XDR-Engineer Practice Test 15 — 15 Questions

Question 1

An administrator is planning firewall rules for endpoints with Cortex XDR agents installed in an environment with strict outbound filtering. Which destination port and protocol must be allowed outbound to the Cortex XDR management tenant for agent telemetry and command-and-control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TCP port 443. Cortex XDR agents communicate with the management tenant exclusively over outbound TCP 443 (HTTPS/TLS). This single port carries telemetry upload, policy retrieval, and command-and-control traffic, so it is the only destination port that must be allowed for agent-cloud communication.

Answer

TCP ports 22, 80, and 443

Answer

UDP port 514 and TCP port 6514

Answer

TCP port 80 and 443

Question 2

An administrator notices that several macOS endpoints have incomplete Cortex XDR agent functionality because required operating system permissions were not granted during installation. Which component or setting must be configured to resolve this?

Accepted Answer

Deploy an Apple MDM configuration profile containing System Extension and Full Disk Access payloads.. macOS endpoints require specific System Extensions and Full Disk Access permissions to be granted, which are typically pre-configured and deployed via Mobile Device Management (MDM) configuration profiles.

Answer

Run the agent installer with sudo privileges twice consecutively.

Answer

Disable Apple SIP (System Integrity Protection) globally on all endpoints.

Answer

Modify the macOS sudoers file to include the Cortex XDR process path.

Question 3

An administrator is setting up Cloud Data Collectors in Cortex XDR to ingest logs from Microsoft Entra ID (Azure AD). Which TWO prerequisites must be verified during troubleshooting if ingestion fails? (Choose two)

Accepted Answer

Ensure the corresponding API permissions and administrative consent are granted in the cloud provider portal.. Option A is correct because ingesting Microsoft Entra ID (Azure AD) logs through a Cloud Data Collector requires an app registration in the cloud provider portal with the appropriate API permissions (for example, Microsoft Graph/Office 365 Management APIs) and tenant-wide admin consent granted, otherwise the collector cannot authenticate and pull audit/sign-in logs. Option E is correct because the Cloud Data Collector must be able to reach the cloud API endpoint (for example, graph.microsoft.com and the Office 365 Management API endpoints over TCP 443); if outbound network access, proxy, or firewall rules block these endpoints, ingestion fails even with correct permissions. Option B is wrong because Cortex XDR Agents are endpoint agents for Windows/macOS/Linux hosts, not something installed on Microsoft Entra ID tenant servers, and Entra ID is a cloud service. Option C is wrong because AD DS LDAP port 389 is irrelevant to cloud-to-cloud Entra ID log ingestion via a Cloud Data Collector. Option D is wrong because a local Broker VM with a syslog listener is used for on-premises/syslog-based log collection, not for API-based Microsoft Entra ID ingestion through a Cloud Data Collector.

Answer

Install the Cortex XDR Agent on the Microsoft Entra ID cloud tenant servers.

Answer

Verify that Active Directory Domain Services (AD DS) LDAP port 389 is open to all endpoints.

Answer

Ensure a local Broker VM is configured with a syslog listener port for Azure AD logs.

Question 4

An administrator notices that Cortex XDR content updates are failing to apply to endpoints in a secured network segment. Which TWO potential causes should the administrator investigate? (Choose two)

Accepted Answer

Firewall rules blocking outbound HTTPS traffic to Content CDN distribution domains.. Option B is correct because Cortex XDR agents retrieve content updates from Palo Alto Networks Content CDN distribution domains over outbound HTTPS (TCP 443), so firewall rules blocking that traffic will prevent updates from being applied to endpoints in the secured segment. Option D is correct because in environments where endpoints reach the internet through a proxy, the agent must authenticate to the proxy to download content packages; proxy authentication failures therefore directly cause content update failures. Option A is not correct because Broker VM database corruption affects Broker VM functions such as local agent communication and content caching, not the fundamental CDN download path described here. Option C is not correct because insufficient space in the /boot partition does not block Cortex XDR content downloads; content is stored in the agent's content directories, not /boot. Option E is not correct because resolving Active Directory domain controllers is unrelated to downloading Cortex XDR content updates from the Content CDN.

Answer

Broker VM database corruption.

Answer

Lack of available disk space in the /boot partition of the endpoint.

Answer

Failure of the local endpoint DNS server to resolve Active Directory domain controllers.

