XDR-Engineer Practice Questions 1 — 50 Questions

Question 1

An administrator wants to check the operational status and resource utilization of a Cortex XDR Broker VM. Where can the administrator monitor this directly within the Cortex XDR management console?

Accepted Answer

Go to Settings > Configurations > Broker VM.. The Broker VM monitoring interface is located under Settings > Configurations > Broker VM.

Answer

Go to XQL Search using dataset = broker_vm_logs.

Answer

Go to Dashboards > Broker VM Performance.

Answer

Go to Endpoint Management > Broker VM.

Question 2

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

Accepted Answer

Scheduled Reports in the Reporting menu. Cortex XDR's Reporting menu includes a Scheduled Reports feature that lets administrators define report templates (including incident reports filtered to critical severity), set a weekly schedule, and configure email delivery to recipients such as the security operations team. This is the native, purpose-built capability for recurring PDF report distribution.

Answer

Incident Export via Syslog

Answer

Data Export Service

Answer

BIOC Alert Notifications

Question 3

An administrator has deployed a Broker VM and enabled the Active Directory (AD) collector to ingest user and group mapping data. The connection test fails with a 'Kerberos Authentication Failed' error. What is the most likely cause of this failure?

Accepted Answer

The Broker VM system clock is out of sync with the Domain Controller by more than five minutes. Kerberos authentication relies on time-stamped tickets to prevent replay attacks. If the Broker VM's system clock differs from the Domain Controller's by more than five minutes (the default Kerberos tolerance), the Key Distribution Center (KDC) rejects the authentication request, producing a 'Kerberos Authentication Failed' error. Therefore, the most likely cause is a clock skew exceeding the allowed threshold.

Answer

The Broker VM firewall is blocking ICMP ping requests

Answer

The Cortex XDR agent on the domain controller has been uninstalled

Answer

The Broker VM has exceeded its maximum disk storage allocation

Question 4

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

Accepted Answer

Change the incident status to Resolved and select the appropriate resolution reason (e.g., False Positive).. Incidents in Cortex XDR are resolved by changing their status to 'Resolved' and assigning an appropriate resolution status such as False Positive or Benign True Positive.

Answer

Delete the agent from Endpoint Management.

Answer

Put the agent into Bypass mode.

Answer

Purge all logs using the XQL delete command.

Question 5

An administrator wants to check the total license utilization and expiration date for their Cortex XDR tenant. Where can this be reviewed?

Accepted Answer

Settings > Configurations > Licenses. License details and usage quotas are found under Settings > Configurations > Licenses.

Answer

Dashboards > License Widget

Answer

Help > About Cortex XDR

Answer

Endpoints > Licensing Status

Question 6

An administrator is reviewing incident triage notes and wants to export audit logs showing all administrative actions taken in the Cortex XDR console over the past 90 days. Where should the administrator navigate?

Accepted Answer

Settings > Configurations > Audit Trail. Audit logs tracking administrator logins, configuration changes, and policy modifications are located under Settings > Configurations > Audit Trail.

Answer

Dashboards > Audit Reports

Answer

Incident Response > Activity Log

Answer

Help > System Logs

Question 7

An administrator wants to configure email notifications whenever a critical severity incident is detected by Cortex XDR. Where is this notification setting configured?

Accepted Answer

Settings > Configurations > Notifications (or Incident Notifications). Incident notification settings, including email integrations and webhook alerts, are configured under Settings > Configurations > Integrations > Email or Notifications.

Answer

Dashboards > Alert Rules

Answer

Endpoints > Policy > Alerts

Answer

XQL Search > Alert Action

Question 8

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

Accepted Answer

Operating system type (Windows, macOS, Linux). Option C is correct because Cortex XDR endpoint groups can be defined by operating system type (Windows, macOS, Linux), which is a standard grouping criterion used to target platform-specific policies and prevention profiles. Option E is correct because Cortex XDR supports grouping endpoints by IP address subnets or network ranges, allowing administrators to apply location- or network-based policies to endpoints in specific segments. Options A, B, and D are not valid grouping criteria in Cortex XDR: printer driver versions, desktop wallpaper resolution settings, and monitor serial numbers are not endpoint attributes the console uses for policy-assignment grouping.

Answer

Installed printer driver versions

Answer

Local user desktop wallpaper resolution settings

Answer

Physical serial number of the endpoint monitor

Question 9

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

Accepted Answer

Create exceptions for known benign alerts to prevent them from inflating incident priority scores.. Incident severity and scoring can be tuned via scoring rules, alert severity mappings, and exception configurations.

