XDR-Engineer Practice Test 16 — 15 Questions

Question 1

A Cortex XDR administrator is planning to deploy agents to a large number of endpoints using a third-party software distribution tool. The administrator needs to obtain the agent installation package that includes the tenant-specific configuration. Where should the administrator download this package?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

From the Cortex XDR management console under Settings > Agent Installation.. The agent installation package with tenant configuration is available in the Cortex XDR management console under Settings > Agent Installation. This package includes the necessary tenant ID and settings to ensure agents register correctly. Using this package simplifies mass deployment via third-party tools, as no additional configuration is needed.

Answer

From the Cortex XDR agent installation directory on an existing endpoint.

Answer

From the Cortex XDR API using the /public_api/v1/agent_installers endpoint.

Answer

From the Palo Alto Networks Customer Support Portal under Software Downloads.

Question 2

An administrator is setting up a Cortex XDR Broker VM to collect logs from a remote site. The Broker VM must be able to receive logs from syslog sources and forward them to the Cortex XDR management console. Which Broker VM component is responsible for receiving syslog traffic?

Accepted Answer

Syslog Collector. The Syslog Collector is the Broker VM component that listens for and receives syslog traffic from remote sources, then forwards it to the Cortex XDR console. Network Mapper, Data Forwarder, and Log Stash do not perform this function, making Syslog Collector the correct choice for collecting syslog logs at a remote site.

Answer

Network Mapper

Answer

Data Forwarder

Answer

Log Stash

Question 3

An administrator needs to temporarily disable the Cortex XDR agent protection on an endpoint to perform maintenance. What is required to perform this action locally using cytool?

Accepted Answer

An anti-tamper password generated in the Cortex XDR management console.. Disabling agent protection locally via cytool requires entering a valid anti-tampering password or uninstall password generated in the console.

Answer

A domain administrator Kerberos ticket.

Answer

An internet connection to the Palo Alto Networks licensing server.

Answer

Physical access to the BIOS/UEFI settings.

Question 4

Which THREE parameters or settings can be managed within a Data Collection profile in Cortex XDR? (Choose three)

Accepted Answer

Collection of process execution and file creation telemetry. In Cortex XDR, a Data Collection profile governs which endpoint telemetry the agent gathers and forwards, so option B is correct because process execution and file creation events are core telemetry categories that can be toggled per profile. Option C is correct because network connection and DNS activity are also telemetry types controlled by the Data Collection profile, enabling or disabling their collection. Option E is correct because script execution logging for PowerShell and bash is a configurable telemetry setting within the profile. Option A is not part of a Data Collection profile, since local firewall blocking rules for network isolation are configured through isolation or firewall policy settings, not telemetry collection. Option D is also unrelated, as the anti-tampering administrator password is an agent security setting managed in the agent configuration, not in the Data Collection profile.

Answer

Defining local firewall blocking rules for network isolation

Answer

Setting the anti-tampering administrator password for agent removal

Question 5

A Cortex XDR administrator is troubleshooting an agent on a Windows endpoint that is not enforcing malware prevention. The agent status shows as connected, and the malware prevention module is enabled in the agent settings profile. Which action should the administrator take next to diagnose why malware prevention is not blocking threats?

Accepted Answer

Check the agent's local log files for errors related to the malware prevention module.. The most effective next step is to examine the agent's local logs for errors related to the malware prevention module. Logs can reveal signature update failures, licensing problems, or conflicts that explain why enforcement is not occurring. Reinstalling, checking Defender, or toggling the module are either disruptive or not directly diagnostic.

Answer

Verify that the endpoint has the latest Windows Defender definitions.

Answer

Reinstall the Cortex XDR agent on the endpoint.

Answer

Disable and re-enable the malware prevention module in the profile.

Question 6

An administrator needs to deploy the Cortex XDR agent to endpoints using an existing Active Directory Group Policy Object (GPO). Which package format should the administrator download from the Cortex XDR management console?

Accepted Answer

MSI. The MSI package format is required for deployment via Active Directory Group Policy Objects (GPO) or other enterprise software distribution tools that natively support Windows Installer packages.

Answer

EXE

Answer

PKG

Answer

TGZ

Question 7

An administrator wants to ensure that all critical severity alerts generated in Cortex XDR are immediately brought to the attention of the SOC by triggering an audible notification and high-priority banner in the console. Where are console notification preferences managed?

Accepted Answer

User Profile / Notifications settings in the Cortex XDR console. Console alert notifications, preferences, and display settings are managed within user profile settings or notification configurations in the Cortex XDR console.

Answer

Agent Profile -> Malware Settings

Answer

Data Export Service configuration

Answer

Host Insights -> Scan Schedules

Question 8

An administrator wants to create a custom BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR to detect unexpected execution of PowerShell scripts downloading files from the internet. Which tool within the Cortex XDR management console should the administrator use to write and test this logic?

Accepted Answer

BIOC Rule Builder under Analytics. Cortex XDR provides the BIOC rule builder under the Analytics section to write custom behavioral rules based on OS query or endpoint events.

Answer

Host Insights Query Builder

Answer

Cortex XSOAR Playbook Designer

Answer

IOC Management under Malware Protection

Question 9

An administrator needs to deploy Cortex XDR agents to a network segment where endpoints do not have direct internet access to the Cortex XDR cloud. Which component should be deployed to act as a proxy and forward agent traffic?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM is the component deployed in network segments without direct internet access to act as a proxy, forwarding agent traffic to the Cortex XDR cloud. It brokers communication between endpoints and the cloud, and can also host local services like the WildFire local analysis and syslog collection. This makes it the correct choice for proxying agent traffic in restricted segments.

