XDR-Analyst Practice Test 8 — 10 Questions

Question 1

An administrator is configuring a Broker VM to act as a Syslog collector for third-party network devices. Which configuration step must be performed within the Cortex XDR console after deploying the Broker VM to enable the Syslog Collector app?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Syslog Collector app instance on the specific Broker VM via Settings > Configurations > Broker VM. After deploying the Broker VM, administrators must install and configure the Syslog Collector content app from the Cortex XDR Marketplace or Broker VM configuration menu.

Answer

Push an XML configuration update using Panorama

Answer

Reboot the Broker VM hypervisor with the Syslog ISO attached

Answer

Manually compile the rsyslog.conf file via SSH on the Broker VM CLI

Question 2

An administrator is configuring Broker VM network settings and firewall rules in a secure data center zone. Which THREE traffic flows must be permitted through internal firewalls for the Broker VM to function correctly?

Accepted Answer

Inbound Syslog (TCP/UDP 514 or custom ports) from network devices to the Broker VM Syslog collector. Option C is correct because the Broker VM hosts a Syslog collector that receives log and event data from network devices, so inbound Syslog on TCP/UDP 514 or configured custom ports must be allowed through internal firewalls. Option D is correct because the Broker VM must communicate with Active Directory Domain Controllers over LDAP/LDAPS on TCP 389/636 in both directions to perform directory lookups, user/group resolution, and related identity functions. Option E is correct because the Broker VM requires outbound HTTPS on TCP 443 to reach the Cortex XDR cloud tenant and associated content delivery networks for registration, management, telemetry, and content updates. Option A is not correct because BitTorrent peer-to-peer traffic is not a supported or required Broker VM communication flow. Option B is not correct because exposing RDP from all internet IP addresses directly to the Broker VM is an insecure management practice and is not a required internal firewall flow for Broker VM functionality.

Answer

Outbound BitTorrent peer-to-peer traffic for software distribution

Answer

Inbound Remote Desktop Protocol (RDP) from all internet IP addresses directly to the Broker VM

Question 3

A security administrator is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints. Before installation, the administrator must ensure that the endpoints meet the minimum operating system requirements for the Cortex XDR agent. Which of the following is a valid supported Windows operating system for the Cortex XDR agent?

Accepted Answer

Windows 10 (64-bit). The Cortex XDR agent requires a currently supported Windows platform. Windows 10 64-bit is a supported operating system and is a realistic target for enterprise deployment, so it satisfies the minimum OS requirement. Legacy platforms such as Windows 7 SP1, Windows Server 2008 R2, and Windows XP are no longer supported by current agent releases and cannot be used for a new deployment.

Answer

Windows XP Professional

Answer

Windows Server 2008 R2

Answer

Windows 7 SP1

Question 4

An analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?

Accepted Answer

Process execution telemetry from endpoint agents. Process execution telemetry from endpoint agents is correct because a BIOC rule detects behavioral patterns based on endpoint activity, such as process executions. To detect suspicious use of 'whoami' by an authenticated domain user, the rule must evaluate process execution events, which include the process name, command line, user context, and parent process. This telemetry is collected by the Cortex XDR agent and stored in the endpoint data lake, allowing BIOC rules to trigger on specific behaviors.

Answer

Cloud storage audit logs

Answer

Firewall URL filtering logs

Answer

DHCP lease tables

Question 5

An analyst is reviewing the Causality Chain for an alert. Which TWO key insights does this view provide? (Choose two)

Accepted Answer

The chronological sequence of events associated with the detection. Option C is correct because the Causality Chain view presents the chronological sequence of events associated with the detection, allowing the analyst to see how activity unfolded over time leading up to the alert. Option E is correct because the Causality Chain specifically maps the parent-child process relationships that led to the alert, showing which process spawned which and how the detection was ultimately triggered. Options A, B, and D are incorrect because physical server room location, email distribution list membership, and CPU power consumption wattage are unrelated to the process lineage and event timeline that the Causality Chain provides.

Answer

The physical location of the server room containing the host

Answer

The corporate email distribution list membership

Answer

The power consumption wattage of the CPU

Question 6

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

Accepted Answer

Suppress or disable the noisy alert rule if it lacks operational value. Option B is correct because suppressing or disabling an alert rule that has no operational value stops the recurring false positive from generating new incidents, directly reducing incident pollution at the rule level. Option C is correct because tuning the specific detector or BIOC rule parameters (for example, adjusting thresholds, logic, or conditions) refines detection so the benign activity no longer triggers the rule while preserving its legitimate detections. Option E is correct because creating an alert exclusion rule scoped to unique file hashes or paths precisely filters out the known-benign artifacts, preventing those specific false positives from re-entering the incident queue without broadly weakening detection. Option A does not belong because starring alerts only flags them for visibility and does not prevent them from being generated or polluting incidents. Option D does not belong because adding a featured field column merely changes how alerts are displayed and hides nothing from the incident pipeline, so the false positives still occur.

Answer

Star all future instances of the alert in the incident view

Answer

Add a featured field column to hide the false positive alerts

Question 7

An administrator is deploying Cortex XDR agents in a Linux environment and needs to ensure that the agent does not interfere with a critical custom database application. Which feature should the administrator configure to exclude specific directories or processes from agent inspection?

Accepted Answer

Global Agent Profile Exclusions (Path, Process, and File Hash exclusions). The correct feature is Global Agent Profile Exclusions (Path, Process, and File Hash exclusions) (A). These exclusions allow administrators to specify directories, processes, or file hashes that the agent should ignore during inspection, preventing interference with critical applications. This is configured in the agent profile and applied to endpoints.

Answer

Broker VM Firewall Rules

Answer

Kernel Module Blacklisting via /etc/modprobe.d

Answer

Linux iptables PREROUTING chains

Question 8

Where in the Cortex XDR console can an analyst review the complete lifecycle timeline of an incident, from initial raw alert generation to final resolution?

Accepted Answer

The Incident Details page and Incident Timeline view. The Incident Details page and Incident Timeline view in Cortex XDR provide a unified, chronological record of an incident's entire lifecycle. This includes the initial raw alert generation, subsequent alert grouping into an incident, all investigative actions taken, and the final resolution or closure. Analysts use this view to understand the full scope and progression of a security event without needing to correlate data from multiple separate tools.

Answer

The Syslog forwarding configuration panel

Answer

The Global Dashboard widget builder

Answer

The Agent installation status log

Question 9

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

Accepted Answer

Signed binary exception with path and certificate verification. Signed binary exceptions combined with valid certificate verification and file path checks allow legitimate administrative or updater tools to operate without generating alerts.

Answer

Configuring a network port forwarding rule

Answer

Deleting the software updater from all endpoints

Answer

Disabling all behavioral monitoring on the subnet

Question 10

An administrator needs to customize the incident queue to show the 'OS Version' column for all displayed incidents. Which configuration interface should be accessed?

Accepted Answer

Featured fields settings. Featured fields configuration allows administrators to add standard or custom attributes like OS Version as columns in the incident table.

Answer

Incident scoring weight profiles

Answer

Alert exclusion rule manager

Answer

Data stitching correlation parameters