XDR-Engineer Practice Exam 3 — 20 Questions

Question 1

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Analytics rule descriptions and details within the Cortex XDR console / documentation reference. The engineer can review the definition and rule logic of built-in Analytics detectors in the Analytics rule descriptions and details within the Cortex XDR console or documentation reference. This provides insight into the behavioral logic and heuristics used by the Analytics engine.

Answer

Agent binary configuration file (agent.conf)

Answer

Host Insights Vulnerability assessment database

Answer

Cortex XSOAR Playbook Designer source code

Question 2

An XDR engineer needs to automate the enrichment of Cortex XDR incidents with threat intelligence from an external MISP instance. The MISP API requires an authentication key and returns JSON. Which Cortex XDR automation component should be used to create a custom integration that queries MISP and updates incident fields?

Accepted Answer

Cortex XDR Integrations. Integrations are the automation component designed to connect to external systems, handle authentication such as MISP API keys, and parse JSON responses. They enable custom commands that can be invoked by playbooks to enrich incidents. Scripts, Playbooks, and Dashboards do not provide the API connectivity and parsing capabilities required for this scenario.

Answer

Cortex XDR Scripts

Answer

Cortex XDR Dashboards

Answer

Cortex XDR Playbooks

Question 3

A Cortex XDR administrator needs to verify that the Broker VM is receiving and forwarding endpoint telemetry to the Cortex XDR management console. The Broker VM appears online in the console, but no new endpoint logs have appeared for several hours. Which Broker VM component should the administrator check first to confirm that log ingestion is functioning?

Accepted Answer

The Broker VM Log Collector service. When a Broker VM is online but endpoint logs stop arriving, the first component to verify is the Log Collector service, which is responsible for receiving and forwarding endpoint telemetry. Other broker services handle different data types or unrelated functions, so they would not explain the absence of Cortex XDR agent logs.

Answer

The Broker VM Syslog Collector service

Answer

The Cortex XDR agent content update scheduler

Answer

The Cortex XDR management console database replication status

Question 4

A security engineer is planning to deploy Cortex XDR agents to a large fleet of Windows servers that have no direct internet access. The organization wants the agents to receive content updates without exposing each server to the internet. Which component should be deployed to meet this requirement?

Accepted Answer

Cortex XDR Broker VM. The Broker VM is designed to serve as an on-premises proxy and cache for Cortex XDR agents, enabling them to receive content updates even when they cannot directly reach the internet. It is the recommended component for environments with restricted connectivity, as it centralizes update distribution and reduces external exposure.

Answer

Cortex XDR agent with a proxy configuration pointing to an external web proxy

Answer

Cortex XDR agent with a local content update repository on each server

Answer

Cortex XDR management console with a content update schedule

Question 5

A Cortex XDR administrator needs a recurring report that shows the top ten MITRE ATT&CK techniques observed across all incidents in the last seven days, broken down by severity. The report must be generated automatically every Monday at 06:00 and emailed to the security leadership team. Which Cortex XDR capability should the administrator configure to meet these requirements?

Accepted Answer

Create a custom dashboard widget with an XQL query grouped by technique and severity, then configure a scheduled report template that includes that widget and delivers it by email.. The requirement combines aggregation, visualization, scheduling, and email delivery. Cortex XDR achieves this through dashboard widgets backed by XQL for the grouped technique-and-severity view, plus a scheduled report template that bundles the widget and sends it to recipients. Rules and exclusions operate on live telemetry and cannot produce a recurring top-ten analytical report.

Answer

Configure an alert exclusion that suppresses all but the top ten techniques, then enable scheduled email notifications on the incident management page.

Answer

Create a correlation rule that groups incidents by ATT&CK technique and enable the built-in weekly incident summary email that ships with the Cortex XDR console.

Answer

Create a BIOC rule that matches ATT&CK technique identifiers and configure a notification email action on the rule so it fires every Monday at 06:00.

Question 6

A security analyst is reviewing an incident in Cortex XDR and wants to understand the sequence of events that led to a detection, including which process launched which child process and how the activity unfolded over time. Which Cortex XDR feature should the analyst use to view this ordered chain of related events?

