XDR-Engineer Practice Test 19 — 15 Questions

Question 1

An administrator is planning the deployment of Cortex XDR agents to a large number of endpoints that are located in a remote branch office with limited bandwidth. The administrator wants to minimize the impact on the WAN link during agent installation and content updates. Which deployment method should be used to achieve this goal?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a Broker VM in the branch office and configure it as an agent proxy for content updates.. Deploying a Broker VM in the branch office allows it to serve as a local proxy for agent content updates, significantly reducing WAN bandwidth usage. This is the recommended approach for remote sites with limited connectivity, as it localizes update traffic and ensures agents receive updates efficiently without saturating the WAN link.

Answer

Use a group policy to disable automatic content updates and manually update each agent via a USB drive.

Answer

Install the Cortex XDR agent with the 'no update' flag and rely on periodic full agent reinstallation for updates.

Answer

Configure the agents to download updates directly from the Cortex XDR cloud during off-peak hours.

Question 2

When setting up data forwarding from Cortex XDR to a third-party SIEM using the Cortex XDR Data Forwarder, which protocol is commonly used to stream the logs?

Accepted Answer

HTTP/HTTPS or Syslog. Cortex XDR Data Forwarder typically streams logs to SIEMs using HTTPS or syslog protocols.

Answer

NetBIOS Name Service (NBNS)

Answer

Dynamic Host Configuration Protocol (DHCP)

Answer

Remote Desktop Protocol (RDP)

Question 3

A junior analyst needs a quick count of how many alerts each severity produced over the last seven days to prepare a management summary. Which Cortex XDR capability is the most direct way to obtain this aggregated view without writing complex query logic?

Accepted Answer

Use a predefined dashboard widget that charts alert counts grouped by severity over a selectable time range.. Prebuilt dashboard widgets are purpose-designed to aggregate and visualize alert counts by severity across a chosen time range. They require no query authoring and update as data changes, making them the fastest route to a management summary. Manual tallies, raw telemetry exports, and agent logs all add effort without improving the result.

Answer

Export all raw endpoint telemetry to a CSV and pivot the severity column in a spreadsheet.

Answer

Open the Incidents view, filter by the last seven days, and manually tally severities from the list.

Answer

Enable verbose logging on each agent and review the local log files for severity tags.

Question 4

A Cortex XDR administrator is troubleshooting an issue where the Cortex XDR agent on a Windows endpoint is not blocking a known malicious file, even though the prevention policy is set to block. The administrator has confirmed that the policy is applied and the agent is connected. Which of the following is the most likely reason for the agent's failure to block?

Accepted Answer

The file's hash is on the local allow list in the Cortex XDR agent configuration.. A local allow list entry for the file's hash would cause the Cortex XDR agent to bypass prevention actions, even if the policy is set to block. This is a common oversight when troubleshooting unexpected non-blocking behavior. The administrator should inspect the agent's local allow list configuration and remove the entry if it is not intended.

Answer

The Cortex XDR agent is in 'Report Only' mode for the prevention policy.

Answer

The malicious file is located on a network share that is excluded from scanning by the prevention policy.

Answer

The Cortex XDR agent's content update is outdated and does not recognize the file as malicious.

Question 5

An administrator is planning a Cortex XDR agent rollout across a mixed environment of Windows, macOS, and Linux servers. Which TWO key prerequisites must be verified prior to deployment? (Choose two)

Accepted Answer

Ensure outbound TCP port 443 communication is allowed from endpoints to the Cortex XDR server or Broker VM.. Option A is correct because Cortex XDR agents must reach the Cortex XDR management server or a Broker VM over outbound TCP 443 for registration, policy retrieval, and telemetry upload, so this connectivity must be verified before rollout. Option C is correct because agent compatibility is version-specific: the administrator must confirm each target Windows, macOS, and Linux OS version appears in the current Cortex XDR release notes' supported operating systems list, otherwise installation or protection may fail. Option B is not required because agent installation logs are stored locally and forwarded through the agent's own channel, not via a mandatory external Syslog server. Option D is wrong because native OS firewalls should remain enabled and be configured to permit the agent's required traffic, not uninstalled. Option E is wrong because kernel headers are a Linux concern, not Windows, and they are not manually compiled on every endpoint for agent installation.

