XDR-Engineer Practice Test 14 — 15 Questions

Question 1

When creating a widget for a custom dashboard in Cortex XDR, an analyst wants to display a visual trend of total alert counts categorized by severity over the last 30 days. Which data source and visualization type are most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an XQL-based widget with a time-series chart configuration querying the `xdr_alerts` dataset.. Custom dashboards can utilize XQL queries to feed widgets, allowing time-series line or bar charts based on `xdr_alerts`.

Answer

Use a BIOC rule status widget configured for endpoint health metrics.

Answer

Use a Network Connection geographic map widget.

Answer

Use the Agent Version distribution widget.

Question 2

An administrator is planning a Cortex XDR deployment across a segmented network architecture where endpoints reside in a zone without direct internet access, but have access to a local proxy. Which TWO configuration steps are required to route agent traffic through this proxy? (Choose two)

Accepted Answer

Specify the proxy server address and port during the agent installation command or via agent settings. Option B is correct because the Cortex XDR agent must be told where the proxy is; this is done by supplying the proxy server address and port in the agent installation command (for example, the proxy settings parameters in the installer) or by configuring the same values in the agent settings after deployment, so the agent knows to send its traffic to the local proxy instead of attempting direct connections. Option E is correct because the local proxy itself must be permitted to forward the agent's traffic outbound to the Cortex XDR cloud endpoints over HTTPS on TCP 443, resolving the required Cortex XDR FQDNs/URLs; without this outbound allow rule the proxy cannot relay heartbeats, telemetry, or content updates. Option A is not correct because disabling TLS would break the agent's secure HTTPS communication and is not a supported or secure way to route traffic through a proxy. Option C is not correct because changing the default gateway to point at the management console is not how proxy routing works and would not provide the required path to the Cortex XDR cloud. Option D is not correct because a Microsoft Exchange server is unrelated to agent proxy traffic and is not needed for alert notifications in this scenario.

Answer

Disable TLS encryption on the proxy to allow raw packet inspection of agent heartbeats

Answer

Change the endpoint default gateway to point directly to the Cortex XDR management console

Answer

Install a local Microsoft Exchange server on the proxy to handle email-based alert notifications

Question 3

Where in the Cortex XDR web interface can an administrator generate API keys (API Key and Incident ID / Key) required for external integrations and scripts to authenticate with the Cortex XDR API?

Accepted Answer

Settings > Configurations > Integrations > API Keys. In the Cortex XDR web interface, API keys are generated under Settings > Configurations > Integrations > API Keys. This location provides both the API Key and the associated Incident ID/Key required for external scripts and integrations to authenticate with the Cortex XDR API. The API key acts as a credential for the API, while the Incident ID/Key is used for specific API operations related to incidents. This is the standard path for administrators to create and manage API access.

Answer

Marketplace > Settings > Credentials

Answer

Endpoints > Policy > Authentication

Answer

Incidents > Actions > Generate Key

Question 4

An administrator is preparing to deploy Cortex XDR agents in a hardened enterprise environment with strict endpoint security controls. Which TWO actions should the administrator perform on the endpoints to prevent interference with agent installation and operation? (Choose two)

Accepted Answer

Ensure the account performing the installation possesses local Administrator or root privileges. Option C is correct because the Cortex XDR agent installs kernel-level drivers and services (e.g., the Cortex XDR service and its filter drivers), which require local Administrator rights on Windows or root privileges on Linux/macOS to install, register, and operate properly. Option D is correct because legacy or third-party antivirus software can block driver loading, quarantine agent files, or intercept the same OS telemetry hooks, so the administrator must uninstall it or configure mutual exclusions to prevent conflicts with the Cortex XDR agent. Option A is wrong because FAT32 is not required or recommended for Cortex XDR telemetry databases and lacks the security and file-size capabilities of NTFS; formatting drives would be destructive and unnecessary. Option B is wrong because UAC is a Windows OS feature controlled through system settings or Group Policy, not BIOS hardware settings, and disabling it is not a prerequisite for agent installation. Option E is wrong because disabling all firewall rules and deleting TCP/IP stack registry keys would break network connectivity and is not a supported or necessary step for Cortex XDR deployment.

Answer

Format all local hard drives with FAT32 to ensure compatibility with Cortex XDR telemetry databases

Answer

Disable Windows User Account Control (UAC) by modifying the hardware BIOS settings

Answer

Disable all local Windows firewall rules and delete the TCP/IP stack registry keys

Question 5

An automation engineer is building a Cortex XSOAR playbook that is triggered by a Cortex XDR incident. The playbook needs to fetch all associated endpoint artifacts using the Cortex XDR integration. Which parameter is required in the command execution to ensure all relevant forensics files are retrieved?

