XDR-Engineer Practice Test 18 — 15 Questions

Question 1

An engineer needs to write an XQL query to search for all events where a process named "cmd.exe" spawned a process named "powershell.exe". Which XQL dataset and query structure should be used?

Accepted Answer

dataset = xdr_data | filter event_type = ENUM_PROCESS_START and actor_process_image_name ends with "cmd.exe" and action_process_image_name ends with "powershell.exe". It uses the proper XQL dataset (xdr_data) and the correct field names for process lineage in Cortex XDR: actor_process_image_name identifies the parent (spawning) process, and action_process_image_name identifies the child (spawned) process. The event_type filter ENUM_PROCESS_START ensures only process creation events are considered, and using ends with "cmd.exe" and ends with "powershell.exe" correctly matches full paths like C:\Windows\System32\cmd.exe. This structure directly mirrors the XDR data model for process execution events.

Answer

dataset = xdr_data | filter event_type = ENUM_PROCESS_START and actor_process_image_name = "cmd.exe" and cited_process_image_name = "powershell.exe"

Answer

dataset = xdr_alerts | filter alert_name = "cmd.exe spawned powershell"

Answer

dataset = panw_threat_intel | filter process_name = "cmd.exe" and child_process = "powershell.exe"

Question 2

An administrator wants to ensure high availability and load balancing for log collection using Cortex XDR Broker VMs. Which TWO architectural best practices should be implemented? (Choose two)

Accepted Answer

Configure syslog sources to point to a network load balancer that distributes traffic across multiple Broker VM instances.. Option B is correct because placing a network load balancer in front of multiple Broker VMs lets syslog sources send to one virtual IP while the load balancer distributes connections across the Broker VM instances, providing both load balancing and failover if one VM becomes unavailable. Option E is correct because deploying multiple Broker VMs horizontally scales log forwarding capacity, so large numbers of endpoints and syslog sources are spread across several appliances rather than overloading a single VM. Options A and D are incorrect because Cortex XDR Broker VMs do not support Windows Failover Clustering or VRRP-based active-passive clustering inside the appliance; high availability is achieved through external load balancing and multiple broker instances, not OS-level clustering. Option C is incorrect because funneling all syslog traffic through one Broker VM creates a single point of failure and a bottleneck, which is the opposite of the high availability and load balancing goal.

Answer

Cluster Broker VMs into a single IP address using Windows Failover Clustering.

Answer

Route all syslog traffic through a single Broker VM to prevent packet loss.

Answer

Configure active-passive clustering using VRRP directly inside the Broker VM appliance settings.

Question 3

An administrator needs to onboard a new log source into Cortex XDR. The source is a Linux server that writes application logs to a local file. The administrator wants the logs parsed into Cortex XDR fields without installing a full endpoint agent. Which ingestion method is most appropriate?

Accepted Answer

Use the Broker VM File Collector to read and forward the log file. The Broker VM File Collector is the correct ingestion method for reading local application log files and forwarding them to Cortex XDR for parsing, without requiring a full endpoint agent. The Cortex XDR agent is not a generic file forwarder, the Syslog Collector expects syslog messages, and IOC feeds handle threat indicators rather than raw logs.

Answer

Create an IOC feed that points to the log file's directory

Answer

Configure the Cortex XDR agent to forward the log file

Answer

Enable the Syslog Collector and configure the application to write to syslog

Question 4

A Cortex XDR engineer needs to reduce alert fatigue caused by a noisy built-in Analytics BIOC. Rather than disabling the rule entirely, the security team wants to keep the detection but suppress matching alerts whenever the triggering process is a known signed internal IT automation binary. Which action should the engineer configure in Cortex XDR?

Accepted Answer

Create an exception (allow list) rule scoped to the BIOC that matches the automation binary's hash or signer, applied at the endpoint policy level.. Exceptions (allow list rules) are the mechanism Cortex XDR provides to suppress specific known-good activity from triggering a BIOC while keeping the detection active for everything else. Scoping by hash, signer, or process path to the trusted automation binary silences the recurring false positives without disabling the rule or blocking legitimate tooling.

Answer

Increase the BIOC's severity threshold so that only high-severity alerts are generated, then close the remaining alerts manually.

Answer

Disable the built-in Analytics BIOC entirely and rely on custom IOC feeds to catch the same behavior.

Answer

Add the automation binary to a malware hash block list so the process is terminated before the BIOC can fire.

Question 5

An administrator wants to prevent users from disabling the Cortex XDR agent on their Windows endpoints. Which agent setting should be configured to enforce this restriction?

