XDR-Engineer Practice Test 20 — 15 Questions

Question 1

A Cortex XDR administrator is planning to deploy the agent on a Windows Server 2019 that hosts a Microsoft SQL Server database. The database server has high I/O and memory usage. The administrator wants to ensure that the Cortex XDR agent does not degrade database performance. Which action should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new agent settings profile that excludes the database files and processes from scanning, and apply it to the server.. For performance-sensitive servers like database hosts, Cortex XDR administrators should create agent settings profiles that exclude specific files, folders, or processes from scanning. This reduces the agent's impact on database operations while maintaining protection. Disabling the agent or using monitor-only mode without exclusions does not adequately balance security and performance.

Answer

Disable the Cortex XDR agent on the database server and rely on network-based protection.

Answer

Install the agent in monitor-only mode without any exclusions.

Answer

Install the agent with the default protection policy and monitor performance.

Question 2

Which TWO actions can be performed directly within the Cortex XDR Data Integration management interface? (Choose two)

Accepted Answer

Define custom log parsing and mapping rules. Option B is correct because the Cortex XDR Data Integration management interface lets you create custom log parsing and mapping rules so that ingested third-party logs are normalized into Cortex XDR's schema for detection and search. Option D is correct because the same interface is where you deploy, configure, and monitor Broker VM instances, which act as the on-premises collectors/proxies that forward data to Cortex XDR. The remaining options are unrelated to Cortex XDR data integration: A concerns physical datacenter hardware provisioning, C concerns wireless guest-network portals, and E concerns router firmware maintenance, none of which are functions of the Cortex XDR Data Integration UI.

Answer

Provision physical server rack enclosures

Answer

Configure corporate Wi-Fi guest portal splash pages

Answer

Flash BIOS firmware on enterprise routers

Question 3

An administrator is configuring a Cortex XDR agent settings profile for a group of Windows servers that run a legacy line-of-business application. The application is known to trigger behavioral threat protection alerts due to its unusual memory allocation patterns. The administrator needs to prevent these false positives without disabling the entire behavioral threat module. Which Cortex XDR agent configuration should be used?

Accepted Answer

Create a Behavioral Threat exception rule that targets the specific process and its known memory allocation behavior.. The correct approach is to create a Behavioral Threat exception rule for the specific process and its memory allocation behavior. This preserves the Behavioral Threat Protection module for all other processes while eliminating the false positives caused by the legacy application. The other options either disable protection too broadly or address the wrong module.

Answer

Add the application's executable to the allow list in the Exploit Protection profile.

Answer

Lower the Behavioral Threat Protection action from 'Block' to 'Report' for the entire server group.

Answer

Disable the Behavioral Threat Protection module entirely for the server group.

Question 4

An administrator is configuring log forwarding to an external SIEM using Syslog. Which THREE configuration parameters must typically be defined to establish the Syslog destination successfully? (Choose three)

Accepted Answer

Destination IP address or FQDN. Option A (Destination IP address or FQDN) is correct because the Syslog client must know the network location of the external SIEM collector to send messages to it, whether specified as an IPv4/IPv6 address or a resolvable FQDN. Option B (Port number) is correct because Syslog listeners bind to a specific port (commonly UDP/TCP 514, or 6514 for TLS), and the forwarder must target that exact port to reach the collector. Option D (Protocol (TCP, UDP, or TLS)) is correct because Syslog can be transported over UDP, TCP, or TLS-encrypted TCP, and the forwarder must select a transport matching the SIEM's listener configuration. Option C (Agent proxy bypass list) is not required for basic Syslog forwarding, as it pertains to HTTP(S) proxy behavior rather than Syslog transport. Option E (Endpoint BIOS Administrator password) is unrelated to network log forwarding and is a hardware firmware security setting.

