Palo Alto Networks Certified XSIAM Engineer Practice Exam

What the Palo Alto Networks Certified XSIAM Engineer exam covers

• Planning and Installation115 questions
• Integration and Automation161 questions
• Content Optimization130 questions
• Maintenance and Troubleshooting113 questions

Free Palo Alto Networks Certified XSIAM Engineer practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 519-question bank.

1. Question 1Planning and Installation

   Kestrel Freight is activating its first Cortex XSIAM tenant. Its Palo Alto Networks firewalls already forward logs to a Strata Logging Service instance hosted in the EU region, and the plan is to stream that instance's data into the new tenant. The SOC analysts work from the United States, and the legal team has no data residency preference. Which region decision should the engineer make on the Tenant Activation page?

   • ASelect the US region to keep the tenant close to the analysts, and stream the EU instance into it
   • BSelect the US region, and host the Directory Sync Service in the EU region beside the log instance
   • CSelect the EU region, the region in which the Strata Logging Service instance is already hostedCorrect
   • DSelect the EU region for the tenant, and move the Strata Logging Service instance to the US region
   ✓ Correct answer: C

   The plan and prepare stage tells you to determine the region that will host Cortex XSIAM and its associated services. It then adds that if you plan to stream data from a Strata Logging Service instance, that instance must be in the same region as Cortex XSIAM. Kestrel Freight's instance already lives in the EU region and the legal team has no competing residency requirement, so the tenant region should be EU. Analyst location does not change this constraint, because the region is chosen at activation for where the tenant and its data are hosted.

   Why the other options are wrong

   • AStreaming from Strata Logging Service requires the instance and the tenant to share a region, so a US tenant cannot take the stream from an EU instance.
   • BThe Directory Sync Service is one of the associated services whose region you plan, but moving it does not lift the rule that the Strata Logging Service instance must match the tenant region.
   • DMoving the Strata Logging Service instance to the US region would put it in a different region from the EU tenant, and an instance that streams data into Cortex XSIAM must be in the same region as Cortex XSIAM.
2. Question 2Planning and Installation

   Corvane Insurance has a Cortex XSIAM tenant in the EU region and will deploy its first Broker VM from the Broker VMs page. The perimeter firewall is not a Palo Alto Networks firewall, so App-IDs cannot be used and every storage bucket must be allowed by FQDN. The firewall team has asked which storage bucket the Broker VM image itself is downloaded from. Which FQDN should the engineer give them?

   • Apanw-xdr-installers-prod-us.storage.googleapis.com
   • Bpanw-xdr-payloads-prod-us.storage.googleapis.com
   • Cglobal-content-profiles-policy.storage.googleapis.com
   • Dxdr-ova-installers-prod-us.storage.googleapis.comCorrect
   ✓ Correct answer: D

   Under Broker VM Resources, which are required for deployments that use Broker VM features, the required resources page lists xdr-ova-installers-prod-us.storage.googleapis.com as the bucket used to download Broker VM images from the server. The page states that this storage bucket is used for all regions, so the us suffix does not conflict with an EU tenant. It is reached on port 443 from the GCP IP ranges. The other buckets in the table serve agent installers, legacy live terminal payloads and content updates.

   Why the other options are wrong

   • AThis bucket is used to download Cortex XDR agent installers for upgrade actions from the server, not Broker VM images.
   • BThis bucket is used to download the live terminal executable for agents earlier than version 7.1.0, not Broker VM images.
   • CThis bucket is used to download content updates, not the Broker VM image.
3. Question 3Planning and Installation

   Marlow Health manages Cortex XSIAM user groups through Cloud Identity Engine directory sync: CIE pulls groups from Okta over SCIM, and the tenant imports selected CIE groups with Import AD Group. This morning the identity team created a new Okta group, SOC-Hunt. One hour later the engineer cannot find SOC-Hunt in the tenant's import list, although older Okta groups appear there, and the SCIM provisioning log in Okta shows no errors. What should the engineer do?

