Troubleshooting practice questions

Direct Syslog forwarding from AWS VPC to Broker VM

Why wrong: Incorrect. CloudTrail does not natively stream via raw syslog without intermediary services.

Scheduled SCP file transfer to a Broker VM SFTP directory

Why wrong: Incorrect. CloudTrail uses cloud APIs and SQS, not manual SCP transfers.

Cortex XDR Agent polling AWS metadata

Why wrong: Incorrect. CloudTrail logs are cloud-native and do not involve endpoint agents.

Stop the entire XSIAM tenant, wipe the database, and re-import all log sources from scratch.

Why wrong: Incorrect. Wiping the tenant is disruptive and unnecessary for updating a parser.

Disable data ingestion globally while rewriting the SQL database schema.

Why wrong: Incorrect. Database schemas are managed automatically by XSIAM; ingestion does not require manual schema SQL rewrites.

Deploy a local text-editor plugin to every Broker VM via SSH to modify underlying regex config files.

Why wrong: Incorrect. Parsers are managed centrally in the cloud XSIAM console, not via manual file edits on Broker VMs.

Run the `xdrctl troubleshoot` command from any managed Windows endpoint agent console.

Why wrong: Incorrect. `xdrctl` is for the Cortex XDR endpoint agent, not the Broker VM.

Reset the cloud tenant encryption keys under General Settings.

Why wrong: Incorrect. Resetting encryption keys will disrupt tenant communications and does not diagnose Broker VM log ingestion.

Open the XSIAM Incident Graph to view packet captures from the Broker VM IP.

Why wrong: Incorrect. Incident graphs do not display raw packet captures or low-level Broker VM container logs.

SSH into the Cortex XSIAM management cluster master node and check the /var/log/parser.log file.

Why wrong: Incorrect. Administrators do not have direct SSH access to the underlying XSIAM cloud management infrastructure.

Open the Cortex XDR Agent console on the local machine and export the Agent Log Collector bundle.

Why wrong: Incorrect. The Agent Log Collector is for endpoint agent troubleshooting, not cloud-side custom parser validation.

Review the Incident Graph to trace dropped packets from the ingestion pipeline.

Why wrong: Incorrect. Incident graphs are for security investigations, not low-level log parsing debug.

Reinstall the local printer drivers on the administrator's laptop.

Why wrong: Incorrect. Printer drivers are irrelevant to cloud API integrations.

Format the Broker VM Docker container storage volumes.

Why wrong: Incorrect. Formatting storage volumes is destructive and unnecessary for credential or network checks.

The Cortex XDR agent version is too new for the cloud tenant and must be downgraded.

Why wrong: Incorrect. Backward compatibility is maintained; version mismatches cause registration errors, not CA pinning failures.

The local firewall is blocking UDP port 514 outbound from the endpoint.

Why wrong: Incorrect. Cortex XDR agents communicate outbound over HTTPS (port 443), not syslog (UDP 514).

The XSIAM tenant license has expired, causing all agents to enter a permanent lock state.

Why wrong: Incorrect. License expiration typically results in grace periods or data ingestion throttling, not SSL certificate verification errors.

Modify the global tenant encryption keys to flush cache memory.

Why wrong: Incorrect. Encryption keys have no impact on Broker VM resource usage.

Reinstall the Cortex XDR agent on all Windows domain controllers.

Why wrong: Incorrect. Domain controllers do not resolve Broker VM resource constraints.

Change the tenant license key to an enterprise tier.

Why wrong: Incorrect. License tiers do not fix faulty BIOC rule logic.

Reboot the XSIAM management cloud cluster master node via SSH.

Why wrong: Incorrect. Administrators do not have SSH access to restart cloud cluster master nodes.

Disable the default Cortex XDR agent prevention modules.

Why wrong: Incorrect. Agent prevention modules protect endpoints and do not affect cloud BIOC rule logic.

The Broker VM requires a manual firmware downgrade to support legacy API protocols

Why wrong: Firmware downgrades are not a valid troubleshooting step for API authentication errors.

The Cortex XDR agent service on endpoints has stopped responding

Why wrong: Endpoint agents have no direct bearing on third-party cloud API integrations.

The XQL query builder cache is corrupted and requires a database purge

Why wrong: API authentication happens independently of the XQL query cache.

Cortex XDR Agent endpoint quarantine logs

Why wrong: Incorrect. Quarantine logs relate to endpoint containment, not API integrations.

The local BIOS event log of the client workstation

Why wrong: Incorrect. Client BIOS logs have no relevance to cloud integration execution.

The Data Stitching execution summary report

Why wrong: Data stitching summaries show record linkage statistics, not API connection debug outputs.

The Endpoint Agent audit trail under Cortex XDR > Agents

Why wrong: Endpoint agent audit trails track endpoint sensor commands, not server-side integrations.

The Broker VM system log file (/var/log/broker/broker.log)

Why wrong: Broker VM logs cover log collection transport, whereas cloud-based integration instances execute on the server backend.

Create a new playbook to manually map the fields in the alert.

Why wrong: Manual mapping via playbook is inefficient and not the standard method for XDM transformation.

Modify the ingestion configuration to change the vendor product type.

Why wrong: This does not address the underlying parsing/mapping logic.

Update the Data Collector version on the server.

Why wrong: Collector versioning usually does not fix individual parsing logic errors.

Examine the Data Lake storage partition allocation table.

Why wrong: Incorrect. Storage partitions relate to data retention and disk space, not API automation integration.

Inspect the Cortex XDR Agent debug bundle collected from the affected server.

Why wrong: Incorrect. Agent debug bundles contain endpoint telemetry, not XSOAR server integration logs.

Check the local `syslog.log` file on the Broker VM container.

Why wrong: Incorrect. Broker VMs handle log collection, not Cortex XSOAR playbook execution debugging.

Verifying that local ICMP ping is disabled across all enterprise routers

Why wrong: ICMP status is unrelated to HTTPS API communication between the Broker VM and XSIAM.

Ensuring inbound TCP port 22 is open to the public internet for continuous remote telemetry streaming

Why wrong: Opening SSH (port 22) to the public internet introduces severe security risks and is not required for telemetry.

The Broker VM operating system automatically shuts down all network interfaces after 10 minutes of clock discrepancy.

Why wrong: Interfaces do not shut down; authentication and token validations fail.

Log collection collectors stop accepting UDP packets if the system time is set to UTC instead of local time.

Why wrong: Syslog collection does not depend on local timezone settings for packet acceptance.

The XSIAM licensing server revokes the Broker VM activation token if NTP is not reachable every 60 seconds.

Why wrong: Licensing tokens are not revoked due to temporary NTP unreachable states.

Modify the global tenant encryption keys under General Settings.

Why wrong: Incorrect. Encryption keys do not resolve Docker container networking corruption on Broker VMs.

Execute an XQL query with the `reset_broker` command.

Why wrong: Incorrect. XQL is a query language and cannot execute management resets on Broker VMs.

Run the `xdrctl uninstall` command on every managed Windows endpoint.

Why wrong: Incorrect. `xdrctl` is for endpoint agents, not Broker VMs.

In the Cortex XSIAM tenant UI under Incident Response settings.

Why wrong: Tenant UI settings do not configure local appliance proxy routes.

By editing the local firewall rules using iptables to forward port 80 to port 3128.

Why wrong: iptables rule changes do not configure application-level proxy authentication.

By modifying the Windows Registry on the underlying host operating system.

Why wrong: Broker VM runs on a hardened Linux appliance, not Windows.