Answer

Agent proxy bypass list

Answer

Endpoint BIOS Administrator password

Question 5

An organization wants to configure granular reporting and alerting based on MITRE ATT&CK techniques. Within Cortex XDR, which THREE methods or views allow security teams to analyze detections mapped against the MITRE ATT&CK framework? (Choose three)

Accepted Answer

Incident and alert details displaying mapped ATT&CK tactics and techniques. Option A is correct because Cortex XDR incident and alert detail panes automatically enrich each detection with the mapped MITRE ATT&CK tactic and technique, letting analysts pivot on the specific adversary behavior that triggered the alert. Option B is correct because Cortex XDR provides a dedicated MITRE ATT&CK coverage dashboard and reporting view that aggregates detections by tactic and technique, which is exactly what is needed for granular reporting and alerting against the framework. Option E is correct because the Behavioral Indicators of Compromise (BIOC) rule authoring interface lets analysts tag custom rules with ATT&CK technique IDs, so their custom detections are also mapped and reportable within the framework. Option C is incorrect because the agent uninstallation wizard is an endpoint management function with no relation to ATT&CK mapping or detection analytics. Option D is incorrect because a local endpoint BIOS flashing utility is a hardware/firmware maintenance task and has nothing to do with analyzing detections against MITRE ATT&CK.

Answer

Agent uninstallation wizard

Answer

Local endpoint BIOS flashing utility

Question 6

An organization needs to forward all Cortex XDR incidents and alerts to an external SIEM platform in real time. Which Cortex XDR feature should the administrator configure?

Accepted Answer

Syslog Forwarding configuration. Cortex XDR's Syslog Forwarding configuration allows the administrator to stream alerts, incidents, and audit logs to an external SIEM in real time via syslog (UDP/TCP/TLS). It is configured under Settings > Configurations > Syslog and supports multiple destinations with customizable formats (CEF, LEEF, JSON). This is the native, supported mechanism for real-time SIEM integration.

Answer

Scheduled PDF Reporting

Answer

BIOC Rule Simulator

Answer

Agent Upgrade Profiles

Question 7

An administrator notices that a specific BIOC alert is triggering false positives across multiple developer workstations. What is the most efficient way to tune this behavior in Cortex XDR without writing custom XQL exclusion queries?

Accepted Answer

Click the alert in the Incident view, select Add Exception, and define criteria such as file hash or digital signature.. Adding an exception directly from the alert in the Incident view allows the administrator to define precise criteria (e.g., file hash, digital signature) to exclude legitimate activity from triggering the BIOC. This is the most efficient method because it leverages the built-in exception mechanism without writing custom XQL queries. It also ensures the exception is scoped to the specific behavior, reducing false positives while maintaining security coverage.

Answer

Downgrade the agent content version to a legacy release.

Answer

Delete the default BIOC profile and create an entirely new tenant policy.

Answer

Restart the Cortex XDR Agent service on each developer workstation.

Question 8

An administrator wants to create a BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR that triggers an alert whenever a PowerShell script attempts to download and execute a payload from an external IP address. Which data source must be enabled and properly ingested for this rule to function effectively?

Accepted Answer

Cortex XDR agent process execution logs and network event logs.. BIOC rules looking for script execution and network connections rely on process execution logs and network event logs generated by the Cortex XDR agent.

Answer

NetFlow logs exported exclusively from core enterprise routers.

Answer

Active Directory authentication logs via Windows Event Forwarding.

Answer

DNS query logs collected via external DNS sinkholes.

Question 9

An XDR engineer needs to schedule a recurring report that summarizes the count of alerts by MITRE ATT&CK tactic for the previous seven days, and deliver it as a CSV file every Monday at 08:00 to a distribution list. Which Cortex XDR feature should the engineer use to configure this?

Accepted Answer

Create a Scheduled Report in the Cortex XDR Reports module and select CSV as the output format and the MITRE ATT&CK tactic field as the grouping.. Scheduled Reports in Cortex XDR are the built-in mechanism for recurring, formatted reporting with selectable output types and email delivery. Grouping by MITRE ATT&CK tactic is natively supported because alert records carry that field. Alternative approaches such as dashboards, correlation rules, or case templates do not combine scheduling, CSV output, and distribution-list delivery in a single supported configuration.

Answer

Build an XQL query in the Query Center and pin the result to a custom dashboard, then configure the dashboard to email a PDF snapshot weekly.

Answer

Configure a Report Template under Cases and attach it to an incident, then rely on the incident owner to manually export and send the file each week.

Answer

Define a Correlation Rule that triggers on alert creation and uses a webhook to POST the aggregated counts to the distribution list every Monday.

Question 10

An analyst is investigating an incident and notices that a custom Analytics BIOC rule generated too many false positives due to a legitimate administrative tool. What is the recommended method to tune this rule without completely disabling it?

Accepted Answer

Add an exception to the specific BIOC rule based on criteria such as file path, hash, or signer.. Exceptions can be added to BIOC rules to filter out known legitimate parameters, such as specific file hashes, signing certificates, or file paths.

