XDR-Engineer Detection And Reporting Practice Test 2 — 15 Questions

Question 1

An organization needs to forward all Cortex XDR incidents and alerts to an external SIEM platform in real time. Which Cortex XDR feature should the administrator configure?

Accepted Answer

Syslog Forwarding configuration. Cortex XDR supports real-time forwarding of alerts and incidents to external SIEMs using Syslog forwarding or the Data Export Service / Webhook integrations.

Answer

Scheduled PDF Reporting

Answer

BIOC Rule Simulator

Answer

Agent Upgrade Profiles

Question 2

An administrator created a new BIOC detection rule, but test alerts are not appearing in the Incident triage view. Upon checking the rule status, it is active and enabled. What is a common reason why a valid BIOC rule might fail to generate alerts?

Accepted Answer

The required event telemetry type is disabled in the agent Data Collection profile.. BIOC rules evaluate telemetry collected by the agent. If the required event types (e.g., process execution, registry modification) are not enabled in the agent's Data Collection profile, the underlying telemetry will not exist for the rule to match.

Answer

BIOC rules only execute when triggered manually by an analyst.

Answer

Cortex XDR requires a mandatory 72-hour calibration period before BIOC rules become active.

Answer

All BIOC rules require Cortex XSOAR to authorize alert generation.

Question 3

An analyst wants to write an advanced XQL query that correlates network connection events with process execution events using a common join key (`causality_id`). Which XQL command operator is used to combine two datasets based on a matching field?

Accepted Answer

join. In XQL, the `join` operator is used to combine datasets or query streams based on shared keys such as causality IDs.

Answer

link

Answer

merge_streams

Answer

combine_tables

Question 4

An analyst is reviewing an incident where a suspicious process spawned a child process. The analyst wants to check if any other endpoint in the enterprise has ever executed this exact child process image file name combined with a specific command-line argument. Which search method is most efficient?

Accepted Answer

Execute an XQL query across xdr_data filtering for the specific process name and command line.. Using XQL to search across the entire `xdr_data` dataset for the specific process name and command line provides immediate enterprise-wide visibility.

Answer

Reboot all endpoints into Safe Mode.

Answer

Manually check the Agent Management list for each host individually.

Answer

Review the weekly PDF Scheduled Report.

Question 5

An organization experiences repeated false positive alerts from a specific legitimate administrative script that matches a built-in Cortex XDR behavioral Analytics detection. How should the administrator handle this built-in detection alert to prevent future false positives without disabling protection entirely?

Accepted Answer

Create an exception / exclusion rule for the analytic alert specifying the legitimate file hash or path.. Built-in behavioral analytics alerts can be tuned or suppressed by creating specific alert exclusions or exceptions based on file hashes, digital signatures, or specific execution parameters.

Answer

Delete the underlying OS telemetry dataset using an XQL drop command.

Answer

Uninstall the Cortex XDR agent from the administrative server.

Answer

Disable the entire Analytics module globally across the tenant.

Question 6

An analyst is reviewing an incident and wants to quickly export the raw artifact details and event logs associated with the specific alert for offline sharing. Which feature in the Incident View should the analyst use?

Accepted Answer

Export options in the Incident View (CSV/JSON). Cortex XDR provides export options within incident views to download incident details, alerts, and observables as CSV or JSON.

Answer

Agent installation log collector

Answer

Cortex XSOAR Marketplace

Answer

Syslog alert routing daemon

Question 7

An administrator wants to ensure that all critical severity alerts generated in Cortex XDR are immediately brought to the attention of the SOC by triggering an audible notification and high-priority banner in the console. Where are console notification preferences managed?

Accepted Answer

User Profile / Notifications settings in the Cortex XDR console. Console alert notifications, preferences, and display settings are managed within user profile settings or notification configurations in the Cortex XDR console.

Answer

Agent Profile -> Malware Settings

Answer

Data Export Service configuration

Answer

Host Insights -> Scan Schedules

Question 8

An analyst notices that an endpoint has been isolated due to a severe security incident, but investigation reveals the alert was a false positive. What is the correct procedure to restore network connectivity to the endpoint?

