XDR-Engineer Practice Exam 4 — 20 Questions

Question 1

A security administrator is installing a Cortex XDR Broker VM in a highly secure environment where internet access is restricted. The Broker VM must be able to communicate with the Cortex XDR cloud to receive updates and forward data. Which network configuration must be allowed to ensure successful operation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Outbound TCP 443 to the Cortex XDR cloud FQDNs and inbound TCP 443 from agents.. The Broker VM must have outbound TCP 443 access to the Cortex XDR cloud for updates and data forwarding, and it must accept inbound TCP 443 from agents to receive their telemetry. This ensures secure, reliable communication. The other options either use incorrect protocols or ports, which would break functionality.

Answer

Outbound TCP 8443 to the Cortex XDR cloud and inbound TCP 8443 from agents.

Answer

Outbound TCP 443 to the Cortex XDR cloud and inbound UDP 514 from agents.

Answer

Outbound UDP 514 to the Cortex XDR cloud and inbound TCP 443 from agents.

Question 2

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which TWO locations or methods should the administrator check to diagnose the root cause of the failure? (Choose two)

Accepted Answer

Windows Installer verbose installation logs generated with logging parameters (/L*v). Installation issues can be diagnosed using Windows Installer verbose logs and Event Viewer system/application logs.

Answer

The local BIOS/UEFI secure boot configuration summary file

Answer

The Cisco ISE policy enforcement cache database

Answer

The global Panorama traffic log buffer

Question 3

An administrator is planning network connectivity for a Broker VM that needs to forward logs to an external SIEM while also communicating with Cortex XDR. Which network configuration requirement must be met?

Accepted Answer

The Broker VM must be able to resolve DNS and communicate outbound to the Cortex XDR cloud over TCP port 443. The Broker VM requires outbound HTTPS access to the Cortex XDR cloud and inbound/outbound connectivity depending on syslog collection and SIEM forwarding roles.

Answer

The Broker VM must operate as an explicit proxy server with Kerberos authentication enabled

Answer

The Broker VM must have ICMP echo requests enabled across all enterprise routers

Answer

The Broker VM must have a direct public IP address assigned to its management interface

Question 4

An administrator wants to ensure high availability and load balancing for log collection and agent proxying using Broker VMs. Which TWO best practices should be considered during the planning phase? (Choose two)

Accepted Answer

Ensure all Broker VMs are synchronized with accurate NTP time sources. Deploying multiple Broker VMs behind a load balancer and sizing them appropriately ensures high availability and scalability.

Answer

Assign identical MAC addresses to all Broker VM instances to simplify switch ARP tables

Answer

Configure all agents to connect to a single static Broker VM IP address without failover options

Answer

Run Broker VMs exclusively on physical bare-metal hardware without virtualization hypervisors

Question 5

An administrator is preparing to deploy Cortex XDR agents in an environment utilizing a software restriction policy and Application Whitelisting. What must the administrator verify before running the agent installation?

Accepted Answer

Ensure the Cortex XDR installer binaries, service executables, and driver certificates are trusted or whitelisted in the local security software. Third-party application whitelisting or restriction software can block the execution of the Cortex XDR installer or core drivers if they are not explicitly trusted or excluded.

Answer

Disable Windows User Account Control (UAC) entirely across all domain controllers

Answer

Configure the local hosts file to resolve the management tenant to localhost

Answer

Convert the file system from NTFS to FAT32 to support raw driver loading

Question 6

An administrator is configuring a Cortex XDR Broker VM to collect logs from third-party syslog sources within a segregated network zone. Which prerequisite must be met on the network firewall to allow the Broker VM to successfully receive syslog data?

Accepted Answer

Allow inbound UDP/TCP port 514 from the internal log forwarders to the Broker VM.. The Broker VM acts as a syslog collector and requires UDP or TCP port 514 (or a custom configured port) to be allowed inbound from the log sources.

Answer

Allow outbound TCP port 443 to the Cortex XDR tenant.

Answer

Allow inbound TCP port 22 from the management station to the Broker VM.

Answer

Allow outbound DNS traffic on port 53 to local domain controllers.

Question 7

A security architect is planning a Cortex XDR deployment for a large enterprise with 8,000 endpoints across three geographic regions. The company requires that all endpoint telemetry and alerts be stored within the region where each endpoint resides, and that no data leaves that region. Which Cortex XDR deployment architecture should the architect recommend?

Accepted Answer

Deploy separate Cortex XDR tenants in each region, with endpoints connecting to the tenant in their own region.. Cortex XDR tenants are provisioned in specific geographic regions, and all endpoint data, alerts, and incidents are stored within that region. To meet strict data residency requirements per region, separate tenants must be deployed in each region so endpoints report to a local tenant. A single tenant cannot enforce per-endpoint data residency, and Broker VMs do not change the tenant's data storage location.

