XDR-Engineer Detection And Reporting Practice Test 3 — 15 Questions

Question 1

An administrator wants to ensure that all critical severity alerts generated in Cortex XDR are immediately brought to the attention of the SOC by triggering an audible notification and high-priority banner in the console. Where are console notification preferences managed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

User Profile / Notifications settings in the Cortex XDR console. Console alert notifications, preferences, and display settings are managed within user profile settings or notification configurations in the Cortex XDR console.

Answer

Agent Profile -> Malware Settings

Answer

Data Export Service configuration

Answer

Host Insights -> Scan Schedules

Question 2

An analyst notices that an endpoint has been isolated due to a severe security incident, but investigation reveals the alert was a false positive. What is the correct procedure to restore network connectivity to the endpoint?

Accepted Answer

Select the endpoint in Endpoint Management and click 'Unisolate'.. The correct procedure to restore network connectivity to an isolated endpoint is to select the endpoint in Endpoint Management and click 'Unisolate'. This action directly reverses the isolation policy applied by the Cortex XDR agent, allowing the endpoint to communicate on the network again. Isolation is a containment measure that restricts all network traffic except to the management server; unisolating removes that restriction. This is the standard workflow for false positives.

Answer

Change the agent operating mode to Diagnostic mode.

Answer

Delete the incident from the triage queue.

Answer

Reinstall the Cortex XDR agent using the command line.

Question 3

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

Accepted Answer

Analytics rule descriptions and details within the Cortex XDR console / documentation reference. The engineer can review the definition and rule logic of built-in Analytics detectors in the Analytics rule descriptions and details within the Cortex XDR console or documentation reference. This provides insight into the behavioral logic and heuristics used by the Analytics engine.

Answer

Agent binary configuration file (agent.conf)

Answer

Host Insights Vulnerability assessment database

Answer

Cortex XSOAR Playbook Designer source code

Question 4

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

Accepted Answer

Change the incident status to Resolved and select the appropriate resolution reason (e.g., False Positive).. Incidents in Cortex XDR are resolved by changing their status to 'Resolved' and assigning an appropriate resolution status such as False Positive or Benign True Positive.

Answer

Delete the agent from Endpoint Management.

Answer

Put the agent into Bypass mode.

Answer

Purge all logs using the XQL delete command.

Question 5

An administrator wants to configure role-based access control (RBAC) so that a newly formed tier-1 SOC team can view incidents and run XQL queries, but cannot modify firewall rules, agent settings, or create custom BIOC rules. Where should the administrator configure this role?

Accepted Answer

Settings -> Configurations -> Roles. Role-based access control in Cortex XDR is configured under Settings -> Configurations -> Roles, where administrators define custom roles with granular permissions across modules such as Incidents, XQL, BIOC, Agent Settings, and Firewall. Creating a role that grants view/query permissions while withholding configuration rights is exactly what this location supports.

Answer

Agent Settings -> Profiles -> Permissions

Answer

Host Insights -> License Roles

Answer

Incident Management -> Access Control

Question 6

An administrator is configuring custom BIOC rules in Cortex XDR. Which TWO elements are mandatory when defining a new BIOC rule? (Choose two)

Accepted Answer

Rule Logic / Event Query criteria. Option D (Rule Name) is mandatory because every BIOC rule in Cortex XDR must have a unique, descriptive name that identifies it in the BIOC rules list and in generated alerts, so the console will not let you save the rule without one. Option C (Rule Logic / Event Query criteria) is mandatory because the BIOC rule is defined by its behavioral logic — the event query/condition built from fields such as event type, action, and process attributes — which determines what activity triggers the rule; without this criteria there is nothing for the rule to detect. Option A (External SIEM Forwarding Destination IP) is not required to define a BIOC rule, since forwarding to an external SIEM is a separate integration/notification setting configured outside the rule definition. Option B (Custom Agent Installation Password) is unrelated to BIOC rule creation; it is part of agent deployment/installation configuration. Option E (Cortex XSOAR Playbook ID) is not mandatory because playbook execution is an optional response action that can be attached to a rule, not a required element for defining the BIOC logic itself.

