I85PREP
⌘ K
XSIAM Engineer study materials
XSIAM Engineer study resources

XSIAM Engineer practice questions

One question at a time. Build your XSIAM Engineer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cortex XSIAM Platform Architecture and Deployment

In a Cortex XSIAM deployment, which component is responsible for collecting and normalizing data from on-premises log sources before forwarding it to the Cortex XSIAM tenant?

  1. The Cortex XSIAM Broker VM Correct answer.
  2. The Cortex XSIAM management console
  3. The Cortex XDR agent
  4. The Cortex XSIAM Marketplace

Explanation

The Broker VM is the on-premises appliance that receives data from local sources, applies collection and normalization, and forwards it into the Cortex XSIAM tenant. It also serves roles such as local agent distribution and syslog collection.

Question 2Cortex XSIAM Platform Architecture and Deployment

Which data source type does Cortex XSIAM ingest natively through the Cortex XDR agent rather than requiring a Broker VM or cloud integration?

  1. Cloud audit logs from a SaaS provider
  2. Third-party firewall syslog
  3. Endpoint process and network telemetry Correct answer.
  4. NetFlow records from a core switch

Explanation

The Cortex XDR agent runs on endpoints and streams rich endpoint telemetry such as process, file, and network events directly to the platform. Syslog, cloud audit, and NetFlow sources instead require Broker VM collection or API-based integrations.

Question 3Cortex XSIAM Platform Architecture and Deployment

A security team wants to understand how Cortex XSIAM correlates disparate alerts into incidents. Which statement best describes the platform's detection model?

  1. Correlation happens only on the endpoint agent before data leaves the host
  2. Analytics and correlation rules group related events and alerts into incidents for investigation Correct answer.
  3. Each raw log line is presented to analysts as an independent incident
  4. Incidents are created manually by analysts from a query interface

Explanation

Cortex XSIAM applies analytics, machine learning, and correlation rules to combine related events and alerts into higher-level incidents. This reduces alert fatigue by presenting grouped, contextualized cases rather than isolated raw logs.

Question 4Cortex XSIAM Platform Architecture and Deployment

Which capability allows Cortex XSIAM to take automated response actions such as isolating an endpoint or blocking a hash when a detection fires?

  1. Read-only syslog forwarding
  2. Static dashboard widgets
  3. Playbook-driven automation with response actions Correct answer.
  4. Manual CSV export of alerts

Explanation

Cortex XSIAM uses playbooks and automation rules to execute response actions automatically or with approval when detections trigger. These actions can include endpoint isolation, file quarantine, and indicator blocking.

Question 5Cortex XSIAM Platform Architecture and Deployment

An engineer needs to grant an analyst the ability to investigate incidents but not to modify platform configuration. Which Cortex XSIAM mechanism enforces this?

  1. Agent version management
  2. Role-based access control with scoped permissions Correct answer.
  3. Data retention policies
  4. Broker VM high availability

Explanation

Cortex XSIAM uses role-based access control to assign permissions and scopes to users, separating investigative access from administrative configuration. This ensures least-privilege access across the platform.

Question 6Cortex XSIAM Platform Architecture and Deployment

Which statement accurately describes the relationship between Cortex XSIAM and Cortex XDR in a typical architecture?

  1. The two products cannot share telemetry
  2. Cortex XSIAM is a broader security operations platform that can ingest endpoint data including from Cortex XDR agents Correct answer.
  3. Cortex XSIAM replaces the need for any endpoint agent
  4. Cortex XDR is the management layer that controls Cortex XSIAM tenants

Explanation

Cortex XSIAM is positioned as an extended security intelligence and automation platform that consolidates multiple data sources, including endpoint telemetry from Cortex XDR agents. The endpoint agent remains a key telemetry source within the broader platform.

Question 7Cortex XSIAM Platform Architecture and Deployment

What is the primary purpose of the Cortex XSIAM Marketplace?

  1. To manage endpoint agent licenses
  2. To install integrations, content packs, and playbooks that extend platform capabilities Correct answer.
  3. To host the Broker VM virtual appliance images only
  4. To store raw log archives for compliance

Explanation

The Marketplace provides integrations, content packs, and playbooks that extend data ingestion and automation capabilities. Engineers use it to add support for new sources and response workflows.

