XDR-Engineer Practice Test 17 — 15 Questions

Question 1

An administrator is troubleshooting an issue where custom Correlation Rules in Cortex XDR are not generating expected incidents. Which THREE diagnostic steps should the administrator perform? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check rule status to ensure the rule is enabled and assigned to the correct scope or endpoint group.. Troubleshooting correlation rules involves validating query logic, reviewing time windows, and checking matching criteria.

Answer

Restart all endpoint agents associated with the correlation rule.

Answer

Reboot the Broker VM log collector service.

Question 2

A Cortex XDR administrator is investigating an incident where a process attempted to access the LSASS process on a Windows server. The administrator wants to retrieve the raw event data for this activity to understand the full context, including the command line and parent process. Which Cortex XDR feature should the administrator use to obtain this detailed event information?

Accepted Answer

Causality Chain view for the alert, which displays the process tree and allows drilling down to raw event data.. The Causality Chain view is the correct feature to use. It provides a detailed process tree and allows the administrator to drill down into individual events to see raw data, including command line, parent process, and other metadata. This is essential for understanding the full context of an alert like LSASS access. Other options either provide summary information or are not designed for this purpose.

Answer

Incident details page, which shows the alert and associated artifacts.

Answer

Agent management console, which logs all process executions and can export raw events.

Answer

Query Builder, using the 'action_process_image_name' field and filtering by the hostname and time range.

Question 3

An administrator is setting up automated alert ingestion from a third-party SIEM into Cortex XSOAR. Which TWO integration methods or components are typically used to achieve this? (Choose two)

Accepted Answer

Webhook integrations that listen for incoming HTTP POST alerts pushed from the third-party system. Option B is correct because Cortex XSOAR supports webhook-based integrations where the third-party SIEM pushes alerts via HTTP POST to an XSOAR listener endpoint, enabling near real-time automated ingestion. Option E is correct because polling-based API integrations are also a standard method, where XSOAR queries the SIEM's alert queue or REST API on a scheduled interval to fetch new alerts. Together, webhook push and scheduled API polling are the two typical mechanisms for automated third-party alert ingestion. Options A, C, and D are incorrect because floppy disks, manual CSV export with printing, and parallel port cable bridging are obsolete or manual transport methods that do not provide automated, programmatic alert ingestion into Cortex XSOAR.

Answer

Direct physical floppy disk transport

Answer

Manual CSV export and physical printing

Answer

Local parallel port cable bridging

Question 4

An administrator is designing a Cortex XDR deployment for a network with strict egress filtering. The security team wants to ensure that agents can communicate with the Cortex XDR cloud and receive updates. Which outbound communication method should be allowed to meet this requirement with minimal open ports?

Accepted Answer

Allow outbound HTTPS (TCP 443) to the Cortex XDR cloud endpoints. Cortex XDR agents use HTTPS over TCP 443 to communicate with the Cortex XDR cloud. This single outbound port is sufficient for registration, policy updates, and content delivery, making it the optimal choice for environments with strict egress filtering.

Answer

Allow outbound TCP 8080 to the Cortex XDR cloud endpoints

Answer

Allow outbound UDP 53 to the Cortex XDR cloud endpoints

Answer

Allow outbound TCP 4443 to the Cortex XDR cloud endpoints

Question 5

An analyst wants to write an advanced XQL query that correlates network connection events with process execution events using a common join key (`causality_id`). Which XQL command operator is used to combine two datasets based on a matching field?

Accepted Answer

join. The XQL `join` operator combines two datasets based on a matching field, which is exactly what is needed to correlate network connection events with process execution events using `causality_id` as the join key. It supports inner, left, and right join semantics similar to SQL, allowing analysts to enrich one event stream with context from another. This is the standard XQL construct for cross-dataset correlation in Cortex XDR.

Answer

link

Answer

merge_streams

Answer

combine_tables

Question 6

Which TWO tasks can an automation playbook in Cortex XDR / XSOAR execute automatically upon detecting a confirmed threat? (Choose two)

Accepted Answer

Isolate compromised endpoints from the network. Option A is correct because Cortex XDR/XSOAR playbooks can invoke the endpoint isolation action, which cuts the compromised host off from the network (except for the management channel to Cortex XDR) to contain lateral movement and exfiltration. Option D is correct because playbooks can automatically run indicator enrichment tasks that query threat intelligence integrations such as VirusTotal to add reputation, detection ratios, and context to hashes, IPs, domains, or URLs. Options B and C are incorrect because RAM upgrades and vendor hardware orders are physical procurement/logistics activities outside the scope of a security automation playbook. Option E is also incorrect because repainting office walls is a facilities task with no relation to threat detection or response automation.

Answer

Automatically upgrade the physical RAM on compromised servers

Answer

Order replacement laptop hardware from vendors

Answer

Repaint the interior office walls of the SOC

Question 7

An administrator needs to ingest Office 365 audit logs into Cortex XDR. Which integration method is officially supported and recommended by Palo Alto Networks for this data source?

Accepted Answer

Office 365 Management Activity API integration. Office 365 logs are ingested using the Office 365 Management Activity API integration via Broker VM or cloud-to-cloud integration.

Answer

Local WMI polling from a Windows domain controller

Answer

SNMP trap listener configured on the endpoint agent

Answer

Syslog forwarding from Microsoft Outlook client applications

Question 8

An administrator is planning to deploy Cortex XDR agents on macOS endpoints and needs to ensure that the agents have the necessary permissions to monitor system activity. Which TWO actions must be performed on each macOS endpoint? (Choose two.)

Accepted Answer

Approve the system extension in Security & Privacy settings. On macOS, Cortex XDR requires Full Disk Access to monitor files and processes, and the system extension must be approved to enable network and endpoint monitoring. These two actions are essential for the agent to function properly and provide full protection.