   • ACreate SOC-Hunt as a user group in Cortex Gateway so that CIE can pick it up
   • BWait a few hours for the periodic CIE to tenant sync, then check againCorrect
   • CHave a SOC-Hunt member sign in through SSO so JIT provisioning creates the group
   • DEnter SOC-Hunt in the SAML Group Mapping of an existing group to register it
   ✓ Correct answer: B

   With CIE directory sync, CIE synchronizes groups from the IdP over SCIM, and the tenant then synchronizes the CIE groups selected with Import AD Group. The documentation states that this sync runs on a periodic background schedule, so a delay of a few hours may occur after the list of groups changes in the IdP or after a group-to-user mapping changes in CIE. Older groups appearing and a clean SCIM log point to that normal delay rather than a fault. The engineer should wait and check the import list again.

   Why the other options are wrong

   • AGroups created in Cortex Gateway are shared across tenants and do not support SAML group mapping; they are not a source that CIE reads, since CIE synchronizes groups from the IdP over SCIM.
   • CSigning in through SSO does not create IdP groups or speed up the CIE directory sync, so the group still waits for the periodic sync.
   • DSAML group mapping is evaluated at login for the current session and does not alter the persistent group list, so it does not add a group to the CIE import list.
4. Question 4Integration and Automation

   An engineer at Faraday Clinics opens Settings > Data Sources & Integrations, clicks + Add New, and searches for a niche SaaS ticketing product. The search returns No Data Sources Found. What is the documented next step?

   • AUse Connect Another Instance on a similar data source and rename the instance
   • BClick Try searching the Marketplace, then use a Custom Collector if none existsCorrect
   • CEnable it as an XDR data source, since those skip the Data Source Onboarder
   • DCreate a parsing rule for the product so that it appears in the search results
   ✓ Correct answer: B

   Data sources in the Onboarder are drawn from the Marketplace, Custom Collectors and integrations. When a search returns No Data Sources Found, clicking Try searching the Marketplace opens the Marketplace page prefiltered for that search. If the Marketplace has no option either, one of the Custom Collectors can be used to build a collector. This keeps the search inside supported content before falling back to a custom build.

   Why the other options are wrong

   • AConnect Another Instance adds an instance of a data source that is already integrated; it does not onboard a different product.
   • CThe Onboarder is unavailable for XDR data sources, but that does not make an unrelated SaaS product available as one.
   • DThe data source list is drawn from the Marketplace, Custom Collectors and integrations; parsing rules do not add entries to it.
5. Question 5Integration and Automation

   Garvey Logistics' new Cortex XSIAM deployment must let playbooks manage the company's Palo Alto Networks firewalls and Panorama, for example to push policy changes. Which content pack from the recommended list should the engineer install?

   • ACortex XDR by Palo Alto Networks
   • BGeneric Export Indicators Service
   • CPAN-OS by Palo Alto NetworksCorrect
   • DCommon Playbooks
   ✓ Correct answer: C

   Besides the pre-installed packs, the content packs page recommends reviewing popular packs: Phishing, Cortex XDR by Palo Alto Networks, Atlassian Jira, ServiceNow, PAN-OS by Palo Alto Networks and a collaboration pack such as Microsoft Teams or Slack. Of these, PAN-OS by Palo Alto Networks is described as managing Palo Alto Networks firewalls and Panorama from Cortex XSIAM. Garvey's playbooks can use its integration once an instance is configured.

   Why the other options are wrong

   • ACortex XDR by Palo Alto Networks automates Cortex XDR incident response and adds views and layouts for investigations; it does not manage firewalls or Panorama.
   • BThe Generic Export Indicators Service publishes indicator lists that firewalls can pull, such as block lists; it does not manage firewall or Panorama configuration.
   • DCommon Playbooks is a pre-installed building-block pack, not the recommended pack for managing firewalls and Panorama.
6. Question 6Integration and Automation

   Harrowgate Mutual's phishing playbook classifies sender addresses and writes them to context, then runs an internal branch and an external branch when matching addresses are found. The external branch's reputation task is shown below. ``` Context after classification: Email.Address = [alice@harrowgate.example, bob@harrowgate.example, x@unknown.example] Email.Type = [Internal, Internal, External] External branch, task "Get sender reputation" Input email: Get Email.Address ``` When a message has both internal and external senders, the task checks the reputation of all three addresses. Which change corrects the input?