Question 8Cortex XSIAM Platform Architecture and Deployment

Which deployment consideration is most important when sizing a Broker VM for high-volume syslog ingestion?

  1. Disabling log normalization to save resources
  2. Routing all traffic through the management console
  3. Matching CPU, memory, and disk to the expected events-per-second rate Correct answer.
  4. Selecting the smallest available appliance to reduce cost

Explanation

Broker VM sizing must account for the volume of events per second, since collection, parsing, and forwarding consume CPU, memory, and disk. Undersizing leads to dropped or delayed data.

Question 9Cortex XSIAM Platform Architecture and Deployment

An engineer is configuring data ingestion from a cloud provider's audit log API. Which Cortex XSIAM component typically handles this integration?

  1. The endpoint agent installed on cloud virtual machines
  2. A local syslog relay on the Broker VM
  3. The Marketplace billing module
  4. A cloud-based integration instance configured in the platform Correct answer.

Explanation

Cloud audit logs are pulled through API-based integration instances configured in the platform, which authenticate and fetch data on a schedule. This differs from agent-based or syslog-based collection.

Question 10Cortex XSIAM Platform Architecture and Deployment

A SOC wants Cortex XSIAM to automatically enrich incidents with threat intelligence before an analyst reviews them. Which approach best fits the platform's architecture?

  1. Disable correlation so raw indicators surface faster
  2. Export incidents to a spreadsheet for enrichment
  3. Manually query an external threat feed for each incident
  4. Configure a playbook that runs enrichment steps on incident creation Correct answer.

Explanation

Playbooks can be triggered on incident creation to automatically run enrichment steps such as threat intelligence lookups. This embeds enrichment into the workflow without manual effort.

Question 11Cortex XSIAM Platform Architecture and Deployment

Which statement best explains why Cortex XSIAM normalizes ingested data into a common schema?

  1. It encrypts data at rest
  2. It replaces the need for role-based access control
  3. It enables consistent correlation, search, and analytics across heterogeneous sources Correct answer.
  4. It reduces the need for endpoint agents

Explanation

Normalization maps fields from many source types into a common schema so that correlation rules, queries, and analytics can operate consistently. Without it, cross-source analysis would be unreliable.

Question 12Cortex XSIAM Platform Architecture and Deployment

During a Cortex XSIAM rollout, an engineer must ensure endpoint data continues to flow even if the on-premises Broker VM fails. Which design choice addresses this?

  1. Install a single Broker VM with maximum disk
  2. Deploy Broker VMs in a high-availability configuration Correct answer.
  3. Disable endpoint telemetry during outages
  4. Rely solely on cloud API integrations

Explanation

High availability for Broker VMs ensures continued collection and forwarding if one appliance fails. A single appliance, regardless of disk size, remains a single point of failure.

Question 13Cortex XSIAM Platform Architecture and Deployment

Which factor most directly determines how far back analysts can investigate historical incidents in Cortex XSIAM?

  1. The endpoint agent version
  2. The configured data retention period for the relevant data sets Correct answer.
  3. The number of installed Marketplace content packs
  4. The number of configured user roles

Explanation

Retention settings define how long data remains queryable, which bounds historical investigation. Content packs, agent versions, and roles do not control data availability over time.

Question 14Cortex XSIAM Platform Architecture and Deployment

An analyst reports that incidents from a newly integrated firewall source are not being correlated with endpoint activity. What is the most likely architectural cause?

  1. The firewall logs are not being normalized into the common schema used by correlation rules Correct answer.
  2. The Marketplace contains too many content packs
  3. The endpoint agent is installed on too many hosts
  4. The analyst has read-only access

Explanation

Correlation depends on normalized fields; if firewall logs are not mapped to the common schema, rules cannot join them with endpoint events. Verifying parsing and normalization is the first diagnostic step.

Question 15Cortex XSIAM Platform Architecture and Deployment

Which Cortex XSIAM feature allows engineers to define which alerts automatically become incidents based on severity and confidence thresholds?

  1. Broker VM load balancing
  2. Agent heartbeat monitoring
  3. Alert-to-incident correlation and grouping rules Correct answer.
  4. Marketplace subscription tiers

Explanation

Correlation and grouping rules determine how alerts are combined and escalated into incidents based on criteria such as severity and confidence. This controls incident volume and prioritization.

