Free XSIAM-Engineer sample questions

Correct answer: Security Analyst

The Security Analyst role typically includes permissions for investigation, querying, and viewing incidents but does not include full administrative rights or the default ability to execute high-impact response actions without specific permission grants. It is the best baseline to clone and restrict further if needed.

Correct answer: Plan for a Heavy or Custom resource profile with at least 16 vCPUs and 32GB RAM.

A standard Broker VM profile supports up to roughly 2,000-5,000 EPS depending on the configuration. For 8,000 EPS, a 'Heavy' profile or a custom high-performance configuration with significantly increased CPU and RAM (e.g., 16 vCPUs, 32GB RAM) is required to prevent buffer overflows and packet drops.

Correct answers: SQS Queue for message buffering; SNS Topic for event notifications

An SQS queue is required to buffer the event notifications from S3. XSIAM polls this queue to know which objects to download and ingest.

For efficient ingestion (SQS-based), XSIAM typically requires an SQS queue subscribed to an SNS topic that receives S3 event notifications (ObjectCreated). This allows XSIAM to pull logs immediately rather than scanning the bucket.

Correct answer: Conditional Task / Data Collection Task

A conditional task evaluates specific criteria (like incident.severity == 'Critical') and directs the playbook flow down different paths based on the result. This is the standard method for branching logic in playbooks.

Correct answer: False

Content Packs in XSIAM are installed as a unit. While you can choose which components to *enable* or *use* after installation, the installation process itself generally deploys the full pack contents (integrations, playbooks, layouts, etc.) to the instance.

Correct answer: alter username = regextract(_raw_log, "User: (\S+)")

The `regextract` function is used in XQL to extract data based on a regex pattern. The pattern `User: (\S+)` looks for 'User: ' followed by non-whitespace characters, capturing 'admin'.

Correct answer: To normalize data from different sources into a unified schema for correlation and detection

XDM (XSIAM Data Model) provides a standardized schema (fields like xdm.source.ip, xdm.event.type) that allows XSIAM to correlate and analyze data from diverse vendors (e.g., Cisco firewall, Windows Event Log, AWS CloudTrail) uniformly without needing vendor-specific queries for every rule.

Correct answer: trapsd.log / cytool logs

The `trapsd.log` (on Windows/Linux/macOS varies slightly in name/location, often under ProgramData or /var/log/traps) contains the core agent operations, including heartbeats and connection attempts to the Cortex cloud service. It is the primary source for connectivity errors.

Correct answer: Configure a Syslog Collector with a custom vendor/product name -> Ingest data -> Create a Parsing Rule using XQL to map fields to XDM -> Validate and Enable.

The correct workflow is to first ingest the data (often identifying it with a custom vendor/product tag), then use the XSIAM parsing engine (accessible via Settings -> Configurations -> Parsing Rules) to define how to break the `_raw_log` into fields and map them to the XDM schema (normalization).

Correct answer: BIOC Rules Editor

BIOC (Behavioral Indicator of Compromise) rules are specific detection rules that match raw EDR data (process, file, network events) to identify malicious behaviors. They are managed in the BIOC Rules section of the XSIAM console.