Operations And Lifecycle Management practice questions

Enable Cortex XSOAR playbook automation to execute a daily database backup.

Why wrong: Incorrect. XSOAR is an orchestration tool; native streaming is handled via XSIAM Log Forwarding configurations.

Set up a BIOC alert rule to email CSV exports every 24 hours.

Why wrong: Incorrect. BIOC rules generate alerts, and email is not a scalable or supported streaming mechanism for log archiving.

Modify the Data Retention profile to replicate raw blocks to an external S3 bucket automatically.

Why wrong: Incorrect. Direct S3 bucket replication of raw blocks is not a configurable retention profile setting; Log Forwarding is used.

Purge the Cortex Data Lake table associated with the alert ID.

Why wrong: Incorrect. Purging tables destroys historical data and does not stop the correlation rule from firing on new data.

Delete the default data parser associated with the event source to block the noisy logs entirely.

Why wrong: Incorrect. Deleting the parser would break all visibility and other rules relying on that data source.

Change the tenant status from Active to Evaluation mode to suppress notifications.

Why wrong: Incorrect. Evaluation mode does not suppress specific rule alerts and impacts overall tenant operations.

Modify the global tenant retention policy to purge tier-1 logs automatically.

Why wrong: Incorrect. Data retention policies manage how long data is stored, not who can view specific incidents.

Deploy a separate Cortex XSOAR server to handle tier-2 escalations independently.

Why wrong: Incorrect. While XSOAR handles orchestration, XSIAM RBAC handles access control natively within the platform.

Write a BIOC rule to drop unauthorized access attempts at the ingestion layer.

Why wrong: Incorrect. BIOC rules trigger alerts and incidents, they do not restrict administrative viewing access.

Review the Audit Trail dashboard for high-frequency API polling events.

Why wrong: Incorrect. The Audit Trail records administrative actions within XSIAM, not data volume ingestion statistics.

Execute an XQL query using the `dataset = host_inventory` command and group by storage size.

Why wrong: Incorrect. Ingestion metrics and license usage are tracked in dedicated license management views, not generic host inventory datasets.

Check the Cortex XDR Agent health status page under Endpoint Management.

Why wrong: Incorrect. Endpoint Management tracks agent status and versions, not overall tenant log ingestion volume.

SSH into the Cortex XSIAM management cluster master node and check the /var/log/parser.log file.

Why wrong: Incorrect. Administrators do not have direct SSH access to the underlying XSIAM cloud management infrastructure.

Open the Cortex XDR Agent console on the local machine and export the Agent Log Collector bundle.

Why wrong: Incorrect. The Agent Log Collector is for endpoint agent troubleshooting, not cloud-side custom parser validation.

Review the Incident Graph to trace dropped packets from the ingestion pipeline.

Why wrong: Incorrect. Incident graphs are for security investigations, not low-level log parsing debug.

Run the `xdrctl troubleshoot` command from any managed Windows endpoint agent console.

Why wrong: Incorrect. `xdrctl` is for the Cortex XDR endpoint agent, not the Broker VM.

Reset the cloud tenant encryption keys under General Settings.

Why wrong: Incorrect. Resetting encryption keys will disrupt tenant communications and does not diagnose Broker VM log ingestion.

Open the XSIAM Incident Graph to view packet captures from the Broker VM IP.

Why wrong: Incorrect. Incident graphs do not display raw packet captures or low-level Broker VM container logs.

Manually push the MSI package via Active Directory Group Policy Objects using an external script.

Why wrong: Incorrect. While possible, this is an external method and not the native XSIAM platform feature designed for lifecycle agent upgrades.

Execute an XQL remediation action with the `upgrade_agent` command across all active sessions.

Why wrong: Incorrect. XQL is a query language and does not execute arbitrary agent installation commands directly in that manner.

Set up a global Log Forwarding profile to broadcast the binary over syslog.

Why wrong: Incorrect. Log forwarding profiles are for sending logs out, not pushing agent installation binaries.

Enable port 22 inbound on the Cortex XSIAM management tenant for SSH tunnel establishment.

Why wrong: Incorrect. Communication is initiated outbound from the Collector to XSIAM over HTTPS.

Manually create the database schema in the Cortex Data Lake to accept the raw logs.

Why wrong: Incorrect. Cortex Data Lake and XSIAM handle parsing and schema generation automatically upon ingestion.

Configure the syslog daemon on the local server to forward directly to port 443 of the cloud engine without an agent.

Why wrong: Incorrect. Syslog forwarding typically requires a local collector or broker VM to ingest and forward securely.

Deploy separate Broker VMs for each business unit without configuring user roles.

Why wrong: Incorrect. Broker VMs ingest data, but without security domains or roles, any user with access can view all ingested incidents.

Create separate correlation rules with identical logic for each user.

Why wrong: Incorrect. Duplicating rules does not restrict data visibility or user access rights.

Set up independent data retention periods for each analyst account.

Why wrong: Incorrect. Data retention is configured globally or per dataset, not per analyst account.

Enable Auto-Isolation rules on all endpoints.

Why wrong: Incorrect. Auto-isolation isolates compromised hosts from the network; it does not send email notifications to stakeholders.

Modify the Log Forwarding profile to send raw JSON syslog packets to the stakeholder's email address.