Accepted Answer

Provide the unique Agent ID and the absolute file path of the artifact.. When fetching endpoint files or running get-file commands in XSOAR using the Cortex XDR integration, providing the specific agent ID and file path or artifact identifier is required to target the correct machine.

Answer

Specify the cloud storage bucket ARN where the endpoint stores its local cache.

Answer

Enter the firewall security policy rule ID that triggered the alert.

Answer

Supply the global tenant ID and the Active Directory Distinguished Name of the host.

Question 6

A Cortex XDR administrator is building an automation playbook that must enrich an incident with threat intelligence from an external API. The API requires a bearer token and returns JSON. The administrator wants the playbook to handle API rate limits gracefully by retrying after a delay when a 429 status code is received. Which Cortex XDR Automation configuration should the administrator use to implement this retry logic?

Accepted Answer

Use a conditional task that checks the HTTP status code and loops back to the API call task with a sleep task for the delay.. Cortex XDR Automation playbooks can implement retry logic by evaluating the API response status code and using conditional branching with a sleep task before re-invoking the API call. This approach handles 429 rate limit responses gracefully. Built-in retry parameters or instance-level settings do not provide this capability for arbitrary external APIs, so a playbook-level loop is the correct design.

Answer

Configure the integration command with a 'retry' parameter set to the number of attempts and a 'delay' parameter in seconds.

Answer

Set the integration instance timeout to a high value so the API call waits until the rate limit resets.

Answer

Enable the 'Ignore rate limit' option in the integration instance settings to bypass 429 responses automatically.

Question 7

An administrator is installing the Cortex XDR agent on a fleet of macOS endpoints running macOS Big Sur and later. The administrator notices that agent extensions are not automatically approved. Which deployment step must be completed to ensure full functionality without manual user intervention?

Accepted Answer

Deploy a Mobile Device Management (MDM) configuration profile containing the required system extension and network filter payloads. On modern macOS versions, system extensions and network filters require an MDM configuration profile to grant explicit pre-approval and avoid manual user authorization prompts.

Answer

Disable SIP (System Integrity Protection) on all endpoints via Recovery Mode

Answer

Modify the /etc/pam.d/authorization file prior to running the PKG installer

Answer

Run the installer using sudo privileges with the --force flag

Question 8

An administrator is setting up alert notification rules in Cortex XDR. Which TWO delivery channels can be configured to notify security personnel when high-severity incidents occur? (Choose two)

Accepted Answer

Webhook integration (e.g., Slack, PagerDuty, XSOAR). Option A is correct because Cortex XDR alert notification rules support webhook-based delivery channels, allowing integration with third-party services such as Slack, PagerDuty, and XSOAR to push high-severity incident alerts to security personnel. Option D is correct because Cortex XDR can send email notifications as a native delivery channel for alert rules, enabling administrators to notify security teams directly via configured email recipients. Option B is incorrect because Cortex XDR does not provide automatic local printer output as a notification delivery method. Option C is incorrect because Bluetooth broadcast to nearby mobile phones is not a supported alert notification channel in Cortex XDR. Option E is incorrect because endpoint speaker audio alarms are not a configurable delivery channel for Cortex XDR alert notification rules.

Answer

Automatic local printer output

Answer

Bluetooth broadcast to nearby mobile phones

Answer

Endpoint speaker audio alarm

Question 9

During the planning phase of a Cortex XDR deployment, an organization decides to deploy Cortex XDR agents in a disconnected environment without direct internet access to the Cortex XDR cloud. Which architecture component must be installed to facilitate agent communication and updates?

Accepted Answer

Cortex XDR Broker VM. In dark site or disconnected environments, the Cortex XDR Collector is used to proxy agent telemetry and updates since agents cannot directly reach the Cortex XDR cloud.

Answer

Prisma Access Remote Networks Connector

Answer

Traps Management Service

Answer

Panorama Management Server

Question 10

An administrator is planning the deployment of Cortex XDR agents across endpoints and needs to configure Agent Settings profiles. Which TWO configurations can be managed directly within an Agent Settings profile? (Choose two)

Accepted Answer

Agent operational mode (e.g., Normal, Extended, or Disabled). Option A is correct because an Agent Settings profile in Cortex XDR directly controls the agent's operational mode, allowing the administrator to set it to Normal, Extended, or Disabled per endpoint group. Option C is correct because the same profile manages scheduled malware scan settings and scan exclusions, which are agent-side configurations pushed to endpoints. Option B is incorrect because PAN-OS firewall security rule policies are managed on the firewall itself (or via Panorama/Strata Cloud Manager), not inside a Cortex XDR Agent Settings profile. Option D is incorrect because WildFire threat signature updates are delivered through the WildFire/cloud content update mechanism, not configured as a per-profile agent setting. Option E is incorrect because Cortex XSOAR playbook automation triggers belong to XSOAR orchestration and are not part of Cortex XDR agent settings.

