XDR-Engineer Practice Test 9 — 10 Questions

Question 1

An administrator is troubleshooting why a Cortex XDR Agent is failing to communicate with the cloud management console. Which TWO network or configuration checks should the administrator perform? (Choose two)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check local proxy configurations and ensure the agent profile has correct proxy credentials defined if required.. Option C is correct because Cortex XDR agents often sit behind corporate proxies, so the administrator must confirm the endpoint's local proxy settings and ensure the agent profile contains valid proxy credentials (username/password or certificate) if the proxy requires authentication; otherwise the agent cannot reach the cloud. Option D is correct because the agent communicates with the Cortex XDR management console over outbound TCP 443 to the tenant-specific URL (e.g., .xdr..paloaltonetworks.com), so any firewall, security gateway, or SSL-inspection device blocking that traffic will break communication. Option A is wrong because the Broker VM does not require SSH access to endpoints; it is used for local agent communication and log collection, not remote shell management. Option B is wrong because UDP 514 is syslog, not a Cortex XDR agent communication channel, and the agent does not listen on it for cloud connectivity. Option E is wrong because inbound TCP 22 (SSH) is not needed for the agent to reach the cloud console and is unrelated to agent-cloud communication.

Answer

Check that the Broker VM has direct SSH access to the endpoint.

Answer

Verify that UDP port 514 is listening locally on the endpoint.

Answer

Verify that inbound TCP port 22 is open on the endpoint for remote management.

Question 2

During an investigation, a SOC analyst needs to determine which user account was associated with a specific process execution that triggered a Cortex XDR alert. The analyst has the Causality ID from the alert. Which Cortex XDR feature or query approach should the analyst use to identify the responsible user?

Accepted Answer

Run an XQL query on the xdr_data dataset filtering by the Causality ID and project the actor_effective_username field.. The xdr_data dataset in Cortex XDR stores detailed endpoint telemetry, including process causality chains and effective usernames. By filtering on the Causality ID from the alert and projecting actor_effective_username, the analyst directly identifies the user account responsible for the process execution. This approach is precise and leverages native XQL capabilities.

Answer

Check the Audit Log in Cortex XDR, which records the username of the endpoint user for every process execution.

Answer

Open the Incident View and look at the 'Assigned User' field, which lists the account that triggered the alert.

Answer

Use the Threat Intelligence module to look up the Causality ID, which resolves to the user account in the threat feed.

Question 3

A Cortex XDR engineer is tuning detection coverage and wants to know which MITRE ATT&CK techniques the organization's current endpoint policies and analytics are actually detecting, so gaps can be prioritized. Which Cortex XDR capability should the engineer use to map existing detections to ATT&CK techniques and visualize coverage?

Accepted Answer

A coverage or ATT&CK mapping view that correlates analytics and BIOCs to ATT&CK techniques and highlights techniques with no associated detections.. ATT&CK mapping correlates deployed analytics and BIOCs with adversary techniques and can highlight techniques with no associated detections, which is exactly what the engineer needs to prioritize tuning. Scan scheduling, agent versioning, and retention settings describe operational or storage state and cannot reveal technique-level detection coverage.

Answer

The agent version report, which shows which endpoint agent builds are installed across the fleet.

Answer

The endpoint scan scheduler, which lists when each endpoint last completed a full malware scan.

Answer

The data retention setting, which controls how long raw endpoint events are stored before deletion.

Question 4

Which TWO criteria can be used to dynamically group endpoints and assign agent profiles in Cortex XDR? (Choose two)

Accepted Answer

Operating system type (e.g., Windows, macOS, Linux). Option B is correct because Cortex XDR dynamic endpoint groups can filter endpoints by operating system type (Windows, macOS, Linux), allowing an agent profile to be assigned automatically to all endpoints running a given OS. Option C is correct because hostname or naming-convention patterns (for example, matching a prefix like 'SRV-' or a regex) are supported dynamic filter criteria used to group endpoints and bind them to an agent profile. Option A is not a supported grouping criterion, as Cortex XDR does not use physical desk location numbers for dynamic endpoint grouping. Option D is nonsensical and not a valid attribute; BIOS serial numbers are not used as a color-based grouping criterion. Option E is irrelevant, since local account password expiration dates are not endpoint attributes exposed for dynamic grouping or agent profile assignment.