Why wrong: Incorrect. Log forwarding profiles send data via syslog or HTTP, not directly to individual email addresses.

Set up a scheduled XQL query that emails CSV attachments every minute.

Why wrong: Incorrect. Scheduled queries are not designed for real-time incident alerting and can cause performance overhead.

The XQL query syntax used by the integration is malformed and requires rewriting the SQL statement.

Why wrong: Incorrect. Integrations use built-in connectors, not manual XQL queries for ingestion polling.

The local firewall on the Cortex XDR agent is blocking outbound HTTPS requests to the threat intel feed.

Why wrong: Incorrect. API integrations are executed cloud-to-cloud by XSIAM, not by local endpoint agents.

The Broker VM container needs to be restarted via SSH to reload the routing table.

Why wrong: Incorrect. Cloud-based API integrations do not rely on Broker VMs for direct polling unless specifically routed through one, and auth failures indicate credential issues.

Update the Log Forwarding profile timeout threshold.

Why wrong: Incorrect. Log forwarding profiles manage streaming timeouts to external servers, not UI sessions.

Modify the Agent Settings profile assigned to the administrator's laptop.

Why wrong: Incorrect. Agent settings control endpoint security modules, not cloud console web session timeouts.

Edit the XQL query execution limit parameters in Analytics settings.

Why wrong: Incorrect. XQL query limits govern search execution time and row counts, not UI login sessions.

Inspect the raw storage blocks in the Data Lake Explorer.

Why wrong: Incorrect. Data Lake Explorer is for querying logs, not monitoring report job histories.

Review the Incident Response playbook execution logs in Cortex XSOAR.

Why wrong: Incorrect. XSIAM native reporting tasks are managed within XSIAM's reporting interface.

Check the Endpoint Management > Task Management tab.

Why wrong: Incorrect. Endpoint Management tasks relate to agent commands and package deployment, not reporting.

Inspect the Cortex XDR Agent installation directory for rule cache files.

Why wrong: Incorrect. Correlation rules execute in the XSIAM cloud analytics engine, not locally on the agent.

Review the Windows Event Viewer on the primary Domain Controller.

Why wrong: Incorrect. Windows Event Viewer logs local host events, not XSIAM cloud-based correlation rule states.

Examine the Firewall Traffic logs for outgoing rule-check packets.

Why wrong: Incorrect. Cloud correlation engine evaluation does not generate external outbound traffic packets for rule checks.

Reinstall the Cortex XDR management extension pack.

Why wrong: Incorrect. Reinstalling packs does not alter UI column configurations.

Rewrite the underlying XQL query for the default dashboard using API calls.

Why wrong: Incorrect. Incident view layouts are adjusted via built-in UI options, not by rewriting default dashboards via API.

Modify the global database schema JSON file via the Admin CLI.

Why wrong: Incorrect. Modifying core database schemas is not supported or required for UI column layout adjustments.

Modify the global tenant license key to include custom CA extensions.

Why wrong: Incorrect. License keys dictate feature enablement and capacity, not CA trust stores.

Upload the certificate directly into the browser's local trusted root store.

Why wrong: Incorrect. Browser trust stores only affect client-side web UI access, not Broker VM log ingestion.

Run the `certmgr /add` command on every managed Windows endpoint.

Why wrong: Incorrect. Endpoints do not manage Broker VM ingestion certificates.

Stop the entire XSIAM tenant, wipe the database, and re-import all log sources from scratch.

Why wrong: Incorrect. Wiping the tenant is disruptive and unnecessary for updating a parser.

Disable data ingestion globally while rewriting the SQL database schema.

Why wrong: Incorrect. Database schemas are managed automatically by XSIAM; ingestion does not require manual schema SQL rewrites.

Deploy a local text-editor plugin to every Broker VM via SSH to modify underlying regex config files.

Why wrong: Incorrect. Parsers are managed centrally in the cloud XSIAM console, not via manual file edits on Broker VMs.

Configure an Agent Protection policy under Endpoint Management.

Why wrong: Incorrect. Agent protection policies secure endpoints against malware, not XSIAM web console user accounts.

Set up an automated correlation rule to detect inactive login tokens.

Why wrong: Incorrect. Correlation rules detect security threats, they do not enforce administrative console login policies.

Modify the Log Forwarding rule timeout threshold.

Why wrong: Incorrect. Log forwarding rules manage data streaming, not user console access.

Apply the proxy configuration via the Cortex XDR Agent installation profile.

Why wrong: Incorrect. Broker VMs are independent OVA/Docker containers and do not use endpoint agent installation profiles.

Configure the proxy settings inside the Windows registry of the local administrator's workstation.

Why wrong: Incorrect. Workstation registry settings do not affect Broker VM network traffic routing.

Modify the XQL search query headers to include proxy authentication tokens.

Why wrong: Incorrect. XQL queries execute within the search engine and have no role in network-level proxy routing.

Open the Endpoint Management > Audit Log view.

Why wrong: Incorrect. Endpoint audit logs track agent-specific actions, not tenant-wide administrative activities.

Check the Incident Management dashboard filtered by user severity.

Why wrong: Incorrect. Incident dashboards track security threats, not administrative platform configuration changes.

Run an XQL query on the `host_boot` dataset.

Why wrong: Incorrect. Host boot datasets contain OS startup telemetry, not XSIAM administrator audit trails.