XDR-Engineer Exam Questions and Answers

An endpoint running Cortex XDR Agent has experienced repeated kernel panics after a content update. The administrator needs to boot the endpoint into safe mode or disable the prevention modules remotely using the command line tool. Which utility should the administrator invoke locally via script or recovery environment?

An administrator wants to check the operational status and resource utilization of a Cortex XDR Broker VM. Where can the administrator monitor this directly within the Cortex XDR management console?

An administrator is troubleshooting a scenario where Cortex XDR Agent data is not appearing in the management console. Firewall rules restrict outbound traffic. Which destination port and protocol must be opened outbound from the endpoints to the Cortex XDR management console for agent telemetry?

An administrator needs to verify whether Cortex XDR Agents are successfully receiving policy updates from the Cortex XDR management console. Where should the administrator check in the management console?

An endpoint user reports that a legitimate internal application is being blocked by Cortex XDR Exploit Protection. The administrator wants to create an exception without completely disabling the module. Which mechanism should the administrator use in the Cortex XDR console?

An administrator notices that a newly installed Cortex XDR Agent on a Windows endpoint is not communicating with the Cortex XDR management console. Which log file should the administrator review first on the local endpoint to troubleshoot agent installation and service startup issues?

An administrator deployed a new Cortex XDR agent profile, but a specific subset of endpoints in the finance department is failing to receive the policy updates. What is the most likely troubleshooting step on the endpoint?

When installing the Cortex XDR agent on a macOS endpoint, which additional operating system configuration must be completed to ensure full visibility and prevention capabilities?

An administrator needs to exclude a specific internal software development folder from all Cortex XDR agent scans and behavioral monitoring. Where should this exclusion be added?

Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

An analyst notices that a custom BIOC rule is generating too many false positives during normal software deployments. What is the most appropriate next step in detection engineering for this rule?

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?

An analyst writes an XQL query to aggregate alert counts by severity and action, but the query returns a parsing syntax error.

dataset = xdr_data | filter causality_actor_process_image_name != null | comp count() by causality_actor_process_image_name

What is the correct XQL syntax correction needed to successfully execute this aggregation?

A security engineer is investigating a potential lateral movement technique using WMI. The engineer wants to query the XDR backend using XQL (XDR Query Language) to search for process executions spawned by wmic.exe across all endpoints. Which XQL dataset should the query target?

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

A security analyst needs to ingest custom JSON-formatted security logs from an in-house application into Cortex XDR. Where should the administrator define the custom log mapping to ensure fields are parsed correctly under the generic log profile schema?

An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?

Which menu path in the Cortex XDR management console should an administrator navigate to view the overall health, status, and log forwarding statistics of deployed Broker VMs?

When configuring an integration instance in Cortex XSOAR (or Cortex XDR Automation) for a third-party threat intelligence feed, what is the primary purpose of the instance name?

An administrator is troubleshooting a Cortex XDR syslog integration where logs from a high-throughput network device are being dropped or delayed. The Broker VM resource utilization for CPU and memory is normal. Which underlying collector configuration setting should be adjusted to handle the high burst rate?

An administrator is installing the Cortex XDR agent on a fleet of macOS endpoints running macOS Big Sur and later. The administrator notices that agent extensions are not automatically approved. Which deployment step must be completed to ensure full functionality without manual user intervention?

During the planning phase of a Cortex XDR deployment, an organization decides to deploy Cortex XDR agents in a disconnected environment without direct internet access to the Cortex XDR cloud. Which architecture component must be installed to facilitate agent communication and updates?

An administrator is configuring a Broker VM instance in the Cortex XDR console. After deploying the OVA template in the hypervisor, what is the mandatory next step required to link the Broker VM to the Cortex XDR cloud tenant?

An administrator needs to install the Cortex XDR agent on a Linux server running Red Hat Enterprise Linux (RHEL) 8. Which package manager command or installation script is natively supported for deploying the agent package?

An administrator is planning firewall rules for endpoints with Cortex XDR agents installed in an environment with strict outbound filtering. Which destination port and protocol must be allowed outbound to the Cortex XDR management tenant for agent telemetry and command-and-control?

An administrator is preparing to deploy the Cortex XDR agent across 5,000 Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation package format should the administrator export from the Cortex XDR management console?