XDR-Engineer Practice Test 11 — 15 Questions

Question 1

An administrator is configuring log forwarding from a Cortex XDR Broker VM to an external SIEM and encounters connection timeouts. Which THREE troubleshooting actions should the administrator take? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check if the SIEM requires mutual TLS (mTLS) authentication and ensure valid client certificates are configured on the Broker VM.. Option A is correct because connection timeouts during log forwarding can result from the SIEM requiring mutual TLS (mTLS), where the Broker VM must present a valid client certificate; verifying and configuring the correct client certificate on the Broker VM resolves handshake failures that manifest as timeouts. Option B is correct because examining the Broker VM export logs reveals queue backups or explicit delivery error responses from the SIEM receiver, which directly indicate whether logs are being buffered due to unreachable or rejecting endpoints. Option C is correct because verifying the destination SIEM listener IP address and port are reachable from the Broker VM using tools like nc or telnet confirms basic network connectivity and isolates firewall, routing, or listener-binding issues causing the timeouts. Option D is not relevant because restarting the Cortex XDR management console web server does not address Broker VM-to-SIEM network or authentication problems. Option E is not appropriate because reinstalling the Windows operating system on the SIEM receiver is a drastic, unrelated action that does not troubleshoot the forwarding connection.

Answer

Restart the Cortex XDR management console web server.

Answer

Reinstall the Windows operating system on the SIEM receiver.

Question 2

Which TWO actions can an administrator take if a Cortex XDR agent fails to register with the cloud management console after installation? (Choose two)

Accepted Answer

Check that the installation package was created with the correct tenant parameters and valid token.. Option D is correct because a Cortex XDR agent registration is bound to the tenant-specific installation package, which embeds the correct tenant ID and a valid registration token; if the package was generated for the wrong tenant or the token is expired/invalid, the agent cannot authenticate to the cloud management console and registration fails. Option E is correct because Cortex XDR agents communicate with the Cortex XDR backend over outbound TCP 443 (HTTPS); if firewall, proxy, or network rules block this outbound connectivity, the agent cannot reach the console and will never register. Option A is wrong because printer sharing permissions are unrelated to agent-to-cloud communication. Option B is wrong because refreshing an ISP dynamic IP lease on the local router does not address agent registration, which uses outbound HTTPS sessions rather than inbound IP-dependent connectivity. Option C is wrong because changing the desktop wallpaper theme has no bearing on Cortex XDR agent registration or network connectivity.

Answer

Reconfigure the endpoint's printer sharing permissions.

Answer

Reboot the local office router to refresh the ISP dynamic IP lease.

Answer

Change the Windows desktop wallpaper theme.

Question 3

An analyst notices that a custom BIOC rule is generating too many false positives during normal software deployments. What is the most appropriate next step in detection engineering for this rule?

Accepted Answer

Tune the BIOC rule logic by adding specific process path exclusions or qualifying criteria.. The most appropriate next step is to tune the BIOC rule logic by adding specific process path exclusions or qualifying criteria. This reduces false positives while preserving detection coverage for malicious activity. Tuning is a standard detection engineering practice that balances security efficacy with operational noise.

Answer

Change the agent operating mode to Bypass.

Answer

Disable the entire Analytics engine on all endpoints.

Answer

Delete the BIOC rule and rely solely on default cloud-delivered IOCs.

Question 4

An organization requires high availability and load balancing for their Broker VM log ingestion tier. Which TWO architectural considerations or configurations support this requirement? (Choose two)

Accepted Answer

Deploying multiple Broker VMs behind an external Layer 4 load balancer for syslog/network log ingestion. Option A is correct because deploying multiple Broker VMs behind an external Layer 4 load balancer provides both high availability and load distribution for syslog and network log ingestion, since L4 (TCP/UDP) load balancing can spread flows across brokers and remove failed nodes from rotation. Option E is correct because configuring redundant collector instances across multiple Broker VMs ensures that if one collector or VM fails, another continues ingesting and forwarding logs, which is the core of an HA ingestion tier. Option B is wrong because sharing a single static IP across independent, uncoordinated cloud regions without routing is not a valid HA or load-balancing design and would cause traffic blackholing or conflicts. Option C is wrong because running multiple active database instances on the same Broker VM container kernel does not provide HA or load balancing and risks resource contention and data corruption. Option D is wrong because disabling network encryption weakens security and does not deliver high availability or load balancing.

