XDR-Engineer Practice Test 2 — 30 Questions

Question 1

An enterprise security team wants to ingest NetFlow records from core routers into Cortex XDR. Which component and collector combination supports NetFlow/IPFIX ingestion?

Accepted Answer

Broker VM with the NetFlow / IPFIX Collector enabled. NetFlow/IPFIX ingestion in Cortex XDR is supported through the Broker VM with the NetFlow/IPFIX Collector enabled. The Broker VM acts as a collector that receives flow data from routers and forwards it to Cortex XDR for analysis. This is the designed architecture for network flow ingestion.

Answer

Direct API streaming from router CLI to the XDR cloud storage bucket

Answer

Cortex XDR Agent installed directly on the core routers via SSH

Answer

Cortex XSOAR integration instance using SNMP polling

Question 2

A security engineer is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints that are managed by Microsoft Endpoint Configuration Manager (MECM). The organization wants to automate the installation and ensure that the agent is installed with the correct distribution package. What should the engineer do first to obtain the necessary installation package for MECM deployment?

Accepted Answer

Download the Cortex XDR agent installer from the Cortex XDR management console and create a deployment package in MECM.. The correct approach is to download the Cortex XDR agent installer from the management console and package it for MECM. This ensures the correct version, tenant-specific settings, and integration with MECM's deployment capabilities. Other methods either rely on manual user actions, use incorrect sources, or are not applicable to third-party software distribution.

Answer

Retrieve the agent installer from the Palo Alto Networks Customer Support Portal and upload it to MECM.

Answer

Use the Cortex XDR API to generate a one-time installation link and send it to all users via email.

Answer

Configure MECM to pull the agent installer directly from the Microsoft Update Catalog.

Question 3

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

Accepted Answer

To automatically apply specific configuration and security settings upon agent registration.. Assigning an agent profile to an installation package ensures that when the agent registers with the Cortex XDR cloud, it automatically receives the configuration and security settings defined in that profile. This streamlines deployment by applying the correct policy set without manual intervention. The profile determines settings like Malware Protection, Exploit Protection, and Agent Settings for the endpoint.

Answer

To encrypt the installation binary against unauthorized tampering during transit.

Answer

To determine which operating system architecture (32-bit or 64-bit) the package will target.

Answer

To set the license expiration date for the endpoint.

Question 4

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

Accepted Answer

The administrator must provide the anti-tampering password configured in the Cortex XDR console.. Cortex XDR's anti-tampering feature requires the anti-tampering password — configured in the Agent Settings profile in the management console — before the agent's protection can be disabled locally using cytool. This prevents unauthorized users or malware from turning off endpoint protection. The administrator must supply this password when running the disable command.

Answer

A live terminal session must be opened from the cloud console to execute the command.

Answer

The agent must first be uninstalled and reinstalled in debug mode.

Answer

The endpoint must be disconnected from the active domain controller.

Question 5

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

Accepted Answer

TCP port 443 for cloud tenant and agent communication. Option A is correct because the Cortex XDR Broker VM uses TCP 443 to communicate outbound with the Cortex XDR cloud tenant and to receive agent traffic, which is the standard secure HTTPS channel for registration, policy, and telemetry. Option B is correct because the Broker VM's syslog ingestion component listens on UDP/TCP 514 by default (and can be set to custom ports) to collect syslog from firewalls, proxies, and other log sources. Option C is wrong because Telnet on TCP 23 is an insecure legacy management protocol and is not used for Broker VM syslog or agent communication. Option D is wrong because TFTP on UDP 69 is a trivial file-transfer protocol, not an agent staging or communication mechanism for the Broker VM. Option E is wrong because RDP on TCP 3389 is a Windows remote-desktop service, not a log-streaming or agent-communication channel for the Broker VM.

