XDR-Engineer Practice Test 2 — 25 Questions

Question 1

An administrator wants to run an ad-hoc query to investigate failed logon attempts across all endpoints over the last 24 hours. Which tool in Cortex XDR should the administrator use?

Accepted Answer

XQL Search. XQL Search is the native query tool in Cortex XDR used to search and analyze collected endpoint and network datasets.

Answer

BIOC Generator

Answer

Correlation Rules Builder

Answer

Query Builder for Syslog

Question 2

What is the primary purpose of using a Broker VM in a Cortex XDR deployment architecture?

Accepted Answer

To act as a local log collector, aggregator, and agent proxy for data sources that cannot directly connect to the Cortex XDR cloud. Broker VMs act as intermediary collectors and forwarders for logs, threat intel, and cloud integrations in environments where direct cloud access is restricted.

Answer

To host the core Cortex XDR multi-tenant cloud database

Answer

To run local endpoint antivirus scans on unmanaged guest laptops

Answer

To replace all physical firewalls and routers within the corporate perimeter

Question 3

An administrator is writing a custom Python automation script within a Cortex XSOAR integration. Which TWO standard practices should be followed to ensure proper execution and error handling within the platform? (Choose two)

Accepted Answer

Return results using structured 'CommandResults' objects containing standard outputs and human-readable text. Option B is correct because Cortex XSOAR integrations should return structured CommandResults objects, which carry the standard context outputs (readable by playbooks) and the human-readable entry text shown in the War Room, ensuring downstream automation can consume the data reliably. Option C is correct because integration code must catch exceptions and report failures through return_error(), which produces a proper error entry in the War Room instead of letting the script crash and lose the failure context. The unmarked options are inappropriate: A writes to hypervisor kernel memory (impossible and unsafe from a containerized integration), D uses CPU-spinning infinite loops that would hang the integration worker, and E leaks credentials into public logs, violating security best practices.

Answer

Write raw binary data directly to the host hypervisor kernel memory space

Answer

Execute infinite `while` loops without sleep intervals to maximize CPU usage

Answer

Print debug passwords in plain text to public stdout logs

Question 4

An administrator needs to deploy the Cortex XDR agent across a multi-tenant environment using a single management console. How should the administrator structure the deployment to isolate endpoint data between different business units?

Accepted Answer

Create distinct agent installation packages with embedded registration tokens tied to specific Cortex XDR folders and assign RBAC scopes. Cortex XDR supports multi-tenancy through child tenants or by using endpoint groups and granular role-based access control (RBAC).

Answer

Modify the Windows Registry on each endpoint to point to separate cloud regions

Answer

Deploy multiple Broker VMs on the same subnet and assign static VLAN tags

Answer

Install multiple instances of the Cortex XDR agent side-by-side on each endpoint

Question 5

A Cortex XDR engineer is configuring a Broker VM to collect logs from a third-party EDR solution that writes to a local folder on the Broker VM as JSON files. The engineer needs Cortex XDR to parse these files and map the fields into the XDR data model. Which component should the engineer configure on the Broker VM to achieve this?

Accepted Answer

File Collector. The File Collector on a Broker VM is specifically built to ingest logs from files on the local filesystem, including JSON, and to apply parsing rules that map fields into the Cortex XDR schema. It is the only listed component that can read files and forward their contents to Cortex XDR for analysis.

Answer

Syslog Collector

Answer

Windows Event Collector

Answer

Network Mapper

Question 6

An enterprise security team wants to ingest NetFlow records from core routers into Cortex XDR. Which component and collector combination supports NetFlow/IPFIX ingestion?

Accepted Answer

Broker VM with the NetFlow / IPFIX Collector enabled. NetFlow/IPFIX ingestion in Cortex XDR is supported through the Broker VM with the NetFlow/IPFIX Collector enabled. The Broker VM acts as a collector that receives flow data from routers and forwards it to Cortex XDR for analysis. This is the designed architecture for network flow ingestion.

Answer

Direct API streaming from router CLI to the XDR cloud storage bucket

Answer

Cortex XDR Agent installed directly on the core routers via SSH

Answer

Cortex XSOAR integration instance using SNMP polling

Question 7

A security engineer is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints that are managed by Microsoft Endpoint Configuration Manager (MECM). The organization wants to automate the installation and ensure that the agent is installed with the correct distribution package. What should the engineer do first to obtain the necessary installation package for MECM deployment?

Accepted Answer

Download the Cortex XDR agent installer from the Cortex XDR management console and create a deployment package in MECM.. The correct approach is to download the Cortex XDR agent installer from the management console and package it for MECM. This ensures the correct version, tenant-specific settings, and integration with MECM's deployment capabilities. Other methods either rely on manual user actions, use incorrect sources, or are not applicable to third-party software distribution.

Answer

Retrieve the agent installer from the Palo Alto Networks Customer Support Portal and upload it to MECM.

