XDR-Engineer Practice Test 13 — 15 Questions

Question 1

An administrator is planning network integration for Cortex XDR by forwarding syslog data from third-party security devices. Which component must be configured to receive syslog messages and forward them securely to the Cortex XDR cloud tenant?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cortex XDR Broker VM with the Syslog Collector module enabled. The Cortex XDR Broker VM supports log collector modules that ingest syslog data from third-party devices and forward it to the Cortex XDR data lake.

Answer

Palo Alto Networks Next-Generation Firewall configured with GlobalProtect

Answer

Cortex XDR Agent installed on a dedicated Linux log server

Answer

Prisma Access Cloud Secure Web Gateway

Question 2

An analyst is investigating an incident in Cortex XDR and wants to gather more forensic data from an endpoint. Which TWO live response actions can the analyst execute directly from the Cortex XDR console? (Choose two)

Accepted Answer

Run Live Response command-line scripts/commands. Option B is correct because Cortex XDR's Live Response feature provides a remote shell on the endpoint that lets analysts execute built-in commands and upload/run custom scripts for triage and forensic collection. Option E is correct because Live Response includes file retrieval actions (get file) that pull specified files or artifacts from the endpoint into the Cortex XDR console for offline analysis. Option A is incorrect because BIOS boot sequence changes are firmware-level settings not exposed through Cortex XDR Live Response. Option C is incorrect because adding physical memory is a hardware operation that cannot be performed remotely via the console. Option D is incorrect because flashing switch firmware is a network-device maintenance task outside the scope of endpoint Live Response actions.

Answer

Modify local BIOS boot sequence configurations

Answer

Upgrade the endpoint's physical hardware memory

Answer

Flash new network switch firmware

Question 3

Where in the Cortex XDR management console can an administrator review the connection status, agent version, and operating system of all registered endpoints?

Accepted Answer

Endpoints > Endpoint Management. The Cortex XDR management console provides endpoint inventory and status information under Endpoints > Endpoint Management. This view lists all registered endpoints along with their connection status, agent version, operating system, and other metadata, making it the correct location to review fleet-wide agent health.

Answer

Dashboards > Health > Agents

Answer

Response > Endpoint Status

Answer

Settings > Agent Management > Status

Question 4

When configuring a custom Malware Protection profile, an administrator wants to enable prevention for greyware (Potentially Unwanted Applications - PUA). What action does the Cortex XDR agent take when a PUA is detected and the profile action is set to 'Block'?

Accepted Answer

Quarantines the file and terminates the running process.. When a PUA is detected and the profile action is set to 'Block', the agent quarantines the file and terminates the running process (B). This prevents the PUA from executing or continuing to run, while preserving the file in quarantine for potential analysis or restoration. This is the standard block action for malware and PUA in Cortex XDR.

Answer

Sends an alert to the console but allows the application to continue running.

Answer

Isolates the entire endpoint from the corporate network.

Answer

Deletes the file permanently from the disk without creating a quarantine backup.

Question 5

An administrator needs to deploy Cortex XDR agents to a large fleet of Windows endpoints via Group Policy Object (GPO). Which installation package type and parameter should the administrator utilize to ensure a silent installation without user interaction?

Accepted Answer

Use the .msi package with the /quiet and /norestart parameters.. For silent, unattended deployment via GPO, the correct approach is to use the .msi installer with the /quiet and /norestart parameters. MSI packages are natively supported by Group Policy Software Installation and Windows Installer, and /quiet suppresses all UI while /norestart prevents an automatic reboot during deployment. This is the standard enterprise deployment method for Cortex XDR on Windows.

Answer

Use the .exe package and modify the registry before execution.

Answer

Use the .exe package with the /silent switch.

Answer

Use the .pkg package with the --unattended flag.

Question 6

An organization utilizes custom correlation rules in Cortex XDR. An engineer needs to export these custom BIOC rules to backup configurations or migrate them to another Cortex XDR tenant. Which administrative feature supports this?

