XDR-Engineer Practice Test 8 — 10 Questions

Question 1

A Cortex XDR administrator is troubleshooting why a custom BIOC rule that was expected to trigger on specific process behavior is not generating alerts. The rule is enabled and assigned to the relevant endpoint policy. Which two actions should the administrator take to diagnose the issue? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the BIOC rule's condition syntax and field names match the actual event schema. When a BIOC rule does not trigger, the most common causes are incorrect condition syntax or field names and a mismatch between the rule and the agent's content or policy. Verifying the rule's logic against the event schema and confirming that the agent has the correct content and policy assignment are the two essential diagnostic steps.

Answer

Restart the Cortex XDR management console to force rule recompilation

Answer

Change the rule's severity to Critical to ensure it generates an incident

Answer

Disable all other BIOC rules to isolate the non-triggering rule

Question 2

An administrator is setting up agent settings profiles in Cortex XDR. What is the primary purpose of creating multiple agent settings profiles?

Accepted Answer

To apply distinct security policies, operational modes, and exclusions to different groups of endpoints. Agent settings profiles let administrators bundle distinct security policy configurations — malware protection, exploit protection, behavioral threat settings, endpoint operational modes (e.g., block vs. report), and exclusions — and then assign each profile to different endpoint groups. This allows one tenant to enforce different postures for servers, workstations, or business units without duplicating the whole tenant configuration.

Answer

To assign different cloud tenants to individual users

Answer

To support different operating system architectures within the same profile

Answer

To manage software license renewals automatically

Question 3

An architect is designing a Cortex XDR deployment for an organization with strict outbound internet filtering. Agents cannot connect directly to the public cloud. Which architectural component must be installed within the DMZ or internal network to act as a proxy and forward agent traffic to the Cortex XDR cloud?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM is the architectural component designed to sit in a DMZ or internal network and proxy agent traffic to the Cortex XDR cloud when direct outbound internet access is restricted. It also handles other functions like local agent distribution, syslog collection, and WildFire forwarding. This makes it the correct answer for environments with strict outbound filtering.

Answer

Panorama Management Server

Answer

Cortex XSOAR Engine

Answer

WildFire Appliance

Question 4

An administrator wants to verify whether Cortex XDR successfully collected telemetry from a newly installed agent. Which reporting or query tool can be used to quickly list all active agents and their last seen timestamp?

Accepted Answer

Endpoint Management view in the Cortex XDR console. The Endpoint Management page provides a real-time inventory of all enrolled agents, their status, and last seen timestamps.

Answer

BIOC Rule Testing interface

Answer

Incident triage queue

Answer

Security Information and Event Management (SIEM) export logs

Question 5

An administrator is troubleshooting a Broker VM that is failing to pull updates from the Cortex XDR cloud. Upon inspecting the Broker VM system logs, the administrator notices SSL handshake errors. What is the most likely root cause?

Accepted Answer

An intervening firewall or explicit proxy is performing SSL decryption and presenting an untrusted certificate to the Broker VM. SSL inspection or interception by an explicit proxy or next-generation firewall without proper TLS decryption certificate installation causes SSL handshake failures on the Broker VM.

Answer

The Broker VM registration key contains invalid characters due to copy-paste formatting

Answer

The Cortex XDR management tenant license has expired due to billing cycle misalignment

Answer

The Broker VM kernel version is incompatible with the Linux swap space partition size

Question 6

What is the primary function of an Agent Settings profile in Cortex XDR?

Accepted Answer

To configure administrative options such as anti-tampering passwords and operational parameters.. An Agent Settings profile in Cortex XDR is used to configure administrative and operational options for the endpoint agent, including the anti-tampering password, agent logging level, malware scan schedules, and other behavior controls. It is applied to endpoints via policy rules and governs how the agent operates locally rather than defining detection content. This makes it the correct place for administrative parameters such as passwords and operational settings.

Answer

To establish network firewall rules for endpoint isolation.

Answer

To specify which file hashes are malicious and should be blocked.

Answer

To define exploit prevention techniques for browser-based attacks.

Question 7

An administrator is configuring a Cortex XDR automation rule to trigger a playbook when a new alert matches specific conditions. The playbook must run only for alerts with a severity of High or Critical and only for alerts originating from the 'Malware' alert category. Which TWO configuration elements must be set in the automation rule to enforce these conditions? (Choose two.)

Accepted Answer

Alert category filter set to Malware. To enforce severity and category conditions in a Cortex XDR automation rule, the rule must include a severity filter set to High and Critical and an alert category filter set to Malware. These two filters determine which alerts trigger the playbook. Timeout, exclusion lists, and endpoint groups do not control alert selection based on severity or category.

Answer

Playbook timeout set to 300 seconds

Answer

Endpoint group scoped to the 'Malware' group

Answer

Exclusion list containing all Medium and Low severity alerts

Question 8

An organization is deploying Cortex XDR agents across a restricted corporate network where endpoints cannot reach the public internet. How must the administrator configure the environment to ensure agents can successfully connect to the Cortex XDR server?

Accepted Answer

Deploy a Cortex XDR Broker VM internally to proxy agent communication to the Cortex XDR cloud.. When endpoints cannot reach the public internet, Cortex XDR agents cannot establish their outbound TLS connection to the Cortex XDR cloud. The supported solution is to deploy a Broker VM inside the restricted network; agents connect to the Broker, which proxies their traffic out to the Cortex XDR service. This preserves agent functionality without opening direct internet access from every endpoint.

Answer

Open outbound HTTPS port 443 directly from every endpoint to public DNS root servers.

Answer

Configure agents to communicate via SNMP traps to the primary domain controller.

Answer

Manually export logs via USB on each endpoint on a weekly basis.

Question 9

Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?

Accepted Answer

cytool. The cytool utility is the command-line interface on Windows endpoints for querying and managing the Cortex XDR agent. Running commands such as 'cytool status' or 'cytool info' displays the agent's operational status, connection state to the management server, and installed version. It is the standard tool for local agent diagnostics on Windows.

Answer

xdr-cli

Answer

traps-cli

Answer

pan-agent-ctl

Question 10

An administrator is configuring a Syslog Collector agent on Cortex XDR to ingest logs from a third-party firewall. Which log collection protocol and transport layer combination is natively supported by the Cortex XDR Collector for receiving unencrypted syslog messages?

Accepted Answer

Syslog over UDP and TCP. The Cortex XDR Collector natively supports receiving unencrypted syslog messages over both UDP and TCP. UDP is commonly used for syslog due to its low overhead, while TCP provides reliable delivery. This combination is standard for syslog ingestion in many security platforms.

Answer

Syslog over HTTP/HTTPS

Answer

Syslog over SSH tunneling

Answer

Syslog over FTP/SFTP