Question 16Cortex XSIAM Platform Architecture and Deployment

What is the recommended first step when onboarding a new log source into Cortex XSIAM?

  1. Disable existing correlation rules
  2. Immediately create response playbooks for the source
  3. Verify that a supported integration or parser exists for the source format Correct answer.
  4. Reduce data retention to minimum

Explanation

Onboarding begins by confirming integration or parser support so the data can be collected and normalized correctly. Playbooks and tuning come after data is flowing and validated.

Question 17Cortex XSIAM Platform Architecture and Deployment

An engineer wants to validate that a Broker VM is successfully forwarding data to the tenant. Which evidence best confirms this?

  1. Ingested events from the source appear in platform queries with recent timestamps Correct answer.
  2. The Marketplace shows available content packs
  3. The endpoint agent version is current
  4. The Broker VM has a static IP address

Explanation

Successful forwarding is confirmed when recent events from the source are queryable in the platform. Configuration attributes like IP addressing do not prove data delivery.

Question 18Cortex XSIAM Platform Architecture and Deployment

Which statement about Cortex XSIAM's cloud-native architecture is accurate?

  1. The platform is delivered as a cloud service, reducing the need to host the analytics and storage stack on premises Correct answer.
  2. All platform components must run on customer-managed hardware
  3. Analytics run only on the endpoint agent
  4. The platform stores no data in the cloud

Explanation

Cortex XSIAM is delivered as a cloud service, so analytics, correlation, and storage are largely operated by the vendor. Customers primarily deploy lightweight collection components such as Broker VMs and agents.

Question 19Cortex XSIAM Platform Architecture and Deployment

A team needs to segment data so that analysts in one region cannot view incidents from another region. Which Cortex XSIAM capability supports this?

  1. Agent exclusion lists
  2. Scoped role-based access control with data segmentation Correct answer.
  3. Syslog forwarding filters
  4. Broker VM clustering

Explanation

Scoped RBAC can restrict users to specific data segments, supporting regional or business-unit separation. Collection and forwarding features do not enforce analyst visibility boundaries.

Question 20Cortex XSIAM Platform Architecture and Deployment

Which integration pattern is most appropriate for pulling indicators from an external threat intelligence platform into Cortex XSIAM on a recurring schedule?

  1. A dashboard widget that displays indicators
  2. A syslog feed pushed from the endpoint agent
  3. A scheduled integration instance that fetches and stores indicators Correct answer.
  4. A manual upload performed by each analyst

Explanation

Scheduled integration instances can poll external intelligence platforms and store indicators for matching and enrichment. Manual uploads and dashboards do not provide recurring automated ingestion.

Question 21Cortex XSIAM Platform Architecture and Deployment

An engineer observes that incident volume spiked after onboarding a noisy source. Which approach best aligns with Cortex XSIAM tuning practices?

  1. Disable all playbooks platform-wide
  2. Reduce the number of analysts
  3. Remove normalization for the source
  4. Adjust correlation and alerting rules to suppress low-fidelity detections from that source Correct answer.

Explanation

Tuning focuses on correlation and alerting logic so low-fidelity detections do not create excessive incidents. This preserves detection coverage while reducing noise.

Question 22Cortex XSIAM Platform Architecture and Deployment

A company must keep certain regulated log data within its own network while still using Cortex XSIAM analytics. Which architectural consideration is most relevant?

  1. Determining which data can be forwarded to the cloud tenant versus retained locally, and configuring collection accordingly Correct answer.
  2. Increasing the number of Marketplace content packs
  3. Disabling role-based access control
  4. Installing the endpoint agent on the management console

Explanation

Regulatory constraints require mapping which data may leave the local network and configuring collection and retention to respect that boundary. This is a data-flow design decision, not a content or access-control one.

Question 23Cortex XSIAM Platform Architecture and Deployment

Which statement best captures the role of machine learning analytics in Cortex XSIAM's detection pipeline?

  1. ML models analyze normalized telemetry to surface anomalous behavior that static rules may miss Correct answer.
  2. ML replaces all correlation rules and playbooks
  3. ML runs only on the Broker VM
  4. ML requires disabling data normalization

Explanation

Machine learning models operate on normalized telemetry to detect behavioral anomalies complementing rule-based detection. They augment rather than replace correlation rules and automation.