Accepted Answer

Export and Import options within the BIOC management interface. Cortex XDR provides Export and Import options directly within the BIOC (Behavioral Indicators of Compromise) management interface, allowing administrators to download custom correlation rules as a file and re-upload them into another tenant. This is the supported mechanism for backup and cross-tenant migration of custom BIOC rules.

Answer

Agent deployment script parameter flags

Answer

Cortex XDR API key generation settings

Answer

Data Export Service configuration bucket

Question 7

An administrator wants to configure role-based access control (RBAC) so that a newly formed tier-1 SOC team can view incidents and run XQL queries, but cannot modify firewall rules, agent settings, or create custom BIOC rules. Where should the administrator configure this role?

Accepted Answer

Settings -> Configurations -> Roles. Role-based access control in Cortex XDR is configured under Settings -> Configurations -> Roles, where administrators define custom roles with granular permissions across modules such as Incidents, XQL, BIOC, Agent Settings, and Firewall. Creating a role that grants view/query permissions while withholding configuration rights is exactly what this location supports.

Answer

Agent Settings -> Profiles -> Permissions

Answer

Host Insights -> License Roles

Answer

Incident Management -> Access Control

Question 8

An administrator is configuring data forwarding filters in Cortex XDR to send specific severity alerts to a SIEM. The requirement is to forward all 'High' and 'Critical' severity alerts while excluding 'Low' and 'Medium' alerts. Where is this filter configured?

Accepted Answer

Under Settings > Configurations > Data Forwarding rules. Data forwarding filters that determine which alerts (by severity, type, etc.) are sent to external systems like a SIEM are configured under Settings > Configurations > Data Forwarding rules. This is where administrators define the severity thresholds and alert criteria that control what leaves Cortex XDR.

Answer

In the Cortex XDR Agent installation package configuration properties

Answer

Inside the Cortex XSOAR incident layout editor

Answer

On the Broker VM local routing table configuration

Question 9

What is the function of an Exploit Protection profile in Cortex XDR?

Accepted Answer

To prevent memory-based attacks and protect applications from exploitation techniques.. An Exploit Protection profile in Cortex XDR is a security policy that defines which exploit mitigation techniques (e.g., DEP, ASLR, SEHOP, Heap Spray, ROP) are applied to protected applications to prevent memory-based attacks such as buffer overflows, ROP chains, and heap sprays. It hardens applications against exploitation techniques rather than scanning for known malware hashes.

Answer

To encrypt endpoint hard drives using BitLocker or FileVault.

Answer

To control USB mass storage device access.

Answer

To detect and block known malware hashes during file scans.

Question 10

An administrator is troubleshooting a Cortex XDR syslog integration where logs from a high-throughput network device are being dropped or delayed. The Broker VM resource utilization for CPU and memory is normal. Which underlying collector configuration setting should be adjusted to handle the high burst rate?

Accepted Answer

Increase the syslog collector worker threads and queue size parameters in the Broker VM configuration. Increasing the syslog collector worker threads and queue size parameters in the Broker VM configuration allows the collector to process more messages concurrently and buffer bursts, preventing drops or delays. This is the correct tuning when CPU and memory are normal, as the bottleneck is likely in the collector's processing capacity.

Answer

Switch the syslog transport from TCP to ICMP tunneling

Answer

Enable verbose kernel debugging on the Cortex XDR agent

Answer

Decrease the agent keep-alive interval to force faster handshakes

Question 11

Which TWO of the following data sources can be natively onboarded and collected using a Cortex XDR Broker VM? (Choose two)

Accepted Answer

AWS CloudTrail log buckets. Option A (AWS CloudTrail log buckets) is correct because the Cortex XDR Broker VM can natively collect cloud audit logs by connecting to AWS S3 buckets where CloudTrail stores its log files, using the broker's cloud data collection capability. Option E (Syslog / CEF data streams from network security devices) is correct because the Broker VM includes a Syslog Collector that natively receives and parses Syslog and CEF-formatted events from firewalls, proxies, and other network security appliances. The remaining options are not supported: Bluetooth proximity logs from mobile phones are not a Broker VM data source, hardware serial numbers via SNMP are not natively onboarded by the Broker VM, and kernel memory dumps from unmanaged switches are neither a supported collection method nor a standard Broker VM integration.