Answer

PAN-OS firewall security rule policies

Answer

Global WildFire threat signature updates

Answer

Cortex XSOAR playbook automation triggers

Question 11

An administrator needs to ingest CEF (Common Event Format) logs from a third-party security device using the Broker VM. Which collector type must be enabled on the Broker VM configuration page in Cortex XDR?

Accepted Answer

Generic Syslog / CEF Collector. The Generic Syslog / CEF Collector is designed to ingest syslog messages in CEF format from third-party devices. Enabling this collector type on the Broker VM allows it to parse CEF logs and forward them to Cortex XDR. Other collector types are specific to cloud services or protocols and do not support generic CEF ingestion.

Answer

AWS CloudTrail App Collector

Answer

Office 365 Management Activity Collector

Answer

Active Directory WMI Collector

Question 12

An engineer is writing an XQL query to investigate endpoint activity. Which TWO commands are valid XQL query operators used for data manipulation and shaping? (Choose two)

Accepted Answer

filter. The XQL (Cortex XQL) query language uses pipeline-style operators such as filter and stats to manipulate and shape event data. Option A, filter, is correct because it is a valid XQL stage that restricts results to records matching a Boolean expression (e.g., filter event_type = "PROCESS"), acting as the primary data-selection operator. Option E, stats, is correct because it is a valid XQL stage that performs aggregations such as count(), sum(), avg(), min(), and max(), optionally grouped by fields, to shape raw events into summarized results. Options B, C, and D are not XQL operators: SELECT * FROM is SQL query syntax, DROP TABLE is a SQL DDL statement for deleting a table, and INSERT INTO is a SQL DML statement for adding rows, none of which are part of XQL's pipeline-based data manipulation syntax.

Answer

SELECT * FROM

Answer

DROP TABLE

Answer

INSERT INTO

Question 13

An administrator is troubleshooting an issue where Cortex XDR Broker VM cannot forward logs from a syslog source. Which CLI command on the Broker VM can the administrator use to verify active syslog listening ports and network connectivity status?

Accepted Answer

netstat -tulnp. The netstat command is used across Linux environments (including the Broker VM OS) to verify listening ports and active network connections.

Answer

pan_broker_status --syslog

Answer

traceroute -syslog

Answer

systemctl check-syslog

Question 14

An organization wants to ingest custom syslog data from a third-party firewall into Cortex XDR and build detection rules around it. Which feature enables parsing and structuring this unformatted log data so it can be queried effectively using XQL?

Accepted Answer

Custom Parsing Rules. Custom Parsing Rules in Cortex XDR allow you to define how unformatted or semi-structured log data (such as third-party syslog) is parsed into structured fields that XQL can query. Once the parser extracts fields like source IP, action, or username, detection rules and XQL queries can reference them directly.

Answer

Data Stitching Rules

Answer

BIOC Exception Filters

Answer

BIOC Correlation Policies

Question 15

An administrator is planning an upgrade cycle for Cortex XDR agents. Which TWO best practices should be followed to ensure a smooth upgrade process across the enterprise? (Choose two)

Accepted Answer

Schedule agent upgrades during planned maintenance windows to minimize potential user disruption. Option A is correct because scheduling agent upgrades during planned maintenance windows minimizes disruption to end users and avoids interrupting business-critical workloads while the Cortex XDR agent is updated and potentially restarted. Option E is correct because deploying new agent versions to a pilot/test group first allows the administrator to validate compatibility, performance, and functionality on a limited set of endpoints before committing to a broad enterprise rollout, which is a standard phased-deployment best practice. The remaining options are not appropriate: B is wrong because Cortex XDR agents are installed from vendor-provided packages, not compiled from source code on each endpoint via SSH; C is wrong because forcing immediate reboots on production servers during peak hours causes outages and violates change-management best practices; and D is wrong because deleting historical security logs destroys audit and forensic data and is not a prerequisite for upgrading agents.

Answer

Manually log into every single endpoint via SSH to compile the source code

Answer

Force an immediate forced reboot on all production servers during peak business hours

Answer

Delete all historical security logs from the cloud tenant prior to upgrading