Accepted Answer

Enable 'Agent Tamper Protection' in the agent settings profile.. Agent Tamper Protection is the specific setting designed to prevent users from disabling or tampering with the Cortex XDR agent. It enforces restrictions that block attempts to stop the agent service, modify its files, or uninstall it without proper authorization. Other options either limit UI access, protect only against uninstallation, or serve a different purpose entirely.

Answer

Configure 'Agent Uninstall Password' in the agent settings profile.

Answer

Enable 'Endpoint Isolation' for the endpoint group.

Answer

Set 'User Interface Access' to 'Read Only' in the agent settings profile.

Question 6

An enterprise has deployed Cortex XDR agents across Windows and Linux hosts. A security engineer notices that a specific custom BIOC rule is triggering successfully on Windows endpoints but fails to fire on Linux endpoints despite identical malicious commands being executed. What is the most likely cause?

Accepted Answer

The BIOC rule logic uses Windows-specific event fields and command structures that do not match Linux event telemetry schema.. BIOC rules contain operating system-specific syntax and event fields. A rule built exclusively for Windows event structures will not evaluate correctly against Linux OS telemetry.

Answer

The Linux agents must be rebooted into Diagnostic mode for BIOC evaluation.

Answer

Linux endpoints do not support custom BIOC rules in Cortex XDR.

Answer

Custom BIOCs require Cortex XSOAR to process Linux telemetry.

Question 7

An administrator is reviewing endpoint isolation troubleshooting steps. Which TWO behaviors occur on a Windows endpoint when it is isolated via Cortex XDR? (Choose two)

Accepted Answer

All network traffic is blocked except for communication with the Cortex XDR management console and designated exceptions.. Option C is correct because Cortex XDR network isolation works by blocking all inbound and outbound network traffic on the endpoint while still permitting the agent's communication with the Cortex XDR management console (and any configured isolation exceptions), so the endpoint remains reachable for management. Option E is correct because isolation is designed to contain a threat without losing control: the administrator can still manage the endpoint and execute remote response actions (such as live terminal, file retrieval, or additional response scripts) from the Cortex XDR console. Option A is incorrect because isolation does not disable the local agent's prevention modules; endpoint protection continues to run and enforce policy. Option B is incorrect because isolation does not power off or shut down the endpoint after any timeout. Option D is incorrect because isolation does not disable local user login or blank the physical screen; the user can still log in locally, only network connectivity is restricted.

Answer

All local agent prevention modules are automatically disabled.

Answer

The endpoint automatically shuts down after 10 minutes of isolation.

Answer

Local user login is completely disabled and the physical screen turns black.

Question 8

A Cortex XDR engineer is deploying the Broker VM in a high-security environment where outbound internet access is restricted. The Broker VM must be able to receive updates and communicate with the Cortex XDR cloud. Which configuration should the engineer implement to allow this communication?

Accepted Answer

Allow outbound access to the required Cortex XDR cloud FQDNs and IP addresses on the firewall.. The Broker VM initiates outbound connections to the Cortex XDR cloud for updates and management. In a restricted environment, the firewall must be configured to allow these outbound connections to the specific FQDNs and IP addresses used by Cortex XDR. This direct approach is recommended and avoids the complexity of proxy configurations.

Answer

Configure a forward proxy on the Broker VM to route traffic through an internal proxy server.

Answer

Set up a reverse proxy on the Broker VM to accept incoming connections from the Cortex XDR cloud.

Answer

Configure the Broker VM to use a custom update server and allow outbound access to it.

Question 9

An administrator needs to ensure that unauthorized USB storage devices are blocked from being used on corporate endpoints. Which Cortex XDR feature should be configured?

Accepted Answer

Device Control. Device Control rules in Cortex XDR allow administrators to restrict or block access to peripheral devices such as USB storage.

Answer

Endpoint Isolation

Answer

Disk Encryption Management

Answer

Behavioral Threat Protection

Question 10

Which THREE advanced troubleshooting steps can an administrator take when analyzing a malfunctioning Cortex XDR agent on a Linux endpoint? (Choose three)

Accepted Answer

Verify that required kernel headers or dependencies are installed and loaded properly.. Option B is correct because the Cortex XDR agent on Linux relies on kernel modules (e.g., the Traps/Cortex kernel driver) that require matching kernel headers and build dependencies to compile and load; verifying them with tools like `uname -r` and checking for `kernel-devel`/`kernel-headers` packages is a valid advanced troubleshooting step. Option C is correct because agent logs are written to designated directories such as /var/log/traps or /var/log/cortex, and inspecting these logs (e.g., via `tail -f` or `grep`) is essential for diagnosing agent malfunctions. Option E is correct because checking the agent's service status with `systemctl status cxdr` (or legacy daemon names like `traps` or `cytool`) confirms whether the service is running, failed, or disabled, which is a standard Linux troubleshooting action. Option A is not appropriate because reformatting the root filesystem and reinstalling the kernel is a destructive, last-resort OS recovery action, not an agent troubleshooting step. Option D is incorrect because Windows Registry keys do not exist on Linux endpoints and are irrelevant to a Linux Cortex XDR agent.