Accepted Answer

The Causality Chain view of the associated alert, which shows the process tree and event sequence leading to the detection.. The Causality Chain presents the ordered process tree and related events that generated an alert, giving the analyst the timeline and lineage needed to understand how activity unfolded. Administrative, device control, and licensing views contain configuration or peripheral data and cannot reconstruct the detection sequence.

Answer

The license and entitlement page, which shows which Cortex XDR modules are enabled for the tenant.

Answer

The endpoint's device control log, which lists USB and peripheral device connections.

Answer

The policy audit log, which records administrative changes made to endpoint policies over time.

Question 7

A Cortex XDR administrator notices that the Broker VM's disk usage is consistently above 90%, and some endpoints are intermittently failing to send logs. The administrator needs to reduce disk pressure without losing critical data. Which action should be taken first?

Accepted Answer

Review and adjust the Broker VM's log retention and rotation settings. Excessive disk usage on a Broker VM is typically caused by log files that are not rotated or retained according to policy. Adjusting log retention and rotation settings reduces disk pressure and restores stable log forwarding. Increasing disk size or redeploying the VM treats the symptom rather than the cause and may be disruptive.

Answer

Disable the Broker VM's Syslog Collector to stop all log ingestion

Answer

Increase the Broker VM's disk size immediately

Answer

Delete the Broker VM and redeploy it with a larger disk

Question 8

A Cortex XDR administrator is troubleshooting why a custom Correlation Rule is not generating incidents. The rule is enabled and scheduled to run every hour. The administrator checks the rule's configuration and sees that it uses a query that references the 'action_process_image_name' field. However, no incidents have been generated despite the query returning results when run manually in the Query Builder. What is the most likely cause?

Accepted Answer

The Correlation Rule is scoped to a specific endpoint group that does not include the endpoints where the activity occurred.. The most likely cause is that the Correlation Rule is scoped to a specific endpoint group that does not include the endpoints where the activity occurred. Even if the query returns results when run manually across all data, the rule only evaluates data from endpoints within its scope. The administrator should review the rule's scope settings and expand it to include the relevant endpoints. Other options are less likely because they contradict the fact that the manual query returns results.

Answer

The Correlation Rule requires the 'action_process_image_name' field to be normalized, but the data source does not populate this field.

Answer

The Correlation Rule's schedule is set to run every hour, but the query results are only retained for 30 minutes, causing the rule to miss the data.

Answer

The Correlation Rule uses a field that is not indexed, causing the rule to fail silently while manual queries use a different indexing mechanism.

Question 9

A Cortex XDR administrator wants to create a custom BIOC rule that detects when a process creates a scheduled task using schtasks.exe with a specific suspicious argument pattern. The rule must trigger only when the parent process is NOT explorer.exe. Which BIOC rule configuration achieves this?

Accepted Answer

Create a BIOC rule with a process execution event, match on schtasks.exe and the argument pattern, and add a condition that parent_process_name != 'explorer.exe'.. BIOC rules in Cortex XDR support conditions on CEF fields within a single event. For a process execution event, parent_process_name is available, so adding a condition that it does not equal explorer.exe ensures the rule triggers only for the desired parent context. This is the simplest and most direct configuration.

Answer

Create a BIOC rule with a process execution event matching schtasks.exe and the argument, then use a suppression rule to exclude events where parent_process_name equals 'explorer.exe'.

Answer

Create a BIOC rule using a registry event to monitor Task Scheduler registry keys, and filter on the user context to exclude explorer.exe.

Answer

Create a BIOC rule with a process execution event matching schtasks.exe and the argument, then use a correlation rule to join with a second event where parent_process_name is not explorer.exe.

Question 10

An XDR engineer is tuning the noise generated by a custom BIOC rule that fires on process executions containing the string 'powershell'. The engineer wants to suppress alerts only when the parent process is a known software deployment agent and the command line also contains 'Invoke-WebRequest'. Which mechanism should be used to implement this narrowly scoped exception without disabling the rule?

Accepted Answer

Modify the BIOC rule condition to add an exclusion clause matching the deployment agent as parent process and 'Invoke-WebRequest' in the command line.. The most precise way to reduce false positives from a custom BIOC rule is to add an exception clause inside the rule itself, targeting the exact parent-process and command-line combination observed in legitimate activity. This preserves detection for all other powershell executions. Broad suppression mechanisms either do not apply to custom BIOCs or reduce visibility for genuine threats, making them inappropriate for this scenario.

