Free XSIAM-Engineer sample questions

Correct answer: Broker VM with Local Agent Settings enabled

The Broker VM acts as a concentrator for network logs and other data sources. It can aggregate, compress, and cache data before transmission to the Cortex XSIAM cloud, significantly reducing WAN bandwidth usage compared to direct transmission from all endpoints or devices.

Correct answer: TCP/443

Port 443 (HTTPS) is the primary requirement for the Broker VM to communicate with the Cortex XSIAM cloud for registration, configuration updates, and data upload. While other ports like 8883 (MQTT) may be used for specific functions or caching, 443 is mandatory for basic connectivity.

Correct answer: Security Analyst

The Security Analyst role typically includes permissions for investigation, querying, and viewing incidents but does not include full administrative rights or the default ability to execute high-impact response actions without specific permission grants. It is the best baseline to clone and restrict further if needed.

Correct answer: Plan for a Heavy or Custom resource profile with at least 16 vCPUs and 32GB RAM.

A standard Broker VM profile supports up to roughly 2,000-5,000 EPS depending on the configuration. For 8,000 EPS, a 'Heavy' profile or a custom high-performance configuration with significantly increased CPU and RAM (e.g., 16 vCPUs, 32GB RAM) is required to prevent buffer overflows and packet drops.

Correct answers: SNS Topic for event notifications; SQS Queue for message buffering

For efficient ingestion (SQS-based), XSIAM typically requires an SQS queue subscribed to an SNS topic that receives S3 event notifications (ObjectCreated). This allows XSIAM to pull logs immediately rather than scanning the bucket.

An SQS queue is required to buffer the event notifications from S3. XSIAM polls this queue to know which objects to download and ingest.

Correct answer: Conditional Task / Data Collection Task

A conditional task evaluates specific criteria (like incident.severity == 'Critical') and directs the playbook flow down different paths based on the result. This is the standard method for branching logic in playbooks.

Correct answer: False

Content Packs in XSIAM are installed as a unit. While you can choose which components to *enable* or *use* after installation, the installation process itself generally deploys the full pack contents (integrations, playbooks, layouts, etc.) to the instance.

Correct answer: alter username = regextract(_raw_log, "User: (\S+)")

The `regextract` function is used in XQL to extract data based on a regex pattern. The pattern `User: (\S+)` looks for 'User: ' followed by non-whitespace characters, capturing 'admin'.

Correct answer: To normalize data from different sources into a unified schema for correlation and detection

XDM (XSIAM Data Model) provides a standardized schema (fields like xdm.source.ip, xdm.event.type) that allows XSIAM to correlate and analyze data from diverse vendors (e.g., Cisco firewall, Windows Event Log, AWS CloudTrail) uniformly without needing vendor-specific queries for every rule.

Correct answer: trapsd.log / cytool logs

The `trapsd.log` (on Windows/Linux/macOS varies slightly in name/location, often under ProgramData or /var/log/traps) contains the core agent operations, including heartbeats and connection attempts to the Cortex cloud service. It is the primary source for connectivity errors.