Palo Alto Networks XSIAM-Engineer Exam - Topic 3 Question 7 Discussion

Actual exam question for Palo Alto Networks's XSIAM-Engineer exam

Question #: 7
Topic #: 3

A Cortex XSIAM engineer plans to add Kafka and Syslog Collectors to a Broker VM cluster.

What are two expected behaviors of the applets when they are added to the cluster? (Choose two.)

ASyslog Collector applet is automatically initiated, enters an active state on the primary node, and is on standby on the standby nodes.

BKafka Collector applet is automatically initiated, enters an active state on the primary node, and is on standby on the standby nodes.

CSyslog Collector applet is active on all cluster nodes, including primary and standby.

DKafka Collector applet is active on all cluster nodes, including primary and standby.

Show Suggested Answer

Suggested Answer: A, D

In a Broker VM cluster, the Syslog Collector applet runs in active/standby mode (active on the primary node, standby on others), while the Kafka Collector applet runs in active/active mode (active on all nodes). This design ensures both high availability and scalability for ingestion.

by Azzie at Jan 05, 2026, 05:16 AM

Limited Time Offer

25%

Off

Get Premium XSIAM-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Leonida

4 days ago

I'm going with A and B. Gotta keep those applets under control, you know?

upvoted 0 times

...

Kerry

9 days ago

C and D? Really? Active on all nodes? That's just asking for trouble!

upvoted 0 times

...

Ernest

14 days ago

A and B seem like the correct answers. The applets should be active on the primary node and on standby on the standby nodes.

upvoted 0 times

...

Merlyn

19 days ago

From what I recall, the Syslog Collector should be the one that enters an active state on the primary node, but I’m not 100% certain about the Kafka Collector's behavior.

upvoted 0 times

...

Cyril

24 days ago

I’m a bit confused about the Syslog Collector. Did we cover whether it can be active on all nodes or just the primary and standby?

upvoted 0 times

...

Jamal

29 days ago

I think the Kafka Collector is supposed to be active only on the primary node and standby on others, similar to what we practiced in the labs.

upvoted 0 times

...

Ashlee

1 month ago

I remember something about how the Syslog Collector behaves in clusters, but I'm not entirely sure if it goes active on all nodes or just the primary.

upvoted 0 times

...

Sabina

1 month ago

Ah, I think I've got it. The Syslog Collector should be active on the primary node, and the Kafka Collector should be active on the primary node as well. The standby nodes would likely have both applets in a standby state, ready to take over if needed. I'll mark those two options.

upvoted 0 times

...

Deandrea

1 month ago

Based on my experience, I'd say the Syslog Collector is likely to be active on the primary node and on standby on the other nodes. The Kafka Collector, on the other hand, might be active on all nodes to ensure high availability. But I'll double-check the details.

upvoted 0 times

...

Bettina

2 months ago

I'm a bit confused on this one. I know Kafka and Syslog are common tools, but I'm not sure how they're expected to behave in this specific Cortex XSIAM setup. I'll need to review the documentation carefully.

upvoted 0 times

...

Ashton

2 months ago

Okay, let's see. I think the key is understanding how the applets are designed to function in a clustered environment. I'll need to consider the differences between primary and standby nodes.

upvoted 0 times

...

Avery

2 months ago

Hmm, this seems like a tricky one. I'll need to think carefully about the expected behaviors of the Kafka and Syslog Collectors in a Broker VM cluster.

upvoted 0 times

...