XDR-Engineer Practice Test 14 — 15 Questions

Question 1

A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sequence or threshold-based BIOC rule. To evaluate stateful conditions across multiple events over a specific time window, sequence or threshold-based behavioral analytics / BIOC rules must be configured.

Answer

Agent Malware Prevention profile exception

Answer

Local firewall rule configuration

Answer

Static IOC file hash block rule

Question 2

An enterprise has deployed Cortex XDR agents across Windows and Linux hosts. A security engineer notices that a specific custom BIOC rule is triggering successfully on Windows endpoints but fails to fire on Linux endpoints despite identical malicious commands being executed. What is the most likely cause?

Accepted Answer

The BIOC rule logic uses Windows-specific event fields and command structures that do not match Linux event telemetry schema.. BIOC rules contain operating system-specific syntax and event fields. A rule built exclusively for Windows event structures will not evaluate correctly against Linux OS telemetry.

Answer

The Linux agents must be rebooted into Diagnostic mode for BIOC evaluation.

Answer

Linux endpoints do not support custom BIOC rules in Cortex XDR.

Answer

Custom BIOCs require Cortex XSOAR to process Linux telemetry.

Question 3

An analyst is investigating an alert generated by Analytics where a user account executed an unusual command. The analyst wants to view all other actions performed by that same user across any endpoint during a 24-hour window. Which query technique in XQL best fulfills this requirement?

Accepted Answer

dataset = xdr_data | filter username == 'TargetUser' and _time >= now() - 24h. Filtering the `xdr_data` dataset by the specific username and a time range (`emp_time` or timestamp filters) allows full behavioral reconstruction of user activity.

Answer

dataset = endpoints_inventory | filter owner == 'TargetUser'

Answer

dataset = panw_analytics_alerts | filter alert_id == 'TargetUser'

Answer

dataset = network_story | filter user_context == null

Question 4

An administrator wants to configure local log retention settings and verify the ingestion rate of raw endpoint telemetry within Cortex XDR. Where can the administrator monitor platform license consumption and data ingestion metrics?

Accepted Answer

Settings -> Configurations -> License Management / Hub. License utilization, data ingestion volumes, and storage statistics in Cortex XDR are managed and viewed via the License Management / Settings menus.

Answer

Host Insights -> Disk Utilization report

Answer

Incident Response -> Queue Statistics

Answer

Analytics -> BIOC Rule Health monitor

Question 5

An analyst is investigating an incident and notices that a custom Analytics BIOC rule generated too many false positives due to a legitimate administrative tool. What is the recommended method to tune this rule without completely disabling it?

Accepted Answer

Add an exception to the specific BIOC rule based on criteria such as file path, hash, or signer.. Exceptions can be added to BIOC rules to filter out known legitimate parameters, such as specific file hashes, signing certificates, or file paths.

Answer

Delete the BIOC rule and recreate it as an XQL scheduled alert.

Answer

Change the BIOC rule severity level from High to Low so analysts ignore it.

Answer

Modify the global agent profile to exclude the administrative tool from all endpoint monitoring.

Question 6

Which TWO authentication methods are commonly supported when configuring API integrations in Cortex XSOAR? (Choose two)

Accepted Answer

API Key / Token Authentication. API integrations commonly use API Key authentication and OAuth2.

Answer

Rotary dial pulse signaling

Answer

Physical punch cards

Answer

Plain text Telnet login prompts

Question 7

An analyst is reviewing an incident where a suspicious process spawned a child process. The analyst wants to check if any other endpoint in the enterprise has ever executed this exact child process image file name combined with a specific command-line argument. Which search method is most efficient?

Accepted Answer

Execute an XQL query across xdr_data filtering for the specific process name and command line.. Using XQL to search across the entire `xdr_data` dataset for the specific process name and command line provides immediate enterprise-wide visibility.

Answer

Reboot all endpoints into Safe Mode.

Answer

Manually check the Agent Management list for each host individually.

Answer

Review the weekly PDF Scheduled Report.

Question 8

An administrator wants to ensure that all critical severity alerts generated in Cortex XDR are immediately brought to the attention of the SOC by triggering an audible notification and high-priority banner in the console. Where are console notification preferences managed?

Accepted Answer

User Profile / Notifications settings in the Cortex XDR console. Console alert notifications, preferences, and display settings are managed within user profile settings or notification configurations in the Cortex XDR console.

Answer

Agent Profile -> Malware Settings

Answer

Data Export Service configuration

Answer

Host Insights -> Scan Schedules

Question 9

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

Accepted Answer

Change the incident status to Resolved and select the appropriate resolution reason (e.g., False Positive).. Incidents in Cortex XDR are resolved by changing their status to 'Resolved' and assigning an appropriate resolution status such as False Positive or Benign True Positive.

Answer

Delete the agent from Endpoint Management.

Answer

Put the agent into Bypass mode.

Answer

Purge all logs using the XQL delete command.

Question 10

An engineer is writing an XQL query to investigate endpoint activity. Which TWO commands are valid XQL query operators used for data manipulation and shaping? (Choose two)

Accepted Answer

filter. XQL utilizes powerful pipeline operators such as `filter`, `stats`, `fields`, and `sort` to process datasets.

Answer

SELECT * FROM

Answer

DROP TABLE

Answer

INSERT INTO

Question 11

An organization wants to configure granular reporting and alerting based on MITRE ATT&CK techniques. Within Cortex XDR, which THREE methods or views allow security teams to analyze detections mapped against the MITRE ATT&CK framework? (Choose three)

Accepted Answer

Incident and alert details displaying mapped ATT&CK tactics and techniques. Cortex XDR integrates MITRE ATT&CK mapping into the Incident View, Analytics alerts, and dedicated Security posture / ATT&CK reporting widgets.

Answer

Agent uninstallation wizard

Answer

Local endpoint BIOS flashing utility

Question 12

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

Accepted Answer

The underlying XQL query string that defines the detection logic.. When configuring scheduled XQL rules, administrators must specify the query string, execution frequency/time window, and alert severity mapping.

Answer

The physical memory allocation limit on the Broker VM handling syslog collection.

Answer

The kernel bypass configuration parameters for Windows endpoints.

Question 13

An analyst is troubleshooting a complex multi-stage attack in Cortex XDR. Which THREE analytical tools or views in the console help reconstruct the sequence of events across endpoints? (Choose three)

Accepted Answer

Causality View graph. Incident causality views, XQL hunting queries, and attack story timelines are core tools used to reconstruct attacks in Cortex XDR.

Answer

Agent deployment package downloader

Answer

Global agent proxy configuration menu

Question 14

An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?

Accepted Answer

A Condition (or Decision) block that evaluates the sandbox verdict output. Conditional routing in playbooks is handled using Decision or Condition tasks to evaluate previous task outputs.

Answer

A Data Collection task pointing to the endpoint agent

Answer

A Post-Processing script executed directly on the Broker VM

Answer

A Manual Approval step without automated logic branching

Question 15

When testing a newly configured API integration instance in Cortex XSOAR, what is the standard action used to verify connectivity and authentication credentials?

Accepted Answer

Run the 'test-module' command. The 'test-module' command is the standard mechanism in Cortex XSOAR to test API connectivity and credentials.

Answer

Reboot the Cortex XDR management server tenant

Answer

Restart the Broker VM container service

Answer

Execute a full endpoint isolation workflow