XDR-Engineer Practice Test 4 — 10 Questions

Question 1

An enterprise security team wants to ingest NetFlow records from core routers into Cortex XDR. Which component and collector combination supports NetFlow/IPFIX ingestion?

Accepted Answer

Broker VM with the NetFlow / IPFIX Collector enabled. NetFlow/IPFIX ingestion in Cortex XDR is supported through the Broker VM with the NetFlow/IPFIX Collector enabled. The Broker VM acts as a collector that receives flow data from routers and forwards it to Cortex XDR for analysis. This is the designed architecture for network flow ingestion.

Answer

Direct API streaming from router CLI to the XDR cloud storage bucket

Answer

Cortex XDR Agent installed directly on the core routers via SSH

Answer

Cortex XSOAR integration instance using SNMP polling

Question 2

A security engineer is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints that are managed by Microsoft Endpoint Configuration Manager (MECM). The organization wants to automate the installation and ensure that the agent is installed with the correct distribution package. What should the engineer do first to obtain the necessary installation package for MECM deployment?

Accepted Answer

Download the Cortex XDR agent installer from the Cortex XDR management console and create a deployment package in MECM.. The correct approach is to download the Cortex XDR agent installer from the management console and package it for MECM. This ensures the correct version, tenant-specific settings, and integration with MECM's deployment capabilities. Other methods either rely on manual user actions, use incorrect sources, or are not applicable to third-party software distribution.

Answer

Retrieve the agent installer from the Palo Alto Networks Customer Support Portal and upload it to MECM.

Answer

Use the Cortex XDR API to generate a one-time installation link and send it to all users via email.

Answer

Configure MECM to pull the agent installer directly from the Microsoft Update Catalog.

Question 3

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

Accepted Answer

To automatically apply specific configuration and security settings upon agent registration.. Assigning an agent profile to an installation package ensures that when the agent registers with the Cortex XDR cloud, it automatically receives the configuration and security settings defined in that profile. This streamlines deployment by applying the correct policy set without manual intervention. The profile determines settings like Malware Protection, Exploit Protection, and Agent Settings for the endpoint.

Answer

To encrypt the installation binary against unauthorized tampering during transit.

Answer

To determine which operating system architecture (32-bit or 64-bit) the package will target.

Answer

To set the license expiration date for the endpoint.

Question 4

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

Accepted Answer

The administrator must provide the anti-tampering password configured in the Cortex XDR console.. Cortex XDR's anti-tampering feature requires the anti-tampering password — configured in the Agent Settings profile in the management console — before the agent's protection can be disabled locally using cytool. This prevents unauthorized users or malware from turning off endpoint protection. The administrator must supply this password when running the disable command.

Answer

A live terminal session must be opened from the cloud console to execute the command.

Answer

The agent must first be uninstalled and reinstalled in debug mode.

Answer

The endpoint must be disconnected from the active domain controller.

Question 5

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

Accepted Answer

TCP port 443 for cloud tenant and agent communication. Option A is correct because the Cortex XDR Broker VM uses TCP 443 to communicate outbound with the Cortex XDR cloud tenant and to receive agent traffic, which is the standard secure HTTPS channel for registration, policy, and telemetry. Option B is correct because the Broker VM's syslog ingestion component listens on UDP/TCP 514 by default (and can be set to custom ports) to collect syslog from firewalls, proxies, and other log sources. Option C is wrong because Telnet on TCP 23 is an insecure legacy management protocol and is not used for Broker VM syslog or agent communication. Option D is wrong because TFTP on UDP 69 is a trivial file-transfer protocol, not an agent staging or communication mechanism for the Broker VM. Option E is wrong because RDP on TCP 3389 is a Windows remote-desktop service, not a log-streaming or agent-communication channel for the Broker VM.

Answer

TCP port 23 for Telnet remote management

Answer

UDP port 69 for Trivial File Transfer Protocol (TFTP) agent staging

Answer

TCP port 3389 for Remote Desktop Protocol (RDP) log streaming

Question 6

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

Accepted Answer

Agent software version. Option A (Agent software version) is correct because the Endpoint Management module in Cortex XDR displays the installed agent version for each enrolled endpoint, allowing analysts to verify whether agents are up to date and identify version drift across the fleet. Option C (Last seen timestamp) is correct because the console shows when each agent last communicated with the Cortex XDR management server, which is essential for spotting offline or unresponsive endpoints. The unmarked options do not belong: hard drive manufacturing serial numbers (B), BIOS cryptographic signature keys (D), and local administrator password hashes (E) are not status fields exposed in the Endpoint Management agent inventory, and password hashes in particular would never be surfaced in a management console for security reasons.

Answer

Hard drive manufacturing serial number

Answer

BIOS cryptographic signature key

Answer

Local administrator password hash

Question 7

A security administrator needs to block a known malicious executable from running across all Windows endpoints managed by Cortex XDR. The file is identified by its SHA-256 hash. The administrator wants the block to be enforced at the agent level without scanning file content. Which Cortex XDR feature should be used?

Accepted Answer

Configure an Indicators of Compromise (IOC) policy with a hash indicator and set the action to Block.. Cortex XDR provides the Indicators of Compromise (IOC) feature to block or report on specific artifacts such as file hashes. By creating an IOC policy with the SHA-256 hash and setting the action to Block, the administrator can immediately prevent the executable from running on all targeted endpoints. This method is precise and does not rely on signature updates or heuristic detection.

Answer

Create a Malware profile with a custom blocklist that includes the SHA-256 hash.

Answer

Use the Exploit Protection profile to add the executable to the list of blocked processes.

Answer

Add the SHA-256 hash to the Blocklist in the Cortex XDR management console under Endpoints > Blocklist.

Question 8

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

Accepted Answer

Upload the custom CA certificate bundle into the Broker VM trust store via the Broker VM management page. To trust self-signed certificates on a Broker VM, the administrator must upload the custom CA certificate bundle via the Broker VM management interface.

Answer

Add the target API IP address to the Broker VM local hosts file

Answer

Modify the Broker VM system kernel parameters to ignore cipher mismatches

Answer

Disable SSL/TLS verification globally for all Cortex XDR broker app modules

Question 9

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

Accepted Answer

Data Collection profile. The Data Collection profile dictates what telemetry, logs, and files are gathered and sent from the endpoint to the Cortex XDR backend.

Answer

Exploit Protection profile

Answer

Agent Settings profile

Answer

Biometric Threat Prevention profile

Question 10

An administrator needs to ensure that Cortex XDR agents on a set of Linux endpoints can communicate with the Cortex XDR management console through a forward proxy. The proxy requires authentication. Which configuration should the administrator apply to the agent?

Accepted Answer

Configure the proxy settings in the Agent Settings profile, specifying the proxy address, port, and authentication credentials.. To configure an authenticated forward proxy for Cortex XDR agents, the administrator must use an Agent Settings profile. This profile includes proxy settings where the address, port, and credentials can be specified. Applying the profile to the target Linux endpoints ensures the agents use the proxy for communication. Other methods, such as local file edits or global server settings, are not supported and would not reliably achieve the goal.

Answer

Configure the proxy settings in the Cortex XDR management console under Server Settings, which automatically applies to all agents.

Answer

Use a transparent proxy that does not require authentication, as Cortex XDR agents do not support authenticated proxies.

Answer

Edit the agent configuration file on each Linux endpoint to include the proxy details and restart the agent service.