Question 24Cortex XSIAM Platform Architecture and Deployment

An engineer is designing a multi-tenant-like separation for two business units sharing one Cortex XSIAM tenant. Which combination best achieves isolation of visibility and response scope?

  1. Disabling correlation for one business unit
  2. Scoped RBAC for visibility combined with scoped automation and asset grouping for response Correct answer.
  3. Separate Broker VMs only, with shared analyst roles
  4. A single global admin role for all analysts

Explanation

Effective separation requires both scoped visibility through RBAC and scoped response through automation and asset grouping. Collection changes alone do not isolate what analysts can see or act on.

Question 25Cortex XSIAM Platform Architecture and Deployment

A security architect must justify why Cortex XSIAM uses Broker VMs instead of requiring all log sources to send data directly to the cloud. Which rationale is most accurate?

  1. Broker VMs eliminate the need for cloud analytics
  2. Broker VMs enable secure local collection, buffering, and normalization for sources that cannot or should not connect directly to the cloud Correct answer.
  3. Broker VMs store all incident data permanently on premises
  4. Broker VMs replace endpoint agents entirely

Explanation

Broker VMs provide a local collection tier that can buffer, normalize, and securely forward data from sources lacking direct cloud connectivity. They complement rather than replace cloud analytics and endpoint agents.

Question 26Cortex XSIAM Platform Architecture and Deployment

In Cortex XSIAM, which component is responsible for executing playbooks and issuing commands to integrated security products during automated response?

  1. The data normalization pipeline
  2. The Marketplace content updater
  3. The Cortex XSIAM engine that runs automation playbooks and actions Correct answer.
  4. The Broker VM that buffers and forwards logs

Explanation

Cortex XSIAM separates detection from response execution: the automation engine runs playbooks and dispatches actions to integrated products through their configured instances. Broker VMs only handle data transport, normalization shapes data for analytics, and Marketplace content updates supply integrations and content packs.

Question 27Cortex XSIAM Platform Architecture and Deployment

Which Cortex XSIAM capability provides a curated library of integrations, playbooks, and parsing rules that engineers install into a tenant?

  1. The Broker VM configuration wizard
  2. The audit log export job
  3. The content pack catalog delivered through the Marketplace Correct answer.
  4. The query builder in the investigation console

Explanation

The Marketplace distributes content packs that bundle integrations, playbooks, and parsers so engineers can extend tenant capability without building everything from scratch. The other options are operational tools for transport, querying, and auditing rather than content distribution.

Question 28Cortex XSIAM Platform Architecture and Deployment

A SOC wants Cortex XSIAM to correlate endpoint, identity, and network telemetry into a single incident rather than separate alerts. Which architectural characteristic enables this?

  1. Separate data stores per source type queried on demand
  2. Centralized ingestion into one analytics data layer with a unified schema Correct answer.
  3. Per-product consoles that forward summarized alerts by email
  4. Manual analyst stitching of alerts from each console

Explanation

Cortex XSIAM ingests telemetry from many sources into a single analytics layer where normalized fields allow cross-source correlation into one incident. Per-source stores or email summaries prevent the platform from joining events across domains automatically.

Question 29Cortex XSIAM Platform Architecture and Deployment

Which statement describes how Cortex XSIAM handles detection content updates compared with a fully self-managed SIEM?

  1. Detection content is maintained only by the customer's MSSP
  2. Detection content is frozen at the version installed at deployment
  3. Detection content is delivered and maintained as part of the cloud service Correct answer.
  4. Detection rules must be written from scratch by each customer

Explanation

As a cloud-delivered platform, Cortex XSIAM supplies and updates detection content as part of the service, reducing the burden of authoring and maintaining every rule locally. Customers can still add custom content, but they are not required to build the baseline themselves.

Question 30Cortex XSIAM Platform Architecture and Deployment

An engineer must onboard a syslog feed from a device that cannot reach the internet directly. Which Cortex XSIAM deployment pattern supports this requirement?