Question 5

When planning agent deployment strategies across different operating systems, which TWO package formats are utilized for macOS and Linux endpoints respectively? (Choose two)

Accepted Answer

PKG format for macOS endpoints. Option B is correct because macOS natively uses the PKG (flat package) format for software installation and deployment, making it the standard package type for macOS endpoints in agent deployment strategies. Option E is correct because Linux distributions rely on native package managers, where RPM (Red Hat/CentOS/Fedora) and DEB (Debian/Ubuntu) are the two dominant package formats for installing agents on Linux endpoints. Option A is incorrect because MSI is a Windows Installer format, not used on Linux. Option C is incorrect because EXE is a Windows executable format and is not the native deployment package for macOS. Option D is incorrect because DMG is a macOS disk image format, not applicable to headless Linux servers, which use RPM or DEB packages instead.

Answer

MSI format for Linux endpoints

Answer

EXE format for macOS endpoints

Answer

DMG format for headless Linux servers

Question 6

An administrator is designing a scheduled report distribution list in Cortex XDR. Which TWO formats can be selected when generating and exporting scheduled reports? (Choose two)

Accepted Answer

CSV. In Cortex XDR, scheduled reports can be generated and exported in CSV (option C) and PDF (option D) formats. CSV is correct because it provides machine-readable, comma-separated tabular data suitable for further analysis in spreadsheets or SIEM ingestion, and it is one of the standard export formats offered for scheduled reports. PDF is correct because it is the standard human-readable, formatted report output that preserves the report's layout, charts, and tables for distribution to stakeholders. Options A, B, and E are not valid report export formats in Cortex XDR: PowerPoint (.pptx), Windows Executable (.exe), and Virtual Machine Disk (.vmdk) are unrelated to scheduled report generation and cannot be selected.

Answer

PowerPoint Presentation (.pptx)

Answer

Windows Executable (.exe)

Answer

Virtual Machine Disk (.vmdk)

Question 7

Which TWO actions can an administrator perform from the Endpoint Management view in the Cortex XDR management console? (Choose two)

Accepted Answer

Isolate an endpoint from the network during an incident.. Option B is correct because the Endpoint Management view in Cortex XDR lets an administrator select an endpoint and run the Isolate action, which cuts the endpoint off from the network (except for the Cortex XDR communication channel) during incident response. Option D is correct because the same view provides endpoint actions such as initiating a manual malware scan on one or more selected endpoints to detect threats on demand. Option A is not part of Cortex XDR endpoint actions, since perimeter gateway firewall policies are configured on Palo Alto Networks next-generation firewalls (or Panorama), not from the Endpoint Management view. Option C is also incorrect because firewall traffic filters are created and deployed through firewall management tools, not through Cortex XDR's endpoint management. Option E is incorrect because DNS server IP address assignments are handled by DHCP/DNS or endpoint network configuration, not by Cortex XDR's Endpoint Management view.

Answer

Configure firewall security policies for perimeter gateways.

Answer

Create and deploy Palo Alto Networks firewall traffic filters.

Answer

Manage DNS server IP address assignments.

Question 8

Which TWO settings can be configured within a Malware Protection profile in Cortex XDR? (Choose two)

Accepted Answer

File, folder, and hash exclusion lists. Option C is correct because a Malware Protection profile in Cortex XDR includes exclusion configuration, allowing administrators to define file, folder, and hash exclusions so that trusted or performance-sensitive items are not scanned or blocked by the malware engine. Option D is correct because the Malware Protection profile lets you set the action taken for Potentially Unwanted Applications (PUA), choosing whether detected PUA is blocked or merely alerted. Option A is incorrect because the anti-tampering password for agent uninstallation is configured in the agent settings or endpoint policy, not inside the Malware Protection profile. Option B is incorrect because Broker VM proxy port forwarding schedules are configured in the Broker VM or network/proxy settings, not in a Malware Protection profile. Option E is incorrect because browser-based exploit mitigation rules are part of exploit protection or the Exploit Protection profile, not the Malware Protection profile.

Answer

Anti-tampering password for agent uninstallation

Answer

Broker VM proxy port forwarding schedules

Answer

Browser-based exploit mitigation rules

Question 9

An administrator is troubleshooting an issue where Cortex XDR cannot forward alerts to a third-party SIEM via HTTPS Syslog. Which test tool can be executed from the Broker VM to verify network reachability and TLS handshake success against the remote SIEM listener?

Accepted Answer

openssl s_client -connect :. The `openssl s_client -connect :` command is the correct tool because it initiates a full TLS handshake with the remote SIEM listener, verifying both network reachability (TCP connection) and TLS negotiation success. This directly addresses the administrator's need to confirm that the Broker VM can establish a secure channel to the SIEM over HTTPS Syslog. Unlike basic connectivity tests, it validates certificate exchange, protocol version, and cipher suite compatibility, which are critical for HTTPS-based syslog forwarding.

Answer

syslog-test --handshake

Answer

telnet <siem_ip> 443 --secure

Answer

ping -tls <siem_ip>

Question 10

An administrator has configured a new AWS CloudTrail integration via Broker VM to ingest cloud logs into Cortex XDR. However, no logs are appearing in the XDR database. Upon reviewing the Broker VM logs, the administrator notices an 'AccessDenied' error from AWS. What is the most likely root cause?

