SecOps-Pro Cortex XDR Practice Test 3 — 15 Questions

Question 1

What is the function of the 'Cortex XDR Broker Service'?

Accepted Answer

To act as a proxy/relay for agents in restricted environments.. The Cortex XDR Broker Service acts as a proxy/relay for agents in restricted environments, such as those without direct internet access. It enables agents to communicate with the Cortex XDR cloud by forwarding traffic through the broker. It does not manage user identities, store endpoint logs, or provide automatic remediation.

Answer

To manage user identities.

Answer

To store endpoint logs.

Answer

To provide automatic remediation.

Question 2

When investigating a file, you see a 'WildFire' verdict. What does this indicate?

Accepted Answer

The file was analyzed in a cloud sandbox and determined to be malicious.. A WildFire verdict means the file was submitted to Palo Alto Networks' WildFire cloud sandbox, executed in a controlled environment, and analyzed for malicious behavior. The verdict reflects the sandbox's determination — benign, grayware, phishing, or malicious — based on observed activity such as registry modification, network callbacks, or process injection. In Cortex XDR, this verdict is surfaced as part of the file's threat intelligence enrichment to help analysts decide on response actions.

Answer

The file was marked as safe by the user.

Answer

The file matches a local hash blocklist.

Answer

The file was blocked by the local firewall.

Question 3

Which TWO of the following are valid ways to deploy the Cortex XDR agent?

Accepted Answer

Manually downloading and installing the agent package.. Option D is correct because the Cortex XDR agent can be deployed manually by downloading the installation package (MSI for Windows, PKG/DMG for macOS, or RPM/DEB for Linux) from the Cortex XDR console or support portal and running the installer locally on the endpoint. Option E is correct because the agent package can be distributed at scale through third-party software distribution or endpoint management systems such as Microsoft SCCM, allowing silent installation across many endpoints. Option A is not a valid deployment method because the console does not send an email link that installs the agent; email is only used for notifications or registration invitations, not for agent installation. Option B is incorrect because the Cortex XDR agent is not delivered through the Windows Update service, which only distributes Microsoft and driver updates. Option C is incorrect because a browser cannot push and install a system-level agent onto an endpoint; browsers lack the privileges and mechanism to perform such an installation.

Answer

Using an email link sent by the console.

Answer

Installing it through the Windows Update service.

Answer

Pushing the agent via the browser.

Question 4

Which THREE items can you use to build a BIOC rule in Cortex XDR?

Accepted Answer

File hash and file path.. BIOC rules are built using various telemetry fields such as process execution, file activity, and registry changes.

Answer

User password history.

Answer

The color of the desktop wallpaper.

Question 5

Which TWO methods can be used to investigate an endpoint in Cortex XDR?

Accepted Answer

Endpoint View.. Analysts can use the Endpoint View for historical data and the Live Terminal for real-time interaction.

Answer

Sending a network broadcast.

Answer

Running a full system re-image.

Answer

Deleting the endpoint from the console.

Question 6

Which TWO features in Cortex XDR help reduce alert fatigue for security analysts?

Accepted Answer

Incident Stitching.. Alert suppression and Incident stitching significantly reduce the noise by grouping related alerts and hiding redundant ones.

Answer

Disabling the network log collection.

Answer

Enabling Debug Logging.

Answer

Increasing the scan frequency.

Question 7

Which THREE actions are available when responding to an incident via the Response feature?

Accepted Answer

Isolate host.. Common response actions include isolating a host, killing a process, and quarantining a file.

Answer

Change the user password.

Answer

Perform a remote OS reinstall.

Question 8

Which TWO types of logs can be ingested by a Cortex XDR Collector?

Accepted Answer

Third-party network device logs (e.g., Syslog).. Option C is correct because a Cortex XDR Collector can ingest third-party network device logs such as Syslog, which is a standard protocol for forwarding event data from routers, switches, and other network appliances into Cortex XDR for correlation and analysis. Option E is correct because the Cortex XDR Collector natively supports ingesting Palo Alto Networks Next-Generation Firewall logs, including traffic, threat, and URL filtering logs, which are parsed and normalized for Cortex XDR detection and investigation. The unmarked options do not belong: local user email drafts (A) are personal application data not collected by the Cortex XDR Collector, internal coffee machine status (B) is an IoT/facilities telemetry source outside the supported log ingestion scope, and physical hardware inventory logs (D) are asset-management data rather than the security event logs the Collector is designed to receive.