  1. Open inbound firewall rules so the tenant can pull syslog directly from the device
  2. Install a full Cortex XSIAM server on premises to terminate the syslog stream
  3. Deploy a Broker VM inside the network to receive the syslog and forward it to the tenant Correct answer.
  4. Send the syslog to the Marketplace for parsing before ingestion

Explanation

Broker VMs act as local collection points that receive data from sources unable to egress directly and forward it securely to the cloud tenant. The tenant does not initiate inbound connections to customer devices, and the Marketplace distributes content rather than receiving logs.

Question 31Cortex XSIAM Platform Architecture and Deployment

A security team wants to enrich incidents with asset ownership data from its CMDB. Which Cortex XSIAM mechanism best supports recurring, automated enrichment?

  1. A saved query that analysts run manually during triage
  2. A Broker VM rule that rewrites log fields before ingestion
  3. An integration instance with a scheduled playbook that writes enrichment fields to incidents Correct answer.
  4. A one-time CSV import of asset owners into a lookup table

Explanation

Integrations plus scheduled playbooks provide repeatable enrichment that keeps incident context current as the CMDB changes. A one-time import goes stale, manual queries do not automate enrichment, and Broker VM field rewriting alters raw data rather than adding asset context.

Question 32Cortex XSIAM Platform Architecture and Deployment

An engineer needs to restrict which analysts can view incidents containing data from a regulated business unit. Which Cortex XSIAM construct is designed for this?

  1. Role-based access control combined with scoped visibility such as tenant or dataset restrictions Correct answer.
  2. Broker VM high-availability pairing
  3. Playbook task-level approval gates
  4. Log forwarding filters on the collector

Explanation

Access control in Cortex XSIAM is enforced through roles and scoped visibility so analysts only see the data their role permits. Broker HA, playbook approvals, and collector filters affect availability, workflow control, and data routing, not who can view incidents.

Question 33Cortex XSIAM Platform Architecture and Deployment

A customer wants Cortex XSIAM to query an external REST API every hour for new indicators. Which configuration element defines the endpoint, credentials, and fetch interval?

  1. A dataset schema that includes the indicator fields
  2. A correlation rule that references the API URL
  3. An integration instance configured with the API parameters and a scheduled fetch Correct answer.
  4. A dashboard widget bound to the API response

Explanation

Integration instances hold connection parameters and credentials, and their fetch commands can be scheduled to poll on an interval. Correlation rules, dataset schemas, and dashboard widgets consume data but do not establish authenticated polling of an external API.

Question 34Cortex XSIAM Platform Architecture and Deployment

During a proof of concept, an engineer must confirm that a newly onboarded source's events are parsed into the expected normalized fields. Which action best verifies this?

  1. Confirm the integration instance shows a connected status
  2. Review the audit log for configuration changes
  3. Query recent events from that source and inspect the mapped normalized fields Correct answer.
  4. Check that the Broker VM shows a healthy heartbeat

Explanation

Parsing success is proven by inspecting events in the data layer and confirming raw values land in the expected normalized fields. Heartbeats, connection status, and audit entries confirm transport and configuration activity but say nothing about field mapping quality.

Question 35Cortex XSIAM Platform Architecture and Deployment

An architect is planning capacity and must decide where to deploy Broker VMs for a large distributed estate. Which placement principle best aligns with Cortex XSIAM design?

  1. Place a single collector at the data center edge to consolidate all sources
  2. Place collectors on each endpoint to eliminate network hops
  3. Place collectors close to the data sources they serve and size them for peak forwarding volume Correct answer.
  4. Place collectors only in the cloud region hosting the tenant

Explanation

Broker VMs are placed near their sources so traffic stays local until it is forwarded, and each must be sized for peak throughput and buffering. A single edge collector creates a bottleneck and single point of failure, cloud-region placement defeats local collection, and per-endpoint collectors are not the intended model.

Question 36Cortex XSIAM Platform Architecture and Deployment

A team wants to ingest firewall logs, endpoint telemetry, and cloud audit events while keeping a consistent field vocabulary for detection rules. Which Cortex XSIAM design element achieves this consistency?

  1. Relying on vendor-specific field names inside correlation rules
  2. Normalizing all sources into a shared schema used by detection content Correct answer.
  3. Requiring analysts to translate field names per source in each rule
  4. Storing each source in its own raw-only dataset without mapping

Explanation

A shared normalized schema lets detection content reference common field names regardless of the originating product. Raw-only datasets, per-source translation, and vendor-specific field names force rules to be rewritten for every source and undermine reuse.

