Palo Alto Networks Certified XSIAM Engineer

Last checked November 10, 2026 against the official Palo Alto Networks exam page.

1. Question 1Integration and Automation

   A new firewall source is onboarded. Analysts can search its raw events, but standard detections that rely on common XDM fields never fire on those events. Which step is the most likely gap?

   1. AThe raw events were not exported to a separate archive bucket for long-term retention by the team
   2. BThe Broker VM was not restarted after the source was added to the inventory
   3. CThe integration's playbook has not been added to the incident layout for the source
   4. DA data modeling rule mapping parsed fields to the XDM schema is missing for the source
   Show answer and explanationHide answer

   Correct answer: D

   Raw events are searchable, so ingestion works, but standard detections read XDM fields that only a data modeling rule populates. Restarting the Broker VM, adding a playbook to a layout and archiving raw data do not change which fields the detections read.

2. Question 2Content Optimization

   What is the primary job of a parsing rule in XSIAM?

   1. ATo block ingestion of any event that contains an external IP address by default
   2. BTo assign a risk score to alerts after the correlation engine has already grouped them
   3. CTo define which dashboard widgets each analyst role is allowed to see on the home page
   4. DTo extract structured fields from raw ingested data and place them in the target dataset
   Show answer and explanationHide answer

   Correct answer: D

   Parsing rules turn raw log lines into named fields within a dataset, and later steps depend on those fields. Scoring happens after correlation, widget visibility is a permissions matter, and parsing rules are not an IP blocklist.

3. Question 3Maintenance and Troubleshooting

   In XQL, which fields distinguish when an event occurred from when it was ingested?

   1. A_time holds the event time and _insert_time holds the ingestion time
   2. B_time holds the ingestion time and _insert_time holds the event time
   3. CBoth fields always hold the same value for every event
   4. D_time holds the dataset creation date and _insert_time holds the rule creation date
   Show answer and explanationHide answer

   Correct answer: A

   _time is the event timestamp (set by parsing, otherwise defaulting to ingestion time) and _insert_time records when the event was inserted. Comparing them reveals ingestion delay.

4. Question 4Planning and Installation

   A company with three branch offices wants firewall and Active Directory logs sent to XSIAM. The branch networks allow only outbound connections and no inbound rules may be added. Which deployment best meets this requirement?

   1. AOpen inbound firewall rules at each branch so the XSIAM tenant can reach the log sources directly over the internet
   2. BDeploy a Broker VM at each location so it can initiate outbound connections to the XSIAM tenant
   3. CInstall an XDR agent on each firewall appliance so the appliance pushes its logs to the tenant
   4. DExport the logs to a USB drive at each branch and upload them to the tenant once a week
   Show answer and explanationHide answer

   Correct answer: B

   A Broker VM placed at each site initiates outbound connections, so no inbound rules are needed. Opening inbound rules violates the stated constraint, XDR agents are installed on endpoints and servers rather than network appliances, and weekly USB uploads do not provide continuous ingestion.

5. Question 5Integration and Automation

   What is the main purpose of a feed integration in XSIAM?

   1. ATo send alerts from the tenant to a ticketing system through an outbound webhook
   2. BTo bring external indicators such as IPs, domains and file hashes into the platform
   3. CTo replace the Broker VM when collecting syslog from on-premises network devices
   4. DTo keep long-term archived copies of raw events in an external object storage bucket
   Show answer and explanationHide answer

   Correct answer: B

   Feed integrations ingest threat intelligence indicators so that IOC matching can use them. Sending alerts to a ticketing tool is an outbound integration rather than a feed, syslog collection is a Broker VM function, and archiving raw events is a storage function.