XDR-Engineer Practice Test 4 — 25 Questions

Question 1

Which type of profile in Cortex XDR controls the collection of endpoint telemetry used for threat hunting and forensic analysis?

Accepted Answer

Data Collection profile. Data Collection profiles determine what security telemetry and artifacts are gathered from endpoints and sent to the Cortex XDR backend.

Answer

Agent Settings profile

Answer

Malware Protection profile

Answer

Network Control profile

Question 2

Which THREE advanced troubleshooting steps can an administrator take when analyzing a malfunctioning Cortex XDR agent on a Linux endpoint? (Choose three)

Accepted Answer

Verify that required kernel headers or dependencies are installed and loaded properly.. Troubleshooting Linux agents involves inspecting system services, log files in standard directories, and kernel module/system extension status.

Answer

Reformat the Linux root filesystem and reinstall the operating system kernel.

Answer

Modify the Windows Registry keys for the Cortex XDR service.

Question 3

An administrator wants to configure role-based access control (RBAC) so that a newly formed tier-1 SOC team can view incidents and run XQL queries, but cannot modify firewall rules, agent settings, or create custom BIOC rules. Where should the administrator configure this role?

Accepted Answer

Settings -> Configurations -> Roles. Role-Based Access Control (RBAC) roles and permissions in Cortex XDR are managed under Settings -> Configurations -> Roles.

Answer

Agent Settings -> Profiles -> Permissions

Answer

Host Insights -> License Roles

Answer

Incident Management -> Access Control

Question 4

An organization is deploying Cortex XDR agents across a restricted corporate network where endpoints cannot reach the public internet. How must the administrator configure the environment to ensure agents can successfully connect to the Cortex XDR server?

Accepted Answer

Deploy a Cortex XDR Broker VM internally to proxy agent communication to the Cortex XDR cloud.. In isolated networks, administrators must configure a Cortex XDR Broker VM to act as a proxy/collector within the internal network, allowing agents to forward telemetry and receive updates through the internal Broker VM.

Answer

Open outbound HTTPS port 443 directly from every endpoint to public DNS root servers.

Answer

Configure agents to communicate via SNMP traps to the primary domain controller.

Answer

Manually export logs via USB on each endpoint on a weekly basis.

Question 5

An organization utilizes custom correlation rules in Cortex XDR. An engineer needs to export these custom BIOC rules to backup configurations or migrate them to another Cortex XDR tenant. Which administrative feature supports this?

Accepted Answer

Export and Import options within the BIOC management interface. Cortex XDR provides administrative export and import capabilities under Analytics / BIOC rules to manage rule portability.

Answer

Agent deployment script parameter flags

Answer

Cortex XDR API key generation settings

Answer

Data Export Service configuration bucket

Question 6

Which THREE parameters or settings can be managed within a Data Collection profile in Cortex XDR? (Choose three)

Accepted Answer

Collection of process execution and file creation telemetry. Data Collection profiles configure what artifacts, telemetry, and forensic data are gathered from endpoints.

Answer

Defining local firewall blocking rules for network isolation

Answer

Setting the anti-tampering administrator password for agent removal

Question 7

An analyst notices that a custom BIOC rule is generating too many false positives during normal software deployments. What is the most appropriate next step in detection engineering for this rule?

Accepted Answer

Tune the BIOC rule logic by adding specific process path exclusions or qualifying criteria.. Tuning detection logic by refining filters, excluding specific process paths, or adding qualifying criteria is the standard method to handle false positives.

Answer

Change the agent operating mode to Bypass.

Answer

Disable the entire Analytics engine on all endpoints.

Answer

Delete the BIOC rule and rely solely on default cloud-delivered IOCs.

Question 8

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

Accepted Answer

Analytics rule descriptions and details within the Cortex XDR console / documentation reference. While custom BIOCs are fully user-editable, built-in Analytics rule details, descriptions, and attack descriptions are documented within the Cortex XDR Analytics documentation and rule description references in the console.

Answer

Agent binary configuration file (agent.conf)

Answer

Host Insights Vulnerability assessment database

Answer

Cortex XSOAR Playbook Designer source code

Question 9

An analyst wants to view the complete Attack Story (causality chain) of an incident to understand how an initial phishing email led to credential dumping. Where in the Cortex XDR console should the analyst navigate?

Accepted Answer

Incident Details -> Causality View. The Causality View within the Incident Details page provides the visual attack story graph mapping out process ancestry and network activity.

Answer

Host Insights -> System Explorer

Answer

Reporting -> Scheduled Reports -> Attack Chain

Answer

Settings -> Configurations -> Causality

Question 10

An engineer is writing an XQL query to investigate rare process executions. The query needs to calculate the distinct count of endpoints where each process image name was executed, filtering out processes that appeared on more than 50 hosts. Which XQL snippet correctly implements this filter after aggregation?

Accepted Answer

stats host_count = count(distinct hostname) by actor_process_image_name | filter host_count <= 50. After using `stats` to aggregate and calculate distinct host counts (e.g., `stats host_count = count(distinct hostname)`), the subsequent `filter` command must be applied to the newly created aggregate field `host_count <= 50`.