Answer

Reformat the Linux root filesystem and reinstall the operating system kernel.

Answer

Modify the Windows Registry keys for the Cortex XDR service.

Question 11

An analyst builds a custom dashboard widget in Cortex XDR that shows the count of alerts grouped by MITRE ATT&CK technique. The widget works, but the team also wants a second widget that shows the same alert counts split by the assigned alert owner so managers can track workload. The analyst wants to reuse the existing query with minimal changes. Which adjustment should the analyst make to the widget's XQL query?

Accepted Answer

Add a second field to the existing comp count() aggregation so the results are grouped by both technique and owner.. Grouping in XQL happens inside the aggregation stage, so adding the owner field to the same comp count() that already groups by technique yields counts per technique-and-owner pair. This reuses the existing query with a single-field edit, producing the workload view managers need without restructuring the pipeline.

Answer

Change the widget type from a table to a pie chart and rely on the visualization to separate results by owner.

Answer

Replace comp count() with a dedup stage on the technique field so each technique appears only once.

Answer

Wrap the existing query in a join statement that merges the alert table with itself on the technique field.

Question 12

An administrator is configuring a Cortex XDR integration with a third-party SIEM using the Cortex XDR API. The SIEM needs to retrieve alerts periodically. Which API endpoint and HTTP method should be used to fetch alerts?

Accepted Answer

POST /public_api/v1/alerts/get_alerts. The Cortex XDR API requires a POST request to /public_api/v1/alerts/get_alerts to retrieve alerts. This endpoint supports filtering and pagination, essential for a SIEM to periodically pull alerts efficiently. Authentication uses API key headers.

Answer

POST /public_api/v1/incidents/get_incidents

Answer

GET /public_api/v1/alerts/get_incidents

Answer

GET /public_api/v1/alerts/get_alerts

Question 13

An administrator needs to update the Cortex XDR Broker VM software version. What is the recommended and supported method to perform this upgrade?

Accepted Answer

Initiate the upgrade directly from the Cortex XDR management console under Settings > Configurations > Broker VM.. The recommended and supported method to upgrade the Cortex XDR Broker VM is through the Cortex XDR management console. Under Settings > Configurations > Broker VM, administrators can initiate the upgrade, which pushes the new version to the Broker VM. This ensures compatibility and proper validation by Palo Alto Networks.

Answer

Download the RPM package from Customer Support Portal and compile it manually via SSH.

Answer

Re-deploy a new Broker VM virtual appliance and delete the old one.

Answer

Run 'apt-get upgrade pan-broker' from the Broker VM Linux terminal.

Question 14

An administrator needs to uninstall a protected Cortex XDR agent from a Windows endpoint for troubleshooting purposes. What is required to complete the uninstallation successfully?

Accepted Answer

Enter the designated Cortex XDR agent uninstallation password when prompted by the uninstaller. Cortex XDR agents are protected against unauthorized removal by an uninstallation password configured in the agent settings profile.

Answer

Revoke the endpoint certificate from the local Certificate Authority (CA) store

Answer

Disable Windows Defender and run the standard Windows Add or Remove Programs wizard

Answer

Boot the endpoint into Safe Mode and delete the agent installation directory manually

Question 15

An administrator is designing an automated incident response playbook in Cortex XSOAR. Which TWO core concepts are essential for passing data between playbook tasks? (Choose two)

Accepted Answer

Incident Context (Context Data) to store and retrieve structured key-value data. Option B is correct because Cortex XSOAR stores and shares structured key-value data across playbook tasks in the Incident Context, which tasks read from and write to using context paths (e.g., ${incident.customFields}), making it the primary data-passing mechanism. Option D is correct because each playbook task produces outputs and accepts inputs, and the playbook engine maps prior task outputs (or context keys) into subsequent task inputs/arguments, which is how data flows from one task to the next. Option A is wrong because there is no such thing as static global environment variables hardcoded in the server kernel for playbook data passing. Option C is wrong because XSOAR playbooks are not written using C++ direct memory pointer references. Option E is wrong because manual USB transfer is not an automated data-passing method within a playbook.

Answer

Static global environment variables hardcoded in the server kernel

Answer

Direct memory pointer references in C++ syntax

Answer

Manual USB flash drive transfer between server nodes