Answer

External SIEM Forwarding Destination IP

Answer

Custom Agent Installation Password

Answer

Cortex XSOAR Playbook ID

Question 7

An analyst is investigating an incident in Cortex XDR and wants to gather more forensic data from an endpoint. Which TWO live response actions can the analyst execute directly from the Cortex XDR console? (Choose two)

Accepted Answer

Run Live Response command-line scripts/commands. Option B is correct because Cortex XDR's Live Response feature provides a remote shell on the endpoint that lets analysts execute built-in commands and upload/run custom scripts for triage and forensic collection. Option E is correct because Live Response includes file retrieval actions (get file) that pull specified files or artifacts from the endpoint into the Cortex XDR console for offline analysis. Option A is incorrect because BIOS boot sequence changes are firmware-level settings not exposed through Cortex XDR Live Response. Option C is incorrect because adding physical memory is a hardware operation that cannot be performed remotely via the console. Option D is incorrect because flashing switch firmware is a network-device maintenance task outside the scope of endpoint Live Response actions.

Answer

Modify local BIOS boot sequence configurations

Answer

Upgrade the endpoint's physical hardware memory

Answer

Flash new network switch firmware

Question 8

An engineer is writing an XQL query to investigate endpoint activity. Which TWO commands are valid XQL query operators used for data manipulation and shaping? (Choose two)

Accepted Answer

filter. The XQL (Cortex XQL) query language uses pipeline-style operators such as filter and stats to manipulate and shape event data. Option A, filter, is correct because it is a valid XQL stage that restricts results to records matching a Boolean expression (e.g., filter event_type = "PROCESS"), acting as the primary data-selection operator. Option E, stats, is correct because it is a valid XQL stage that performs aggregations such as count(), sum(), avg(), min(), and max(), optionally grouped by fields, to shape raw events into summarized results. Options B, C, and D are not XQL operators: SELECT * FROM is SQL query syntax, DROP TABLE is a SQL DDL statement for deleting a table, and INSERT INTO is a SQL DML statement for adding rows, none of which are part of XQL's pipeline-based data manipulation syntax.

Answer

SELECT * FROM

Answer

DROP TABLE

Answer

INSERT INTO

Question 9

An administrator is configuring log forwarding to an external SIEM using Syslog. Which THREE configuration parameters must typically be defined to establish the Syslog destination successfully? (Choose three)

Accepted Answer

Destination IP address or FQDN. Option A (Destination IP address or FQDN) is correct because the Syslog client must know the network location of the external SIEM collector to send messages to it, whether specified as an IPv4/IPv6 address or a resolvable FQDN. Option B (Port number) is correct because Syslog listeners bind to a specific port (commonly UDP/TCP 514, or 6514 for TLS), and the forwarder must target that exact port to reach the collector. Option D (Protocol (TCP, UDP, or TLS)) is correct because Syslog can be transported over UDP, TCP, or TLS-encrypted TCP, and the forwarder must select a transport matching the SIEM's listener configuration. Option C (Agent proxy bypass list) is not required for basic Syslog forwarding, as it pertains to HTTP(S) proxy behavior rather than Syslog transport. Option E (Endpoint BIOS Administrator password) is unrelated to network log forwarding and is a hardware firmware security setting.

Answer

Agent proxy bypass list

Answer

Endpoint BIOS Administrator password

Question 10

An organization wants to configure granular reporting and alerting based on MITRE ATT&CK techniques. Within Cortex XDR, which THREE methods or views allow security teams to analyze detections mapped against the MITRE ATT&CK framework? (Choose three)

Accepted Answer

Incident and alert details displaying mapped ATT&CK tactics and techniques. Option A is correct because Cortex XDR incident and alert detail panes automatically enrich each detection with the mapped MITRE ATT&CK tactic and technique, letting analysts pivot on the specific adversary behavior that triggered the alert. Option B is correct because Cortex XDR provides a dedicated MITRE ATT&CK coverage dashboard and reporting view that aggregates detections by tactic and technique, which is exactly what is needed for granular reporting and alerting against the framework. Option E is correct because the Behavioral Indicators of Compromise (BIOC) rule authoring interface lets analysts tag custom rules with ATT&CK technique IDs, so their custom detections are also mapped and reportable within the framework. Option C is incorrect because the agent uninstallation wizard is an endpoint management function with no relation to ATT&CK mapping or detection analytics. Option D is incorrect because a local endpoint BIOS flashing utility is a hardware/firmware maintenance task and has nothing to do with analyzing detections against MITRE ATT&CK.

