XDR-Engineer Practice Test 3 — 30 Questions

Question 1

Where should an administrator navigate in the Cortex XDR management console to create and manage security profiles such as Malware Protection and Exploit Protection?

Accepted Answer

Endpoints > Policy Rules. Security profiles in Cortex XDR are managed under the Endpoints > Policy Rules section.

Answer

Settings > Endpoint Configuration

Answer

Dashboards > Profiles

Answer

Response > Profiles

Question 2

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

Accepted Answer

Configure an isolation exception rule specifying the permitted IP address.. When an endpoint is isolated, administrators can define network exceptions (such as specific IP addresses or ports) in the Response or Global Settings to allow remediation traffic.

Answer

Add the IP address to the Data Collection profile under restricted hosts.

Answer

Create a firewall policy on the next-generation firewall to bypass XDR isolation.

Answer

Disable the agent service via Live Terminal using the 'net stop' command.

Question 3

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

Accepted Answer

To automatically apply specific configuration and security settings upon agent registration.. Assigning a profile to an installation package ensures that the endpoint immediately adopts the correct configuration, security rules, and data collection settings upon registration.

Answer

To encrypt the installation binary against unauthorized tampering during transit.

Answer

To determine which operating system architecture (32-bit or 64-bit) the package will target.

Answer

To set the license expiration date for the endpoint.

Question 4

An administrator notices that several Cortex XDR agents are showing a 'Disconnected' status in the management console. What is a common initial cause to investigate?

Accepted Answer

Network connectivity issues or firewall blocks preventing outbound communication to the Cortex XDR backend.. Network connectivity issues, firewall blocks on outgoing ports (like HTTPS port 443), or proxy misconfigurations commonly cause agents to lose connection to the Cortex XDR cloud.

Answer

The agent license count has been exceeded by one license.

Answer

The Data Collection profile was modified to reduce log verbosity.

Answer

The local endpoint user changed their Windows login password.

Question 5

Which TWO settings can be configured within a Malware Protection profile in Cortex XDR? (Choose two)

Accepted Answer

File, folder, and hash exclusion lists. Malware Protection profiles control scanning parameters, exclusions, and actions for detected threats like malware and PUA.

Answer

Anti-tampering password for agent uninstallation

Answer

Broker VM proxy port forwarding schedules

Answer

Browser-based exploit mitigation rules

Question 6

Which THREE actions occur on a Windows endpoint when the Cortex XDR agent isolates the host during an active security incident? (Choose three)

Accepted Answer

All inbound and outbound network traffic is blocked except for allowed management traffic to Cortex XDR and defined exceptions.. Endpoint isolation cuts off general network communication while preserving critical management channels such as communication with the Cortex XDR cloud and optionally defined exceptions.

Answer

The endpoint physical hardware power supply is automatically shut off.

Answer

All local user accounts on the machine are permanently deleted.

Question 7

An administrator needs to deploy Cortex XDR agents to a large fleet of Windows endpoints via Group Policy Object (GPO). Which installation package type and parameter should the administrator utilize to ensure a silent installation without user interaction?

Accepted Answer

Use the .msi package with the /quiet and /norestart parameters.. To silently install the Cortex XDR agent using GPO or third-party deployment tools, administrators use the MSI installation package with the /quiet and /norestart parameters.

Answer

Use the .exe package and modify the registry before execution.

Answer

Use the .exe package with the /silent switch.

Answer

Use the .pkg package with the --unattended flag.

Question 8

Where in the Cortex XDR management console can an administrator review the connection status, agent version, and operating system of all registered endpoints?

Accepted Answer

Endpoints > Endpoint Management. The Endpoint Management view provides a comprehensive inventory table of all deployed agents, their status, versions, and details.

Answer

Dashboards > Health > Agents

Answer

Response > Endpoint Status

Answer

Settings > Agent Management > Status

Question 9

Which TWO criteria can be used to dynamically group endpoints and assign agent profiles in Cortex XDR? (Choose two)

Accepted Answer

Operating system type (e.g., Windows, macOS, Linux). Dynamic endpoint grouping in Cortex XDR can be based on criteria such as operating system type and Active Directory organizational units or naming patterns.

Answer

Physical office desk location number

Answer

BIOS manufacturer serial number color

Answer

Local user account password expiration date

Question 10

During a troubleshooting session, an administrator needs to collect all Cortex XDR agent troubleshooting logs into a single compressed archive directly from the Windows endpoint command line. Which cytool command should be executed?

Accepted Answer

cytool log collect. The 'cytool log collect' command generates a diagnostic archive containing all relevant agent logs for support or advanced troubleshooting.

Answer

cytool debug generate

Answer

cytool dump-logs

Answer

cytool export support-bundle

Question 11

An organization needs to forward all Cortex XDR incidents and alerts to an external SIEM platform in real time. Which Cortex XDR feature should the administrator configure?

Accepted Answer

Syslog Forwarding configuration. Cortex XDR supports real-time forwarding of alerts and incidents to external SIEMs using Syslog forwarding or the Data Export Service / Webhook integrations.

