Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Palo Alto Networks XSIAM-Engineer Exam - Topic 3 Question 7 Discussion

Actual exam question for Palo Alto Networks's XSIAM-Engineer exam
Question #: 7
Topic #: 3
[All XSIAM-Engineer Questions]

A Cortex XSIAM engineer plans to add Kafka and Syslog Collectors to a Broker VM cluster.

What are two expected behaviors of the applets when they are added to the cluster? (Choose two.)

Show Suggested Answer Hide Answer
Suggested Answer: A, D

In a Broker VM cluster, the Syslog Collector applet runs in active/standby mode (active on the primary node, standby on others), while the Kafka Collector applet runs in active/active mode (active on all nodes). This design ensures both high availability and scalability for ingestion.


by Azzie at Jan 05, 2026, 05:16 AM

Limited Time Offer

25%

Off

Get Premium XSIAM-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Teri
23 days ago
I agree with A and B. Keeps things organized in the cluster.
upvoted 0 times
...
Art
28 days ago
A and B seem right. Kafka and Syslog need that setup.
upvoted 0 times
...
Tegan
1 month ago
I feel like C is wrong. It shouldn't be active on all nodes.
upvoted 0 times
...
Shaun
1 month ago
I think A and B are correct. Makes sense for primary and standby roles.
upvoted 0 times
...
Hannah
1 month ago
I've seen setups where C happens, but not sure if it's standard.
upvoted 0 times
...
Galen
2 months ago
Totally agree with A and B! Makes sense for cluster behavior.
upvoted 0 times
...
Keneth
2 months ago
Wait, how can both collectors be active on all nodes? That seems off.
upvoted 0 times
...
Tegan
2 months ago
I think C is a possibility too.
upvoted 0 times
...
Omega
2 months ago
A and B are correct!
upvoted 0 times
...
Carlee
2 months ago
A and B, for sure. Gotta love that redundancy and failover, am I right?
upvoted 0 times
...
Emogene
2 months ago
Haha, active on all nodes? What is this, a free-for-all? A and B all the way!
upvoted 0 times
...
Leonida
3 months ago
I'm going with A and B. Gotta keep those applets under control, you know?
upvoted 0 times
...
Kerry
3 months ago
C and D? Really? Active on all nodes? That's just asking for trouble!
upvoted 0 times
...
Ernest
4 months ago
A and B seem like the correct answers. The applets should be active on the primary node and on standby on the standby nodes.
upvoted 0 times
...
Merlyn
4 months ago
From what I recall, the Syslog Collector should be the one that enters an active state on the primary node, but I’m not 100% certain about the Kafka Collector's behavior.
upvoted 0 times
...
Cyril
4 months ago
I’m a bit confused about the Syslog Collector. Did we cover whether it can be active on all nodes or just the primary and standby?
upvoted 0 times
...
Jamal
4 months ago
I think the Kafka Collector is supposed to be active only on the primary node and standby on others, similar to what we practiced in the labs.
upvoted 0 times
...
Ashlee
4 months ago
I remember something about how the Syslog Collector behaves in clusters, but I'm not entirely sure if it goes active on all nodes or just the primary.
upvoted 0 times
...
Sabina
4 months ago
Ah, I think I've got it. The Syslog Collector should be active on the primary node, and the Kafka Collector should be active on the primary node as well. The standby nodes would likely have both applets in a standby state, ready to take over if needed. I'll mark those two options.
upvoted 0 times
...
Deandrea
5 months ago
Based on my experience, I'd say the Syslog Collector is likely to be active on the primary node and on standby on the other nodes. The Kafka Collector, on the other hand, might be active on all nodes to ensure high availability. But I'll double-check the details.
upvoted 0 times
...
Bettina
5 months ago
I'm a bit confused on this one. I know Kafka and Syslog are common tools, but I'm not sure how they're expected to behave in this specific Cortex XSIAM setup. I'll need to review the documentation carefully.
upvoted 0 times
...
Ashton
5 months ago
Okay, let's see. I think the key is understanding how the applets are designed to function in a clustered environment. I'll need to consider the differences between primary and standby nodes.
upvoted 0 times
...
Avery
5 months ago
Hmm, this seems like a tricky one. I'll need to think carefully about the expected behaviors of the Kafka and Syslog Collectors in a Broker VM cluster.
upvoted 0 times
Barabara
17 days ago
I think A and B are the right choices.
upvoted 0 times
...
...

Save Cancel