XDR-Engineer Detection And Reporting Practice Test 2 — 15 Questions

Question 1

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

Accepted Answer

Scheduled Reports in the Reporting menu. Cortex XDR's Reporting menu includes a Scheduled Reports feature that lets administrators define report templates (including incident reports filtered to critical severity), set a weekly schedule, and configure email delivery to recipients such as the security operations team. This is the native, purpose-built capability for recurring PDF report distribution.

Answer

Incident Export via Syslog

Answer

Data Export Service

Answer

BIOC Alert Notifications

Question 2

A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?

Accepted Answer

Sequence or threshold-based BIOC rule. To evaluate stateful conditions across multiple events over a specific time window, sequence or threshold-based behavioral analytics / BIOC rules must be configured.

Answer

Agent Malware Prevention profile exception

Answer

Local firewall rule configuration

Answer

Static IOC file hash block rule

Question 3

An enterprise has deployed Cortex XDR agents across Windows and Linux hosts. A security engineer notices that a specific custom BIOC rule is triggering successfully on Windows endpoints but fails to fire on Linux endpoints despite identical malicious commands being executed. What is the most likely cause?

Accepted Answer

The BIOC rule logic uses Windows-specific event fields and command structures that do not match Linux event telemetry schema.. BIOC rules contain operating system-specific syntax and event fields. A rule built exclusively for Windows event structures will not evaluate correctly against Linux OS telemetry.

Answer

The Linux agents must be rebooted into Diagnostic mode for BIOC evaluation.

Answer

Linux endpoints do not support custom BIOC rules in Cortex XDR.

Answer

Custom BIOCs require Cortex XSOAR to process Linux telemetry.

Question 4

An administrator wants to create a custom BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR to detect unexpected execution of PowerShell scripts downloading files from the internet. Which tool within the Cortex XDR management console should the administrator use to write and test this logic?

Accepted Answer

BIOC Rule Builder under Analytics. Cortex XDR provides the BIOC rule builder under the Analytics section to write custom behavioral rules based on OS query or endpoint events.

Answer

Host Insights Query Builder

Answer

Cortex XSOAR Playbook Designer

Answer

IOC Management under Malware Protection

Question 5

An analyst wants to view the complete Attack Story (causality chain) of an incident to understand how an initial phishing email led to credential dumping. Where in the Cortex XDR console should the analyst navigate?

Accepted Answer

Incident Details -> Causality View. The Causality View is the dedicated visualization in Cortex XDR that reconstructs the full attack story by chaining together related alerts, processes, and network events into a single causality chain. It is accessed by opening the specific incident and navigating to the Incident Details page, where the Causality View tab displays the root cause (e.g., a phishing email) through to the final malicious action (e.g., credential dumping). This view is purpose-built for exactly this kind of end-to-end forensic narrative.

Answer

Host Insights -> System Explorer

Answer

Reporting -> Scheduled Reports -> Attack Chain

Answer

Settings -> Configurations -> Causality

Question 6

An administrator wants to verify whether Cortex XDR successfully collected telemetry from a newly installed agent. Which reporting or query tool can be used to quickly list all active agents and their last seen timestamp?

Accepted Answer

Endpoint Management view in the Cortex XDR console. The Endpoint Management page provides a real-time inventory of all enrolled agents, their status, and last seen timestamps.

Answer

BIOC Rule Testing interface

Answer

Incident triage queue

Answer

Security Information and Event Management (SIEM) export logs

Question 7

An engineer is writing an XQL query to investigate rare process executions. The query needs to calculate the distinct count of endpoints where each process image name was executed, filtering out processes that appeared on more than 50 hosts. Which XQL snippet correctly implements this filter after aggregation?

Accepted Answer

stats host_count = count(distinct hostname) by actor_process_image_name | filter host_count <= 50. In XQL, the `filter` stage must come after the `stats` aggregation stage when you want to filter on an aggregated field like `host_count`. The correct snippet first computes `host_count = count(distinct hostname)` grouped by `actor_process_image_name`, then applies `filter host_count <= 50` to keep only processes seen on 50 or fewer hosts. This is the standard XQL pattern for 'rare process' hunting.

Answer

filter host_count <= 50 | stats host_count = count(distinct hostname) by actor_process_image_name

Answer

group by actor_process_image_name having count(distinct hostname) <= 50

Answer

stats host_count = count(hostname) where host_count <= 50

Question 8

An organization requires all custom BIOC alerts to be automatically tagged with the label 'Tier-3-Investigation' and assigned directly to a specific escalation group. Where can an administrator configure this automatic handling?