Answer

Local Bluetooth proximity logs from mobile phones

Answer

Physical desktop hardware serial numbers via SNMP

Answer

Direct kernel memory dumps from unmanaged switches

Question 12

Which command-line utility is installed natively with the Cortex XDR agent on Windows endpoints to manage agent settings, check connection status, and troubleshoot locally?

Accepted Answer

cytool. The 'cytool' command-line utility is bundled with the Cortex XDR agent to perform local administrative tasks such as checking status, viewing logs, and running diagnostics.

Answer

traps-cli

Answer

pan-agent-ctl

Answer

xdr-admin

Question 13

An administrator is configuring a Broker VM in Cortex XDR to act as a log collector for third-party security devices. Which TWO log ingestion formats are natively supported by the Cortex XDR Broker VM Log Collector? (Choose two)

Accepted Answer

Syslog (UDP and TCP). The Cortex XDR Broker VM Log Collector natively supports receiving syslog over both UDP and TCP, which is the standard mechanism for ingesting events from third-party security appliances such as firewalls, IDS/IPS, and routers, making option D correct. It also natively supports HTTP/HTTPS ingestion, allowing JSON payloads from cloud APIs and other REST-based sources to be collected, which makes option E correct. Option A is incorrect because AFP is an Apple file-sharing protocol, not a log ingestion format supported by the Broker VM. Option B is incorrect because NetBIOS Datagram Service on UDP port 138 is a Windows name-resolution/datagram service, not a supported log transport. Option C is incorrect because raw disk imaging over NFS v3 is not a log collection method and is unrelated to the Broker VM Log Collector's ingestion capabilities.

Answer

Apple Filing Protocol (AFP) file streaming

Answer

NetBIOS Datagram Service (UDP port 138)

Answer

Direct raw disk imaging via NFS v3

Question 14

An organization is deploying the Cortex XDR Broker VM on-premises to support log ingestion and agent proxying. Which THREE network and system prerequisites must be verified before deployment? (Choose three)

Accepted Answer

Static IP addressing or reserved DHCP lease for the Broker VM.. Option C is correct because the Broker VM must have a stable, predictable address: a static IP or a DHCP reservation ensures the Cortex XDR management plane and agents can reliably reach it for proxying and log ingestion. Option D is correct because Broker VM sizing is workload-dependent; CPU and memory must be allocated according to the volume of logs ingested and the number of agents proxied, otherwise services can be throttled or fail. Option E is correct because the Broker VM requires outbound HTTPS (TCP 443) to the Cortex XDR tenant for registration, configuration retrieval, and telemetry forwarding. Option A is not required and is a security risk, since root SSH from external public IPs is not a prerequisite and should be restricted. Option B is not required because the Broker VM does not need a local full Microsoft SQL Server instance; it uses its own internal data handling and communicates with the Cortex XDR cloud.

Answer

Direct root SSH access enabled by default from external public IP addresses.

Answer

Local installation of a full Microsoft SQL Server database instance on the VM.

Question 15

An administrator is deploying the Cortex XDR agent in a Linux environment and encounters dependency issues during the RPM installation. Specifically, the system reports missing kernel headers. What is the impact on Cortex XDR functionality if kernel headers or required kernel development packages are missing?

Accepted Answer

The agent installation will fail or certain kernel-dependent prevention and monitoring modules will not load properly. Cortex XDR on Linux relies on kernel modules (e.g., for file monitoring, process execution tracking, and exploit prevention) that must be compiled against the running kernel's headers. If kernel headers or development packages are missing, the RPM installation fails or the agent installs without loading its kernel-dependent prevention modules, leaving the endpoint only partially protected.

Answer

The endpoint will experience an immediate kernel panic and enter a reboot loop

Answer

The agent will automatically download the correct kernel source code from the public Linux kernel archives

Answer

The agent will operate normally without any functional limitations because Linux does not use kernel modules for security