XDR-Engineer Practice Questions 2 — 50 Questions

Question 1

An engineer is tuning detection coverage in Cortex XDR and wants to confirm whether a specific built-in Analytics BIOC is currently enabled, which MITRE ATT&CK technique it maps to, and whether it has generated any alerts in the past 24 hours. Which approach most directly provides all three pieces of information in one place?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Open the BIOC rule in the Cortex XDR management console, review its enabled state and MITRE mapping, then query the alerts dataset in XQL filtered by that BIOC name and a 24-hour window. Confirming a built-in Analytics BIOC's enablement and MITRE mapping requires inspecting the rule definition itself, and confirming recent alert activity requires querying the alerts dataset with a time filter. The rule view and an XQL query on alerts together answer all three questions authoritatively, whereas agent diagnostics, IOC feeds, and incident timelines provide only partial or indirect evidence.

Answer

Run a Cortex XDR agent diagnostic on the endpoint and inspect the local BIOC catalog file for the rule state and technique mapping

Answer

Export the IOC feed configuration and cross-reference technique IDs against the indicator list

Answer

Review the incident timeline of the most recent incident and infer the rule state from the alerts it contains

Question 2

A security analyst wants to review all alerts that were generated on a specific endpoint over the past 30 days and see which ones were already resolved versus still open. Which Cortex XDR view should the analyst open to accomplish this?

Accepted Answer

The Alerts view filtered by the endpoint hostname and a 30-day time range, using the Status column to distinguish resolved from open alerts.. The Alerts view is the purpose-built interface for reviewing individual alerts with their metadata, including status. Applying a hostname filter and a 30-day time range narrows the list to the endpoint of interest, and the Status column immediately distinguishes resolved from open alerts without requiring custom queries or navigating unrelated consoles.

Answer

The Endpoint Management console filtered by the host, showing agent status and last-seen timestamps for the device.

Answer

The Query Center with a dataset of alerts, using XQL to project hostname, timestamp, and severity fields only.

Answer

The Incidents view filtered by the endpoint hostname, showing the status of each associated incident.

Question 3

A Cortex XDR administrator wants to ensure that a specific Windows executable is always allowed to run, even if it exhibits behavior that might otherwise be blocked by the Behavioral Threat protection module. The executable is digitally signed by a trusted vendor. Which Cortex XDR feature should the administrator use to achieve this?

Accepted Answer

Configure a Digital Signature allowlist entry for the trusted vendor's certificate.. Cortex XDR allows administrators to create allowlist entries based on digital signatures. By adding the trusted vendor's certificate to the allowlist, any executable signed by that certificate is permitted to run, bypassing behavioral blocks. This method is secure, scalable, and ensures that legitimate software from trusted vendors is not inadvertently blocked.

Answer

Create an Allowlist entry based on the file's SHA-256 hash.

Answer

Add the executable to the Behavioral Threat protection exception list.

Answer

Disable the Behavioral Threat protection module for the endpoint group.

Question 4

A Cortex XDR engineer is configuring the alert notification path so that high-severity incidents reach the on-call SOC analyst quickly. The team wants notifications delivered to an external collaboration platform and also wants an automated action to run when the alert fires. Which TWO Cortex XDR capabilities should the engineer configure to meet these requirements? (Choose two.)

Accepted Answer

Create a script or playbook action and bind it to the alert through a playbook that triggers on the matching alert condition.. External notification integrations attached to alert notification rules handle delivery to collaboration platforms, while playbooks bound to alert conditions provide automated action execution. Together they cover both the notification and the automated response requirements without altering detection coverage or endpoint scan settings.

Answer

Raise the alert severity threshold in the BIOC so that only critical alerts are generated for the on-call team.

Answer

Increase the endpoint agent heartbeat interval so alerts are reported to the management console more frequently.

Answer

Enable the built-in malware signature pack and schedule a daily scan on all endpoints in the policy.

Question 5

An administrator is setting up a Cortex XDR Broker VM to collect logs from a remote site with limited bandwidth. The administrator wants to minimize the amount of data sent over the WAN link while ensuring that critical security events are still ingested. Which feature should be enabled on the Broker VM?

Accepted Answer

Local log filtering and aggregation. Local log filtering and aggregation on the Broker VM allows administrators to reduce the volume of data sent over the WAN by discarding low-value logs and consolidating repetitive events. This directly addresses the bandwidth constraint while ensuring that critical security events are still forwarded to Cortex XDR. Other options either do not reduce data volume or are not supported features for this purpose.

Answer

Syslog over UDP instead of TCP

Answer

TLS encryption with perfect forward secrecy

Answer

Log compression and deduplication

Question 6

An administrator is troubleshooting a Cortex XDR agent on a Windows endpoint that is not communicating with the management console. The administrator runs 'cytool status' and sees that the agent is in a 'Disconnected' state. The network team confirms that the endpoint can reach the console on port 443. Which Cortex XDR component should the administrator check next to ensure proper agent-console communication?