   • ARun the branches one after the other, so the task reads only its own branch's data
   • BAdd a filter to the Get so it keeps the addresses whose Type equals ExternalCorrect
   • CAdd an in filter to the Get that keeps the addresses found in the Email.Type list
   • DSet the source to From Previous Tasks of the classifier to take its external output
   ✓ Correct answer: B

   The best practices explain that tasks take their inputs from the context, not directly from the previous tasks, even when the source says From Previous Tasks. In the documented example, a playbook classifies emails as internal or external and checks the reputation of external addresses. Without a filter on the reputation task, when both internal and external addresses are found both branches run and the task takes every address in its input. The correct input applies a filter for external addresses.

   Why the other options are wrong

   • ATasks take their inputs from the context, not directly from the previous tasks, so Email.Address still holds all three addresses when the task runs, whatever the order of the branches.
   • CThe in filter takes items from one list that are also in another; Email.Type holds Internal and External values, not addresses, so no address is kept. The input needs a filter on Type equals External.
   • DThe best practices note that tasks take inputs from the context even when the source says From Previous Tasks, so this does not filter the addresses.
7. Question 7Content Optimization

   Kestle Partners maps its VPN gateway logs to the Cortex XSIAM data model. A successful VPN login record carries the user, the client and gateway IP addresses, both ports and the protocol, the full transport flow. How should the engineer tag this record's xdm.event.tags?

   • AWith XDM_CONST.EVENT_TAG_AUTHENTICATION alone, as a login is identity data
   • BWith XDM_CONST.EVENT_TAG_NETWORK alone, as the record carries a full flow
   • CWith no XDM tag, since tag add in its Parsing Rule already labels the log
   • DWith both XDM_CONST.EVENT_TAG_AUTHENTICATION and XDM_CONST.EVENT_TAG_NETWORKCorrect
   ✓ Correct answer: D

   The network mapping principles say to preserve dual meaning: an authentication event that carries a full transport flow, for example a VPN login, should be tagged with both XDM_CONST.EVENT_TAG_AUTHENTICATION and XDM_CONST.EVENT_TAG_NETWORK. The same principles treat network as foundational, so IDS, IPS or proxy judgments are mapped on top of the network flow, not instead of it. Tagging both lets the record contribute to authentication stories and to network stories. A single tag would drop one of those meanings.

   Why the other options are wrong

   • AA login that carries a full transport flow keeps its dual meaning and also needs EVENT_TAG_NETWORK.
   • BAn authentication event with a full flow keeps its authentication meaning and also needs EVENT_TAG_AUTHENTICATION.
   • Ctag add labels data in Parsing Rules; network and authentication stories depend on xdm.event.tags in the data model.
8. Question 8Content OptimizationSelect all that apply

   At Thornfield Media, the change board sets this policy before Attack Surface Testing is turned on for the first time. ``` Production web servers: tests may make temporary, fully reversible changes that undo on a restart. No change may persist after a restart or need cleanup by the web team. New tests that meet this policy should be enabled automatically. ``` Which TWO statements are correct for applying this policy? (Choose TWO)

   • ALevel 3 tests fit the policy, because their changes revert after a restart
   • BA Level 2 default enables only new Level 2 tests, so lower ones need edits
   • CAt first enablement, the existing Level 0 and Level 1 tests are turned onCorrect
   • DDefault-credential login tests are rated Level 4, so they fall outside policy
   • EA Level 2 default also enables new Level 0 and Level 1 tests from then onCorrect
   ✓ Correct answer: C, E

   Level 2 is temporary modification: fully reversible changes, such as service configuration that reverts after a restart, which matches the policy. Level 3 introduces changes that persist until someone reverses them, and Levels 4 and 5 go further. When Attack Surface Testing is first enabled, the existing tests at levels 0 and 1 are enabled by default. Selecting Level 2 under Default Attack Surface Test Enablement enables new Level 0, 1 and 2 tests from then on.