Answer

Agent uninstallation wizard

Answer

Local endpoint BIOS flashing utility

Question 11

An administrator is managing custom IOC (Indicator of Compromise) feeds in Cortex XDR. Which THREE file formats or ingestion methods are supported when importing custom IOC indicators? (Choose three)

Accepted Answer

CSV file upload. In Cortex XDR, custom IOC indicators can be imported by uploading a CSV file (option B), which is the standard manual bulk-import format using columns such as indicator type, value, and severity. Cortex XDR also supports consuming external threat intelligence through a TAXII threat feed integration (option C), allowing automated polling of STIX/TAXII 1.x or 2.x servers for indicators. Additionally, indicators can be programmatically ingested via the Cortex XDR REST API (option D), enabling automated pipelines to push IOCs into the IOC store. Option A is incorrect because Cortex XDR does not compile or ingest C++ source code as an IOC format, and option E is incorrect because a Windows Registry Hive backup is a system artifact, not a supported IOC ingestion format or method.

Answer

Compiled C++ source code (.cpp)

Answer

Windows Registry Hive backup (.hiv)

Question 12

An administrator is designing a scheduled report distribution list in Cortex XDR. Which TWO formats can be selected when generating and exporting scheduled reports? (Choose two)

Accepted Answer

CSV. In Cortex XDR, scheduled reports can be generated and exported in CSV (option C) and PDF (option D) formats. CSV is correct because it provides machine-readable, comma-separated tabular data suitable for further analysis in spreadsheets or SIEM ingestion, and it is one of the standard export formats offered for scheduled reports. PDF is correct because it is the standard human-readable, formatted report output that preserves the report's layout, charts, and tables for distribution to stakeholders. Options A, B, and E are not valid report export formats in Cortex XDR: PowerPoint (.pptx), Windows Executable (.exe), and Virtual Machine Disk (.vmdk) are unrelated to scheduled report generation and cannot be selected.

Answer

PowerPoint Presentation (.pptx)

Answer

Windows Executable (.exe)

Answer

Virtual Machine Disk (.vmdk)

Question 13

An analyst is troubleshooting a complex multi-stage attack in Cortex XDR. Which THREE analytical tools or views in the console help reconstruct the sequence of events across endpoints? (Choose three)

Accepted Answer

Causality View graph. Causality View graph is correct because it visually links related alerts, processes, and network activity into a causal chain, letting the analyst trace how one stage of the multi-stage attack triggered the next across endpoints. Incident Timeline view is correct because it presents chronologically ordered events and alerts for an incident, which is essential for reconstructing the exact sequence of attacker actions over time. XQL Search query interface is correct because it allows the analyst to write precise queries against endpoint telemetry (e.g., process, file, network, and registry events) to correlate activity across multiple hosts and fill gaps in the timeline. The unmarked options do not belong: Agent deployment package downloader is only for installing the agent, and Global agent proxy configuration menu is only for configuring agent proxy settings, neither of which provides analytical reconstruction of attack events.

Answer

Agent deployment package downloader

Answer

Global agent proxy configuration menu

Question 14

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

Accepted Answer

Agent software version. Option A (Agent software version) is correct because the Endpoint Management module in Cortex XDR displays the installed agent version for each enrolled endpoint, allowing analysts to verify whether agents are up to date and identify version drift across the fleet. Option C (Last seen timestamp) is correct because the console shows when each agent last communicated with the Cortex XDR management server, which is essential for spotting offline or unresponsive endpoints. The unmarked options do not belong: hard drive manufacturing serial numbers (B), BIOS cryptographic signature keys (D), and local administrator password hashes (E) are not status fields exposed in the Endpoint Management agent inventory, and password hashes in particular would never be surfaced in a management console for security reasons.

Answer

Hard drive manufacturing serial number

Answer

BIOS cryptographic signature key

Answer

Local administrator password hash

Question 15

An administrator is setting up alert notification rules in Cortex XDR. Which TWO delivery channels can be configured to notify security personnel when high-severity incidents occur? (Choose two)

Accepted Answer

Webhook integration (e.g., Slack, PagerDuty, XSOAR). Option A is correct because Cortex XDR alert notification rules support webhook-based delivery channels, allowing integration with third-party services such as Slack, PagerDuty, and XSOAR to push high-severity incident alerts to security personnel. Option D is correct because Cortex XDR can send email notifications as a native delivery channel for alert rules, enabling administrators to notify security teams directly via configured email recipients. Option B is incorrect because Cortex XDR does not provide automatic local printer output as a notification delivery method. Option C is incorrect because Bluetooth broadcast to nearby mobile phones is not a supported alert notification channel in Cortex XDR. Option E is incorrect because endpoint speaker audio alarms are not a configurable delivery channel for Cortex XDR alert notification rules.

Answer

Automatic local printer output

Answer

Bluetooth broadcast to nearby mobile phones

Answer

Endpoint speaker audio alarm