Answer

Reinstall the Cortex XDR Agent on all high-priority servers.

Answer

Modify the Broker VM packet buffer size.

Question 10

Which THREE factors should an administrator consider when planning a large-scale Cortex XDR agent deployment across enterprise endpoints? (Choose three)

Accepted Answer

Potential conflicts with legacy security software that should be uninstalled prior to deployment. Option B is correct because legacy or third-party security software (e.g., older antivirus, HIPS, or EDR agents) can conflict with the Cortex XDR agent's kernel-level drivers and network filtering, causing installation failures, performance degradation, or unprotected endpoints, so it should be identified and removed before rollout. Option D is correct because agents must reach the Cortex XDR management backend or a Broker VM over outbound TCP 443 (HTTPS), and large deployments require bandwidth planning plus firewall/proxy allow-listing of the relevant FQDNs to avoid registration and telemetry failures. Option E is correct because choosing a deployment mechanism that matches each OS ecosystem — GPO or SCCM for Windows, MDM (e.g., Intune, JAMF) for macOS, and appropriate tooling for Linux — ensures scalable, consistent installation and upgrade across heterogeneous enterprise endpoints. Option A is not appropriate because the Cortex XDR agent is an endpoint security agent, not a DNS server, and making it authoritative for a subnet would break name resolution. Option C is incorrect because granting permanent domain administrator rights to local users is a severe security violation and is not required for agent operation, which runs under the SYSTEM/service account context.

Answer

Configuring the agent to act as a primary DNS server for the local subnet

Answer

Ensuring local endpoint users have full domain administrator rights permanently

Question 11

A Cortex XDR engineer is planning the installation of the Broker VM in a demilitarized zone (DMZ) to collect logs from internet-facing servers. Which TWO configurations are required to ensure the Broker VM can securely communicate with the Cortex XDR cloud and internal log sources? (Choose two.)

Accepted Answer

Allow the Broker VM to communicate with internal log sources over the required protocols and ports.. The Broker VM in a DMZ requires outbound HTTPS access to the Cortex XDR cloud for management and updates, and it must be able to receive logs from internal sources. These two configurations ensure secure communication without exposing the Broker VM to inbound internet traffic. Inbound access from the internet or the cloud is not needed and would increase the attack surface.

Answer

Configure the Broker VM to use a static public IP address for cloud communication.

Answer

Configure inbound access from the internet to the Broker VM on TCP 443 for log ingestion.

Answer

Enable inbound access from the Cortex XDR cloud to the Broker VM on TCP 443 for management.

Question 12

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Accepted Answer

Cortex XSOAR Server Audit and Server logs (/var/log/demisto/server.log). Option D is correct because Cortex XSOAR Server Audit and Server logs, including /var/log/demisto/server.log, record API activity, automation execution, and integration errors, which are essential for diagnosing a failing Cortex XDR API query or automation script. Option E is correct because integration debug logs, viewed via Docker container logs for the specific integration instance, show the actual HTTP requests, responses, and errors exchanged with the Cortex XDR API, directly revealing the root cause. Option A is not relevant because Windows Event Viewer Security logs on unmanaged workstations do not capture Cortex XDR API or automation activity. Option B is not relevant because BIOS firmware event logs relate to hardware/firmware events, not API or script failures. Option C is not relevant because Cortex XDR Agent installation MSI error logs only cover agent installation issues, not API query or automation script failures.

Answer

Windows Event Viewer Security log on unmanaged workstations

Answer

Local BIOS firmware event logs

Answer

Cortex XDR Agent installation MSI error logs

Question 13

An analyst is reviewing an incident and wants to quickly export the raw artifact details and event logs associated with the specific alert for offline sharing. Which feature in the Incident View should the analyst use?

Accepted Answer

Export options in the Incident View (CSV/JSON). Cortex XDR provides export options within incident views to download incident details, alerts, and observables as CSV or JSON.

Answer

Agent installation log collector

Answer

Cortex XSOAR Marketplace

Answer

Syslog alert routing daemon

Question 14

A Cortex XDR administrator is investigating an incident where a PowerShell script executed on multiple endpoints, but the Cortex XDR agent did not generate any alerts. The administrator confirms the script is malicious and should have been detected by the Behavioral Threat protection module. Which action should the administrator take first to troubleshoot the missing alerts?

Accepted Answer

Verify that the Behavioral Threat protection module is enabled in the agent policy.. Behavioral Threat protection must be enabled in the agent policy to detect malicious script behavior. If disabled, no alerts will be generated regardless of script activity. Verifying the policy setting is the quickest way to identify why alerts are missing, before investigating other potential causes like connectivity or allow lists.