Accepted Answer

The IAM role or user credentials provided to the Broker VM lack permissions to read from the S3 bucket. AWS CloudTrail ingestion requires an IAM role with sufficient permissions to access the designated S3 bucket containing the logs.

Answer

The Cortex XDR agent license has expired for cloud log ingestion

Answer

The AWS region ID is misspelled in the local hosts configuration file

Answer

The Broker VM has insufficient RAM allocated to run the S3 polling daemon

Question 11

An analyst is troubleshooting a complex multi-stage attack in Cortex XDR. Which THREE analytical tools or views in the console help reconstruct the sequence of events across endpoints? (Choose three)

Accepted Answer

Causality View graph. Causality View graph is correct because it visually links related alerts, processes, and network activity into a causal chain, letting the analyst trace how one stage of the multi-stage attack triggered the next across endpoints. Incident Timeline view is correct because it presents chronologically ordered events and alerts for an incident, which is essential for reconstructing the exact sequence of attacker actions over time. XQL Search query interface is correct because it allows the analyst to write precise queries against endpoint telemetry (e.g., process, file, network, and registry events) to correlate activity across multiple hosts and fill gaps in the timeline. The unmarked options do not belong: Agent deployment package downloader is only for installing the agent, and Global agent proxy configuration menu is only for configuring agent proxy settings, neither of which provides analytical reconstruction of attack events.

Answer

Agent deployment package downloader

Answer

Global agent proxy configuration menu

Question 12

A Cortex XDR administrator is planning to deploy agents to a large number of endpoints across multiple geographic locations. To optimize bandwidth and reduce latency for agent communication, the administrator decides to deploy Broker VMs. Which component of the Cortex XDR architecture is responsible for forwarding endpoint data to the Cortex XDR cloud when a Broker VM is used?

Accepted Answer

The Broker VM acts as a proxy, aggregating and forwarding endpoint data to the Cortex XDR cloud.. The Broker VM functions as a proxy, aggregating endpoint traffic and forwarding it to the Cortex XDR cloud. This reduces direct internet connections from endpoints, optimizes bandwidth usage, and can improve latency by localizing communication. The other options incorrectly describe the agent-cloud relationship or the Broker VM's role.

Answer

The Cortex XDR management console directly polls each endpoint for data, eliminating the need for a Broker VM.

Answer

The Broker VM stores all endpoint data locally and only sends summary reports to the cloud.

Answer

The Cortex XDR agent establishes a direct connection to the Cortex XDR cloud, bypassing the Broker VM.

Question 13

An XDR engineer is configuring a Cortex XDR data forwarding rule to send only endpoint alert data to a third-party SIEM. The SIEM requires that the forwarded payload include the raw event fields and be delivered in JSON format. Which data forwarding destination type should the engineer select?

Accepted Answer

HTTP. HTTP forwarding is the correct choice because it delivers structured JSON payloads over HTTPS and can include raw event fields, which is exactly what the third-party SIEM requires. Syslog, Email, and SMB do not provide JSON-formatted data with raw event fields in a manner suitable for direct SIEM ingestion.

Answer

SMB

Answer

Email

Answer

Syslog

Question 14

A Cortex XDR administrator is investigating an incident and needs to confirm whether a specific endpoint has an active agent that is reporting to the console. The administrator has the endpoint's hostname. Which Cortex XDR console area should be used to quickly locate the endpoint and view its agent status?

Accepted Answer

The Endpoints page under the Inventory section. The Endpoints page under Inventory is the central place to search for a managed endpoint by hostname and view its agent status, including last seen time and operational state. Other console areas focus on incidents, policy configuration, or audit events, none of which directly provide endpoint agent connectivity status.

Answer

The Incidents page under the Detection section

Answer

The Policy Management page under the Configuration section

Answer

The Audit Log page under the Settings section

Question 15

An administrator is configuring a Cortex XDR agent settings profile to minimize the impact on a high-performance computing (HPC) cluster while maintaining essential security monitoring. Which TWO configuration changes should the administrator make to reduce agent resource consumption? (Choose two.)

Accepted Answer

Increase the scan interval for scheduled malware scans.. Increasing the scheduled scan interval and excluding non-critical directories from real-time scanning both reduce agent resource consumption while preserving essential protections. Disabling Behavioral Threat Protection or setting Report Only mode would weaken security, and reducing the heartbeat interval would increase network overhead.

Answer

Disable the Behavioral Threat Protection module.

Answer

Set the agent to 'Report Only' mode for all modules.

Answer

Reduce the heartbeat interval to 5 minutes.