Answer

Delete the BIOC rule and recreate it as an XQL scheduled alert.

Answer

Change the BIOC rule severity level from High to Low so analysts ignore it.

Answer

Modify the global agent profile to exclude the administrative tool from all endpoint monitoring.

Question 11

When configuring the Cortex XDR API to ingest custom threat intelligence feeds, which authentication header and format must be used for the HTTP POST request to ensure successful ingestion?

Accepted Answer

Use 'x-api-key' and 'Authorization: Bearer <token>' headers with a JSON formatted payload.. Cortex XDR APIs authenticate via specific header fields including x-suid and Authorization containing the generated API key ID and secret, structured in a JSON payload format.

Answer

Use OAuth 2.0 client credentials grant type with a form-urlencoded body.

Answer

Use basic authentication with base64 encoded local administrator credentials and XML payloads.

Answer

Use SNMP v3 community strings injected into the custom HTTP header fields.

Question 12

An administrator is planning to deploy Cortex XDR agents to a group of endpoints that do not have direct internet access. The administrator has deployed a Broker VM to act as a proxy. Which agent installation parameter must be specified during installation to ensure the agent communicates with the Broker VM instead of the Cortex XDR cloud?

Accepted Answer

The Broker VM's IP address or FQDN using the SERVER parameter.. To direct an agent to a Broker VM, the SERVER parameter must be set to the Broker VM's IP address or FQDN during installation. This ensures the agent sends data to the Broker VM, which then forwards it to the Cortex XDR cloud. The other parameters either do not exist or serve different purposes, such as specifying an HTTP proxy.

Answer

The Broker VM's IP address or FQDN using the PROXY_SERVER parameter.

Answer

The Broker VM's IP address or FQDN using the BROKER_VM parameter.

Answer

The Cortex XDR cloud FQDN using the CLOUD_SERVER parameter.

Question 13

A Cortex XDR administrator is planning to deploy the agent on a Windows Server 2019 that hosts a Microsoft SQL Server database. The database server has high I/O and memory usage. The administrator wants to ensure that the Cortex XDR agent does not degrade database performance. Which action should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the agents to use the system proxy settings and provide proxy credentials in the agent settings profile.. Cortex XDR agent settings profiles support proxy configuration, including authentication credentials. By configuring the agent to use the system proxy and supplying the necessary credentials, the agent can authenticate to the web proxy and communicate with the Cortex XDR cloud. This approach scales across many endpoints without manual intervention.

Answer

Disable the web proxy authentication requirement for the Cortex XDR cloud URLs.

Answer

Deploy a Broker VM in the same network segment as the endpoints to bypass the web proxy.

Answer

Install the agents with a command-line option that specifies the proxy server address and port, but not credentials.

Question 14

A security operations team has deployed Cortex XDR agents to a large fleet of Linux servers. After a kernel upgrade on several servers, the agents stop reporting and the endpoints show as disconnected in the console. The administrator confirms the servers are reachable and the agent processes are running. Which action should the administrator take to restore agent functionality?

Accepted Answer

Rebuild the agent's kernel module against the new kernel version. On Linux, the Cortex XDR agent depends on a kernel module that must match the running kernel. A kernel upgrade can render the existing module unloadable, causing agents to stop reporting even though their processes run. Rebuilding the module against the new kernel headers restores the agent's kernel-level functionality and connectivity.

Answer

Restart the Cortex XDR management console service

Answer

Disable the agent's kernel-level protection and rely on user-mode monitoring

Answer

Reinstall the Cortex XDR agent using the original installation package

Question 15

A security analyst receives a Cortex XDR alert indicating a possible credential-dumping attempt on a finance workstation. The analyst wants to preserve volatile evidence and prevent the threat from spreading to other hosts while still allowing the incident to be investigated. Which Cortex XDR action should the analyst take on the affected endpoint?

Accepted Answer

Isolate the endpoint from the network using the Cortex XDR isolation action. Isolation is the containment action that stops network propagation without destroying the ability to investigate, because the Cortex XDR agent maintains its management channel during isolation. Process termination, hash blocklisting, and reimaging either fail to contain the threat fully or destroy the volatile evidence needed for the investigation.

Answer

Terminate the suspicious process tree and wait for the next scheduled scan

Answer

Restore the workstation from the most recent backup image

Answer

Add the file hash to the blocklist and close the alert as a true positive