XDR-Engineer Practice Test 10 — 10 Questions

Question 1

An administrator needs to install the Cortex XDR agent on a fleet of headless Linux servers using a silent installation script. Which parameter must be included alongside the installation package to successfully bind the agent to the correct Cortex XDR tenant?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Cortex XDR tenant installation token. When performing automated or silent installations on Linux, the installation script requires the corresponding installation token (often passed via command-line switches or an associated properties file) to authenticate against the tenant.

Answer

The domain administrator password

Answer

The local root SSH private key

Answer

The PAN-OS API key

Question 2

An administrator notices that several Cortex XDR agents are showing a 'Disconnected' status in the management console. What is a common initial cause to investigate?

Accepted Answer

Network connectivity issues or firewall blocks preventing outbound communication to the Cortex XDR backend.. Cortex XDR agents maintain a persistent outbound connection (typically over TCP 443) to the Cortex XDR backend/management service. When that channel is broken — due to proxy misconfiguration, firewall rules, DNS failures, or TLS inspection — the agent cannot check in and the console reports it as 'Disconnected'. This is the most common and first thing to verify before assuming an agent-side or licensing problem.

Answer

The agent license count has been exceeded by one license.

Answer

The Data Collection profile was modified to reduce log verbosity.

Answer

The local endpoint user changed their Windows login password.

Question 3

Which TWO of the following capabilities are provided by Cortex XDR Behavioral Threat Analytics (Analytics BIOCs)? (Choose two)

Accepted Answer

Detecting rare or anomalous process execution across the enterprise environment.. Option A is correct because Cortex XDR Behavioral Threat Analytics (Analytics BIOCs) baselines normal process behavior across the enterprise and flags rare or anomalous process executions that deviate from the established norm, which is the core purpose of the analytics engine. Option B is correct because Analytics BIOCs apply machine learning models to endpoint telemetry to surface multi-stage attack behaviors such as lateral movement and credential dumping (e.g., suspicious access to LSASS), rather than relying on static signatures. Option C is incorrect because agent binary updates are handled by Cortex XDR agent management/content update mechanisms, not by Behavioral Threat Analytics. Option D is incorrect because enforcing firewall rules on third-party perimeter gateways is not a function of Analytics BIOCs; that would require external firewall integration or orchestration. Option E is incorrect because local signature scans of static files at rest are the domain of signature-based malware scanning, whereas Analytics BIOCs focus on behavioral analytics of runtime activity.

Answer

Automatically updating agent software binaries on offline endpoints.

Answer

Manually enforcing firewall blocking rules on third-party perimeter gateways.

Answer

Performing local signature scans on static files at rest.

Question 4

An engineer is configuring Data Export Service (DES) to stream Cortex XDR logs to a cloud storage bucket. Which THREE cloud storage providers are natively supported destinations for DES? (Choose three)

Accepted Answer

Google Cloud Storage. Data Export Service (DES) in Cortex XDR natively supports streaming logs to three major cloud object storage providers: Google Cloud Storage (option A), Microsoft Azure Blob Storage (option B), and Amazon S3 (option D). Each of these is a first-class, built-in destination type configured directly in the DES profile, allowing logs to be exported continuously to their respective buckets/containers. Option C is incorrect because DES does not support exporting to a local FTP server, and active-mode FTP is not a supported transport for DES destinations. Option E is incorrect because Bluetooth-tethered mobile storage is not a cloud storage provider and is not a supported DES destination.

Answer

Local FTP Server via active mode

Answer

Bluetooth tethered mobile storage

Question 5

A Cortex XDR administrator needs to forward only alerts with a severity of Critical to an external SIEM while sending all other alerts to a different destination. The administrator is configuring data forwarding rules. Which approach correctly achieves this requirement?

Accepted Answer

Create one rule with a severity filter for Critical and another rule with a severity filter excluding Critical. Data forwarding rules can filter by severity, so the correct design uses one rule that matches Critical and a second rule that excludes Critical, sending each set to its respective destination. This avoids duplication and ensures non-Critical alerts still reach the second destination. Forwarding everything and filtering downstream, or disabling non-Critical forwarding, fails the stated routing requirement.

