XDR-Engineer Practice Test 1 — 30 Questions

Question 1

An automation playbook in Cortex XSOAR needs to execute a custom Python script that interacts with an internal legacy database not covered by existing Marketplace integrations. Which component should the administrator use to securely run this custom script?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A custom Python Integration running inside an isolated Docker container managed by the engine/server. Custom scripts and integrations in Cortex XSOAR execute within a Docker container environment managed by integration containers or custom Python scripts.

Answer

A local Windows batch script executed by the Cortex XDR endpoint agent

Answer

Direct execution via SSH on the Cortex XDR multi-tenant cloud backend

Answer

A direct SQL query string passed unencrypted through the Syslog collector port

Question 2

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Accepted Answer

Cortex XSOAR Server Audit and Server logs (/var/log/demisto/server.log). Troubleshooting API and automation issues involves reviewing the Cortex XSOAR integration debug logs and the Audit Trail / Server logs.

Answer

Windows Event Viewer Security log on unmanaged workstations

Answer

Local BIOS firmware event logs

Answer

Cortex XDR Agent installation MSI error logs

Question 3

An endpoint user reports that a legitimate internal application is being blocked by Cortex XDR Exploit Protection. The administrator wants to create an exception without completely disabling the module. Which mechanism should the administrator use in the Cortex XDR console?

Accepted Answer

Add a profile exception under Settings > Configurations > Agent Configurations specifying the exploit module and application path.. BIOC (Behavioral Indicator of Compromise) and Exploit Protection exceptions can be managed via Exception profiles or profile exclusions in Cortex XDR.

Answer

Disable behavioral threat protection globally.

Answer

Create a correlation rule to suppress alerts from that path.

Answer

Modify the Broker VM ingestion filter.

Question 4

An enterprise environment uses a proxy server for all outbound internet traffic. How must the administrator configure the Cortex XDR Agent to ensure it can successfully connect through the proxy to the Cortex XDR cloud?

Accepted Answer

Configure the proxy address, port, and authentication credentials within the Agent Configuration profile under Settings.. Proxy settings for the Cortex XDR agent are configured within the Agent Configuration profile in the Cortex XDR management console before installation or pushed via update.

Answer

Configure the proxy settings inside the Traps.properties file locally on each endpoint.

Answer

Modify the Windows Registry key 'ProxyServer' manually on every endpoint without console involvement.

Answer

Configure the proxy settings on the Broker VM only.

Question 5

An administrator is troubleshooting an issue where custom Correlation Rules in Cortex XDR are not generating expected incidents. Which THREE diagnostic steps should the administrator perform? (Choose three)

Accepted Answer

Check rule status to ensure the rule is enabled and assigned to the correct scope or endpoint group.. Troubleshooting correlation rules involves validating query logic, reviewing time windows, and checking matching criteria.

Answer

Restart all endpoint agents associated with the correlation rule.

Answer

Reboot the Broker VM log collector service.

Question 6

An automation playbook in Cortex XSOAR requires parsing a raw email message payload received in an incident. Which built-in automation command or integration should the playbook use to extract indicators of compromise (IOCs) such as URLs, IPs, and file hashes from the email body?

Accepted Answer

Run the 'ExtractIOCs' parsing command on the email body field. ExtractIOCs is a core Cortex XSOAR parsing command used to extract indicators from unstructured text like emails.

Answer

Forward the raw email to the Cortex XDR Agent collector service

Answer

Trigger the 'Device-Control-Block' command against the email sender

Answer

Execute a raw regex match script via PowerShell on a Broker VM worker

Question 7

What is the primary function of the Cortex XDR 'Content Pack' in Marketplace?

Accepted Answer

To provide pre-packaged integrations, playbooks, dashboards, and automation building blocks. Content packs in Marketplace package pre-built integrations, playbooks, dashboards, and incident types.

Answer

To install local antivirus signatures directly onto endpoint file systems

Answer

To store encrypted backups of Cortex XDR database records

Answer

To compile raw C++ source code for custom endpoint isolation drivers

Question 8

An administrator is configuring automated incident enrichment in Cortex XDR. Whenever a new malware incident is generated, the system should automatically query VirusTotal using an integration. Where should this automated workflow be built and attached?

Accepted Answer

As an automated Playbook attached to Incident Trigger rules in the Automation module. Automated workflows triggered by incident creation are built as Playbooks in Cortex XSOAR / XDR Automation and attached to Incident Classification or Trigger rules.

Answer

Inside the Cortex XDR Agent installation policy settings

Answer

Inside the Broker VM local crontab configuration file

Answer

As a local cron job running on each individual endpoint

Question 9

An enterprise environment uses a forward proxy for all outbound internet traffic. The Broker VM deployed in the internal network cannot reach external cloud APIs for threat intelligence enrichment. How should the administrator configure the Broker VM to route traffic through the forward proxy?

Accepted Answer

Configure the proxy settings using the Broker VM configuration menu or environment variables (HTTP_PROXY / HTTPS_PROXY). Broker VM proxy settings are configured during or after deployment via the Broker VM CLI or configuration menu to set HTTP_PROXY/HTTPS_PROXY environment variables.

Answer

Deploy a secondary Broker VM in the DMZ to act as an internal DNS forwarder

Answer

Modify the Windows Registry on the Broker VM host machine

Answer

Write a custom automation playbook in Cortex XSOAR to tunnel packets through ICMP

Question 10

Which TWO actions can be performed directly within the Cortex XDR Data Integration management interface? (Choose two)

Accepted Answer

Define custom log parsing and mapping rules. Data Integration interface allows configuring Broker VMs and defining custom log mappings.