Answer

Local user email drafts.

Answer

Internal coffee machine status.

Answer

Physical hardware inventory logs.

Question 9

Which THREE components are part of the Cortex XDR architecture?

Accepted Answer

Management Console.. The core architecture consists of the Agent, the Data Lake for storage, and the Management Console for administration.

Answer

A local physical tape backup unit.

Answer

The local router's ISP connection.

Question 10

Which TWO actions can be performed from the 'Endpoint Inventory' page?

Accepted Answer

View current agent status.. Option A is correct because the Endpoint Inventory page displays each endpoint's current agent status (e.g., online/offline, healthy/unhealthy, last check-in), which is a core inventory function. Option D is correct because the Endpoint Inventory page lets administrators assign tags to endpoints for grouping, filtering, and policy targeting. Option B is not correct because global firewall settings are configured in a dedicated firewall or policy management area, not from the endpoint inventory list. Option C is not correct because the agent's source code is not editable from a management console page. Option E is not correct because updating an endpoint's operating system is an OS-level maintenance task, not an action available from the Endpoint Inventory page.

Answer

Configure global firewall settings.

Answer

Change the agent's source code.

Answer

Update the agent's OS.

Question 11

Which THREE pieces of information are displayed in the Incident View?

Accepted Answer

Associated alerts.. The incident view provides an overview of the affected entities, the associated alerts, and the status of the investigation.

Answer

The names of all users in the organization.

Answer

The current CPU usage of the cloud console.

Question 12

When analyzing a process execution in the Causality View, which THREE properties can be inspected?

Accepted Answer

Executing user identity.. The causality view allows for deep inspection of process metadata, including the command line, file hash, and the user that executed it.

Answer

The local time zone of the endpoint.

Answer

The total number of files on the disk.

Question 13

An analyst is investigating an alert where a process launched by Microsoft Word spawned a child process that executed an encoded PowerShell command. The analyst wants to view the full process lineage, including parent-child relationships and command-line arguments, for this specific alert. Which Cortex XDR feature should the analyst use?

Accepted Answer

Causality View. Causality View is the correct feature because it visualizes the process tree and provides detailed metadata such as command-line arguments, parent-child relationships, and execution timestamps. This allows the analyst to trace the sequence of events from the initial Word process to the spawned PowerShell command, which is essential for understanding the attack chain and determining the scope of the incident.

Answer

Incident Response Playbook

Answer

Threat Intelligence Platform

Answer

Endpoint DLP Policy

Question 14

A security analyst wants to block a known malicious hash across all endpoints managed by Cortex XDR. Which component should the analyst use to enforce this block?

Accepted Answer

Indicators of Compromise (IoC) Policy. IoC Policies are specifically designed to let administrators define custom indicators, including file hashes, and apply actions such as block or alert across the environment. By adding the malicious hash to an IoC policy, the analyst ensures that the Cortex XDR agent blocks its execution on all managed endpoints, providing a precise and immediate mitigation.

Answer

Malware Policy

Answer

Behavioral Threat Protection (BTP) Rule

Answer

Exploit Protection Profile

Question 15

A Cortex XDR administrator is configuring a new External Data Ingestion (EDI) integration to collect logs from a third-party cloud application. The administrator needs to ensure that the logs are parsed and mapped to Cortex XDR's data model for correlation with endpoint telemetry. Which configuration step is mandatory to achieve this?

Accepted Answer

Assign a unique dataset name and define field mappings in the EDI integration configuration.. External Data Ingestion requires that incoming logs are parsed and mapped to Cortex XDR's data model. This is achieved by defining a dataset name and specifying field mappings during integration setup. Without these mappings, the data remains unstructured and cannot be correlated with endpoint telemetry, rendering it ineffective for detection and response.

Answer

Define a custom parsing rule in the Cortex XDR XQL query editor.

Answer

Enable the Cortex XDR Data Lake and select the third-party application from the predefined list.

Answer

Create a Broker VM and install the third-party application's agent on it.