XDR-Engineer Practice Exam 2 — 20 Questions

Question 1

An administrator is troubleshooting a scenario where Cortex XDR Agent data is not appearing in the management console. Firewall rules restrict outbound traffic. Which destination port and protocol must be opened outbound from the endpoints to the Cortex XDR management console for agent telemetry?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TCP port 443. Cortex XDR agents communicate outbound to the Cortex XDR tenant over TCP port 443 (HTTPS).

Answer

TCP port 389 and 636

Answer

TCP port 22 and 8080

Answer

UDP port 514

Question 2

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

Accepted Answer

Configure an isolation exception rule specifying the permitted IP address.. Cortex XDR allows administrators to configure isolation exception rules that specify IP addresses or hostnames permitted to communicate with an isolated endpoint. This is the supported mechanism to allow a remediation server or management IP to reach an isolated endpoint while keeping all other traffic blocked. The exception is configured in the isolation policy or as a standalone exception rule.

Answer

Add the IP address to the Data Collection profile under restricted hosts.

Answer

Create a firewall policy on the next-generation firewall to bypass XDR isolation.

Answer

Disable the agent service via Live Terminal using the 'net stop' command.

Question 3

An administrator configured a new Agent Settings profile in Cortex XDR, but endpoints in the 'Finance' folder are not applying the new tamper protection password. What is the most likely reason for this behavior?

Accepted Answer

The Agent Settings profile priority for the Finance folder is set lower than a conflicting child assignment or inheritance is broken.. Cortex XDR applies Agent Settings profiles based on folder hierarchy and assignment priority. If the Finance folder has a lower-priority profile than a conflicting child assignment, or if inheritance from the parent is broken, the tamper protection password from the new profile will not be applied. Profile precedence and folder inheritance are the most common reasons a configuration appears not to take effect on a subset of endpoints.

Answer

Tamper protection passwords can only be configured globally and cannot be overridden by profile.

Answer

Tamper protection configuration changes require a manual service restart on every agent.

Answer

Agents require a full endpoint reboot before downloading any configuration changes.

Question 4

An administrator has deployed a Broker VM to act as a syslog collector and agent installer. During the configuration of the Broker VM in the Cortex XDR console, the status remains 'Disconnected'. What is the most likely cause of this issue?

Accepted Answer

Outbound connectivity on TCP port 443 from the Broker VM to the Cortex XDR tenant is blocked.. The Broker VM communicates with the Cortex XDR tenant over outbound TCP 443 to register and maintain its connection. If outbound 443 is blocked by a firewall or proxy, the Broker VM cannot reach the tenant and will show as 'Disconnected' in the console. This is the most common cause of a Broker VM failing to connect after deployment.

Answer

The Cortex XDR agent license count has been exceeded on the tenant.

Answer

The Broker VM requires an active inbound SSH session from the administrator's workstation.

Answer

Syslog UDP port 514 is closed on the internal firewall.

Question 5

A security operations team wants Cortex XDR to push high-severity alerts into their existing ticketing platform automatically, without an analyst manually exporting each incident. Which TWO built-in integration capabilities allow Cortex XDR to deliver alerts to an external system? (Choose two.)

Accepted Answer

Enabling a Cortex XDR API key and calling the public REST endpoints to poll incidents on a schedule.. Automated external delivery in Cortex XDR is achieved through supported integration surfaces: forwarding alerts to an external destination and using the authenticated public REST API to retrieve incidents programmatically. Both are documented, secure, and designed for machine consumption. Console scraping, agent database sharing, and mailbox parsing are unsupported and insecure, so they fail the requirement.

Answer

Publishing the XDR console URL with embedded credentials so the ticketing tool can scrape the incident table.

Answer

Relying on the built-in email notification for every alert and letting the ticketing platform parse the mailbox.

Answer

Exporting the local agent database and mounting it on the ticketing server as a shared volume.

Question 6

An administrator wants to run an ad-hoc query to investigate failed logon attempts across all endpoints over the last 24 hours. Which tool in Cortex XDR should the administrator use?

Accepted Answer

XQL Search. XQL Search is the native query tool in Cortex XDR used to search and analyze collected endpoint and network datasets.

Answer

BIOC Generator

Answer

Correlation Rules Builder

Answer

Query Builder for Syslog

Question 7

What is the primary purpose of using a Broker VM in a Cortex XDR deployment architecture?

Accepted Answer

To act as a local log collector, aggregator, and agent proxy for data sources that cannot directly connect to the Cortex XDR cloud. Broker VMs act as intermediary collectors and forwarders for logs, threat intel, and cloud integrations in environments where direct cloud access is restricted.