Answer

Deploy a Cortex XDR tenant in the primary region and use Broker VMs in each remote region to locally cache and process all endpoint data.

Answer

Deploy Cortex XDR agents in each region and forward all telemetry to a central syslog server in the primary region.

Answer

Deploy a single Cortex XDR tenant in the primary region and configure regional data residency settings for each endpoint group.

Question 8

A Cortex XDR administrator needs to deploy a new agent policy to a group of endpoints running macOS. The policy must enable the Behavioral Threat module and set the action to 'Block' for all severity levels. After creating the policy, the administrator assigns it to the endpoint group. However, the endpoints are not receiving the policy. Which step should the administrator verify first?

Accepted Answer

Verify that the endpoint group is correctly associated with the policy and that the agents are connected.. The most common reason for endpoints not receiving a policy is that the policy is not correctly assigned to their endpoint group, or the agents are not connected to the console. The administrator should first verify the assignment and agent connectivity. Once these are confirmed, the policy will be delivered. Other steps are less likely to resolve the issue.

Answer

Restart the Cortex XDR management console service.

Answer

Check that the macOS endpoints have the latest agent version installed.

Answer

Ensure that the policy is set as the default policy for the tenant.

Question 9

A security engineer is planning the installation of Cortex XDR agents on a large number of endpoints across different operating systems. The engineer must ensure that the agents can be deployed silently and that they automatically register with the correct Cortex XDR tenant. Which TWO installation considerations are essential for a successful mass deployment? (Choose two.)

Accepted Answer

Ensure that the installation is performed with administrative privileges on each endpoint.. The two essential considerations are including the tenant ID or registration token and ensuring administrative privileges. The tenant ID ensures proper registration, and admin rights are needed for installation. Other factors like disabling security software, static IPs, or pre-installing content are not required and could introduce issues.

Answer

Configure the agent to use a static IP address for communication with the Cortex XDR cloud.

Answer

Disable all other security software on the endpoints before installation.

Answer

Pre-install the Cortex XDR content update package on each endpoint to reduce initial cloud traffic.

Question 10

An administrator is troubleshooting an API rate-limiting error (HTTP 429 Too Many Requests) occurring in a custom Cortex XSOAR automation playbook that queries an external threat intel API. How should the integration or playbook be modified to handle this gracefully?

Accepted Answer

Implement exponential backoff and retry logic within the integration command or playbook task. Handling rate limits requires implementing backoff and retry logic or adjusting polling intervals within the integration/playbook.

Answer

Disable SSL certificate validation on the API integration instance

Answer

Switch the integration protocol from HTTPS to raw TCP sockets

Answer

Increase the Broker VM CPU allocation to bypass API server limits

Question 11

A Cortex XDR administrator is troubleshooting why a custom BIOC rule that was expected to trigger on specific process behavior is not generating alerts. The rule is enabled and assigned to the relevant endpoint policy. Which two actions should the administrator take to diagnose the issue? (Choose two.)

Accepted Answer

Verify that the BIOC rule's condition syntax and field names match the actual event schema. When a BIOC rule does not trigger, the most common causes are incorrect condition syntax or field names and a mismatch between the rule and the agent's content or policy. Verifying the rule's logic against the event schema and confirming that the agent has the correct content and policy assignment are the two essential diagnostic steps.

Answer

Restart the Cortex XDR management console to force rule recompilation

Answer

Change the rule's severity to Critical to ensure it generates an incident

Answer

Disable all other BIOC rules to isolate the non-triggering rule

Question 12

An administrator is setting up agent settings profiles in Cortex XDR. What is the primary purpose of creating multiple agent settings profiles?

Accepted Answer

To apply distinct security policies, operational modes, and exclusions to different groups of endpoints. Agent settings profiles let administrators bundle distinct security policy configurations — malware protection, exploit protection, behavioral threat settings, endpoint operational modes (e.g., block vs. report), and exclusions — and then assign each profile to different endpoint groups. This allows one tenant to enforce different postures for servers, workstations, or business units without duplicating the whole tenant configuration.

Answer

To assign different cloud tenants to individual users

Answer

To support different operating system architectures within the same profile

Answer

To manage software license renewals automatically

Question 13

An architect is designing a Cortex XDR deployment for an organization with strict outbound internet filtering. Agents cannot connect directly to the public cloud. Which architectural component must be installed within the DMZ or internal network to act as a proxy and forward agent traffic to the Cortex XDR cloud?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM is the architectural component designed to sit in a DMZ or internal network and proxy agent traffic to the Cortex XDR cloud when direct outbound internet access is restricted. It also handles other functions like local agent distribution, syslog collection, and WildFire forwarding. This makes it the correct answer for environments with strict outbound filtering.