Question 37Cortex XSIAM Platform Architecture and Deployment

An engineer needs Cortex XSIAM to run a containment action automatically only when an incident meets specific severity and asset criticality conditions. Which configuration approach fits best?

  1. A playbook triggered by matching incident criteria with conditional tasks before the containment step Correct answer.
  2. A dataset retention rule applied to matching events
  3. A dashboard alert that emails the SOC when criteria are met
  4. A Broker VM filter that drops matching events before ingestion

Explanation

Automated conditional response is implemented with playbooks whose triggers match incident criteria and whose tasks branch on severity and asset criticality before acting. Filters, dashboards, and retention rules affect data flow or visibility but do not execute containment.

Question 38Cortex XSIAM Platform Architecture and Deployment

An engineer must explain why Cortex XSIAM can apply machine learning across months of telemetry without the customer provisioning analytics infrastructure. Which architectural property supports this?

  1. Analytics run on cloud-managed infrastructure that scales independently of customer hardware Correct answer.
  2. Analytics run on the Broker VM using spare local CPU
  3. Analytics run only on the endpoint agent to reduce cloud load
  4. Analytics require a dedicated on-premises GPU cluster per tenant

Explanation

Because analytics execute on cloud-managed infrastructure, compute and storage scale without customer-provisioned hardware, enabling long-horizon modeling. Broker VMs and endpoint agents are not the analytics tier, and tenants are not required to stand up their own GPU clusters.

Question 39Cortex XSIAM Platform Architecture and Deployment

A regulated customer requires that raw logs remain stored in their own environment while still benefiting from Cortex XSIAM detection. Which architectural discussion is most relevant?

  1. How collection, normalization, and analytics placement interact with data residency requirements Correct answer.
  2. How to reduce incident volume by tuning correlation rules
  3. How to increase Broker VM disk size for longer local retention
  4. How to enable more Marketplace content packs for the tenant

Explanation

Data residency hinges on where data is collected, normalized, and analyzed, so the architecture discussion must address those boundaries and any local retention options. Disk sizing, content packs, and correlation tuning are operational levers that do not by themselves resolve residency constraints.

Question 40Cortex XSIAM Platform Architecture and Deployment

An engineer is designing ingestion for a high-volume source and must choose between sending data directly to the tenant and routing it through a Broker VM. Which consideration most strongly favors the Broker VM path?

  1. The source cannot egress to the internet and requires local buffering and protocol translation Correct answer.
  2. The source already supports the tenant's native ingestion API over the internet
  3. The team wants to minimize the number of deployed appliances
  4. The source emits fewer than one hundred events per day

Explanation

Broker VMs add value when sources cannot reach the cloud directly or need local buffering and protocol handling before forwarding. Sources that can use native cloud ingestion, low-volume feeds, and appliance-minimization goals argue against adding a broker hop.

Question 41Data Sources, Ingestion, and Parsing

In XSIAM, which component is responsible for receiving raw logs from a broker such as a Syslog forwarder before any normalization occurs?

  1. The playbook execution service
  2. The correlation rule engine
  3. The data collector appliance Correct answer.
  4. The Cortex Query Language compiler

Explanation

Collectors are the ingestion tier that terminates transport connections from forwarders and brokers, buffers events, and forwards them to the processing pipeline. Normalization and schema mapping happen downstream of the collector, not inside it.

Question 42Data Sources, Ingestion, and Parsing

A log source sends JSON events where the severity field is sometimes the string "high" and sometimes the integer 3. Which parsing approach best preserves both values for querying?

  1. Store severity as a string field and normalize values during parsing Correct answer.
  2. Map only the integer form and drop string events
  3. Rename the field so the type conflict disappears
  4. Disable type inference for the dataset entirely

Explanation

A field must have one resolved type per dataset, so mixed representations must be coerced at parse time into a single canonical form. Storing severity as a string and mapping numeric codes to labels keeps every event queryable and avoids dropped data.

Question 43Data Sources, Ingestion, and Parsing

Which XSIAM dataset naming convention identifies the built-in dataset that holds normalized endpoint process events?

