Ingestion And Automation

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?

Which menu path in the Cortex XDR management console should an administrator navigate to view the overall health, status, and log forwarding statistics of deployed Broker VMs?

When configuring an integration instance in Cortex XSOAR (or Cortex XDR Automation) for a third-party threat intelligence feed, what is the primary purpose of the instance name?

An administrator is troubleshooting a Cortex XDR syslog integration where logs from a high-throughput network device are being dropped or delayed. The Broker VM resource utilization for CPU and memory is normal. Which underlying collector configuration setting should be adjusted to handle the high burst rate?

An organization requires that logs ingested via the Cortex XDR Syslog Collector be secured using TLS encryption (Syslog-over-TLS). What must the administrator configure on the Broker VM to support this requirement?

An administrator is configuring a Syslog Collector agent on Cortex XDR to ingest logs from a third-party firewall. Which log collection protocol and transport layer combination is natively supported by the Cortex XDR Collector for receiving unencrypted syslog messages?

When setting up data forwarding from Cortex XDR to a third-party SIEM using the Cortex XDR Data Forwarder, which protocol is commonly used to stream the logs?

An administrator needs to ingest CEF (Common Event Format) logs from a third-party security device using the Broker VM. Which collector type must be enabled on the Broker VM configuration page in Cortex XDR?

An administrator has configured a new AWS CloudTrail integration via Broker VM to ingest cloud logs into Cortex XDR. However, no logs are appearing in the XDR database. Upon reviewing the Broker VM logs, the administrator notices an 'AccessDenied' error from AWS. What is the most likely root cause?

Which role is required within Cortex XDR for a user to configure API keys, data integration settings, and automation playbooks?

An automation playbook in Cortex XSOAR needs to execute a custom Python script that interacts with an internal legacy database not covered by existing Marketplace integrations. Which component should the administrator use to securely run this custom script?

Where in the Cortex XDR web interface can an administrator generate API keys (API Key and Incident ID / Key) required for external integrations and scripts to authenticate with the Cortex XDR API?

What is the primary function of the Cortex XDR 'Content Pack' in Marketplace?

An enterprise environment uses a forward proxy for all outbound internet traffic. The Broker VM deployed in the internal network cannot reach external cloud APIs for threat intelligence enrichment. How should the administrator configure the Broker VM to route traffic through the forward proxy?

An administrator has deployed a Broker VM and enabled the Active Directory (AD) collector to ingest user and group mapping data. The connection test fails with a 'Kerberos Authentication Failed' error. What is the most likely cause of this failure?

When testing a newly configured API integration instance in Cortex XSOAR, what is the standard action used to verify connectivity and authentication credentials?

An administrator is configuring automated incident enrichment in Cortex XDR. Whenever a new malware incident is generated, the system should automatically query VirusTotal using an integration. Where should this automated workflow be built and attached?

An enterprise security team wants to ingest NetFlow records from core routers into Cortex XDR. Which component and collector combination supports NetFlow/IPFIX ingestion?

An administrator is configuring data forwarding filters in Cortex XDR to send specific severity alerts to a SIEM. The requirement is to forward all 'High' and 'Critical' severity alerts while excluding 'Low' and 'Medium' alerts. Where is this filter configured?

An administrator is troubleshooting an API rate-limiting error (HTTP 429 Too Many Requests) occurring in a custom Cortex XSOAR automation playbook that queries an external threat intel API. How should the integration or playbook be modified to handle this gracefully?

What is the primary purpose of using a Broker VM in a Cortex XDR deployment architecture?

An administrator needs to ingest Office 365 audit logs into Cortex XDR. Which integration method is officially supported and recommended by Palo Alto Networks for this data source?

Which TWO of the following data sources can be natively onboarded and collected using a Cortex XDR Broker VM? (Choose two)

An administrator is configuring a new integration in Cortex XSOAR and needs to ensure secure credential handling. Which TWO practices are recommended when managing API keys and secrets? (Choose two)

Which TWO actions can be performed directly within the Cortex XDR Data Integration management interface? (Choose two)

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Which TWO authentication methods are commonly supported when configuring API integrations in Cortex XSOAR? (Choose two)

An administrator is designing an automated incident response playbook in Cortex XSOAR. Which TWO core concepts are essential for passing data between playbook tasks? (Choose two)

An organization requires high availability and load balancing for their Broker VM log ingestion tier. Which TWO architectural considerations or configurations support this requirement? (Choose two)

Which TWO tasks can an automation playbook in Cortex XDR / XSOAR execute automatically upon detecting a confirmed threat? (Choose two)

An administrator is setting up automated alert ingestion from a third-party SIEM into Cortex XSOAR. Which TWO integration methods or components are typically used to achieve this? (Choose two)

An administrator needs to troubleshoot an AWS S3 bucket integration via Broker VM where logs are failing to ingest. Which TWO diagnostic steps should be taken? (Choose two)

An administrator is writing a custom Python automation script within a Cortex XSOAR integration. Which TWO standard practices should be followed to ensure proper execution and error handling within the platform? (Choose two)

An automation engineer is building a Cortex XSOAR playbook that is triggered by a Cortex XDR incident. The playbook needs to fetch all associated endpoint artifacts using the Cortex XDR integration. Which parameter is required in the command execution to ensure all relevant forensics files are retrieved?

