XDR-Engineer Practice Test 21 — 15 Questions

Question 1

An investigator is analyzing an advanced threat campaign using the Cortex XDR Incident View and reporting tools. Which THREE elements are typically included in an exported Incident Report PDF generated from Cortex XDR? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The causality chain or alert timeline illustrating the progression of the attack.. Option B is correct because the Cortex XDR Incident Report PDF includes the causality chain/alert timeline, which visualizes the root cause and the sequence of events that make up the attack progression. Option D is correct because the report opens with an executive summary that communicates the incident's scope, severity, and key findings for management and stakeholders. Option E is correct because the report enumerates the impacted endpoints/assets and the associated users involved, which is essential for scoping and remediation tracking. Option A is not included, as the report does not embed analyst remediation script source code repositories, and Option C is not included, since full raw PCAP files for all network flows are not bundled into the Incident Report PDF.

Answer

Source code repositories of all custom scripts executed by the analyst during remediation.

Answer

Complete raw packet capture (PCAP) files for all network flows observed during the incident.

Question 2

A Cortex XDR engineer is asked to reduce alert fatigue from a built-in Analytics BIOC that fires on legitimate administrative activity in the environment, while preserving detection of the malicious behavior the rule targets. The engineer must keep the rule active and avoid weakening coverage for genuinely malicious activity. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Add a Cortex XDR alert exclusion that filters out the known-good activity based on its specific attributes. Reducing false positives while preserving detection requires narrowly scoped suppression of the known-good activity, either through a rule exception or an attribute-based alert exclusion. Disabling the rule, altering severity, or starving telemetry either eliminates detection for the malicious behavior or fails to address the specific noisy pattern.

Answer

Raise the rule's severity threshold so that only critical-severity variants trigger alerts

Answer

Disable the built-in Analytics BIOC entirely and rely on generic malware signatures to catch the technique

Answer

Lower the agent data collection profile on affected endpoints to reduce the telemetry feeding the rule

Question 3

An analyst notices that an endpoint has been isolated due to a severe security incident, but investigation reveals the alert was a false positive. What is the correct procedure to restore network connectivity to the endpoint?

Accepted Answer

Select the endpoint in Endpoint Management and click 'Unisolate'.. The correct procedure to restore network connectivity to an isolated endpoint is to select the endpoint in Endpoint Management and click 'Unisolate'. This action directly reverses the isolation policy applied by the Cortex XDR agent, allowing the endpoint to communicate on the network again. Isolation is a containment measure that restricts all network traffic except to the management server; unisolating removes that restriction. This is the standard workflow for false positives.

Answer

Change the agent operating mode to Diagnostic mode.

Answer

Delete the incident from the triage queue.

Answer

Reinstall the Cortex XDR agent using the command line.

Question 4

An organization requires all custom BIOC alerts to be automatically tagged with the label 'Tier-3-Investigation' and assigned directly to a specific escalation group. Where can an administrator configure this automatic handling?

Accepted Answer

Incident Management / Incident Rules configuration. Cortex XDR's Incident Management area contains Incident Rules where administrators define conditions (such as BIOC alert name, severity, or MITRE tactic) and the resulting actions, including adding labels like 'Tier-3-Investigation' and assigning the incident to a specific escalation group. This is the native mechanism for automating alert triage and routing. Configuring it here ensures every matching BIOC alert is handled consistently without analyst intervention.

Answer

Agent installation package properties

Answer

Cortex XDR Collector configuration file

Answer

BIOC exclusion profile settings

Question 5

An administrator is planning the deployment of Cortex XDR agent protection on servers running critical databases. To prevent potential performance interference or locks on specific database files during agent scans, what should the administrator configure?

Accepted Answer

Configure custom scanning and monitoring path exclusions within the agent settings profile. Administrators configure scan exclusions and path exclusions in the agent settings profile to prevent interference with critical database files and directories.