Answer

Install the agent using the 'sudo' command

Answer

Disable System Integrity Protection (SIP)

Answer

Add the agent to the list of allowed kernel extensions

Question 9

A Cortex XDR administrator is investigating why a specific endpoint is not receiving updated policy settings from the management console. The endpoint shows as connected in the console, and the agent version is up to date. The administrator suspects a communication issue between the agent and the console. Which log should they review first to diagnose the problem?

Accepted Answer

The connectivity log (e.g., C:\ProgramData\PaloAltoNetworks\Cortex XDR\Logs\Connectivity.log).. When an endpoint is not receiving policy updates despite being connected, the connectivity log on the endpoint is the most direct source of information. It records the agent's communication with the management console, including any errors or failed requests. Reviewing this log first can quickly identify issues such as network blocks, authentication failures, or server unavailability.

Answer

The Windows Event Log under Applications and Services Logs > Cortex XDR.

Answer

The Broker VM's log on the management server.

Answer

The agent's operational log (e.g., C:\ProgramData\PaloAltoNetworks\Cortex XDR\Logs\Agent.log).

Question 10

A Cortex XDR administrator is creating an automation script that must run only when a specific indicator (e.g., a file hash) is found on more than 10 endpoints within the last hour. The script should then block the hash across all endpoints. Which Cortex XDR feature should be used to implement this logic?

Accepted Answer

Cortex XDR Automation with a scheduled playbook that queries the Cortex XDR API for hash prevalence and triggers a block action.. Cortex XDR Automation with a scheduled playbook is the correct feature because it can periodically query the API for hash prevalence, evaluate the condition (more than 10 endpoints in an hour), and then execute a block action. BIOC and Exception Rules do not support aggregate counting, and external SIEM correlation is not a native Cortex XDR feature. Thus, automation is the right choice for this conditional, time-based response.

Answer

Cortex XDR Data Forwarding to a SIEM with correlation rules that call back to Cortex XDR API.

Answer

Cortex XDR Exception Rules with a condition for hash prevalence.

Answer

Cortex XDR Behavioral Indicators (BIOC) with a custom rule that triggers on hash prevalence.

Question 11

A detection engineer needs a Cortex XDR alert that fires only when a process writes a suspicious registry Run key and, within the same causality chain, subsequently spawns a script interpreter. The engineer wants the correlation to consider parent-child lineage rather than two unrelated events sharing an endpoint. Which mechanism should be used to express this lineage-aware condition?

Accepted Answer

A Causality Analysis Engine rule that defines the registry write and interpreter spawn as related stages within one process tree.. Lineage-aware correlation in Cortex XDR is expressed through the Causality Analysis Engine, which models process ancestry and event ordering inside a chain. Defining the registry write and interpreter spawn as related stages confines the match to a single process tree. Endpoint-scoped joins, IOC feeds, and count thresholds lack ancestry awareness and cannot enforce the same-chain constraint.

Answer

A scheduled XQL query that joins registry and process events on the endpoint name and runs every five minutes.

Answer

A custom IOC feed containing the registry path and interpreter hash, applied with an AND condition across the environment.

Answer

A BIOC rule scoped to the endpoint that counts both event types and alerts when the combined count exceeds two.

Question 12

An analyst wants to view the complete Attack Story (causality chain) of an incident to understand how an initial phishing email led to credential dumping. Where in the Cortex XDR console should the analyst navigate?

Accepted Answer

Incident Details -> Causality View. The Causality View is the dedicated visualization in Cortex XDR that reconstructs the full attack story by chaining together related alerts, processes, and network events into a single causality chain. It is accessed by opening the specific incident and navigating to the Incident Details page, where the Causality View tab displays the root cause (e.g., a phishing email) through to the final malicious action (e.g., credential dumping). This view is purpose-built for exactly this kind of end-to-end forensic narrative.

Answer

Host Insights -> System Explorer

Answer

Reporting -> Scheduled Reports -> Attack Chain

Answer

Settings -> Configurations -> Causality

Question 13

Which role is required within Cortex XDR for a user to configure API keys, data integration settings, and automation playbooks?

Accepted Answer

Account Admin or Security Administrator role. Configuring API keys, data integration settings, and automation playbooks requires elevated administrative privileges in Cortex XDR. The Account Admin or Security Administrator role grants the necessary permissions to manage tenant-wide integrations and automation, whereas analyst and viewer roles are read-only or investigation-focused.

Answer

Endpoint Viewer role

Answer

Standard User role

Answer

SOC Analyst Tier 1 role

Question 14

An automation playbook in Cortex XSOAR needs to execute a custom Python script that interacts with an internal legacy database not covered by existing Marketplace integrations. Which component should the administrator use to securely run this custom script?

Accepted Answer

A custom Python Integration running inside an isolated Docker container managed by the engine/server. Custom scripts and integrations in Cortex XSOAR execute within a Docker container environment managed by integration containers or custom Python scripts.

Answer

A local Windows batch script executed by the Cortex XDR endpoint agent

Answer

Direct execution via SSH on the Cortex XDR multi-tenant cloud backend

Answer

A direct SQL query string passed unencrypted through the Syslog collector port

Question 15

An administrator needs to verify whether Cortex XDR Agents are successfully receiving policy updates from the Cortex XDR management console. Where should the administrator check in the management console?

Accepted Answer

Go to Endpoints > All Endpoints and check the Last Connected and Content Version columns.. The Status column and Agent Details view under Endpoints provide real-time connection status and policy sync timestamps.

Answer

Go to Incident Response > Investigations.

Answer

Go to Dashboards > Agent Health widget.

Answer

Go to Settings > Configurations > Agent Management.