   Why the other options are wrong

   • ALevel 3 changes persist and must be reversed by the customer; changes that revert on restart are Level 2.
   • BThe selected level includes the levels below it, so a Level 2 default also enables new Level 0 and Level 1 tests.
   • DDefault credential login tests are listed as an example of Level 0, non-intrusive testing.
9. Question 9Maintenance and Troubleshooting

   At Elmstead Council, the change board reviews a proposed issue exclusion. The change record is below. ``` Change: Issue exclusion "Backup agent noise" Criteria: initiator path = C:\Program Files\BackupCo\agent.exe History: apply to historic issues as well as future ones Rollback: if the rule proves too broad, disable it and the historic issues return ``` What should the reviewer flag?

   • AApplying it to history deletes the historic logs, which breaks retention
   • BHistoric issues are covered by IOC/BIOC suppression rules instead
   • CA rule built from scratch cannot cover issues that already exist
   • DThe rollback fails, as historic issues stay excluded after disable or deleteCorrect
   ✓ Correct answer: D

   An issue exclusion can apply to future issues only, or to historic issues as well, in which case existing matches are shown as unavailable. The documentation cautions that this action is irreversible, and all historically excluded issues remain excluded if the rule is disabled or deleted. The rollback plan therefore does not work for historic issues. The exclusion does not delete any logs.

   Why the other options are wrong

   • AAn issue exclusion does not remove or delete the logs that would have triggered the issues.
   • BIOC/BIOC suppression rules exclude indicators from detection rules; historic issues are handled by the exclusion's historic option.
   • CRules built from scratch can also mark existing matching issues as unavailable.
10. Question 10Maintenance and Troubleshooting

    At Kilbride Cloud, a syslog feed collected through the Broker VM brk-01 seems delayed. The engineer reviews the data freshness metrics for two aggregation periods. ``` _time total_event_count data_freshness_max_delay data_freshness_median data_freshness_ninetieth_percentile 09:00 840 3600 212.4 1874.9 09:05 910 300 41.6 187.2 ``` Which interpretation is correct?

    • AAt 09:05 the slowest log arrived exactly 300 seconds after it was created
    • BEach delay runs from arrival at brk-01 to ingestion in the tenant
    • CAt 09:00 the slowest log took between 1 hour and 24 hours to arrive
    • DAt 09:05 the slowest log took between 60 seconds and 5 minutes to arriveCorrect
    ✓ Correct answer: D

    Data freshness measures the difference between log creation at the source (_TIME) and ingestion into Cortex XSIAM (_INSERT_TIME). Per data source and five-minute aggregation period, delays are allocated to buckets and the recorded value is the top value in the range of the bucket: 30, 60, 300, 3,600, 86,400 or 604,800 seconds. A max delay of 300 therefore covers the 60 seconds to 5 minutes bucket, and 3,600 covers 5 minutes to 1 hour. The max delay shows whole numbers, while the median and ninetieth percentile are statistical approximations that show decimals.

    Why the other options are wrong

    • AThe recorded max delay is the top value of its bucket, so 300 means a delay somewhere between 60 seconds and 5 minutes, not exactly 300 seconds.
    • BFreshness is measured from log creation at the source (_TIME) to ingestion into Cortex XSIAM (_INSERT_TIME), not from arrival at the Broker VM.
    • CThe recorded value is the top of the bucket, so 3,600 is the 5 minutes to 1 hour bucket; a delay of 1 hour to 24 hours is recorded as 86,400.

Who this Palo Alto Networks Certified XSIAM Engineer practice exam is for

This practice set is for anyone preparing for the Palo Alto Networks Certified XSIAM Engineer exam at the intermediate level - from first-time candidates building a foundation to experienced Palo Alto practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Palo Alto Networks Certified XSIAM Engineer practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Palo Alto Networks Certified XSIAM Engineer exam.

Related Palo Alto resources

• Palo Alto Networks Certified XSIAM Engineer study guideKey concepts
• Palo Alto practice examsAll Palo Alto
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Palo Alto Networks Certified XSOAR Engineer practice examRelated
• SSE-Engineer practice examRelated
• XDR-Analyst practice examRelated

Palo Alto Networks Certified XSIAM Engineer practice exam FAQ