Answer

TCP port 23 for Telnet remote management

Answer

UDP port 69 for Trivial File Transfer Protocol (TFTP) agent staging

Answer

TCP port 3389 for Remote Desktop Protocol (RDP) log streaming

Question 6

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

Accepted Answer

Agent software version. Option A (Agent software version) is correct because the Endpoint Management module in Cortex XDR displays the installed agent version for each enrolled endpoint, allowing analysts to verify whether agents are up to date and identify version drift across the fleet. Option C (Last seen timestamp) is correct because the console shows when each agent last communicated with the Cortex XDR management server, which is essential for spotting offline or unresponsive endpoints. The unmarked options do not belong: hard drive manufacturing serial numbers (B), BIOS cryptographic signature keys (D), and local administrator password hashes (E) are not status fields exposed in the Endpoint Management agent inventory, and password hashes in particular would never be surfaced in a management console for security reasons.

Answer

Hard drive manufacturing serial number

Answer

BIOS cryptographic signature key

Answer

Local administrator password hash

Question 7

A security administrator needs to block a known malicious executable from running across all Windows endpoints managed by Cortex XDR. The file is identified by its SHA-256 hash. The administrator wants the block to be enforced at the agent level without scanning file content. Which Cortex XDR feature should be used?

Accepted Answer

Configure an Indicators of Compromise (IOC) policy with a hash indicator and set the action to Block.. Cortex XDR provides the Indicators of Compromise (IOC) feature to block or report on specific artifacts such as file hashes. By creating an IOC policy with the SHA-256 hash and setting the action to Block, the administrator can immediately prevent the executable from running on all targeted endpoints. This method is precise and does not rely on signature updates or heuristic detection.

Answer

Create a Malware profile with a custom blocklist that includes the SHA-256 hash.

Answer

Use the Exploit Protection profile to add the executable to the list of blocked processes.

Answer

Add the SHA-256 hash to the Blocklist in the Cortex XDR management console under Endpoints > Blocklist.

Question 8

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

Accepted Answer

Upload the custom CA certificate bundle into the Broker VM trust store via the Broker VM management page. To trust self-signed certificates on a Broker VM, the administrator must upload the custom CA certificate bundle via the Broker VM management interface.

Answer

Add the target API IP address to the Broker VM local hosts file

Answer

Modify the Broker VM system kernel parameters to ignore cipher mismatches

Answer

Disable SSL/TLS verification globally for all Cortex XDR broker app modules

Question 9

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

Accepted Answer

Data Collection profile. The Data Collection profile dictates what telemetry, logs, and files are gathered and sent from the endpoint to the Cortex XDR backend.

Answer

Exploit Protection profile

Answer

Agent Settings profile

Answer

Biometric Threat Prevention profile

Question 10

An administrator needs to ensure that Cortex XDR agents on a set of Linux endpoints can communicate with the Cortex XDR management console through a forward proxy. The proxy requires authentication. Which configuration should the administrator apply to the agent?

Accepted Answer

Configure the proxy settings in the Agent Settings profile, specifying the proxy address, port, and authentication credentials.. To configure an authenticated forward proxy for Cortex XDR agents, the administrator must use an Agent Settings profile. This profile includes proxy settings where the address, port, and credentials can be specified. Applying the profile to the target Linux endpoints ensures the agents use the proxy for communication. Other methods, such as local file edits or global server settings, are not supported and would not reliably achieve the goal.

Answer

Configure the proxy settings in the Cortex XDR management console under Server Settings, which automatically applies to all agents.

Answer

Use a transparent proxy that does not require authentication, as Cortex XDR agents do not support authenticated proxies.

Answer

Edit the agent configuration file on each Linux endpoint to include the proxy details and restart the agent service.

Question 11

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

Accepted Answer

Analytics rule descriptions and details within the Cortex XDR console / documentation reference. The engineer can review the definition and rule logic of built-in Analytics detectors in the Analytics rule descriptions and details within the Cortex XDR console or documentation reference. This provides insight into the behavioral logic and heuristics used by the Analytics engine.

Answer

Agent binary configuration file (agent.conf)

Answer

Host Insights Vulnerability assessment database

Answer

Cortex XSOAR Playbook Designer source code

Question 12

An XDR engineer needs to automate the enrichment of Cortex XDR incidents with threat intelligence from an external MISP instance. The MISP API requires an authentication key and returns JSON. Which Cortex XDR automation component should be used to create a custom integration that queries MISP and updates incident fields?