Answer

Scheduled PDF Reporting

Answer

BIOC Rule Simulator

Answer

Agent Upgrade Profiles

Question 12

An administrator is configuring custom BIOC rules in Cortex XDR. Which TWO elements are mandatory when defining a new BIOC rule? (Choose two)

Accepted Answer

Rule Logic / Event Query criteria. When creating a custom BIOC rule in Cortex XDR, administrators must specify a unique Rule Name and define the matching Rule Logic/Query criteria.

Answer

External SIEM Forwarding Destination IP

Answer

Custom Agent Installation Password

Answer

Cortex XSOAR Playbook ID

Question 13

Which TWO actions can an administrator perform from the Endpoint Management view in the Cortex XDR management console? (Choose two)

Accepted Answer

Isolate an endpoint from the network during an incident.. Endpoint Management allows administrators to view endpoint details and execute management actions such as isolating endpoints or initiating scans.

Answer

Configure firewall security policies for perimeter gateways.

Answer

Create and deploy Palo Alto Networks firewall traffic filters.

Answer

Manage DNS server IP address assignments.

Question 14

An administrator configured a new Agent Settings profile in Cortex XDR, but endpoints in the 'Finance' folder are not applying the new tamper protection password. What is the most likely reason for this behavior?

Accepted Answer

The Agent Settings profile priority for the Finance folder is set lower than a conflicting child assignment or inheritance is broken.. Cortex XDR evaluates folders and profiles based on priority and inheritance. If a sub-folder or specific endpoint group has an explicit profile assigned with higher precedence, or if profile inheritance is broken, the settings will not propagate down as expected.

Answer

Tamper protection passwords can only be configured globally and cannot be overridden by profile.

Answer

Tamper protection configuration changes require a manual service restart on every agent.

Answer

Agents require a full endpoint reboot before downloading any configuration changes.

Question 15

Which THREE methods can be used to obtain Cortex XDR agent installation packages? (Choose three)

Accepted Answer

Downloading directly from the Endpoints > Distributions page in the Cortex XDR management console. Administrators can download installation packages directly from the Cortex XDR console, utilize APIs, or generate them via automated provisioning workflows.

Answer

Requesting physical USB flash drives shipped directly from Palo Alto Networks hardware support

Answer

Downloading installers from public software repositories like npm or PyPI

Question 16

Which type of profile in Cortex XDR controls the collection of endpoint telemetry used for threat hunting and forensic analysis?

Accepted Answer

Data Collection profile. Data Collection profiles determine what security telemetry and artifacts are gathered from endpoints and sent to the Cortex XDR backend.

Answer

Agent Settings profile

Answer

Malware Protection profile

Answer

Network Control profile

Question 17

Which THREE advanced troubleshooting steps can an administrator take when analyzing a malfunctioning Cortex XDR agent on a Linux endpoint? (Choose three)

Accepted Answer

Verify that required kernel headers or dependencies are installed and loaded properly.. Troubleshooting Linux agents involves inspecting system services, log files in standard directories, and kernel module/system extension status.

Answer

Reformat the Linux root filesystem and reinstall the operating system kernel.

Answer

Modify the Windows Registry keys for the Cortex XDR service.

Question 18

An administrator wants to configure role-based access control (RBAC) so that a newly formed tier-1 SOC team can view incidents and run XQL queries, but cannot modify firewall rules, agent settings, or create custom BIOC rules. Where should the administrator configure this role?

Accepted Answer

Settings -> Configurations -> Roles. Role-Based Access Control (RBAC) roles and permissions in Cortex XDR are managed under Settings -> Configurations -> Roles.

Answer

Agent Settings -> Profiles -> Permissions

Answer

Host Insights -> License Roles

Answer

Incident Management -> Access Control

Question 19

An organization is deploying Cortex XDR agents across a restricted corporate network where endpoints cannot reach the public internet. How must the administrator configure the environment to ensure agents can successfully connect to the Cortex XDR server?

Accepted Answer

Deploy a Cortex XDR Broker VM internally to proxy agent communication to the Cortex XDR cloud.. In isolated networks, administrators must configure a Cortex XDR Broker VM to act as a proxy/collector within the internal network, allowing agents to forward telemetry and receive updates through the internal Broker VM.

Answer

Open outbound HTTPS port 443 directly from every endpoint to public DNS root servers.

Answer

Configure agents to communicate via SNMP traps to the primary domain controller.

Answer

Manually export logs via USB on each endpoint on a weekly basis.

Question 20

An organization utilizes custom correlation rules in Cortex XDR. An engineer needs to export these custom BIOC rules to backup configurations or migrate them to another Cortex XDR tenant. Which administrative feature supports this?

Accepted Answer

Export and Import options within the BIOC management interface. Cortex XDR provides administrative export and import capabilities under Analytics / BIOC rules to manage rule portability.

Answer

Agent deployment script parameter flags

Answer

Cortex XDR API key generation settings

Answer

Data Export Service configuration bucket