Answer

Change the agent operational mode to Quarantine Mode exclusively for database servers

Answer

Disable the entire Cortex XDR agent service whenever database backup jobs run

Answer

Lower the agent thread priority via Windows Task Manager permanently

Question 6

When planning the deployment of Cortex XDR preventive capabilities, which mode should an administrator initially use to evaluate security posture without risking business disruption?

Accepted Answer

Telemetry and Monitoring (Detection-only) Mode. Deploying agents in a non-blocking or telemetry-only mode allows administrators to assess alerts and rule performance safely before enforcing blocks.

Answer

Aggressive Prevention Mode

Answer

Disabled Mode

Answer

Quarantine Mode

Question 7

A security administrator is planning to deploy the Cortex XDR agent to 500 Linux servers across multiple data centers. The organization wants to minimize administrative effort and ensure the agent is always running with the latest features. The servers have varying Linux distributions and kernel versions. Which deployment method should the administrator use?

Accepted Answer

Use the Cortex XDR agent installation script with a configuration file to automate deployment and enable automatic upgrades.. The Cortex XDR agent installation script with a configuration file enables automated, consistent deployment across diverse Linux servers and supports automatic upgrades, reducing administrative overhead and ensuring agents remain current. This approach is scalable and recommended for large fleets, unlike manual methods or unconfigured third-party tools.

Answer

Install the agent using the graphical user interface on each server to ensure proper configuration.

Answer

Manually install the agent on each server using the RPM package and configure a cron job for updates.

Answer

Deploy the agent via a third-party configuration management tool like Ansible, using the default package without modifications.

Question 8

A security administrator is creating a new agent installation package for a group of Windows endpoints that must be able to receive and act on live terminal commands from the Cortex XDR management console. The administrator wants the package to be preconfigured so no post-install policy change is needed. Which setting in the installation package creation wizard controls this capability?

Accepted Answer

Enable Live Terminal. Live Terminal is an agent-side capability that must be permitted before the console can open an interactive session on an endpoint. When the requirement is that the capability be preconfigured at install time, the installation package wizard exposes a dedicated toggle for it. Enabling that toggle during package creation ensures every endpoint receiving the package can be administered through live terminal without a later policy edit.

Answer

Enable Behavioral Threat Protection

Answer

Enable Content Update

Answer

Enable Device Control

Question 9

A Cortex XDR engineer is configuring a new ingestion pipeline for a custom application that emits JSON logs over HTTP. The application can POST logs to a webhook but does not support syslog. The engineer wants the logs to be parsed, mapped to XDR fields, and available for correlation with endpoint telemetry. Which Cortex XDR component should be used to receive these logs?

Accepted Answer

Broker VM HTTP Collector. The Broker VM HTTP Collector is the correct choice because it natively accepts HTTP POST requests, which the application can generate. It supports JSON and other formats, allowing the engineer to define parsing rules and map fields to XDR schema. This enables correlation with endpoint data without requiring the application to support syslog.

Answer

Cortex XDR Syslog Collector

Answer

Cortex XDR Agent with the Log Forwarding profile

Answer

Cortex XDR API with the /logs/ingest endpoint

Question 10

A Cortex XDR administrator notices that the Cortex XDR agent on a Windows endpoint is not reporting any new events to the Cortex XDR management console for the past 24 hours, although the endpoint is online and other agents are reporting normally. The administrator verifies that the agent service is running. Which of the following is the MOST likely cause?

Accepted Answer

The agent's communication with the Cortex XDR server is blocked by a firewall or proxy.. When an agent service is running but no events appear in the console, the most likely cause is a communication breakdown between the agent and the Cortex XDR server. This could be due to firewall rules, proxy misconfigurations, or network issues. Checking connectivity and proxy settings is a standard troubleshooting step.

Answer

The agent is in a 'Disconnected' state due to a certificate mismatch with the Cortex XDR server.

Answer

The agent has exceeded its license limit and stopped reporting.

Answer

The agent's local database is corrupted and needs to be reset.

Question 11

An XDR engineer is creating a correlation rule in Cortex XDR to detect a sequence of events: a suspicious process creation followed by a network connection to a known malicious IP. The engineer wants the rule to trigger only if both events occur on the same endpoint within 5 minutes. Which configuration should the engineer use to achieve this?