Answer

Use the Cortex XDR API to generate a one-time installation link and send it to all users via email.

Answer

Configure MECM to pull the agent installer directly from the Microsoft Update Catalog.

Question 8

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

Accepted Answer

To automatically apply specific configuration and security settings upon agent registration.. Assigning an agent profile to an installation package ensures that when the agent registers with the Cortex XDR cloud, it automatically receives the configuration and security settings defined in that profile. This streamlines deployment by applying the correct policy set without manual intervention. The profile determines settings like Malware Protection, Exploit Protection, and Agent Settings for the endpoint.

Answer

To encrypt the installation binary against unauthorized tampering during transit.

Answer

To determine which operating system architecture (32-bit or 64-bit) the package will target.

Answer

To set the license expiration date for the endpoint.

Question 9

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

Accepted Answer

The administrator must provide the anti-tampering password configured in the Cortex XDR console.. Cortex XDR's anti-tampering feature requires the anti-tampering password — configured in the Agent Settings profile in the management console — before the agent's protection can be disabled locally using cytool. This prevents unauthorized users or malware from turning off endpoint protection. The administrator must supply this password when running the disable command.

Answer

A live terminal session must be opened from the cloud console to execute the command.

Answer

The agent must first be uninstalled and reinstalled in debug mode.

Answer

The endpoint must be disconnected from the active domain controller.

Question 10

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

Accepted Answer

TCP port 443 for cloud tenant and agent communication. Option A is correct because the Cortex XDR Broker VM uses TCP 443 to communicate outbound with the Cortex XDR cloud tenant and to receive agent traffic, which is the standard secure HTTPS channel for registration, policy, and telemetry. Option B is correct because the Broker VM's syslog ingestion component listens on UDP/TCP 514 by default (and can be set to custom ports) to collect syslog from firewalls, proxies, and other log sources. Option C is wrong because Telnet on TCP 23 is an insecure legacy management protocol and is not used for Broker VM syslog or agent communication. Option D is wrong because TFTP on UDP 69 is a trivial file-transfer protocol, not an agent staging or communication mechanism for the Broker VM. Option E is wrong because RDP on TCP 3389 is a Windows remote-desktop service, not a log-streaming or agent-communication channel for the Broker VM.

Answer

TCP port 23 for Telnet remote management

Answer

UDP port 69 for Trivial File Transfer Protocol (TFTP) agent staging

Answer

TCP port 3389 for Remote Desktop Protocol (RDP) log streaming

Question 11

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

Accepted Answer

Agent software version. Option A (Agent software version) is correct because the Endpoint Management module in Cortex XDR displays the installed agent version for each enrolled endpoint, allowing analysts to verify whether agents are up to date and identify version drift across the fleet. Option C (Last seen timestamp) is correct because the console shows when each agent last communicated with the Cortex XDR management server, which is essential for spotting offline or unresponsive endpoints. The unmarked options do not belong: hard drive manufacturing serial numbers (B), BIOS cryptographic signature keys (D), and local administrator password hashes (E) are not status fields exposed in the Endpoint Management agent inventory, and password hashes in particular would never be surfaced in a management console for security reasons.

Answer

Hard drive manufacturing serial number

Answer

BIOS cryptographic signature key

Answer

Local administrator password hash

Question 12

A security administrator needs to block a known malicious executable from running across all Windows endpoints managed by Cortex XDR. The file is identified by its SHA-256 hash. The administrator wants the block to be enforced at the agent level without scanning file content. Which Cortex XDR feature should be used?

Accepted Answer

Configure an Indicators of Compromise (IOC) policy with a hash indicator and set the action to Block.. Cortex XDR provides the Indicators of Compromise (IOC) feature to block or report on specific artifacts such as file hashes. By creating an IOC policy with the SHA-256 hash and setting the action to Block, the administrator can immediately prevent the executable from running on all targeted endpoints. This method is precise and does not rely on signature updates or heuristic detection.

Answer

Create a Malware profile with a custom blocklist that includes the SHA-256 hash.

Answer

Use the Exploit Protection profile to add the executable to the list of blocked processes.

Answer

Add the SHA-256 hash to the Blocklist in the Cortex XDR management console under Endpoints > Blocklist.

Question 13

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

Accepted Answer

Upload the custom CA certificate bundle into the Broker VM trust store via the Broker VM management page. To trust self-signed certificates on a Broker VM, the administrator must upload the custom CA certificate bundle via the Broker VM management interface.

Answer

Add the target API IP address to the Broker VM local hosts file

Answer

Modify the Broker VM system kernel parameters to ignore cipher mismatches

Answer

Disable SSL/TLS verification globally for all Cortex XDR broker app modules

Question 14

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

Accepted Answer

Data Collection profile. The Data Collection profile dictates what telemetry, logs, and files are gathered and sent from the endpoint to the Cortex XDR backend.

