architecture.

Answer

Create separate ingestion instances for every collector.

Answer

Install one large collector and increase its CPU allocation.

Answer

Configure log forwarding to a single collector and use a load balancer at the network layer.

Certified XSIAM Engineer XSIAM-Engineer practice test

Three ways to study

Study XSIAM-Engineer by domain

Study XSIAM-Engineer by topic

Operations And Lifecycle Management practice questions

Planning And Installation practice questions

Integration And Automation practice questions

XSIAM Platform Architecture And Deployment practice questions

XSIAM-Engineer fundamentals practice questions

XSIAM-Engineer scenario practice questions

XSIAM-Engineer troubleshooting practice questions

Certified XSIAM Engineer (XSIAM-Engineer) practice questions