  1. audit_logs
  2. system_health
  3. xdr_data Correct answer.
  4. ingestion_metrics

Explanation

The xdr_data dataset is the normalized store for endpoint telemetry such as process, file, and network activity collected by the endpoint agent. Detection content and XQL queries against endpoint behavior target this dataset.

Question 44Data Sources, Ingestion, and Parsing

You need to onboard a custom application log that arrives over HTTP in newline-delimited JSON. Which sequence of steps is correct in the XSIAM onboarding flow?

  1. Configure the broker first, then create a report, then define the dataset schema
  2. Create dataset, then create parsing rule, then configure the collector or broker to send data Correct answer.
  3. Create parser, then create correlation rule, then test dataset
  4. Create correlation rule, then create dataset, then define parser

Explanation

Onboarding begins by defining the dataset and its schema, then building the parsing rule that maps raw fields into it, and finally pointing the ingestion channel at the endpoint. Correlation content comes after the data is queryable.

Question 45Data Sources, Ingestion, and Parsing

A broker forwards CEF-formatted events. What is the primary role of a CEF parsing rule in XSIAM?

  1. Encrypt the CEF payload in transit
  2. Convert CEF into Syslog RFC 5424 framing
  3. Deduplicate identical CEF events before storage
  4. Extract CEF header and extension key-value pairs into dataset fields Correct answer.

Explanation

CEF carries a structured header plus extension key-value pairs, and the parsing rule's job is to split those into named fields that match the dataset schema. Transport encryption and deduplication are handled elsewhere in the pipeline.

Question 46Data Sources, Ingestion, and Parsing

Which XQL construct is used to project and rename parsed fields from a dataset in a query?

  1. config timeframe
  2. fields Correct answer.
  3. dataset
  4. stage

Explanation

The fields stage selects and can alias columns returned by a query, which is how you surface parsed fields with readable names. Stages like dataset and config establish the source and time range rather than shaping columns.

Question 47Data Sources, Ingestion, and Parsing

A vendor log includes a timestamp in the format 2024-03-11T14:22:05.123+02:00. Which parsing consideration is most important for correct event time?

  1. Store the timestamp as an unparsed string field only
  2. Truncate the string to the first 19 characters
  3. Parse the offset and convert to UTC for the event timestamp Correct answer.
  4. Replace the offset with Z without conversion

Explanation

Event time must be normalized to UTC so that correlation, query time windows, and ordering behave consistently across sources. Ignoring the offset or stripping it silently shifts events by hours.

Question 48Data Sources, Ingestion, and Parsing

What distinguishes a parsing rule from a modeling rule in XSIAM data ingestion?

  1. Parsing rules are optional; modeling rules are mandatory for every dataset
  2. Parsing rules extract raw fields; modeling rules map them to normalized schema fields Correct answer.
  3. Parsing rules apply only to CEF; modeling rules apply only to JSON
  4. Parsing rules run on the endpoint; modeling rules run in the cloud

Explanation

Parsing rules break the raw event into fields, while modeling rules translate those vendor-specific fields into the normalized schema used by detection content. The two stages are sequential and both can be required depending on the source.

Question 49Data Sources, Ingestion, and Parsing

Ingestion of a high-volume firewall feed is falling behind and events are arriving with increasing latency. Which action most directly addresses collector-side backpressure?

  1. Increase the correlation rule evaluation interval
  2. Add collector capacity or split the feed across collectors Correct answer.
  3. Reduce the dataset retention period
  4. Disable parsing for the feed to reduce CPU

Explanation

Backpressure at ingestion usually means the collector tier cannot keep up with the event rate, so scaling out collectors or distributing the feed restores throughput. Parsing and retention changes affect downstream processing and storage, not the ingest bottleneck.

Question 50Data Sources, Ingestion, and Parsing

Which statement correctly describes how XSIAM handles a log source that sends events with no parseable timestamp?

  1. The event is rejected and an error is returned to the sender
  2. The platform assigns ingestion time as the event time Correct answer.
  3. The event is duplicated until a timestamp appears
  4. The event is stored with a null timestamp and excluded from all queries

Explanation

When a source timestamp cannot be parsed, the platform falls back to the time the event was received so the event remains ordered and queryable. This fallback is why accurate source timestamp parsing matters for investigation timelines.