Answer

Physical office desk location number

Answer

BIOS manufacturer serial number color

Answer

Local user account password expiration date

Question 5

An administrator is managing custom IOC (Indicator of Compromise) feeds in Cortex XDR. Which THREE file formats or ingestion methods are supported when importing custom IOC indicators? (Choose three)

Accepted Answer

CSV file upload. In Cortex XDR, custom IOC indicators can be imported by uploading a CSV file (option B), which is the standard manual bulk-import format using columns such as indicator type, value, and severity. Cortex XDR also supports consuming external threat intelligence through a TAXII threat feed integration (option C), allowing automated polling of STIX/TAXII 1.x or 2.x servers for indicators. Additionally, indicators can be programmatically ingested via the Cortex XDR REST API (option D), enabling automated pipelines to push IOCs into the IOC store. Option A is incorrect because Cortex XDR does not compile or ingest C++ source code as an IOC format, and option E is incorrect because a Windows Registry Hive backup is a system artifact, not a supported IOC ingestion format or method.

Answer

Compiled C++ source code (.cpp)

Answer

Windows Registry Hive backup (.hiv)

Question 6

A security operations team is implementing automated response actions in Cortex XDR. They need to ensure that when a high-severity alert is triggered, the system automatically isolates the endpoint and creates a case in their ticketing system. Which Cortex XDR component should they use to orchestrate this workflow?

Accepted Answer

Cortex XDR Automation. Cortex XDR Automation provides the orchestration and playbook capabilities needed to automatically respond to alerts. It can execute endpoint isolation and integrate with ticketing systems via APIs, enabling the described workflow without manual intervention.

Answer

Cortex XDR Broker VM

Answer

Cortex XDR Data Forwarding

Answer

Cortex XDR Query Builder

Question 7

Where can an administrator view the status and health of all deployed Broker VMs directly within the Cortex XDR management console?

Accepted Answer

Settings > Configurations > Infrastructure > Broker VMs. Broker VM status and health are viewed under Settings > Configurations > Infrastructure > Broker VMs in the Cortex XDR management console. This is the dedicated management pane where administrators monitor deployed brokers, their connectivity, and health state.

Answer

Settings > Configurations > Broker VMs

Answer

Endpoints > Broker VMs

Answer

XDR Devices > Infrastructure > Broker VMs

Question 8

An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?

Accepted Answer

A Condition (or Decision) block that evaluates the sandbox verdict output. Conditional routing in playbooks is handled using Decision or Condition tasks to evaluate previous task outputs.

Answer

A Data Collection task pointing to the endpoint agent

Answer

A Post-Processing script executed directly on the Broker VM

Answer

A Manual Approval step without automated logic branching

Question 9

An analyst configures a scheduled report in Cortex XDR to summarize alert volumes per endpoint group every Monday. After the first run, the recipient inboxes show the report was generated but the attached data only covers the previous 24 hours instead of the entire preceding week. Which configuration element most likely caused this truncated reporting window?

Accepted Answer

The report's time range was left at the default relative window rather than being set to the intended seven-day period.. Scheduled reports in Cortex XDR honor the time range saved in the report definition. When an analyst expects a week of data but receives a single day, the stored relative range is the usual culprit because the default lookback is short. Editing the report to use an explicit seven-day window aligns the generated dataset with the intended weekly summary.

Answer

The report schedule used a cron expression that fires daily, overwriting the weekly aggregation with the latest single day.

Answer

The endpoint groups were assigned to the report but no data sources were enabled, so only real-time telemetry was included.

Answer

The distribution list exceeded the maximum recipients, so the system truncated the payload to the most recent events.

Question 10

An administrator needs to upgrade a large fleet of Linux endpoints running the Cortex XDR agent. What is the recommended best practice for performing this upgrade via the Cortex XDR management console?

Accepted Answer

Create a new installation package with the upgraded version and push it using software distribution tools or the console upgrade feature.. Deploying an upgraded installation package or using the console's upgrade mechanism ensures consistency, but for Linux, deploying the updated package via software deployment tools or the console upgrade task is standard.

Answer

Delete the endpoint from the console and re-enroll it with the latest agent version.

Answer

Modify the local yum/apt repository configuration to pull updates from Palo Alto Networks public cloud.

Answer

Uninstall the existing agent completely, reboot the server, and manually install the new version via CLI.