Answer

Review the endpoint's local agent logs for script execution events.

Answer

Ensure the script's hash is not in the allow list.

Answer

Check the Cortex XDR management console for agent connectivity issues.

Question 15

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

Accepted Answer

Dashboards menu using a widget based on an XQL query. Custom dashboards and widgets in Cortex XDR are built and managed within the Dashboard module using either pre-built templates or custom XQL queries.

Answer

Agent Settings -> Profiles -> Analytics

Answer

Threat Intelligence -> Feed Management

Answer

Incident Response -> Playbooks

Question 16

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

Accepted Answer

The underlying XQL query string that defines the detection logic.. Option C is correct because a scheduled XQL rule fundamentally requires the XQL query string itself, which defines the detection logic that runs against the Cortex XDR dataset to identify matching events. Option D is correct because the rule must map the query results to alert attributes—severity, alert name, and description—so that generated alerts are meaningful and actionable in the incident view. Option E is correct because a scheduled rule must specify the schedule frequency (how often the query executes) and the time range of data evaluated per run, which together control detection cadence and coverage. Options A and B are incorrect because physical memory allocation on a Broker VM for syslog collection and kernel bypass configuration for Windows endpoints are unrelated to defining a scheduled XQL alert rule; they concern infrastructure sizing and endpoint agent/network settings, not XQL rule parameters.

Answer

The physical memory allocation limit on the Broker VM handling syslog collection.

Answer

The kernel bypass configuration parameters for Windows endpoints.

Question 17

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux systems. What must the administrator do regarding installation packages?

Accepted Answer

Generate and download distinct installation packages tailored for each operating system type.. Separate installation packages must be generated for each distinct operating system (Windows, macOS, Linux) in the Cortex XDR management console.

Answer

Convert an MSI package to PKG format using third-party tools.

Answer

Download a single universal installation package that automatically detects the operating system during execution.

Answer

Use the Linux TGZ installer for all operating systems by leveraging containerization.

Question 18

An administrator is deploying Cortex XDR agents to a group of macOS endpoints. The organization uses a mobile device management (MDM) solution to push configurations. Which file format should the administrator use to deliver the agent settings profile via MDM?

Accepted Answer

A .mobileconfig file containing the agent settings.. For macOS endpoints, Cortex XDR agent settings are delivered via a .mobileconfig file, which is the standard configuration profile format for Apple devices. This file can be generated from the Cortex XDR management console and deployed through MDM. Other file formats like .plist, .json, or .xml are not directly supported for this purpose.

Answer

A .plist file containing the agent settings.

Answer

A .json file containing the agent settings.

Answer

A .xml file containing the agent settings.

Question 19

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

Accepted Answer

Run 'top' or 'htop' via SSH on the Broker VM to identify which specific processes are consuming excessive memory.. Option B is correct because running 'top' or 'htop' over SSH on the Broker VM provides real-time per-process memory (RES/%MEM) visibility, letting the administrator pinpoint which service (e.g., broker, collector, or forwarding process) is driving high utilization. Option C is correct because the Cortex XDR console's Settings > Configurations > Broker VM page surfaces built-in system health metrics (CPU, memory, disk, and service status), giving an authoritative, supported view of Broker VM resource consumption without needing to guess. Option D is correct because collector logs under /var/log/pan/ record ingestion activity and errors, so reviewing them can reveal event loops, repeated retries, or memory leaks that spike during high event ingestion. Option A is not appropriate because recompiling the Linux kernel on a vendor-supplied Broker VM appliance is unsupported and would not address application-level memory consumption. Option E is not appropriate because changing the disk partition table with fdisk is unrelated to memory utilization and risks corrupting the appliance's storage layout.

Answer

Recompile the Linux kernel on the Broker VM appliance to optimize memory paging.

Answer

Change the Broker VM disk partition table using fdisk.

Question 20

A Cortex XDR Agent on a macOS endpoint is failing to start its kernel extension (Endpoint Security extension). Which diagnostic command should be run locally in the macOS Terminal to verify system extension approval status?

Accepted Answer

systemextensionsctl list. On macOS, system extensions (including Endpoint Security extensions) are managed by the systemextensionsctl command. Running 'systemextensionsctl list' displays all installed system extensions and their approval status, which is critical for diagnosing why a kernel extension might fail to start. This command is the correct local diagnostic tool for verifying system extension approval.

Answer

macos-agent-check --status

Answer

kextstat | grep paloalto

Answer

cytool mac status