Answer

Sharing a single static IP address across independent uncoordinated cloud regions without routing

Answer

Running multiple active database instances on the same Broker VM container kernel

Answer

Disabling all network encryption to speed up packet forwarding

Question 5

An enterprise plans to deploy Cortex XDR agents to servers that run resource-intensive, mission-critical database applications. During the installation planning phase, which configuration step should the administrator take to minimize potential performance impact?

Accepted Answer

Configure custom Agent Settings profiles with appropriate exclusions for database files and directories.. Cortex XDR agents allow administrators to create custom Agent Settings profiles that include exclusions for specific files, folders, and processes. Applying exclusions for database files and directories prevents the agent from scanning or intercepting I/O on those paths, which minimizes CPU, memory, and disk overhead on resource-intensive database servers. This is the recommended, supported approach for balancing security with performance on mission-critical workloads.

Answer

Disable all behavioral threat protection features on database servers.

Answer

Set the agent operating mode to disabled via the command line.

Answer

Install only the Traps module without the Cortex XDR agent core.

Question 6

When troubleshooting a Cortex XDR agent installation failure on Windows, which log file generated by the installer provides the most detailed error codes and execution steps?

Accepted Answer

MSI verbose installation log (e.g., generated with /l*v). Standard Windows Installer (MSI) verbose logging captures every action taken during installation and is invaluable for troubleshooting setup failures.

Answer

PanXdrInstall.txt

Answer

CortexAgent_Debug.log

Answer

CyveraInstall.log

Question 7

An administrator is planning the initial deployment of Cortex XDR agents across a mixed environment of Windows and macOS endpoints. Which firewall port and protocol must be opened outbound from the endpoints to ensure successful registration and telemetry reporting to the Cortex XDR management console?

Accepted Answer

TCP port 443 outbound. Cortex XDR agents require outbound TCP port 443 for HTTPS communication to the Cortex XDR management console and tenant endpoints.

Answer

UDP port 514 inbound

Answer

TCP port 3389 inbound

Answer

TCP port 22 outbound

Question 8

During a large-scale Cortex XDR agent deployment using a Software Distribution Tool, administrators notice that multiple endpoints show identical agent IDs (UUIDs) in the Cortex XDR management console, causing telemetry to overwrite. What caused this issue?

Accepted Answer

The endpoints were cloned from a golden image that contained a pre-installed Cortex XDR agent without proper unregistration.. If a golden image or virtual machine template is captured with a pre-installed Cortex XDR agent, the resulting cloned endpoints will share the same persistent registry keys/UUID, requiring the use of the cytool unregister command or specialized imaging preparation.

Answer

The installation script failed to generate a unique token parameter.

Answer

Active Directory GPO distributed the package with a hardcoded configuration XML.

Answer

The Cortex XDR Broker VM assigned the same IP address to all reporting clients.

Question 9

A Cortex XDR engineer needs to build a recurring report that summarizes which MITRE ATT&CK techniques were observed across all incidents from the previous week, broken down by technique ID. The engineer wants the output to be generated automatically every Monday at 08:00 and emailed to the security leadership team. Which Cortex XDR capability should the engineer configure to meet these requirements?

Accepted Answer

A scheduled Report Template built from an XQL-based widget on a custom dashboard. Scheduled reporting that aggregates incident data into an ATT&CK technique breakdown requires an XQL-backed widget embedded in a dashboard and delivered through a Report Template with a recurring schedule and email recipients. BIOC rules, IOC feeds, and agent policies govern detection, ingestion, and endpoint behavior respectively, none of which produce periodic summarized reports.

Answer

A Cortex XDR agent policy with enhanced data collection and a report profile

Answer

A BIOC rule with a MITRE technique mapping and an email notification action

Answer

An IOC feed with a scheduled refresh interval and an email alert threshold

Question 10

Which TWO components or files are typically required when deploying the Cortex XDR agent on Windows endpoints? (Choose two)

Accepted Answer

A valid Cortex XDR agent installation token or profile mapping. Option A is correct because deploying the Cortex XDR agent requires a valid installation token (or a profile mapping in a managed deployment) so the endpoint can authenticate to the Cortex XDR management server and register into the correct tenant and agent profile. Option D is correct because the Cortex XDR agent for Windows is distributed as an MSI installation package, which is the actual installer executed on the endpoint (silently or interactively) to install the agent service. Option B is not required, since GlobalProtect is a separate VPN client and is not a prerequisite for Cortex XDR agent installation. Option C is not required, as Cisco AnyConnect is an unrelated VPN client and has no role in Cortex XDR agent deployment. Option E is not required, because the Cortex XDR agent does not depend on a local Microsoft SQL Server Express instance; endpoint data is sent to the Cortex XDR management console/cloud.