Answer

Configure an external Syslog server to receive local agent installation logs.

Answer

Uninstall all native operating system firewalls before running the agent installer.

Answer

Manually compile the kernel headers on every target Windows endpoint.

Question 6

An administrator is planning the deployment of Cortex XDR agent tamper protection. Which TWO administrative actions or scenarios are protected against when tamper protection is enabled on endpoints? (Choose two)

Accepted Answer

Unauthorized deletion of Cortex XDR agent files, directories, or critical registry keys. Tamper protection is designed to prevent malicious or unauthorized modification of the Cortex XDR agent itself, so option D is correct: it blocks unauthorized deletion of the agent's files, directories, and critical registry keys, which would otherwise disable or degrade the agent. Option E is also correct because tamper protection specifically guards the agent's services against attempts by local users or malware to stop or disable them, preserving endpoint visibility and enforcement. Options A and B are not related to agent integrity: printing jobs and normal administrator-initiated OS reboots are legitimate system operations that tamper protection does not block. Option C is likewise not a protected scenario, since standard automatic content updates from the authorized Cortex XDR cloud tenant are trusted, expected agent activity rather than tampering.

Answer

Standard user printing jobs sent to network printers

Answer

Normal operating system scheduled reboots initiated by the system administrator

Answer

Standard automatic content updates pushed by the authorized Cortex XDR cloud tenant

Question 7

An organization requires that logs ingested via the Cortex XDR Syslog Collector be secured using TLS encryption (Syslog-over-TLS). What must the administrator configure on the Broker VM to support this requirement?

Accepted Answer

Configure the syslog collector instance on the Broker VM with a valid SSL/TLS certificate and private key. To secure syslog ingestion with TLS, the Broker VM's syslog collector must be configured with a valid SSL/TLS certificate and private key. This enables the collector to accept encrypted syslog-over-TLS connections from sources. The certificate and key are used to establish the TLS session, ensuring confidentiality and integrity of the log data.

Answer

Install an external IPsec VPN tunnel between the syslog source and the Cortex XDR cloud tenant

Answer

Modify the Windows Registry keys on the domain controller

Answer

Configure a reverse proxy on the endpoint agent with port forwarding

Question 8

An organization is onboarding a new cloud environment into Cortex XDR. Which THREE mechanisms or components can be utilized to ingest cloud audit logs and telemetry data into Cortex XDR? (Choose three)

Accepted Answer

Cloud Storage integration (e.g., AWS S3 bucket polling) to ingest logs.. Option A is correct because Cortex XDR supports Cloud Storage integrations that poll object storage such as AWS S3 buckets to pull cloud audit logs and telemetry into the platform. Option B is correct because API-based ingestion, using scheduled polling scripts or built-in integrations against cloud provider APIs (e.g., AWS CloudTrail, Azure Activity Log, GCP Audit Logs), is a supported method for bringing cloud logs into Cortex XDR. Option C is correct because the native Cloud Connector configuration onboards cloud accounts to provide cloud infrastructure visibility and ingest audit/telemetry data directly. Option D is not a supported ingestion mechanism, since Cortex XDR does not rely on manual USB transfers by administrative personnel. Option E is not applicable, as Cortex XDR ingests cloud logs through APIs, storage integrations, and connectors rather than physical tap appliances performing kernel-level packet inspection on virtual switches.

Answer

Manual USB drive data transfer initiated by cloud administrative personnel.

Answer

Direct kernel-level packet inspection via physical tap appliances attached to cloud virtual switches.

Question 9

A security team wants Cortex XDR to automatically create a case and assign it to the on-call analyst whenever a high-severity alert is generated from a specific BIOC rule. They have already verified the BIOC rule fires correctly. Which Cortex XDR feature should they configure to achieve this automated response?

Accepted Answer

A Playbook triggered by an alert-based automation rule. Automated case creation and analyst assignment on a specific BIOC alert is achieved by an alert-triggered automation rule that launches a playbook. The playbook contains the logic to create the case and set the assignee. Correlation Rules group alerts, Exception Rules suppress them, and IOC rules enforce indicator matches, so none of those fulfill the orchestration requirement described.