When configuring the Cortex XDR API to ingest custom threat intelligence feeds, which authentication header and format must be used for the HTTP POST request to ensure successful ingestion?

An administrator has deployed a Broker VM to act as a syslog collector and agent installer. During the configuration of the Broker VM in the Cortex XDR console, the status remains 'Disconnected'. What is the most likely cause of this issue?

An administrator wants to create a BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR that triggers an alert whenever a PowerShell script attempts to download and execute a payload from an external IP address. Which data source must be enabled and properly ingested for this rule to function effectively?

An organization is onboarding a new cloud environment into Cortex XDR. Which THREE mechanisms or components can be utilized to ingest cloud audit logs and telemetry data into Cortex XDR? (Choose three)

When setting up automated alert response actions using Cortex XDR built-in response actions or XSOAR integrations, which THREE actions can be automatically initiated directly against an endpoint agent? (Choose three)

An XDR engineer is configuring a Cortex XDR data forwarding rule to send only endpoint alert data to a third-party SIEM. The SIEM requires that the forwarded payload include the raw event fields and be delivered in JSON format. Which data forwarding destination type should the engineer select?

A Cortex XDR administrator is building an automation playbook that must enrich an incident with threat intelligence from an external API. The API requires a bearer token and returns JSON. The administrator wants the playbook to handle API rate limits gracefully by retrying after a delay when a 429 status code is received. Which Cortex XDR Automation configuration should the administrator use to implement this retry logic?

An XDR engineer needs to automate the enrichment of Cortex XDR incidents with threat intelligence from an external MISP instance. The MISP API requires an authentication key and returns JSON. Which Cortex XDR automation component should be used to create a custom integration that queries MISP and updates incident fields?

An administrator is setting up a Cortex XDR Broker VM to collect logs from a remote site. The Broker VM must be able to receive logs from syslog sources and forward them to the Cortex XDR management console. Which Broker VM component is responsible for receiving syslog traffic?

A security operations team is implementing automated response actions in Cortex XDR. They need to ensure that when a high-severity alert is triggered, the system automatically isolates the endpoint and creates a case in their ticketing system. Which Cortex XDR component should they use to orchestrate this workflow?

An administrator is configuring a Cortex XDR integration with a third-party SIEM using the Cortex XDR API. The SIEM needs to retrieve alerts periodically. Which API endpoint and HTTP method should be used to fetch alerts?

A Cortex XDR administrator needs to ensure that endpoint telemetry data is ingested from all Windows endpoints in the organization. Which Cortex XDR component is responsible for collecting this data directly from the endpoints?

An administrator is configuring a Cortex XDR Automation playbook to automatically enrich alerts with threat intelligence. The playbook must query an external threat intelligence platform and add the results to the alert. Which Cortex XDR Automation component should be used to perform this action?

An administrator is setting up a Cortex XDR Broker VM to collect logs from a remote site with limited bandwidth. The administrator wants to minimize the amount of data sent over the WAN link while ensuring that critical security events are still ingested. Which feature should be enabled on the Broker VM?

A security team wants Cortex XDR to automatically create a case and assign it to the on-call analyst whenever a high-severity alert is generated from a specific BIOC rule. They have already verified the BIOC rule fires correctly. Which Cortex XDR feature should they configure to achieve this automated response?

An administrator needs to onboard a new log source into Cortex XDR. The source is a Linux server that writes application logs to a local file. The administrator wants the logs parsed into Cortex XDR fields without installing a full endpoint agent. Which ingestion method is most appropriate?

An administrator is configuring a Cortex XDR automation rule to trigger a playbook when a new alert matches specific conditions. The playbook must run only for alerts with a severity of High or Critical and only for alerts originating from the 'Malware' alert category. Which TWO configuration elements must be set in the automation rule to enforce these conditions? (Choose two.)

A Cortex XDR administrator needs to forward only alerts with a severity of Critical to an external SIEM while sending all other alerts to a different destination. The administrator is configuring data forwarding rules. Which approach correctly achieves this requirement?

A Cortex XDR administrator is creating an automation script that must run only when a specific indicator (e.g., a file hash) is found on more than 10 endpoints within the last hour. The script should then block the hash across all endpoints. Which Cortex XDR feature should be used to implement this logic?

A Cortex XDR engineer is configuring a new ingestion pipeline for a custom application that emits JSON logs over HTTP. The application can POST logs to a webhook but does not support syslog. The engineer wants the logs to be parsed, mapped to XDR fields, and available for correlation with endpoint telemetry. Which Cortex XDR component should be used to receive these logs?

A Cortex XDR engineer is configuring a Broker VM to collect logs from a third-party EDR solution that writes to a local folder on the Broker VM as JSON files. The engineer needs Cortex XDR to parse these files and map the fields into the XDR data model. Which component should the engineer configure on the Broker VM to achieve this?

An XDR engineer is creating a correlation rule in Cortex XDR to detect a sequence of events: a suspicious process creation followed by a network connection to a known malicious IP. The engineer wants the rule to trigger only if both events occur on the same endpoint within 5 minutes. Which configuration should the engineer use to achieve this?