Answer

An active GlobalProtect VPN tunnel client

Answer

A Cisco AnyConnect configuration profile

Answer

A local Microsoft SQL Server Express instance

Question 11

An administrator is configuring custom BIOC rules in Cortex XDR. Which TWO elements are mandatory when defining a new BIOC rule? (Choose two)

Accepted Answer

Rule Logic / Event Query criteria. Option D (Rule Name) is mandatory because every BIOC rule in Cortex XDR must have a unique, descriptive name that identifies it in the BIOC rules list and in generated alerts, so the console will not let you save the rule without one. Option C (Rule Logic / Event Query criteria) is mandatory because the BIOC rule is defined by its behavioral logic — the event query/condition built from fields such as event type, action, and process attributes — which determines what activity triggers the rule; without this criteria there is nothing for the rule to detect. Option A (External SIEM Forwarding Destination IP) is not required to define a BIOC rule, since forwarding to an external SIEM is a separate integration/notification setting configured outside the rule definition. Option B (Custom Agent Installation Password) is unrelated to BIOC rule creation; it is part of agent deployment/installation configuration. Option E (Cortex XSOAR Playbook ID) is not mandatory because playbook execution is an optional response action that can be attached to a rule, not a required element for defining the BIOC logic itself.

Answer

External SIEM Forwarding Destination IP

Answer

Custom Agent Installation Password

Answer

Cortex XSOAR Playbook ID

Question 12

An enterprise environment uses a forward proxy for all outbound internet traffic. The Broker VM deployed in the internal network cannot reach external cloud APIs for threat intelligence enrichment. How should the administrator configure the Broker VM to route traffic through the forward proxy?

Accepted Answer

Configure the proxy settings using the Broker VM configuration menu or environment variables (HTTP_PROXY / HTTPS_PROXY). Broker VM proxy settings are configured during or after deployment via the Broker VM CLI or configuration menu to set HTTP_PROXY/HTTPS_PROXY environment variables.

Answer

Deploy a secondary Broker VM in the DMZ to act as an internal DNS forwarder

Answer

Modify the Windows Registry on the Broker VM host machine

Answer

Write a custom automation playbook in Cortex XSOAR to tunnel packets through ICMP

Question 13

An administrator created a new BIOC detection rule, but test alerts are not appearing in the Incident triage view. Upon checking the rule status, it is active and enabled. What is a common reason why a valid BIOC rule might fail to generate alerts?

Accepted Answer

The required event telemetry type is disabled in the agent Data Collection profile.. BIOC rules evaluate telemetry collected by the agent. If the required event types (e.g., process execution, registry modification) are not enabled in the agent's Data Collection profile, the underlying telemetry will not exist for the rule to match.

Answer

BIOC rules only execute when triggered manually by an analyst.

Answer

Cortex XDR requires a mandatory 72-hour calibration period before BIOC rules become active.

Answer

All BIOC rules require Cortex XSOAR to authorize alert generation.

Question 14

An administrator needs to troubleshoot an AWS S3 bucket integration via Broker VM where logs are failing to ingest. Which TWO diagnostic steps should be taken? (Choose two)

Accepted Answer

Verify that the AWS IAM policy has s3:GetObject and s3:ListBucket permissions. Option C is correct because an S3 bucket integration requires the IAM principal used by the Broker VM to have s3:GetObject (to read the log objects) and s3:ListBucket (to enumerate the bucket contents); missing either permission causes Access Denied errors that halt ingestion. Option E is correct because the Broker VM runs the S3 polling connector inside a container, so inspecting the container logs is the direct way to surface polling failures, authentication errors, or endpoint connectivity issues. Option A is wrong because local monitor resolution has no bearing on S3 log ingestion. Option B is wrong because disconnecting enterprise firewalls is a disruptive, unsafe action and would not isolate an S3 polling problem. Option D is wrong because reinstalling the Windows OS on an S3 server is nonsensical—S3 is a managed AWS service, not a Windows host.

Answer

Change the local monitor resolution on the administrator workstation

Answer

Disconnect all enterprise physical firewalls

Answer

Reinstall the Windows operating system on the AWS S3 server

Question 15

When configuring an integration instance in Cortex XSOAR (or Cortex XDR Automation) for a third-party threat intelligence feed, what is the primary purpose of the instance name?

Accepted Answer

To uniquely identify a specific configuration and credential set for an integration. Integration instances allow administrators to configure multiple instances of the same integration with different parameters, each identified by a unique instance name.

Answer

To determine the operating system kernel executing the automation script

Answer

To define the encryption key used for secure payload transit

Answer

To specify the physical network interface the integration binds to