Answer

Configure a suppression window on the BIOC rule so that duplicate alerts from the same endpoint are collapsed within a 24-hour period.

Answer

Disable the BIOC rule temporarily and create a separate lower-severity rule that only matches the legitimate deployment agent behavior.

Answer

Create an Alert Exclusion rule in the Cortex XDR Exclusions policy that matches the BIOC rule name and the deployment agent process.

Question 11

An engineer is tuning detection coverage in Cortex XDR and wants to confirm whether a specific built-in Analytics BIOC is currently enabled, which MITRE ATT&CK technique it maps to, and whether it has generated any alerts in the past 24 hours. Which approach most directly provides all three pieces of information in one place?

Accepted Answer

Open the BIOC rule in the Cortex XDR management console, review its enabled state and MITRE mapping, then query the alerts dataset in XQL filtered by that BIOC name and a 24-hour window. Confirming a built-in Analytics BIOC's enablement and MITRE mapping requires inspecting the rule definition itself, and confirming recent alert activity requires querying the alerts dataset with a time filter. The rule view and an XQL query on alerts together answer all three questions authoritatively, whereas agent diagnostics, IOC feeds, and incident timelines provide only partial or indirect evidence.

Answer

Run a Cortex XDR agent diagnostic on the endpoint and inspect the local BIOC catalog file for the rule state and technique mapping

Answer

Export the IOC feed configuration and cross-reference technique IDs against the indicator list

Answer

Review the incident timeline of the most recent incident and infer the rule state from the alerts it contains

Question 12

A security analyst wants to review all alerts that were generated on a specific endpoint over the past 30 days and see which ones were already resolved versus still open. Which Cortex XDR view should the analyst open to accomplish this?

Accepted Answer

The Alerts view filtered by the endpoint hostname and a 30-day time range, using the Status column to distinguish resolved from open alerts.. The Alerts view is the purpose-built interface for reviewing individual alerts with their metadata, including status. Applying a hostname filter and a 30-day time range narrows the list to the endpoint of interest, and the Status column immediately distinguishes resolved from open alerts without requiring custom queries or navigating unrelated consoles.

Answer

The Endpoint Management console filtered by the host, showing agent status and last-seen timestamps for the device.

Answer

The Query Center with a dataset of alerts, using XQL to project hostname, timestamp, and severity fields only.

Answer

The Incidents view filtered by the endpoint hostname, showing the status of each associated incident.

Question 13

A Cortex XDR administrator wants to ensure that a specific Windows executable is always allowed to run, even if it exhibits behavior that might otherwise be blocked by the Behavioral Threat protection module. The executable is digitally signed by a trusted vendor. Which Cortex XDR feature should the administrator use to achieve this?

Accepted Answer

Configure a Digital Signature allowlist entry for the trusted vendor's certificate.. Cortex XDR allows administrators to create allowlist entries based on digital signatures. By adding the trusted vendor's certificate to the allowlist, any executable signed by that certificate is permitted to run, bypassing behavioral blocks. This method is secure, scalable, and ensures that legitimate software from trusted vendors is not inadvertently blocked.

Answer

Create an Allowlist entry based on the file's SHA-256 hash.

Answer

Add the executable to the Behavioral Threat protection exception list.

Answer

Disable the Behavioral Threat protection module for the endpoint group.

Question 14

A Cortex XDR engineer is configuring the alert notification path so that high-severity incidents reach the on-call SOC analyst quickly. The team wants notifications delivered to an external collaboration platform and also wants an automated action to run when the alert fires. Which TWO Cortex XDR capabilities should the engineer configure to meet these requirements? (Choose two.)

Accepted Answer

Create a script or playbook action and bind it to the alert through a playbook that triggers on the matching alert condition.. External notification integrations attached to alert notification rules handle delivery to collaboration platforms, while playbooks bound to alert conditions provide automated action execution. Together they cover both the notification and the automated response requirements without altering detection coverage or endpoint scan settings.

Answer

Raise the alert severity threshold in the BIOC so that only critical alerts are generated for the on-call team.

Answer

Increase the endpoint agent heartbeat interval so alerts are reported to the management console more frequently.

