XDR-Engineer Practice Test 2 — 10 Questions

Question 1

A Cortex XDR engineer is planning the installation of the Broker VM in a demilitarized zone (DMZ) to collect logs from internet-facing servers. Which TWO configurations are required to ensure the Broker VM can securely communicate with the Cortex XDR cloud and internal log sources? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Allow the Broker VM to communicate with internal log sources over the required protocols and ports.. The Broker VM in a DMZ requires outbound HTTPS access to the Cortex XDR cloud for management and updates, and it must be able to receive logs from internal sources. These two configurations ensure secure communication without exposing the Broker VM to inbound internet traffic. Inbound access from the internet or the cloud is not needed and would increase the attack surface.

Answer

Configure the Broker VM to use a static public IP address for cloud communication.

Answer

Configure inbound access from the internet to the Broker VM on TCP 443 for log ingestion.

Answer

Enable inbound access from the Cortex XDR cloud to the Broker VM on TCP 443 for management.

Question 2

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Accepted Answer

Cortex XSOAR Server Audit and Server logs (/var/log/demisto/server.log). Option D is correct because Cortex XSOAR Server Audit and Server logs, including /var/log/demisto/server.log, record API activity, automation execution, and integration errors, which are essential for diagnosing a failing Cortex XDR API query or automation script. Option E is correct because integration debug logs, viewed via Docker container logs for the specific integration instance, show the actual HTTP requests, responses, and errors exchanged with the Cortex XDR API, directly revealing the root cause. Option A is not relevant because Windows Event Viewer Security logs on unmanaged workstations do not capture Cortex XDR API or automation activity. Option B is not relevant because BIOS firmware event logs relate to hardware/firmware events, not API or script failures. Option C is not relevant because Cortex XDR Agent installation MSI error logs only cover agent installation issues, not API query or automation script failures.

Answer

Windows Event Viewer Security log on unmanaged workstations

Answer

Local BIOS firmware event logs

Answer

Cortex XDR Agent installation MSI error logs

Question 3

An analyst is reviewing an incident and wants to quickly export the raw artifact details and event logs associated with the specific alert for offline sharing. Which feature in the Incident View should the analyst use?

Accepted Answer

Export options in the Incident View (CSV/JSON). Cortex XDR provides export options within incident views to download incident details, alerts, and observables as CSV or JSON.

Answer

Agent installation log collector

Answer

Cortex XSOAR Marketplace

Answer

Syslog alert routing daemon

Question 4

A Cortex XDR administrator is investigating an incident where a PowerShell script executed on multiple endpoints, but the Cortex XDR agent did not generate any alerts. The administrator confirms the script is malicious and should have been detected by the Behavioral Threat protection module. Which action should the administrator take first to troubleshoot the missing alerts?

Accepted Answer

Verify that the Behavioral Threat protection module is enabled in the agent policy.. Behavioral Threat protection must be enabled in the agent policy to detect malicious script behavior. If disabled, no alerts will be generated regardless of script activity. Verifying the policy setting is the quickest way to identify why alerts are missing, before investigating other potential causes like connectivity or allow lists.

Answer

Review the endpoint's local agent logs for script execution events.

Answer

Ensure the script's hash is not in the allow list.

Answer

Check the Cortex XDR management console for agent connectivity issues.

Question 5

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

Accepted Answer

Dashboards menu using a widget based on an XQL query. Custom dashboards and widgets in Cortex XDR are built and managed within the Dashboard module using either pre-built templates or custom XQL queries.

Answer

Agent Settings -> Profiles -> Analytics

Answer

Threat Intelligence -> Feed Management

Answer

Incident Response -> Playbooks

Question 6

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

Accepted Answer

The underlying XQL query string that defines the detection logic.. Option C is correct because a scheduled XQL rule fundamentally requires the XQL query string itself, which defines the detection logic that runs against the Cortex XDR dataset to identify matching events. Option D is correct because the rule must map the query results to alert attributes—severity, alert name, and description—so that generated alerts are meaningful and actionable in the incident view. Option E is correct because a scheduled rule must specify the schedule frequency (how often the query executes) and the time range of data evaluated per run, which together control detection cadence and coverage. Options A and B are incorrect because physical memory allocation on a Broker VM for syslog collection and kernel bypass configuration for Windows endpoints are unrelated to defining a scheduled XQL alert rule; they concern infrastructure sizing and endpoint agent/network settings, not XQL rule parameters.

Answer

The physical memory allocation limit on the Broker VM handling syslog collection.

Answer

The kernel bypass configuration parameters for Windows endpoints.

Question 7

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux systems. What must the administrator do regarding installation packages?

Accepted Answer

Generate and download distinct installation packages tailored for each operating system type.. Separate installation packages must be generated for each distinct operating system (Windows, macOS, Linux) in the Cortex XDR management console.

Answer

Convert an MSI package to PKG format using third-party tools.

Answer

Download a single universal installation package that automatically detects the operating system during execution.

Answer

Use the Linux TGZ installer for all operating systems by leveraging containerization.

Question 8

An administrator is deploying Cortex XDR agents to a group of macOS endpoints. The organization uses a mobile device management (MDM) solution to push configurations. Which file format should the administrator use to deliver the agent settings profile via MDM?

Accepted Answer

A .mobileconfig file containing the agent settings.. For macOS endpoints, Cortex XDR agent settings are delivered via a .mobileconfig file, which is the standard configuration profile format for Apple devices. This file can be generated from the Cortex XDR management console and deployed through MDM. Other file formats like .plist, .json, or .xml are not directly supported for this purpose.

Answer

A .plist file containing the agent settings.

Answer

A .json file containing the agent settings.

Answer

A .xml file containing the agent settings.

Question 9

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

Accepted Answer

Run 'top' or 'htop' via SSH on the Broker VM to identify which specific processes are consuming excessive memory.. Option B is correct because running 'top' or 'htop' over SSH on the Broker VM provides real-time per-process memory (RES/%MEM) visibility, letting the administrator pinpoint which service (e.g., broker, collector, or forwarding process) is driving high utilization. Option C is correct because the Cortex XDR console's Settings > Configurations > Broker VM page surfaces built-in system health metrics (CPU, memory, disk, and service status), giving an authoritative, supported view of Broker VM resource consumption without needing to guess. Option D is correct because collector logs under /var/log/pan/ record ingestion activity and errors, so reviewing them can reveal event loops, repeated retries, or memory leaks that spike during high event ingestion. Option A is not appropriate because recompiling the Linux kernel on a vendor-supplied Broker VM appliance is unsupported and would not address application-level memory consumption. Option E is not appropriate because changing the disk partition table with fdisk is unrelated to memory utilization and risks corrupting the appliance's storage layout.

Answer

Recompile the Linux kernel on the Broker VM appliance to optimize memory paging.

Answer

Change the Broker VM disk partition table using fdisk.

Question 10

A Cortex XDR Agent on a macOS endpoint is failing to start its kernel extension (Endpoint Security extension). Which diagnostic command should be run locally in the macOS Terminal to verify system extension approval status?

Accepted Answer

systemextensionsctl list. On macOS, system extensions (including Endpoint Security extensions) are managed by the systemextensionsctl command. Running 'systemextensionsctl list' displays all installed system extensions and their approval status, which is critical for diagnosing why a kernel extension might fail to start. This command is the correct local diagnostic tool for verifying system extension approval.

Answer

macos-agent-check --status

Answer

kextstat | grep paloalto

Answer

cytool mac status