Answer

An Exception Rule that excludes the BIOC from generating alerts

Answer

An IOC rule that adds the source IP to the blocklist

Answer

A Correlation Rule that groups alerts into an incident

Question 10

An administrator needs to ensure that Cortex XDR agents on macOS endpoints can perform full disk scans without being blocked by macOS privacy protections. Which Cortex XDR agent configuration is required?

Accepted Answer

Grant the Cortex XDR agent Full Disk Access in macOS System Preferences.. On macOS, the Cortex XDR agent requires Full Disk Access to scan protected locations. This permission is granted in System Preferences or via MDM. Disabling SIP, changing enforcement mode, or using kernel extensions do not address the privacy protection requirement and may introduce other issues.

Answer

Disable System Integrity Protection (SIP) on the macOS endpoint.

Answer

Configure the agent to run in 'Report Only' mode for macOS.

Answer

Install the agent using a kernel extension (kext) instead of a system extension.

Question 11

When installing the Cortex XDR agent on a macOS endpoint, which additional operating system configuration must be completed to ensure full visibility and prevention capabilities?

Accepted Answer

Approve Full Disk Access and System Extensions.. macOS requires the administrator to manually approve System Extensions and Full Disk Access permissions for the Cortex XDR agent to function correctly.

Answer

Disable SIP (System Integrity Protection).

Answer

Configure a custom kernel panic handler in the boot-args.

Answer

Install a local proxy certificate in the Keychain Access utility.

Question 12

A security administrator is preparing to deploy Cortex XDR agents to a mix of Windows and Linux servers. The administrator wants to ensure that the agents can communicate with the Cortex XDR management console even when endpoints are behind a restrictive firewall. Which Cortex XDR agent configuration should be verified?

Accepted Answer

The agent's heartbeat interval and the management console's fully qualified domain name (FQDN) or IP address.. The agent requires the correct management console FQDN or IP address and a heartbeat interval to establish and maintain communication. Firewalls must permit outbound traffic to that address on the necessary ports. Other settings like cache size, update schedule, and SIEM integration do not determine whether the agent can reach the console through a firewall.

Answer

The agent's malware signature update schedule.

Answer

The agent's local cache size for storing alerts during network outages.

Answer

The agent's integration with third-party SIEM solutions.

Question 13

An administrator is configuring a Cortex XDR Automation playbook to automatically enrich alerts with threat intelligence. The playbook must query an external threat intelligence platform and add the results to the alert. Which Cortex XDR Automation component should be used to perform this action?

Accepted Answer

Integration Instance. The Integration Instance is the configured connector to an external system that enables playbooks to query threat intelligence platforms and enrich alerts with the returned data. It handles authentication and API communication.

Answer

Incident Field

Answer

Playbook Task

Answer

Automation Script

Question 14

An administrator is preparing to deploy the Cortex XDR agent across 5,000 Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation package format should the administrator export from the Cortex XDR management console?

Accepted Answer

MSI. The MSI package format is required when deploying software packages via Active Directory Group Policy Objects (GPOs) on Windows endpoints.

Answer

TGZ

Answer

PKG

Answer

EXE

Question 15

An engineer is writing an XQL query to investigate rare process executions. The query needs to calculate the distinct count of endpoints where each process image name was executed, filtering out processes that appeared on more than 50 hosts. Which XQL snippet correctly implements this filter after aggregation?

Accepted Answer

stats host_count = count(distinct hostname) by actor_process_image_name | filter host_count <= 50. In XQL, the `filter` stage must come after the `stats` aggregation stage when you want to filter on an aggregated field like `host_count`. The correct snippet first computes `host_count = count(distinct hostname)` grouped by `actor_process_image_name`, then applies `filter host_count <= 50` to keep only processes seen on 50 or fewer hosts. This is the standard XQL pattern for 'rare process' hunting.

Answer

filter host_count <= 50 | stats host_count = count(distinct hostname) by actor_process_image_name

Answer

group by actor_process_image_name having count(distinct hostname) <= 50

Answer

stats host_count = count(hostname) where host_count <= 50