Answer

filter host_count <= 50 | stats host_count = count(distinct hostname) by actor_process_image_name

Answer

group by actor_process_image_name having count(distinct hostname) <= 50

Answer

stats host_count = count(hostname) where host_count <= 50

Question 11

An organization uses Cortex XDR to ingest cloud audit logs (such as AWS CloudTrail) alongside endpoint telemetry. An analyst wants to write an XQL query to search for AWS console login failures across the `aws_cloudtrail_raw` dataset. Which XQL structure properly targets cloud logs and filters for failed logins?

Accepted Answer

dataset = aws_cloudtrail_raw | filter eventName == 'ConsoleLogin' and responseElements contains 'Failure'. When querying cloud connector logs in Cortex XDR, the dataset name corresponds to the cloud source (e.g., `aws_cloudtrail_raw`) and fields match the cloud schema.

Answer

dataset = panw_analytics_alerts | filter source == 'AWS'

Answer

dataset = xdr_data | filter cloud_event == 'AWS_LOGIN_FAIL'

Answer

dataset = endpoints_inventory | filter cloud_provider == 'AWS'

Question 12

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

Accepted Answer

Agent software version. Endpoint Management displays operational agent details including the agent version and the last seen timestamp.

Answer

Hard drive manufacturing serial number

Answer

BIOS cryptographic signature key

Answer

Local administrator password hash

Question 13

An organization wants to ingest custom syslog data from a third-party firewall into Cortex XDR and build detection rules around it. Which feature enables parsing and structuring this unformatted log data so it can be queried effectively using XQL?

Accepted Answer

Custom Parsing Rules. Cortex XDR uses Parsing Rules (or custom log parsing via Cortex XDR Collector / Broker VM) to map raw log fields into standard data schema fields.

Answer

Data Stitching Rules

Answer

BIOC Exception Filters

Answer

BIOC Correlation Policies

Question 14

An investigator is analyzing an advanced threat campaign using the Cortex XDR Incident View and reporting tools. Which THREE elements are typically included in an exported Incident Report PDF generated from Cortex XDR? (Choose three)

Accepted Answer

The causality chain or alert timeline illustrating the progression of the attack.. Incident reports exported from Cortex XDR include executive summaries, affected assets, causality chain graphs, and timeline details.

Answer

Source code repositories of all custom scripts executed by the analyst during remediation.

Answer

Complete raw packet capture (PCAP) files for all network flows observed during the incident.

Question 15

Which role is required within Cortex XDR for a user to configure API keys, data integration settings, and automation playbooks?

Accepted Answer

Account Admin or Security Administrator role. Administrative tasks such as configuring data integration and API keys require an Administrator role or equivalent permissions.

Answer

Endpoint Viewer role

Answer

Standard User role

Answer

SOC Analyst Tier 1 role

Question 16

An administrator is configuring data forwarding filters in Cortex XDR to send specific severity alerts to a SIEM. The requirement is to forward all 'High' and 'Critical' severity alerts while excluding 'Low' and 'Medium' alerts. Where is this filter configured?

Accepted Answer

Under Settings > Configurations > Data Forwarding rules. Data forwarding rules with specific filters are configured under Settings > Configurations > Data Forwarding.

Answer

In the Cortex XDR Agent installation package configuration properties

Answer

Inside the Cortex XSOAR incident layout editor

Answer

On the Broker VM local routing table configuration

Question 17

An organization requires all custom BIOC alerts to be automatically tagged with the label 'Tier-3-Investigation' and assigned directly to a specific escalation group. Where can an administrator configure this automatic handling?

Accepted Answer

Incident Management / Incident Rules configuration. Cortex XDR allows administrators to configure Incident View rules or Alert forwarding / Incident automation rules to automatically assign, tag, and categorize incoming alerts matching specific criteria.

Answer

Agent installation package properties

Answer

Cortex XDR Collector configuration file

Answer

BIOC exclusion profile settings

Question 18

An analyst wants to write an advanced XQL query that correlates network connection events with process execution events using a common join key (`causality_id`). Which XQL command operator is used to combine two datasets based on a matching field?

Accepted Answer

join. In XQL, the `join` operator is used to combine datasets or query streams based on shared keys such as causality IDs.

Answer

link

Answer

merge_streams

Answer

combine_tables

Question 19

An administrator is designing a scheduled report distribution list in Cortex XDR. Which TWO formats can be selected when generating and exporting scheduled reports? (Choose two)

Accepted Answer

CSV. Cortex XDR supports exporting scheduled reports in standard formats including PDF and CSV.

Answer

PowerPoint Presentation (.pptx)

Answer

Windows Executable (.exe)

Answer

Virtual Machine Disk (.vmdk)

Question 20

Where within the Cortex XDR console should an administrator configure scheduled reporting to automatically email executive summaries to stakeholders on a weekly basis?

Accepted Answer

Reporting > Report Builder. Scheduled reporting and report generation templates are managed within the Dashboards and Reports section of Cortex XDR.

Answer

Incident Response > Incident Management

Answer

XQL Search > Scheduled Queries

Answer

Settings > Configurations > Email Notifications