XDR-Engineer Detection And Reporting Practice Test 3 — 15 Questions

Question 1

An administrator is configuring log forwarding to an external SIEM using Syslog. Which THREE configuration parameters must typically be defined to establish the Syslog destination successfully? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Destination IP address or FQDN. When configuring Syslog forwarding in Cortex XDR, administrators must specify the Destination IP/Hostname, Port, and Transport Protocol (TCP/UDP/TLS).

Answer

Agent proxy bypass list

Answer

Endpoint BIOS Administrator password

Question 2

An organization wants to configure granular reporting and alerting based on MITRE ATT&CK techniques. Within Cortex XDR, which THREE methods or views allow security teams to analyze detections mapped against the MITRE ATT&CK framework? (Choose three)

Accepted Answer

Incident and alert details displaying mapped ATT&CK tactics and techniques. Cortex XDR integrates MITRE ATT&CK mapping into the Incident View, Analytics alerts, and dedicated Security posture / ATT&CK reporting widgets.

Answer

Agent uninstallation wizard

Answer

Local endpoint BIOS flashing utility

Question 3

An administrator is managing custom IOC (Indicator of Compromise) feeds in Cortex XDR. Which THREE file formats or ingestion methods are supported when importing custom IOC indicators? (Choose three)

Accepted Answer

CSV file upload. Cortex XDR supports importing custom IOCs via flat file uploads (CSV), STIX/TAXII threat feeds, and direct API ingestion.

Answer

Compiled C++ source code (.cpp)

Answer

Windows Registry Hive backup (.hiv)

Question 4

An administrator is designing a scheduled report distribution list in Cortex XDR. Which TWO formats can be selected when generating and exporting scheduled reports? (Choose two)

Accepted Answer

CSV. Cortex XDR supports exporting scheduled reports in standard formats including PDF and CSV.

Answer

PowerPoint Presentation (.pptx)

Answer

Windows Executable (.exe)

Answer

Virtual Machine Disk (.vmdk)

Question 5

An analyst is troubleshooting a complex multi-stage attack in Cortex XDR. Which THREE analytical tools or views in the console help reconstruct the sequence of events across endpoints? (Choose three)

Accepted Answer

Causality View graph. Incident causality views, XQL hunting queries, and attack story timelines are core tools used to reconstruct attacks in Cortex XDR.

Answer

Agent deployment package downloader

Answer

Global agent proxy configuration menu

Question 6

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

Accepted Answer

Agent software version. Endpoint Management displays operational agent details including the agent version and the last seen timestamp.

Answer

Hard drive manufacturing serial number

Answer

BIOS cryptographic signature key

Answer

Local administrator password hash

Question 7

An administrator is setting up alert notification rules in Cortex XDR. Which TWO delivery channels can be configured to notify security personnel when high-severity incidents occur? (Choose two)

Accepted Answer

Webhook integration (e.g., Slack, PagerDuty, XSOAR). Cortex XDR supports notifying personnel through Email notifications and Webhook integrations (such as PagerDuty, Slack, or XSOAR).

Answer

Automatic local printer output

Answer

Bluetooth broadcast to nearby mobile phones

Answer

Endpoint speaker audio alarm

Question 8

An engineer is configuring Data Export Service (DES) to stream Cortex XDR logs to a cloud storage bucket. Which THREE cloud storage providers are natively supported destinations for DES? (Choose three)

Accepted Answer

Google Cloud Storage. Cortex XDR Data Export Service supports streaming logs to major cloud storage destinations including Amazon S3, Google Cloud Storage, and Azure Blob Storage.

Answer

Local FTP Server via active mode

Answer

Bluetooth tethered mobile storage

Question 9

An engineer needs to write an XQL query to search for all events where a process named "cmd.exe" spawned a process named "powershell.exe". Which XQL dataset and query structure should be used?