Answer

Create a rule that forwards Critical alerts and disable forwarding for all other severities

Answer

Create one forwarding rule with a severity filter for Critical and a second rule without a severity filter

Answer

Create a single rule that sends all alerts and rely on the SIEM to filter by severity

Question 6

Where within the Cortex XDR console should an administrator configure scheduled reporting to automatically email executive summaries to stakeholders on a weekly basis?

Accepted Answer

Reporting > Report Builder. Cortex XDR's Reporting > Report Builder is where administrators create scheduled reports, define their content, set the schedule (e.g., weekly), and configure email distribution to stakeholders. This is the dedicated module for report generation and delivery. Configuring it here ensures executive summaries are delivered automatically on the defined cadence.

Answer

Incident Response > Incident Management

Answer

XQL Search > Scheduled Queries

Answer

Settings > Configurations > Email Notifications

Question 7

Which type of profile in Cortex XDR controls the collection of endpoint telemetry used for threat hunting and forensic analysis?

Accepted Answer

Data Collection profile. The Data Collection profile in Cortex XDR is the configuration object that governs which endpoint telemetry types (process, file, network, registry, etc.) are collected and forwarded to the Cortex XDR console for threat hunting, causality analysis, and forensic investigation. It is separate from protection profiles, which control prevention behavior rather than data gathering.

Answer

Agent Settings profile

Answer

Malware Protection profile

Answer

Network Control profile

Question 8

An organization requires that Cortex XDR agent installation packages be deployed silently without displaying any user interface or rebooting the workstation. Which command-line arguments should be used with a Windows MSI installer package?

Accepted Answer

msiexec /i <installer>.msi /qn REBOOT=ReallySuppress. Silent installations of MSI packages are standard using the '/qn' or '/quiet' flags, often combined with REBOOT=ReallySuppress to prevent forced reboots.

Answer

setup.exe /silent /noreboot

Answer

install.bat --silent --no-restart

Answer

cytool install --quiet --suppress-reboot

Question 9

An administrator is configuring a new integration in Cortex XSOAR and needs to ensure secure credential handling. Which TWO practices are recommended when managing API keys and secrets? (Choose two)

Accepted Answer

Store API keys using the integration parameter type 'Encrypted' / 'Password'. Option A is correct because Cortex XSOAR provides dedicated parameter types such as 'Encrypted' and 'Password' that mask and securely store sensitive values like API keys in the integration configuration, preventing them from being exposed in plain text in the UI or logs. Option C is correct because periodic key rotation limits the window of exposure if a credential is compromised and is a standard security practice mandated by most organizational policies and compliance frameworks. Option B is incorrect because hardcoding secrets in Python source code exposes them to anyone with repository or content-pack access and makes rotation difficult. Option D is incorrect because writing API keys in plain text in an incident description field exposes them to all users with incident access and to audit logs. Option E is incorrect because sharing credentials across tenants via public GitHub repositories is a severe security violation that leaks secrets to unauthorized parties.

Answer

Hardcode the API keys directly into the playbook Python script source code

Answer

Publish the API keys in plain text within the incident description field for team visibility

Answer

Share integration credentials across all tenants via public GitHub repositories

Question 10

An administrator is configuring automated incident enrichment in Cortex XDR. Whenever a new malware incident is generated, the system should automatically query VirusTotal using an integration. Where should this automated workflow be built and attached?

Accepted Answer

As an automated Playbook attached to Incident Trigger rules in the Automation module. Automated workflows triggered by incident creation are built as Playbooks in Cortex XSOAR / XDR Automation and attached to Incident Classification or Trigger rules.

Answer

Inside the Cortex XDR Agent installation policy settings

Answer

Inside the Broker VM local crontab configuration file

Answer

As a local cron job running on each individual endpoint