Accepted Answer

Select the endpoint in Endpoint Management and click 'Unisolate'.. When an endpoint is isolated during incident containment, an analyst can reverse the action by selecting 'Unisolate' from the endpoint actions menu.

Answer

Change the agent operating mode to Diagnostic mode.

Answer

Delete the incident from the triage queue.

Answer

Reinstall the Cortex XDR agent using the command line.

Question 9

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

Accepted Answer

Analytics rule descriptions and details within the Cortex XDR console / documentation reference. While custom BIOCs are fully user-editable, built-in Analytics rule details, descriptions, and attack descriptions are documented within the Cortex XDR Analytics documentation and rule description references in the console.

Answer

Agent binary configuration file (agent.conf)

Answer

Host Insights Vulnerability assessment database

Answer

Cortex XSOAR Playbook Designer source code

Question 10

An organization uses Cortex XDR to ingest cloud audit logs (such as AWS CloudTrail) alongside endpoint telemetry. An analyst wants to write an XQL query to search for AWS console login failures across the `aws_cloudtrail_raw` dataset. Which XQL structure properly targets cloud logs and filters for failed logins?

Accepted Answer

dataset = aws_cloudtrail_raw | filter eventName == 'ConsoleLogin' and responseElements contains 'Failure'. When querying cloud connector logs in Cortex XDR, the dataset name corresponds to the cloud source (e.g., `aws_cloudtrail_raw`) and fields match the cloud schema.

Answer

dataset = panw_analytics_alerts | filter source == 'AWS'

Answer

dataset = xdr_data | filter cloud_event == 'AWS_LOGIN_FAIL'

Answer

dataset = endpoints_inventory | filter cloud_provider == 'AWS'

Question 11

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

Accepted Answer

Change the incident status to Resolved and select the appropriate resolution reason (e.g., False Positive).. Incidents in Cortex XDR are resolved by changing their status to 'Resolved' and assigning an appropriate resolution status such as False Positive or Benign True Positive.

Answer

Delete the agent from Endpoint Management.

Answer

Put the agent into Bypass mode.

Answer

Purge all logs using the XQL delete command.

Question 12

An administrator wants to configure role-based access control (RBAC) so that a newly formed tier-1 SOC team can view incidents and run XQL queries, but cannot modify firewall rules, agent settings, or create custom BIOC rules. Where should the administrator configure this role?

Accepted Answer

Settings -> Configurations -> Roles. Role-Based Access Control (RBAC) roles and permissions in Cortex XDR are managed under Settings -> Configurations -> Roles.

Answer

Agent Settings -> Profiles -> Permissions

Answer

Host Insights -> License Roles

Answer

Incident Management -> Access Control

Question 13

An administrator is configuring custom BIOC rules in Cortex XDR. Which TWO elements are mandatory when defining a new BIOC rule? (Choose two)

Accepted Answer

Rule Logic / Event Query criteria. When creating a custom BIOC rule in Cortex XDR, administrators must specify a unique Rule Name and define the matching Rule Logic/Query criteria.

Answer

External SIEM Forwarding Destination IP

Answer

Custom Agent Installation Password

Answer

Cortex XSOAR Playbook ID

Question 14

An analyst is investigating an incident in Cortex XDR and wants to gather more forensic data from an endpoint. Which TWO live response actions can the analyst execute directly from the Cortex XDR console? (Choose two)

Accepted Answer

Run Live Response command-line scripts/commands. Cortex XDR Live Response provides interactive tools to investigate endpoints, such as running scripts, retrieving files, and viewing running processes.

Answer

Modify local BIOS boot sequence configurations

Answer

Upgrade the endpoint's physical hardware memory

Answer

Flash new network switch firmware

Question 15

An engineer is writing an XQL query to investigate endpoint activity. Which TWO commands are valid XQL query operators used for data manipulation and shaping? (Choose two)

Accepted Answer

filter. XQL utilizes powerful pipeline operators such as `filter`, `stats`, `fields`, and `sort` to process datasets.

Answer

SELECT * FROM

Answer

DROP TABLE

Answer

INSERT INTO