Answer

Exploit Protection profile

Answer

Agent Settings profile

Answer

Biometric Threat Prevention profile

Question 15

An administrator needs to ensure that Cortex XDR agents on a set of Linux endpoints can communicate with the Cortex XDR management console through a forward proxy. The proxy requires authentication. Which configuration should the administrator apply to the agent?

Accepted Answer

Configure the proxy settings in the Agent Settings profile, specifying the proxy address, port, and authentication credentials.. To configure an authenticated forward proxy for Cortex XDR agents, the administrator must use an Agent Settings profile. This profile includes proxy settings where the address, port, and credentials can be specified. Applying the profile to the target Linux endpoints ensures the agents use the proxy for communication. Other methods, such as local file edits or global server settings, are not supported and would not reliably achieve the goal.

Answer

Configure the proxy settings in the Cortex XDR management console under Server Settings, which automatically applies to all agents.

Answer

Use a transparent proxy that does not require authentication, as Cortex XDR agents do not support authenticated proxies.

Answer

Edit the agent configuration file on each Linux endpoint to include the proxy details and restart the agent service.

Question 16

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

Accepted Answer

Analytics rule descriptions and details within the Cortex XDR console / documentation reference. The engineer can review the definition and rule logic of built-in Analytics detectors in the Analytics rule descriptions and details within the Cortex XDR console or documentation reference. This provides insight into the behavioral logic and heuristics used by the Analytics engine.

Answer

Agent binary configuration file (agent.conf)

Answer

Host Insights Vulnerability assessment database

Answer

Cortex XSOAR Playbook Designer source code

Question 17

An XDR engineer needs to automate the enrichment of Cortex XDR incidents with threat intelligence from an external MISP instance. The MISP API requires an authentication key and returns JSON. Which Cortex XDR automation component should be used to create a custom integration that queries MISP and updates incident fields?

Accepted Answer

Cortex XDR Integrations. Integrations are the automation component designed to connect to external systems, handle authentication such as MISP API keys, and parse JSON responses. They enable custom commands that can be invoked by playbooks to enrich incidents. Scripts, Playbooks, and Dashboards do not provide the API connectivity and parsing capabilities required for this scenario.

Answer

Cortex XDR Scripts

Answer

Cortex XDR Dashboards

Answer

Cortex XDR Playbooks

Question 18

A Cortex XDR administrator needs to verify that the Broker VM is receiving and forwarding endpoint telemetry to the Cortex XDR management console. The Broker VM appears online in the console, but no new endpoint logs have appeared for several hours. Which Broker VM component should the administrator check first to confirm that log ingestion is functioning?

Accepted Answer

The Broker VM Log Collector service. When a Broker VM is online but endpoint logs stop arriving, the first component to verify is the Log Collector service, which is responsible for receiving and forwarding endpoint telemetry. Other broker services handle different data types or unrelated functions, so they would not explain the absence of Cortex XDR agent logs.

Answer

The Broker VM Syslog Collector service

Answer

The Cortex XDR agent content update scheduler

Answer

The Cortex XDR management console database replication status

Question 19

A security engineer is planning to deploy Cortex XDR agents to a large fleet of Windows servers that have no direct internet access. The organization wants the agents to receive content updates without exposing each server to the internet. Which component should be deployed to meet this requirement?

Accepted Answer

Cortex XDR Broker VM. The Broker VM is designed to serve as an on-premises proxy and cache for Cortex XDR agents, enabling them to receive content updates even when they cannot directly reach the internet. It is the recommended component for environments with restricted connectivity, as it centralizes update distribution and reduces external exposure.

Answer

Cortex XDR agent with a proxy configuration pointing to an external web proxy

Answer

Cortex XDR agent with a local content update repository on each server

Answer

Cortex XDR management console with a content update schedule

Question 20

A Cortex XDR administrator needs a recurring report that shows the top ten MITRE ATT&CK techniques observed across all incidents in the last seven days, broken down by severity. The report must be generated automatically every Monday at 06:00 and emailed to the security leadership team. Which Cortex XDR capability should the administrator configure to meet these requirements?

Accepted Answer

Create a custom dashboard widget with an XQL query grouped by technique and severity, then configure a scheduled report template that includes that widget and delivers it by email.. The requirement combines aggregation, visualization, scheduling, and email delivery. Cortex XDR achieves this through dashboard widgets backed by XQL for the grouped technique-and-severity view, plus a scheduled report template that bundles the widget and sends it to recipients. Rules and exclusions operate on live telemetry and cannot produce a recurring top-ten analytical report.

Answer

Configure an alert exclusion that suppresses all but the top ten techniques, then enable scheduled email notifications on the incident management page.

Answer

Create a correlation rule that groups incidents by ATT&CK technique and enable the built-in weekly incident summary email that ships with the Cortex XDR console.

Answer

Create a BIOC rule that matches ATT&CK technique identifiers and configure a notification email action on the rule so it fires every Monday at 06:00.