Accepted Answer

The Cortex XDR agent's certificate and registration status with the console.. When an agent is disconnected but network connectivity is confirmed, the next logical step is to verify the agent's certificate and registration status. Cortex XDR agents use certificates for secure communication with the console; an expired or revoked certificate, or a registration issue, will prevent the agent from connecting. Checking this component is essential for resolving the disconnection.

Answer

The Cortex XDR agent's local database for corruption.

Answer

The Cortex XDR management console's license status.

Answer

The Windows Firewall rules on the endpoint.

Question 7

A Cortex XDR administrator needs to ensure that endpoint telemetry data is ingested from all Windows endpoints in the organization. Which Cortex XDR component is responsible for collecting this data directly from the endpoints?

Accepted Answer

Cortex XDR Agent. The Cortex XDR Agent is the endpoint component that collects telemetry data and sends it to the management console. It provides the necessary visibility into endpoint activities for threat detection and response.

Answer

Syslog Collector

Answer

Broker VM

Answer

Cortex XDR Management Console

Question 8

A security engineer is planning the deployment of Cortex XDR agents to endpoints that are located in a remote office with limited bandwidth. The engineer wants to minimize the impact on the network during the initial agent registration and content updates. Which Cortex XDR component should be deployed on-premises to cache content and reduce WAN traffic?

Accepted Answer

Broker VM. The Broker VM is designed to be deployed on-premises to support various functions, including acting as a proxy and cache for Cortex XDR agents. In a remote office with limited bandwidth, deploying a Broker VM ensures that agents download content updates locally, significantly reducing WAN traffic and improving performance.

Answer

Cortex XDR Management Console

Answer

Cortex Data Lake

Answer

WildFire appliance

Question 9

When testing a newly configured API integration instance in Cortex XSOAR, what is the standard action used to verify connectivity and authentication credentials?

Accepted Answer

Run the 'test-module' command. The 'test-module' command is the standard mechanism in Cortex XSOAR to test API connectivity and credentials.

Answer

Reboot the Cortex XDR management server tenant

Answer

Restart the Broker VM container service

Answer

Execute a full endpoint isolation workflow

Question 10

An XDR engineer is investigating an incident where an alert shows a suspicious scheduled task created on a server. The engineer wants to determine whether the same process that created the task also initiated outbound network connections within the same causality chain. Which Cortex XDR capability should the engineer use to trace this relationship?

Accepted Answer

Open the alert's Causality View to pivot from the scheduled task creation process to its child network events within the same process tree.. The Causality View is designed to show the process tree and linked events sharing a causality ID, which is exactly the relationship needed to connect the process that created a scheduled task to any network connections it initiated. Filtering network data by hostname and time alone cannot establish that link, and the other modules address different questions.

Answer

Check the Threat Intelligence module for any known IOCs matching the server's outbound destination IP addresses.

Answer

Review the Endpoint Management audit log for the server to see which user account created the scheduled task.

Answer

Run an XQL query against the network_story dataset filtered only by the server hostname and the incident time window.

Question 11

A security administrator is installing a Cortex XDR Broker VM in a highly secure environment where internet access is restricted. The Broker VM must be able to communicate with the Cortex XDR cloud to receive updates and forward data. Which network configuration must be allowed to ensure successful operation?

Accepted Answer

Outbound TCP 443 to the Cortex XDR cloud FQDNs and inbound TCP 443 from agents.. The Broker VM must have outbound TCP 443 access to the Cortex XDR cloud for updates and data forwarding, and it must accept inbound TCP 443 from agents to receive their telemetry. This ensures secure, reliable communication. The other options either use incorrect protocols or ports, which would break functionality.

Answer

Outbound TCP 8443 to the Cortex XDR cloud and inbound TCP 8443 from agents.

Answer

Outbound TCP 443 to the Cortex XDR cloud and inbound UDP 514 from agents.

Answer

Outbound UDP 514 to the Cortex XDR cloud and inbound TCP 443 from agents.

Question 12

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which TWO locations or methods should the administrator check to diagnose the root cause of the failure? (Choose two)

Accepted Answer

Windows Installer verbose installation logs generated with logging parameters (/L*v). Installation issues can be diagnosed using Windows Installer verbose logs and Event Viewer system/application logs.

Answer

The local BIOS/UEFI secure boot configuration summary file

Answer

The Cisco ISE policy enforcement cache database

Answer

The global Panorama traffic log buffer

Question 13

An administrator is planning network connectivity for a Broker VM that needs to forward logs to an external SIEM while also communicating with Cortex XDR. Which network configuration requirement must be met?

Accepted Answer

The Broker VM must be able to resolve DNS and communicate outbound to the Cortex XDR cloud over TCP port 443. The Broker VM requires outbound HTTPS access to the Cortex XDR cloud and inbound/outbound connectivity depending on syslog collection and SIEM forwarding roles.

Answer

The Broker VM must operate as an explicit proxy server with Kerberos authentication enabled

Answer

The Broker VM must have ICMP echo requests enabled across all enterprise routers

Answer

The Broker VM must have a direct public IP address assigned to its management interface

Question 14

An administrator wants to ensure high availability and load balancing for log collection and agent proxying using Broker VMs. Which TWO best practices should be considered during the planning phase? (Choose two)

Accepted Answer

Ensure all Broker VMs are synchronized with accurate NTP time sources. Deploying multiple Broker VMs behind a load balancer and sizing them appropriately ensures high availability and scalability.