Answer

Enable the built-in malware signature pack and schedule a daily scan on all endpoints in the policy.

Question 15

An administrator is setting up a Cortex XDR Broker VM to collect logs from a remote site with limited bandwidth. The administrator wants to minimize the amount of data sent over the WAN link while ensuring that critical security events are still ingested. Which feature should be enabled on the Broker VM?

Accepted Answer

Local log filtering and aggregation. Local log filtering and aggregation on the Broker VM allows administrators to reduce the volume of data sent over the WAN by discarding low-value logs and consolidating repetitive events. This directly addresses the bandwidth constraint while ensuring that critical security events are still forwarded to Cortex XDR. Other options either do not reduce data volume or are not supported features for this purpose.

Answer

Syslog over UDP instead of TCP

Answer

TLS encryption with perfect forward secrecy

Answer

Log compression and deduplication

Question 16

An administrator is troubleshooting a Cortex XDR agent on a Windows endpoint that is not communicating with the management console. The administrator runs 'cytool status' and sees that the agent is in a 'Disconnected' state. The network team confirms that the endpoint can reach the console on port 443. Which Cortex XDR component should the administrator check next to ensure proper agent-console communication?

Accepted Answer

The Cortex XDR agent's certificate and registration status with the console.. When an agent is disconnected but network connectivity is confirmed, the next logical step is to verify the agent's certificate and registration status. Cortex XDR agents use certificates for secure communication with the console; an expired or revoked certificate, or a registration issue, will prevent the agent from connecting. Checking this component is essential for resolving the disconnection.

Answer

The Cortex XDR agent's local database for corruption.

Answer

The Cortex XDR management console's license status.

Answer

The Windows Firewall rules on the endpoint.

Question 17

A Cortex XDR administrator needs to ensure that endpoint telemetry data is ingested from all Windows endpoints in the organization. Which Cortex XDR component is responsible for collecting this data directly from the endpoints?

Accepted Answer

Cortex XDR Agent. The Cortex XDR Agent is the endpoint component that collects telemetry data and sends it to the management console. It provides the necessary visibility into endpoint activities for threat detection and response.

Answer

Syslog Collector

Answer

Broker VM

Answer

Cortex XDR Management Console

Question 18

A security engineer is planning the deployment of Cortex XDR agents to endpoints that are located in a remote office with limited bandwidth. The engineer wants to minimize the impact on the network during the initial agent registration and content updates. Which Cortex XDR component should be deployed on-premises to cache content and reduce WAN traffic?

Accepted Answer

Broker VM. The Broker VM is designed to be deployed on-premises to support various functions, including acting as a proxy and cache for Cortex XDR agents. In a remote office with limited bandwidth, deploying a Broker VM ensures that agents download content updates locally, significantly reducing WAN traffic and improving performance.

Answer

Cortex XDR Management Console

Answer

Cortex Data Lake

Answer

WildFire appliance

Question 19

When testing a newly configured API integration instance in Cortex XSOAR, what is the standard action used to verify connectivity and authentication credentials?

Accepted Answer

Run the 'test-module' command. The 'test-module' command is the standard mechanism in Cortex XSOAR to test API connectivity and credentials.

Answer

Reboot the Cortex XDR management server tenant

Answer

Restart the Broker VM container service

Answer

Execute a full endpoint isolation workflow

Question 20

An XDR engineer is investigating an incident where an alert shows a suspicious scheduled task created on a server. The engineer wants to determine whether the same process that created the task also initiated outbound network connections within the same causality chain. Which Cortex XDR capability should the engineer use to trace this relationship?

Accepted Answer

Open the alert's Causality View to pivot from the scheduled task creation process to its child network events within the same process tree.. The Causality View is designed to show the process tree and linked events sharing a causality ID, which is exactly the relationship needed to connect the process that created a scheduled task to any network connections it initiated. Filtering network data by hostname and time alone cannot establish that link, and the other modules address different questions.

Answer

Check the Threat Intelligence module for any known IOCs matching the server's outbound destination IP addresses.

Answer

Review the Endpoint Management audit log for the server to see which user account created the scheduled task.

Answer

Run an XQL query against the network_story dataset filtered only by the server hostname and the incident time window.