Answer

To host the core Cortex XDR multi-tenant cloud database

Answer

To run local endpoint antivirus scans on unmanaged guest laptops

Answer

To replace all physical firewalls and routers within the corporate perimeter

Question 8

An administrator is writing a custom Python automation script within a Cortex XSOAR integration. Which TWO standard practices should be followed to ensure proper execution and error handling within the platform? (Choose two)

Accepted Answer

Return results using structured 'CommandResults' objects containing standard outputs and human-readable text. Option B is correct because Cortex XSOAR integrations should return structured CommandResults objects, which carry the standard context outputs (readable by playbooks) and the human-readable entry text shown in the War Room, ensuring downstream automation can consume the data reliably. Option C is correct because integration code must catch exceptions and report failures through return_error(), which produces a proper error entry in the War Room instead of letting the script crash and lose the failure context. The unmarked options are inappropriate: A writes to hypervisor kernel memory (impossible and unsafe from a containerized integration), D uses CPU-spinning infinite loops that would hang the integration worker, and E leaks credentials into public logs, violating security best practices.

Answer

Write raw binary data directly to the host hypervisor kernel memory space

Answer

Execute infinite `while` loops without sleep intervals to maximize CPU usage

Answer

Print debug passwords in plain text to public stdout logs

Question 9

An administrator needs to deploy the Cortex XDR agent across a multi-tenant environment using a single management console. How should the administrator structure the deployment to isolate endpoint data between different business units?

Accepted Answer

Create distinct agent installation packages with embedded registration tokens tied to specific Cortex XDR folders and assign RBAC scopes. Cortex XDR supports multi-tenancy through child tenants or by using endpoint groups and granular role-based access control (RBAC).

Answer

Modify the Windows Registry on each endpoint to point to separate cloud regions

Answer

Deploy multiple Broker VMs on the same subnet and assign static VLAN tags

Answer

Install multiple instances of the Cortex XDR agent side-by-side on each endpoint

Question 10

A Cortex XDR engineer is configuring a Broker VM to collect logs from a third-party EDR solution that writes to a local folder on the Broker VM as JSON files. The engineer needs Cortex XDR to parse these files and map the fields into the XDR data model. Which component should the engineer configure on the Broker VM to achieve this?

Accepted Answer

File Collector. The File Collector on a Broker VM is specifically built to ingest logs from files on the local filesystem, including JSON, and to apply parsing rules that map fields into the Cortex XDR schema. It is the only listed component that can read files and forward their contents to Cortex XDR for analysis.

Answer

Syslog Collector

Answer

Windows Event Collector

Answer

Network Mapper

Question 11

An enterprise security team wants to ingest NetFlow records from core routers into Cortex XDR. Which component and collector combination supports NetFlow/IPFIX ingestion?

Accepted Answer

Broker VM with the NetFlow / IPFIX Collector enabled. NetFlow/IPFIX ingestion in Cortex XDR is supported through the Broker VM with the NetFlow/IPFIX Collector enabled. The Broker VM acts as a collector that receives flow data from routers and forwards it to Cortex XDR for analysis. This is the designed architecture for network flow ingestion.

Answer

Direct API streaming from router CLI to the XDR cloud storage bucket

Answer

Cortex XDR Agent installed directly on the core routers via SSH

Answer

Cortex XSOAR integration instance using SNMP polling

Question 12

A security engineer is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints that are managed by Microsoft Endpoint Configuration Manager (MECM). The organization wants to automate the installation and ensure that the agent is installed with the correct distribution package. What should the engineer do first to obtain the necessary installation package for MECM deployment?

Accepted Answer

Download the Cortex XDR agent installer from the Cortex XDR management console and create a deployment package in MECM.. The correct approach is to download the Cortex XDR agent installer from the management console and package it for MECM. This ensures the correct version, tenant-specific settings, and integration with MECM's deployment capabilities. Other methods either rely on manual user actions, use incorrect sources, or are not applicable to third-party software distribution.

Answer

Retrieve the agent installer from the Palo Alto Networks Customer Support Portal and upload it to MECM.

Answer

Use the Cortex XDR API to generate a one-time installation link and send it to all users via email.

Answer

Configure MECM to pull the agent installer directly from the Microsoft Update Catalog.

Question 13

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

Accepted Answer

To automatically apply specific configuration and security settings upon agent registration.. Assigning an agent profile to an installation package ensures that when the agent registers with the Cortex XDR cloud, it automatically receives the configuration and security settings defined in that profile. This streamlines deployment by applying the correct policy set without manual intervention. The profile determines settings like Malware Protection, Exploit Protection, and Agent Settings for the endpoint.

Answer

To encrypt the installation binary against unauthorized tampering during transit.

Answer

To determine which operating system architecture (32-bit or 64-bit) the package will target.

Answer

To set the license expiration date for the endpoint.

Question 14

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

Accepted Answer

The administrator must provide the anti-tampering password configured in the Cortex XDR console.. Cortex XDR's anti-tampering feature requires the anti-tampering password — configured in the Agent Settings profile in the management console — before the agent's protection can be disabled locally using cytool. This prevents unauthorized users or malware from turning off endpoint protection. The administrator must supply this password when running the disable command.