Answer

GlobalProtect Gateway

Answer

WildFire Appliance

Answer

Palo Alto Networks Panorama Server

Question 10

An administrator is preparing to deploy the Cortex XDR agent to a large group of Windows endpoints. To ensure the agent can be installed silently without interactive prompts and to control the installation path, which method should the administrator use?

Accepted Answer

Run the MSI installer with the /quiet and INSTALLDIR parameters via msiexec.. The Cortex XDR agent for Windows is installed via an MSI package. To perform a silent installation and specify a custom installation directory, the administrator must use msiexec with the /quiet and INSTALLDIR parameters. This approach allows for automated deployment through software distribution tools, ensuring no user interaction and consistent configuration across endpoints.

Answer

Use the XDR CLI tool with the --silent flag after copying the agent executable to the endpoint.

Answer

Deploy the agent using Group Policy by assigning the MSI package to computers.

Answer

Extract the agent files and run the setup.exe with the /s switch.

Question 11

An administrator is reviewing XQL search performance issues and query timeouts when investigating historical logs. Which THREE methods can the administrator use to optimize query performance? (Choose three)

Accepted Answer

Apply explicit dataset filters and equality checks early in the query pipeline before performing complex aggregations.. Option A is correct because applying explicit dataset filters and equality checks early in the XQL pipeline reduces the volume of events that must be processed by later stages, so expensive aggregations run against a much smaller, already-narrowed result set. Option C is correct because XQL performance is heavily time-bound; restricting the query to the smallest necessary time window limits how many indexed partitions and raw log records the engine must scan, directly reducing query time and timeout risk. Option E is correct because filtering on specific indexed fields lets the query engine use its indexes for fast lookups, whereas broad wildcard searches across all text attributes force full-text scans that are far slower and more resource-intensive. Option B is not appropriate because exporting raw logs to a spreadsheet does not optimize XQL query performance and is impractical for large historical datasets. Option D is not correct because increasing Broker VM CPU does not accelerate the cloud XQL execution engines, which run in the cloud rather than on the local Broker VM.

Answer

Export all raw logs to a local spreadsheet application for filtering.

Answer

Increase the Broker VM CPU allocation to accelerate cloud XQL execution engines.

Question 12

An analyst is reviewing an incident where a suspicious process spawned a child process. The analyst wants to check if any other endpoint in the enterprise has ever executed this exact child process image file name combined with a specific command-line argument. Which search method is most efficient?

Accepted Answer

Execute an XQL query across xdr_data filtering for the specific process name and command line.. Using XQL to search across the entire `xdr_data` dataset for the specific process name and command line provides immediate enterprise-wide visibility.

Answer

Reboot all endpoints into Safe Mode.

Answer

Manually check the Agent Management list for each host individually.

Answer

Review the weekly PDF Scheduled Report.

Question 13

An organization experiences repeated false positive alerts from a specific legitimate administrative script that matches a built-in Cortex XDR behavioral Analytics detection. How should the administrator handle this built-in detection alert to prevent future false positives without disabling protection entirely?

Accepted Answer

Create an exception / exclusion rule for the analytic alert specifying the legitimate file hash or path.. Built-in behavioral analytics alerts can be tuned or suppressed by creating specific alert exclusions or exceptions based on file hashes, digital signatures, or specific execution parameters.

Answer

Delete the underlying OS telemetry dataset using an XQL drop command.

Answer

Uninstall the Cortex XDR agent from the administrative server.

Answer

Disable the entire Analytics module globally across the tenant.

Question 14

An administrator needs to quickly identify which Cortex XDR agent version is installed on a specific Windows endpoint that is experiencing performance issues. The administrator has access to the Cortex XDR management console. Where can this information be found?

Accepted Answer

In the Endpoints page, search for the endpoint and view its details, which include the agent version.. The Cortex XDR management console's Endpoints page provides a comprehensive inventory of all managed endpoints, including the agent version. By searching for the specific endpoint, the administrator can quickly view its details, such as agent version, OS, and status. This is the intended and most efficient method for checking agent versions across the environment.

Answer

In the Agent Installations page under Settings, download the agent installer and check its version.

Answer

In the Audit Logs, search for the endpoint name and find the agent version in the log entries.

Answer

In the Incidents page, filter by the endpoint name and look for agent version in the incident details.

Question 15

An engineer is tuning a custom BIOC rule that triggers on suspicious command-line patterns. During a red-team exercise the rule failed to fire even though the malicious command was executed. Review shows the rule matched on a process image name that the attacker replaced with a renamed copy of the same binary. Which adjustment best restores detection while limiting false positives?

Accepted Answer

Rewrite the rule to match on the command-line arguments and parent process behavior instead of the executable image name.. Detection that depends on a specific executable name breaks when an attacker renames the binary, because the image name changes while behavior does not. Re-anchoring the rule on command-line arguments and parent process behavior restores coverage across renames and keeps the condition specific. Hash indicators, severity tuning, and monitor-only mode do not address the underlying matching weakness.

Answer

Enable the rule in monitor-only mode so the renamed binary is logged without generating an alert.

Answer

Lower the rule's severity threshold so that weaker matches still generate an alert.

Answer

Add the original binary's hash to a custom IOC feed and alert on any hash match across the environment.