Accepted Answer

Cortex XDR Integrations. Integrations are the automation component designed to connect to external systems, handle authentication such as MISP API keys, and parse JSON responses. They enable custom commands that can be invoked by playbooks to enrich incidents. Scripts, Playbooks, and Dashboards do not provide the API connectivity and parsing capabilities required for this scenario.

Answer

Cortex XDR Scripts

Answer

Cortex XDR Dashboards

Answer

Cortex XDR Playbooks

Question 13

A Cortex XDR administrator needs to verify that the Broker VM is receiving and forwarding endpoint telemetry to the Cortex XDR management console. The Broker VM appears online in the console, but no new endpoint logs have appeared for several hours. Which Broker VM component should the administrator check first to confirm that log ingestion is functioning?

Accepted Answer

The Broker VM Log Collector service. When a Broker VM is online but endpoint logs stop arriving, the first component to verify is the Log Collector service, which is responsible for receiving and forwarding endpoint telemetry. Other broker services handle different data types or unrelated functions, so they would not explain the absence of Cortex XDR agent logs.

Answer

The Broker VM Syslog Collector service

Answer

The Cortex XDR agent content update scheduler

Answer

The Cortex XDR management console database replication status

Question 14

A security engineer is planning to deploy Cortex XDR agents to a large fleet of Windows servers that have no direct internet access. The organization wants the agents to receive content updates without exposing each server to the internet. Which component should be deployed to meet this requirement?

Accepted Answer

Cortex XDR Broker VM. The Broker VM is designed to serve as an on-premises proxy and cache for Cortex XDR agents, enabling them to receive content updates even when they cannot directly reach the internet. It is the recommended component for environments with restricted connectivity, as it centralizes update distribution and reduces external exposure.

Answer

Cortex XDR agent with a proxy configuration pointing to an external web proxy

Answer

Cortex XDR agent with a local content update repository on each server

Answer

Cortex XDR management console with a content update schedule

Question 15

A Cortex XDR administrator needs a recurring report that shows the top ten MITRE ATT&CK techniques observed across all incidents in the last seven days, broken down by severity. The report must be generated automatically every Monday at 06:00 and emailed to the security leadership team. Which Cortex XDR capability should the administrator configure to meet these requirements?

Accepted Answer

Create a custom dashboard widget with an XQL query grouped by technique and severity, then configure a scheduled report template that includes that widget and delivers it by email.. The requirement combines aggregation, visualization, scheduling, and email delivery. Cortex XDR achieves this through dashboard widgets backed by XQL for the grouped technique-and-severity view, plus a scheduled report template that bundles the widget and sends it to recipients. Rules and exclusions operate on live telemetry and cannot produce a recurring top-ten analytical report.

Answer

Configure an alert exclusion that suppresses all but the top ten techniques, then enable scheduled email notifications on the incident management page.

Answer

Create a correlation rule that groups incidents by ATT&CK technique and enable the built-in weekly incident summary email that ships with the Cortex XDR console.

Answer

Create a BIOC rule that matches ATT&CK technique identifiers and configure a notification email action on the rule so it fires every Monday at 06:00.

Question 16

A security analyst is reviewing an incident in Cortex XDR and wants to understand the sequence of events that led to a detection, including which process launched which child process and how the activity unfolded over time. Which Cortex XDR feature should the analyst use to view this ordered chain of related events?

Accepted Answer

The Causality Chain view of the associated alert, which shows the process tree and event sequence leading to the detection.. The Causality Chain presents the ordered process tree and related events that generated an alert, giving the analyst the timeline and lineage needed to understand how activity unfolded. Administrative, device control, and licensing views contain configuration or peripheral data and cannot reconstruct the detection sequence.

Answer

The license and entitlement page, which shows which Cortex XDR modules are enabled for the tenant.

Answer

The endpoint's device control log, which lists USB and peripheral device connections.

Answer

The policy audit log, which records administrative changes made to endpoint policies over time.

Question 17

A Cortex XDR administrator notices that the Broker VM's disk usage is consistently above 90%, and some endpoints are intermittently failing to send logs. The administrator needs to reduce disk pressure without losing critical data. Which action should be taken first?