Accepted Answer

Incident Management / Incident Rules configuration. Cortex XDR's Incident Management area contains Incident Rules where administrators define conditions (such as BIOC alert name, severity, or MITRE tactic) and the resulting actions, including adding labels like 'Tier-3-Investigation' and assigning the incident to a specific escalation group. This is the native mechanism for automating alert triage and routing. Configuring it here ensures every matching BIOC alert is handled consistently without analyst intervention.

Answer

Agent installation package properties

Answer

Cortex XDR Collector configuration file

Answer

BIOC exclusion profile settings

Question 9

An organization utilizes custom correlation rules in Cortex XDR. An engineer needs to export these custom BIOC rules to backup configurations or migrate them to another Cortex XDR tenant. Which administrative feature supports this?

Accepted Answer

Export and Import options within the BIOC management interface. Cortex XDR provides Export and Import options directly within the BIOC (Behavioral Indicators of Compromise) management interface, allowing administrators to download custom correlation rules as a file and re-upload them into another tenant. This is the supported mechanism for backup and cross-tenant migration of custom BIOC rules.

Answer

Agent deployment script parameter flags

Answer

Cortex XDR API key generation settings

Answer

Data Export Service configuration bucket

Question 10

An organization needs to forward all Cortex XDR incidents and alerts to an external SIEM platform in real time. Which Cortex XDR feature should the administrator configure?

Accepted Answer

Syslog Forwarding configuration. Cortex XDR's Syslog Forwarding configuration allows the administrator to stream alerts, incidents, and audit logs to an external SIEM in real time via syslog (UDP/TCP/TLS). It is configured under Settings > Configurations > Syslog and supports multiple destinations with customizable formats (CEF, LEEF, JSON). This is the native, supported mechanism for real-time SIEM integration.

Answer

Scheduled PDF Reporting

Answer

BIOC Rule Simulator

Answer

Agent Upgrade Profiles

Question 11

An administrator created a new BIOC detection rule, but test alerts are not appearing in the Incident triage view. Upon checking the rule status, it is active and enabled. What is a common reason why a valid BIOC rule might fail to generate alerts?

Accepted Answer

The required event telemetry type is disabled in the agent Data Collection profile.. BIOC rules evaluate telemetry collected by the agent. If the required event types (e.g., process execution, registry modification) are not enabled in the agent's Data Collection profile, the underlying telemetry will not exist for the rule to match.

Answer

BIOC rules only execute when triggered manually by an analyst.

Answer

Cortex XDR requires a mandatory 72-hour calibration period before BIOC rules become active.

Answer

All BIOC rules require Cortex XSOAR to authorize alert generation.

Question 12

An analyst wants to write an advanced XQL query that correlates network connection events with process execution events using a common join key (`causality_id`). Which XQL command operator is used to combine two datasets based on a matching field?

Accepted Answer

join. The XQL `join` operator combines two datasets based on a matching field, which is exactly what is needed to correlate network connection events with process execution events using `causality_id` as the join key. It supports inner, left, and right join semantics similar to SQL, allowing analysts to enrich one event stream with context from another. This is the standard XQL construct for cross-dataset correlation in Cortex XDR.

Answer

link

Answer

merge_streams

Answer

combine_tables

Question 13

An analyst is reviewing an incident where a suspicious process spawned a child process. The analyst wants to check if any other endpoint in the enterprise has ever executed this exact child process image file name combined with a specific command-line argument. Which search method is most efficient?

Accepted Answer

Execute an XQL query across xdr_data filtering for the specific process name and command line.. Using XQL to search across the entire `xdr_data` dataset for the specific process name and command line provides immediate enterprise-wide visibility.

Answer

Reboot all endpoints into Safe Mode.

Answer

Manually check the Agent Management list for each host individually.

Answer

Review the weekly PDF Scheduled Report.

Question 14

An organization experiences repeated false positive alerts from a specific legitimate administrative script that matches a built-in Cortex XDR behavioral Analytics detection. How should the administrator handle this built-in detection alert to prevent future false positives without disabling protection entirely?

Accepted Answer

Create an exception / exclusion rule for the analytic alert specifying the legitimate file hash or path.. Built-in behavioral analytics alerts can be tuned or suppressed by creating specific alert exclusions or exceptions based on file hashes, digital signatures, or specific execution parameters.

Answer

Delete the underlying OS telemetry dataset using an XQL drop command.

Answer

Uninstall the Cortex XDR agent from the administrative server.

Answer

Disable the entire Analytics module globally across the tenant.

Question 15

An analyst is reviewing an incident and wants to quickly export the raw artifact details and event logs associated with the specific alert for offline sharing. Which feature in the Incident View should the analyst use?

Accepted Answer

Export options in the Incident View (CSV/JSON). Cortex XDR provides export options within incident views to download incident details, alerts, and observables as CSV or JSON.

Answer

Agent installation log collector

Answer

Cortex XSOAR Marketplace

Answer

Syslog alert routing daemon