Accepted Answer

Use a single correlation rule with a time window of 5 minutes and group by endpoint ID.. Correlation rules are designed to detect sequences or combinations of events across a specified time window and can group by fields such as endpoint ID. Setting a 5-minute window and grouping by endpoint ID ensures the rule triggers only when both events occur on the same endpoint within that period.

Answer

Use a scheduled query with a join on endpoint ID and a time difference filter.

Answer

Configure a custom parser to tag both events and then use a dashboard filter.

Answer

Create two separate BIOC rules and use an exception to link them.

Question 12

A Cortex XDR administrator is troubleshooting why a specific endpoint is not receiving updated policy settings from the Cortex XDR management console. The administrator confirms that the endpoint is online and the agent is running. The agent version is up to date. Which of the following should the administrator check FIRST to resolve this issue?

Accepted Answer

Verify that the endpoint is assigned to the correct policy in the Cortex XDR management console.. Policy assignment is a fundamental step in ensuring endpoints receive the correct settings. If an endpoint is not in the appropriate group or the policy is not applied to that group, it will not receive updates. Checking assignment is quick and non-disruptive, making it the best first step.

Answer

Check the endpoint's firewall to ensure it allows inbound connections from the Cortex XDR server.

Answer

Reinstall the Cortex XDR agent on the endpoint.

Answer

Restart the Cortex XDR agent service on the endpoint.

Question 13

A Cortex XDR administrator needs to prevent end users on Windows endpoints from disabling the Cortex XDR agent from the system tray, while still allowing administrators to stop the service for maintenance. Which agent configuration should the administrator apply?

Accepted Answer

Enable agent tamper protection in the Agent Settings profile so users cannot stop or uninstall the agent without a valid uninstall password.. Tamper protection is the Cortex XDR mechanism designed specifically to stop unauthorized users and processes from terminating or removing the agent while preserving an administrative override via the uninstall password. Report-only mode, Malware profiles, and Data Collection profiles address detection, prevention policy, and telemetry respectively, none of which prevent a local user from disabling the agent service.

Answer

Configure a Data Collection profile to capture agent stop events and alert the SOC when the agent is terminated.

Answer

Assign the endpoints to a stricter Malware profile that disables the local agent UI entirely.

Answer

Set the agent to run in report-only mode via the Agent Settings profile so users cannot alter prevention modules.

Question 14

A Cortex XDR administrator wants new Windows endpoints to receive the latest agent version automatically when a new agent release becomes available, without manually reinstalling. Which agent configuration should the administrator enable?

Accepted Answer

Enable automatic agent upgrade in the Agent Settings profile so the agent checks for and installs approved versions.. Automatic agent upgrade is the dedicated setting that allows Cortex XDR agents to detect and install approved newer agent versions on their own. Scan schedules, Malware profiles, and content updates affect scanning behavior, prevention actions, and detection content respectively, and none of them replace the agent binary with a newer version.

Answer

Enable content update downloads only, since agent binary updates are bundled with content releases.

Answer

Set the Malware profile to block unknown executables, which forces the agent to update its engine.

Answer

Configure the agent to run a scheduled full scan every 24 hours, which also triggers a version check.

Question 15

A Cortex XDR administrator is troubleshooting a Windows endpoint where the agent is installed and running but does not appear in the management console. The administrator confirms the endpoint has internet access. Which agent configuration element is MOST likely misconfigured?

Accepted Answer

The agent's registration token or server address embedded in the installation package is incorrect for the target tenant.. An agent that runs but never appears in the console most often has a registration problem, typically an incorrect server address or registration token embedded during installation, which prevents authentication to the intended tenant. Malware profile actions, Data Collection scope, and scan schedules all affect post-registration behavior and cannot by themselves keep a healthy endpoint from registering.

Answer

The endpoint's Data Collection profile is set to collect only critical events.

Answer

The agent's scan schedule is set to run weekly instead of daily.

Answer

The endpoint's assigned Malware profile has prevention modules set to block instead of report.