Answer

Assign identical MAC addresses to all Broker VM instances to simplify switch ARP tables

Answer

Configure all agents to connect to a single static Broker VM IP address without failover options

Answer

Run Broker VMs exclusively on physical bare-metal hardware without virtualization hypervisors

Question 15

An administrator is preparing to deploy Cortex XDR agents in an environment utilizing a software restriction policy and Application Whitelisting. What must the administrator verify before running the agent installation?

Accepted Answer

Ensure the Cortex XDR installer binaries, service executables, and driver certificates are trusted or whitelisted in the local security software. Third-party application whitelisting or restriction software can block the execution of the Cortex XDR installer or core drivers if they are not explicitly trusted or excluded.

Answer

Disable Windows User Account Control (UAC) entirely across all domain controllers

Answer

Configure the local hosts file to resolve the management tenant to localhost

Answer

Convert the file system from NTFS to FAT32 to support raw driver loading

Question 16

An administrator is configuring a Cortex XDR Broker VM to collect logs from third-party syslog sources within a segregated network zone. Which prerequisite must be met on the network firewall to allow the Broker VM to successfully receive syslog data?

Accepted Answer

Allow inbound UDP/TCP port 514 from the internal log forwarders to the Broker VM.. The Broker VM acts as a syslog collector and requires UDP or TCP port 514 (or a custom configured port) to be allowed inbound from the log sources.

Answer

Allow outbound TCP port 443 to the Cortex XDR tenant.

Answer

Allow inbound TCP port 22 from the management station to the Broker VM.

Answer

Allow outbound DNS traffic on port 53 to local domain controllers.

Question 17

A security architect is planning a Cortex XDR deployment for a large enterprise with 8,000 endpoints across three geographic regions. The company requires that all endpoint telemetry and alerts be stored within the region where each endpoint resides, and that no data leaves that region. Which Cortex XDR deployment architecture should the architect recommend?

Accepted Answer

Deploy separate Cortex XDR tenants in each region, with endpoints connecting to the tenant in their own region.. Cortex XDR tenants are provisioned in specific geographic regions, and all endpoint data, alerts, and incidents are stored within that region. To meet strict data residency requirements per region, separate tenants must be deployed in each region so endpoints report to a local tenant. A single tenant cannot enforce per-endpoint data residency, and Broker VMs do not change the tenant's data storage location.

Answer

Deploy a Cortex XDR tenant in the primary region and use Broker VMs in each remote region to locally cache and process all endpoint data.

Answer

Deploy Cortex XDR agents in each region and forward all telemetry to a central syslog server in the primary region.

Answer

Deploy a single Cortex XDR tenant in the primary region and configure regional data residency settings for each endpoint group.

Question 18

A Cortex XDR administrator needs to deploy a new agent policy to a group of endpoints running macOS. The policy must enable the Behavioral Threat module and set the action to 'Block' for all severity levels. After creating the policy, the administrator assigns it to the endpoint group. However, the endpoints are not receiving the policy. Which step should the administrator verify first?

Accepted Answer

Verify that the endpoint group is correctly associated with the policy and that the agents are connected.. The most common reason for endpoints not receiving a policy is that the policy is not correctly assigned to their endpoint group, or the agents are not connected to the console. The administrator should first verify the assignment and agent connectivity. Once these are confirmed, the policy will be delivered. Other steps are less likely to resolve the issue.

Answer

Restart the Cortex XDR management console service.

Answer

Check that the macOS endpoints have the latest agent version installed.

Answer

Ensure that the policy is set as the default policy for the tenant.

Question 19

A security engineer is planning the installation of Cortex XDR agents on a large number of endpoints across different operating systems. The engineer must ensure that the agents can be deployed silently and that they automatically register with the correct Cortex XDR tenant. Which TWO installation considerations are essential for a successful mass deployment? (Choose two.)

Accepted Answer

Ensure that the installation is performed with administrative privileges on each endpoint.. The two essential considerations are including the tenant ID or registration token and ensuring administrative privileges. The tenant ID ensures proper registration, and admin rights are needed for installation. Other factors like disabling security software, static IPs, or pre-installing content are not required and could introduce issues.

Answer

Configure the agent to use a static IP address for communication with the Cortex XDR cloud.

Answer

Disable all other security software on the endpoints before installation.

Answer

Pre-install the Cortex XDR content update package on each endpoint to reduce initial cloud traffic.

Question 20

An administrator is troubleshooting an API rate-limiting error (HTTP 429 Too Many Requests) occurring in a custom Cortex XSOAR automation playbook that queries an external threat intel API. How should the integration or playbook be modified to handle this gracefully?

Accepted Answer

Implement exponential backoff and retry logic within the integration command or playbook task. Handling rate limits requires implementing backoff and retry logic or adjusting polling intervals within the integration/playbook.

Answer

Disable SSL certificate validation on the API integration instance

Answer

Switch the integration protocol from HTTPS to raw TCP sockets

Answer

Increase the Broker VM CPU allocation to bypass API server limits