Accepted Answer

Review and adjust the Broker VM's log retention and rotation settings. Excessive disk usage on a Broker VM is typically caused by log files that are not rotated or retained according to policy. Adjusting log retention and rotation settings reduces disk pressure and restores stable log forwarding. Increasing disk size or redeploying the VM treats the symptom rather than the cause and may be disruptive.

Answer

Disable the Broker VM's Syslog Collector to stop all log ingestion

Answer

Increase the Broker VM's disk size immediately

Answer

Delete the Broker VM and redeploy it with a larger disk

Question 18

A Cortex XDR administrator is troubleshooting why a custom Correlation Rule is not generating incidents. The rule is enabled and scheduled to run every hour. The administrator checks the rule's configuration and sees that it uses a query that references the 'action_process_image_name' field. However, no incidents have been generated despite the query returning results when run manually in the Query Builder. What is the most likely cause?

Accepted Answer

The Correlation Rule is scoped to a specific endpoint group that does not include the endpoints where the activity occurred.. The most likely cause is that the Correlation Rule is scoped to a specific endpoint group that does not include the endpoints where the activity occurred. Even if the query returns results when run manually across all data, the rule only evaluates data from endpoints within its scope. The administrator should review the rule's scope settings and expand it to include the relevant endpoints. Other options are less likely because they contradict the fact that the manual query returns results.

Answer

The Correlation Rule requires the 'action_process_image_name' field to be normalized, but the data source does not populate this field.

Answer

The Correlation Rule's schedule is set to run every hour, but the query results are only retained for 30 minutes, causing the rule to miss the data.

Answer

The Correlation Rule uses a field that is not indexed, causing the rule to fail silently while manual queries use a different indexing mechanism.

Question 19

A Cortex XDR administrator wants to create a custom BIOC rule that detects when a process creates a scheduled task using schtasks.exe with a specific suspicious argument pattern. The rule must trigger only when the parent process is NOT explorer.exe. Which BIOC rule configuration achieves this?

Accepted Answer

Create a BIOC rule with a process execution event, match on schtasks.exe and the argument pattern, and add a condition that parent_process_name != 'explorer.exe'.. BIOC rules in Cortex XDR support conditions on CEF fields within a single event. For a process execution event, parent_process_name is available, so adding a condition that it does not equal explorer.exe ensures the rule triggers only for the desired parent context. This is the simplest and most direct configuration.

Answer

Create a BIOC rule with a process execution event matching schtasks.exe and the argument, then use a suppression rule to exclude events where parent_process_name equals 'explorer.exe'.

Answer

Create a BIOC rule using a registry event to monitor Task Scheduler registry keys, and filter on the user context to exclude explorer.exe.

Answer

Create a BIOC rule with a process execution event matching schtasks.exe and the argument, then use a correlation rule to join with a second event where parent_process_name is not explorer.exe.

Question 20

An XDR engineer is tuning the noise generated by a custom BIOC rule that fires on process executions containing the string 'powershell'. The engineer wants to suppress alerts only when the parent process is a known software deployment agent and the command line also contains 'Invoke-WebRequest'. Which mechanism should be used to implement this narrowly scoped exception without disabling the rule?

Accepted Answer

Modify the BIOC rule condition to add an exclusion clause matching the deployment agent as parent process and 'Invoke-WebRequest' in the command line.. The most precise way to reduce false positives from a custom BIOC rule is to add an exception clause inside the rule itself, targeting the exact parent-process and command-line combination observed in legitimate activity. This preserves detection for all other powershell executions. Broad suppression mechanisms either do not apply to custom BIOCs or reduce visibility for genuine threats, making them inappropriate for this scenario.

Answer

Configure a suppression window on the BIOC rule so that duplicate alerts from the same endpoint are collapsed within a 24-hour period.

Answer

Disable the BIOC rule temporarily and create a separate lower-severity rule that only matches the legitimate deployment agent behavior.

Answer

Create an Alert Exclusion rule in the Cortex XDR Exclusions policy that matches the BIOC rule name and the deployment agent process.