Answer

Panorama Management Server

Answer

Cortex XSOAR Engine

Answer

WildFire Appliance

Question 14

An administrator wants to verify whether Cortex XDR successfully collected telemetry from a newly installed agent. Which reporting or query tool can be used to quickly list all active agents and their last seen timestamp?

Accepted Answer

Endpoint Management view in the Cortex XDR console. The Endpoint Management page provides a real-time inventory of all enrolled agents, their status, and last seen timestamps.

Answer

BIOC Rule Testing interface

Answer

Incident triage queue

Answer

Security Information and Event Management (SIEM) export logs

Question 15

An administrator is troubleshooting a Broker VM that is failing to pull updates from the Cortex XDR cloud. Upon inspecting the Broker VM system logs, the administrator notices SSL handshake errors. What is the most likely root cause?

Accepted Answer

An intervening firewall or explicit proxy is performing SSL decryption and presenting an untrusted certificate to the Broker VM. SSL inspection or interception by an explicit proxy or next-generation firewall without proper TLS decryption certificate installation causes SSL handshake failures on the Broker VM.

Answer

The Broker VM registration key contains invalid characters due to copy-paste formatting

Answer

The Cortex XDR management tenant license has expired due to billing cycle misalignment

Answer

The Broker VM kernel version is incompatible with the Linux swap space partition size

Question 16

What is the primary function of an Agent Settings profile in Cortex XDR?

Accepted Answer

To configure administrative options such as anti-tampering passwords and operational parameters.. An Agent Settings profile in Cortex XDR is used to configure administrative and operational options for the endpoint agent, including the anti-tampering password, agent logging level, malware scan schedules, and other behavior controls. It is applied to endpoints via policy rules and governs how the agent operates locally rather than defining detection content. This makes it the correct place for administrative parameters such as passwords and operational settings.

Answer

To establish network firewall rules for endpoint isolation.

Answer

To specify which file hashes are malicious and should be blocked.

Answer

To define exploit prevention techniques for browser-based attacks.

Question 17

An administrator is configuring a Cortex XDR automation rule to trigger a playbook when a new alert matches specific conditions. The playbook must run only for alerts with a severity of High or Critical and only for alerts originating from the 'Malware' alert category. Which TWO configuration elements must be set in the automation rule to enforce these conditions? (Choose two.)

Accepted Answer

Alert category filter set to Malware. To enforce severity and category conditions in a Cortex XDR automation rule, the rule must include a severity filter set to High and Critical and an alert category filter set to Malware. These two filters determine which alerts trigger the playbook. Timeout, exclusion lists, and endpoint groups do not control alert selection based on severity or category.

Answer

Playbook timeout set to 300 seconds

Answer

Endpoint group scoped to the 'Malware' group

Answer

Exclusion list containing all Medium and Low severity alerts

Question 18

An organization is deploying Cortex XDR agents across a restricted corporate network where endpoints cannot reach the public internet. How must the administrator configure the environment to ensure agents can successfully connect to the Cortex XDR server?

Accepted Answer

Deploy a Cortex XDR Broker VM internally to proxy agent communication to the Cortex XDR cloud.. When endpoints cannot reach the public internet, Cortex XDR agents cannot establish their outbound TLS connection to the Cortex XDR cloud. The supported solution is to deploy a Broker VM inside the restricted network; agents connect to the Broker, which proxies their traffic out to the Cortex XDR service. This preserves agent functionality without opening direct internet access from every endpoint.

Answer

Open outbound HTTPS port 443 directly from every endpoint to public DNS root servers.

Answer

Configure agents to communicate via SNMP traps to the primary domain controller.

Answer

Manually export logs via USB on each endpoint on a weekly basis.

Question 19

Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?

Accepted Answer

cytool. The cytool utility is the command-line interface on Windows endpoints for querying and managing the Cortex XDR agent. Running commands such as 'cytool status' or 'cytool info' displays the agent's operational status, connection state to the management server, and installed version. It is the standard tool for local agent diagnostics on Windows.

Answer

xdr-cli

Answer

traps-cli

Answer

pan-agent-ctl

Question 20

An administrator is configuring a Syslog Collector agent on Cortex XDR to ingest logs from a third-party firewall. Which log collection protocol and transport layer combination is natively supported by the Cortex XDR Collector for receiving unencrypted syslog messages?

Accepted Answer

Syslog over UDP and TCP. The Cortex XDR Collector natively supports receiving unencrypted syslog messages over both UDP and TCP. UDP is commonly used for syslog due to its low overhead, while TCP provides reliable delivery. This combination is standard for syslog ingestion in many security platforms.

Answer

Syslog over HTTP/HTTPS

Answer

Syslog over SSH tunneling

Answer

Syslog over FTP/SFTP