Answer

Provision physical server rack enclosures

Answer

Configure corporate Wi-Fi guest portal splash pages

Answer

Flash BIOS firmware on enterprise routers

Question 11

An organization requires high availability and load balancing for their Broker VM log ingestion tier. Which TWO architectural considerations or configurations support this requirement? (Choose two)

Accepted Answer

Deploying multiple Broker VMs behind an external Layer 4 load balancer for syslog/network log ingestion. High availability for Broker VMs involves deploying multiple Broker VMs behind a load balancer and configuring collectors across instances.

Answer

Sharing a single static IP address across independent uncoordinated cloud regions without routing

Answer

Running multiple active database instances on the same Broker VM container kernel

Answer

Disabling all network encryption to speed up packet forwarding

Question 12

An administrator needs to ingest Office 365 audit logs into Cortex XDR. Which integration method is officially supported and recommended by Palo Alto Networks for this data source?

Accepted Answer

Office 365 Management Activity API integration. Office 365 logs are ingested using the Office 365 Management Activity API integration via Broker VM or cloud-to-cloud integration.

Answer

Local WMI polling from a Windows domain controller

Answer

SNMP trap listener configured on the endpoint agent

Answer

Syslog forwarding from Microsoft Outlook client applications

Question 13

An XDR administrator needs to forward Cortex XDR alerts to an external SIEM. Which integration mechanism should be configured in the Cortex XDR management console under Data Collection?

Accepted Answer

Cortex XDR Streaming API. Cortex XDR provides direct integration with external SIEMs using the Syslog or HTTPS streaming feature available in the Data Collection configuration menu, allowing seamless alert forwarding.

Answer

Endpoint Tagging Policy

Answer

Local Agent Settings Profile

Answer

Hash Exception Rule

Question 14

An administrator is configuring a new integration in Cortex XSOAR and needs to ensure secure credential handling. Which TWO practices are recommended when managing API keys and secrets? (Choose two)

Accepted Answer

Store API keys using the integration parameter type 'Encrypted' / 'Password'. API keys and secrets should be stored securely using integration parameters configured as password/credential types and managed securely.

Answer

Hardcode the API keys directly into the playbook Python script source code

Answer

Publish the API keys in plain text within the incident description field for team visibility

Answer

Share integration credentials across all tenants via public GitHub repositories

Question 15

An administrator is troubleshooting an issue where Cortex XDR Broker VM cannot forward logs from a syslog source. Which CLI command on the Broker VM can the administrator use to verify active syslog listening ports and network connectivity status?

Accepted Answer

netstat -tulnp. The netstat command is used across Linux environments (including the Broker VM OS) to verify listening ports and active network connections.

Answer

pan_broker_status --syslog

Answer

traceroute -syslog

Answer

systemctl check-syslog

Question 16

An administrator is troubleshooting a Broker VM that cannot ingest CEF logs from a third-party SIEM. Which service status command should the administrator run inside the Broker VM shell to verify that the syslog collector service is running?

Accepted Answer

systemctl status pan-syslog-collector. Systemctl is the standard Linux service management tool used on the Broker VM appliance.

Answer

pan_status --all

Answer

broker-vm status-collector

Answer

service broker status

Question 17

An administrator is designing an automated incident response playbook in Cortex XSOAR. Which TWO core concepts are essential for passing data between playbook tasks? (Choose two)

Accepted Answer

Incident Context (Context Data) to store and retrieve structured key-value data. Playbooks use Incident Context (The War Room / Context Data) and task outputs/arguments to pass data between tasks.

Answer

Static global environment variables hardcoded in the server kernel

Answer

Direct memory pointer references in C++ syntax

Answer

Manual USB flash drive transfer between server nodes

Question 18

An administrator is configuring a new Syslog data collector in Cortex XDR to ingest logs from a third-party firewall. The logs are arriving at the Cortex XDR Collector, but they are not appearing in the Query Builder. Which step should the administrator perform to resolve this issue?

Accepted Answer

Configure a custom log mapping in the Broker VM configuration to parse the incoming syslog format.. To properly ingest and parse third-party logs via a Syslog collector, the administrator must define a custom parsing rule or select a predefined parser mapping in the Cortex XDR Broker VM configuration so the fields are correctly normalized before reaching the backend database.

Answer

Disable SSL/TLS verification on the firewall sending the syslog events.

Answer

Generate a new API key in the Cortex XDR management console and assign it to the syslog source.

Answer

Restart the Cortex XDR Agent on all managed endpoints to enable syslog forwarding.

Question 19

An administrator has deployed a Broker VM to act as a syslog collector and agent installer. During the configuration of the Broker VM in the Cortex XDR console, the status remains 'Disconnected'. What is the most likely cause of this issue?

Accepted Answer

Outbound connectivity on TCP port 443 from the Broker VM to the Cortex XDR tenant is blocked.. The Broker VM requires outbound HTTPS access (port 443) to the Cortex XDR tenant URL for registration and management heartbeat. Network connectivity or firewall blocks are the most frequent cause of disconnection.

Answer

The Cortex XDR agent license count has been exceeded on the tenant.

Answer

The Broker VM requires an active inbound SSH session from the administrator's workstation.

Answer

Syslog UDP port 514 is closed on the internal firewall.

Question 20

An administrator needs to update the Cortex XDR Broker VM software version. What is the recommended and supported method to perform this upgrade?

Accepted Answer

Initiate the upgrade directly from the Cortex XDR management console under Settings > Configurations > Broker VM.. Broker VM upgrades are managed directly from the Cortex XDR management console under Settings > Configurations > Broker VM.

Answer

Download the RPM package from Customer Support Portal and compile it manually via SSH.

Answer

Re-deploy a new Broker VM virtual appliance and delete the old one.

Answer

Run 'apt-get upgrade pan-broker' from the Broker VM Linux terminal.