Answer

A live terminal session must be opened from the cloud console to execute the command.

Answer

The agent must first be uninstalled and reinstalled in debug mode.

Answer

The endpoint must be disconnected from the active domain controller.

Question 15

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

Accepted Answer

TCP port 443 for cloud tenant and agent communication. Option A is correct because the Cortex XDR Broker VM uses TCP 443 to communicate outbound with the Cortex XDR cloud tenant and to receive agent traffic, which is the standard secure HTTPS channel for registration, policy, and telemetry. Option B is correct because the Broker VM's syslog ingestion component listens on UDP/TCP 514 by default (and can be set to custom ports) to collect syslog from firewalls, proxies, and other log sources. Option C is wrong because Telnet on TCP 23 is an insecure legacy management protocol and is not used for Broker VM syslog or agent communication. Option D is wrong because TFTP on UDP 69 is a trivial file-transfer protocol, not an agent staging or communication mechanism for the Broker VM. Option E is wrong because RDP on TCP 3389 is a Windows remote-desktop service, not a log-streaming or agent-communication channel for the Broker VM.

Answer

TCP port 23 for Telnet remote management

Answer

UDP port 69 for Trivial File Transfer Protocol (TFTP) agent staging

Answer

TCP port 3389 for Remote Desktop Protocol (RDP) log streaming

Question 16

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

Accepted Answer

Agent software version. Option A (Agent software version) is correct because the Endpoint Management module in Cortex XDR displays the installed agent version for each enrolled endpoint, allowing analysts to verify whether agents are up to date and identify version drift across the fleet. Option C (Last seen timestamp) is correct because the console shows when each agent last communicated with the Cortex XDR management server, which is essential for spotting offline or unresponsive endpoints. The unmarked options do not belong: hard drive manufacturing serial numbers (B), BIOS cryptographic signature keys (D), and local administrator password hashes (E) are not status fields exposed in the Endpoint Management agent inventory, and password hashes in particular would never be surfaced in a management console for security reasons.

Answer

Hard drive manufacturing serial number

Answer

BIOS cryptographic signature key

Answer

Local administrator password hash

Question 17

A security administrator needs to block a known malicious executable from running across all Windows endpoints managed by Cortex XDR. The file is identified by its SHA-256 hash. The administrator wants the block to be enforced at the agent level without scanning file content. Which Cortex XDR feature should be used?

Accepted Answer

Configure an Indicators of Compromise (IOC) policy with a hash indicator and set the action to Block.. Cortex XDR provides the Indicators of Compromise (IOC) feature to block or report on specific artifacts such as file hashes. By creating an IOC policy with the SHA-256 hash and setting the action to Block, the administrator can immediately prevent the executable from running on all targeted endpoints. This method is precise and does not rely on signature updates or heuristic detection.

Answer

Create a Malware profile with a custom blocklist that includes the SHA-256 hash.

Answer

Use the Exploit Protection profile to add the executable to the list of blocked processes.

Answer

Add the SHA-256 hash to the Blocklist in the Cortex XDR management console under Endpoints > Blocklist.

Question 18

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

Accepted Answer

Upload the custom CA certificate bundle into the Broker VM trust store via the Broker VM management page. To trust self-signed certificates on a Broker VM, the administrator must upload the custom CA certificate bundle via the Broker VM management interface.

Answer

Add the target API IP address to the Broker VM local hosts file

Answer

Modify the Broker VM system kernel parameters to ignore cipher mismatches

Answer

Disable SSL/TLS verification globally for all Cortex XDR broker app modules

Question 19

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

Accepted Answer

Data Collection profile. The Data Collection profile dictates what telemetry, logs, and files are gathered and sent from the endpoint to the Cortex XDR backend.

Answer

Exploit Protection profile

Answer

Agent Settings profile

Answer

Biometric Threat Prevention profile

Question 20

An administrator needs to ensure that Cortex XDR agents on a set of Linux endpoints can communicate with the Cortex XDR management console through a forward proxy. The proxy requires authentication. Which configuration should the administrator apply to the agent?

Accepted Answer

Configure the proxy settings in the Agent Settings profile, specifying the proxy address, port, and authentication credentials.. To configure an authenticated forward proxy for Cortex XDR agents, the administrator must use an Agent Settings profile. This profile includes proxy settings where the address, port, and credentials can be specified. Applying the profile to the target Linux endpoints ensures the agents use the proxy for communication. Other methods, such as local file edits or global server settings, are not supported and would not reliably achieve the goal.

Answer

Configure the proxy settings in the Cortex XDR management console under Server Settings, which automatically applies to all agents.

Answer

Use a transparent proxy that does not require authentication, as Cortex XDR agents do not support authenticated proxies.

Answer

Edit the agent configuration file on each Linux endpoint to include the proxy details and restart the agent service.