Accepted Answer

dataset = xdr_data | filter event_type = ENUM_PROCESS_START and actor_process_image_name ends with "cmd.exe" and action_process_image_name ends with "powershell.exe". To query endpoint event data in Cortex XDR, the `dataset = xdr_data` is used along with filtering by event types such as PROCESS_START.

Answer

dataset = xdr_data | filter event_type = ENUM_PROCESS_START and actor_process_image_name = "cmd.exe" and cited_process_image_name = "powershell.exe"

Answer

dataset = xdr_alerts | filter alert_name = "cmd.exe spawned powershell"

Answer

dataset = panw_threat_intel | filter process_name = "cmd.exe" and child_process = "powershell.exe"

Question 10

An administrator wants to create a new BIOC rule to detect suspicious process execution in Cortex XDR. Which menu path should the administrator navigate to in the Cortex XDR console?

Accepted Answer

Incident Response > BIOC Rules. To create or manage BIOC rules in Cortex XDR, administrators must navigate to Incident Response > BIOC Rules.

Answer

XQL Search > Query Builder

Answer

Endpoints > Policy Rules

Answer

Data Collection > Log Stitching

Question 11

An administrator wants to ensure high availability and proper auditing of user activities within the Cortex XDR management console. Which THREE administrative auditing features are available? (Choose three)

Accepted Answer

Audit Log of administrator actions within the console. Cortex XDR tracks administrative actions through Audit Logs, tracks login sessions, and supports SAML/SSO integration for secure authentication auditing.

Answer

Endpoint hard disk SMART status monitoring

Answer

Automatic kernel debugging dump generation

Question 12

An administrator is designing a custom Alert-based BIOC rule in Cortex XDR. The requirement is to trigger an alert only when three distinct failed login events occur within a 5-minute window from the same source IP address. How should the aggregation and time window be configured?

Accepted Answer

Set the threshold count to 3, group by source IP address, and set the time window to 5 minutes.. Alert-based BIOC rules support aggregation and grouping by specific fields with a sliding time window to detect threshold breaches.

Answer

Set the threshold count to 5, group by event ID, and set the time window to 3 minutes.

Answer

Configure a BIOC rule using a single event trigger with a recurrence limit set to 3.

Answer

Use XQL correlation rules instead, because BIOC rules cannot evaluate time-based thresholds.

Question 13

Where within the Cortex XDR console should an administrator configure scheduled reporting to automatically email executive summaries to stakeholders on a weekly basis?

Accepted Answer

Reporting > Report Builder. Scheduled reporting and report generation templates are managed within the Dashboards and Reports section of Cortex XDR.

Answer

Incident Response > Incident Management

Answer

XQL Search > Scheduled Queries

Answer

Settings > Configurations > Email Notifications

Question 14

An organization wants to ingest custom syslog data from a third-party firewall into Cortex XDR and build detection rules around it. Which feature enables parsing and structuring this unformatted log data so it can be queried effectively using XQL?

Accepted Answer

Custom Parsing Rules. Cortex XDR uses Parsing Rules (or custom log parsing via Cortex XDR Collector / Broker VM) to map raw log fields into standard data schema fields.

Answer

Data Stitching Rules

Answer

BIOC Exception Filters

Answer

BIOC Correlation Policies

Question 15

An analyst is investigating an incident and notices that a custom Analytics BIOC rule generated too many false positives due to a legitimate administrative tool. What is the recommended method to tune this rule without completely disabling it?

Accepted Answer

Add an exception to the specific BIOC rule based on criteria such as file path, hash, or signer.. Exceptions can be added to BIOC rules to filter out known legitimate parameters, such as specific file hashes, signing certificates, or file paths.

Answer

Delete the BIOC rule and recreate it as an XQL scheduled alert.

Answer

Change the BIOC rule severity level from High to Low so analysts ignore it.

Answer

Modify the global agent profile to exclude the administrative tool from all endpoint monitoring.