XDR-Engineer Practice Test 1 — 10 Questions

Question 1

An administrator wants to check the operational status and resource utilization of a Cortex XDR Broker VM. Where can the administrator monitor this directly within the Cortex XDR management console?

Accepted Answer

Go to Settings > Configurations > Broker VM.. The Broker VM monitoring interface is located under Settings > Configurations > Broker VM.

Answer

Go to XQL Search using dataset = broker_vm_logs.

Answer

Go to Dashboards > Broker VM Performance.

Answer

Go to Endpoint Management > Broker VM.

Question 2

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

Accepted Answer

Scheduled Reports in the Reporting menu. Cortex XDR's Reporting menu includes a Scheduled Reports feature that lets administrators define report templates (including incident reports filtered to critical severity), set a weekly schedule, and configure email delivery to recipients such as the security operations team. This is the native, purpose-built capability for recurring PDF report distribution.

Answer

Incident Export via Syslog

Answer

Data Export Service

Answer

BIOC Alert Notifications

Question 3

An administrator has deployed a Broker VM and enabled the Active Directory (AD) collector to ingest user and group mapping data. The connection test fails with a 'Kerberos Authentication Failed' error. What is the most likely cause of this failure?

Accepted Answer

The Broker VM system clock is out of sync with the Domain Controller by more than five minutes. Kerberos authentication relies on time-stamped tickets to prevent replay attacks. If the Broker VM's system clock differs from the Domain Controller's by more than five minutes (the default Kerberos tolerance), the Key Distribution Center (KDC) rejects the authentication request, producing a 'Kerberos Authentication Failed' error. Therefore, the most likely cause is a clock skew exceeding the allowed threshold.

Answer

The Broker VM firewall is blocking ICMP ping requests

Answer

The Cortex XDR agent on the domain controller has been uninstalled

Answer

The Broker VM has exceeded its maximum disk storage allocation

Question 4

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

Accepted Answer

Change the incident status to Resolved and select the appropriate resolution reason (e.g., False Positive).. Incidents in Cortex XDR are resolved by changing their status to 'Resolved' and assigning an appropriate resolution status such as False Positive or Benign True Positive.

Answer

Delete the agent from Endpoint Management.

Answer

Put the agent into Bypass mode.

Answer

Purge all logs using the XQL delete command.

Question 5

An administrator wants to check the total license utilization and expiration date for their Cortex XDR tenant. Where can this be reviewed?

Accepted Answer

Settings > Configurations > Licenses. License details and usage quotas are found under Settings > Configurations > Licenses.

Answer

Dashboards > License Widget

Answer

Help > About Cortex XDR

Answer

Endpoints > Licensing Status

Question 6

An administrator is reviewing incident triage notes and wants to export audit logs showing all administrative actions taken in the Cortex XDR console over the past 90 days. Where should the administrator navigate?

Accepted Answer

Settings > Configurations > Audit Trail. Audit logs tracking administrator logins, configuration changes, and policy modifications are located under Settings > Configurations > Audit Trail.

Answer

Dashboards > Audit Reports

Answer

Incident Response > Activity Log

Answer

Help > System Logs

Question 7

An administrator wants to configure email notifications whenever a critical severity incident is detected by Cortex XDR. Where is this notification setting configured?

Accepted Answer

Settings > Configurations > Notifications (or Incident Notifications). Incident notification settings, including email integrations and webhook alerts, are configured under Settings > Configurations > Integrations > Email or Notifications.

Answer

Dashboards > Alert Rules

Answer

Endpoints > Policy > Alerts

Answer

XQL Search > Alert Action

Question 8

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

Accepted Answer

Operating system type (Windows, macOS, Linux). Option C is correct because Cortex XDR endpoint groups can be defined by operating system type (Windows, macOS, Linux), which is a standard grouping criterion used to target platform-specific policies and prevention profiles. Option E is correct because Cortex XDR supports grouping endpoints by IP address subnets or network ranges, allowing administrators to apply location- or network-based policies to endpoints in specific segments. Options A, B, and D are not valid grouping criteria in Cortex XDR: printer driver versions, desktop wallpaper resolution settings, and monitor serial numbers are not endpoint attributes the console uses for policy-assignment grouping.

Answer

Installed printer driver versions

Answer

Local user desktop wallpaper resolution settings

Answer

Physical serial number of the endpoint monitor

Question 9

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

Accepted Answer

Create exceptions for known benign alerts to prevent them from inflating incident priority scores.. Incident severity and scoring can be tuned via scoring rules, alert severity mappings, and exception configurations.

Answer

Reinstall the Cortex XDR Agent on all high-priority servers.

Answer

Modify the Broker VM packet buffer size.

Question 10

Which THREE factors should an administrator consider when planning a large-scale Cortex XDR agent deployment across enterprise endpoints? (Choose three)

Accepted Answer

Potential conflicts with legacy security software that should be uninstalled prior to deployment. Option B is correct because legacy or third-party security software (e.g., older antivirus, HIPS, or EDR agents) can conflict with the Cortex XDR agent's kernel-level drivers and network filtering, causing installation failures, performance degradation, or unprotected endpoints, so it should be identified and removed before rollout. Option D is correct because agents must reach the Cortex XDR management backend or a Broker VM over outbound TCP 443 (HTTPS), and large deployments require bandwidth planning plus firewall/proxy allow-listing of the relevant FQDNs to avoid registration and telemetry failures. Option E is correct because choosing a deployment mechanism that matches each OS ecosystem — GPO or SCCM for Windows, MDM (e.g., Intune, JAMF) for macOS, and appropriate tooling for Linux — ensures scalable, consistent installation and upgrade across heterogeneous enterprise endpoints. Option A is not appropriate because the Cortex XDR agent is an endpoint security agent, not a DNS server, and making it authoritative for a subnet would break name resolution. Option C is incorrect because granting permanent domain administrator rights to local users is a severe security violation and is not required for agent operation, which runs under the SYSTEM/service account context.

Answer

Configuring the agent to act as a primary DNS server for the local subnet

Answer

Ensuring local endpoint users have full domain administrator rights permanently