XDR-Engineer Detection And Reporting Practice Test 4 — 15 Questions

Question 1

An engineer is configuring Data Export Service (DES) to stream Cortex XDR logs to a cloud storage bucket. Which THREE cloud storage providers are natively supported destinations for DES? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Google Cloud Storage. Data Export Service (DES) in Cortex XDR natively supports streaming logs to three major cloud object storage providers: Google Cloud Storage (option A), Microsoft Azure Blob Storage (option B), and Amazon S3 (option D). Each of these is a first-class, built-in destination type configured directly in the DES profile, allowing logs to be exported continuously to their respective buckets/containers. Option C is incorrect because DES does not support exporting to a local FTP server, and active-mode FTP is not a supported transport for DES destinations. Option E is incorrect because Bluetooth-tethered mobile storage is not a cloud storage provider and is not a supported DES destination.

Answer

Local FTP Server via active mode

Answer

Bluetooth tethered mobile storage

Question 2

An engineer needs to write an XQL query to search for all events where a process named "cmd.exe" spawned a process named "powershell.exe". Which XQL dataset and query structure should be used?

Accepted Answer

dataset = xdr_data | filter event_type = ENUM_PROCESS_START and actor_process_image_name ends with "cmd.exe" and action_process_image_name ends with "powershell.exe". It uses the proper XQL dataset (xdr_data) and the correct field names for process lineage in Cortex XDR: actor_process_image_name identifies the parent (spawning) process, and action_process_image_name identifies the child (spawned) process. The event_type filter ENUM_PROCESS_START ensures only process creation events are considered, and using ends with "cmd.exe" and ends with "powershell.exe" correctly matches full paths like C:\Windows\System32\cmd.exe. This structure directly mirrors the XDR data model for process execution events.

Answer

dataset = xdr_data | filter event_type = ENUM_PROCESS_START and actor_process_image_name = "cmd.exe" and cited_process_image_name = "powershell.exe"

Answer

dataset = xdr_alerts | filter alert_name = "cmd.exe spawned powershell"

Answer

dataset = panw_threat_intel | filter process_name = "cmd.exe" and child_process = "powershell.exe"

Question 3

Where within the Cortex XDR console should an administrator configure scheduled reporting to automatically email executive summaries to stakeholders on a weekly basis?

Accepted Answer

Reporting > Report Builder. Cortex XDR's Reporting > Report Builder is where administrators create scheduled reports, define their content, set the schedule (e.g., weekly), and configure email distribution to stakeholders. This is the dedicated module for report generation and delivery. Configuring it here ensures executive summaries are delivered automatically on the defined cadence.

Answer

Incident Response > Incident Management

Answer

XQL Search > Scheduled Queries

Answer

Settings > Configurations > Email Notifications

Question 4

An organization wants to ingest custom syslog data from a third-party firewall into Cortex XDR and build detection rules around it. Which feature enables parsing and structuring this unformatted log data so it can be queried effectively using XQL?

Accepted Answer

Custom Parsing Rules. Custom Parsing Rules in Cortex XDR allow you to define how unformatted or semi-structured log data (such as third-party syslog) is parsed into structured fields that XQL can query. Once the parser extracts fields like source IP, action, or username, detection rules and XQL queries can reference them directly.

Answer

Data Stitching Rules

Answer

BIOC Exception Filters

Answer

BIOC Correlation Policies

Question 5

An analyst is investigating an incident and notices that a custom Analytics BIOC rule generated too many false positives due to a legitimate administrative tool. What is the recommended method to tune this rule without completely disabling it?

Accepted Answer

Add an exception to the specific BIOC rule based on criteria such as file path, hash, or signer.. Exceptions can be added to BIOC rules to filter out known legitimate parameters, such as specific file hashes, signing certificates, or file paths.

Answer

Delete the BIOC rule and recreate it as an XQL scheduled alert.

Answer

Change the BIOC rule severity level from High to Low so analysts ignore it.

Answer

Modify the global agent profile to exclude the administrative tool from all endpoint monitoring.

Question 6

Which TWO of the following capabilities are provided by Cortex XDR Behavioral Threat Analytics (Analytics BIOCs)? (Choose two)

Accepted Answer

Detecting rare or anomalous process execution across the enterprise environment.. Option A is correct because Cortex XDR Behavioral Threat Analytics (Analytics BIOCs) baselines normal process behavior across the enterprise and flags rare or anomalous process executions that deviate from the established norm, which is the core purpose of the analytics engine. Option B is correct because Analytics BIOCs apply machine learning models to endpoint telemetry to surface multi-stage attack behaviors such as lateral movement and credential dumping (e.g., suspicious access to LSASS), rather than relying on static signatures. Option C is incorrect because agent binary updates are handled by Cortex XDR agent management/content update mechanisms, not by Behavioral Threat Analytics. Option D is incorrect because enforcing firewall rules on third-party perimeter gateways is not a function of Analytics BIOCs; that would require external firewall integration or orchestration. Option E is incorrect because local signature scans of static files at rest are the domain of signature-based malware scanning, whereas Analytics BIOCs focus on behavioral analytics of runtime activity.

Answer

Automatically updating agent software binaries on offline endpoints.

Answer

Manually enforcing firewall blocking rules on third-party perimeter gateways.

Answer

Performing local signature scans on static files at rest.

Question 7

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

Accepted Answer

The underlying XQL query string that defines the detection logic.. Option C is correct because a scheduled XQL rule fundamentally requires the XQL query string itself, which defines the detection logic that runs against the Cortex XDR dataset to identify matching events. Option D is correct because the rule must map the query results to alert attributes—severity, alert name, and description—so that generated alerts are meaningful and actionable in the incident view. Option E is correct because a scheduled rule must specify the schedule frequency (how often the query executes) and the time range of data evaluated per run, which together control detection cadence and coverage. Options A and B are incorrect because physical memory allocation on a Broker VM for syslog collection and kernel bypass configuration for Windows endpoints are unrelated to defining a scheduled XQL alert rule; they concern infrastructure sizing and endpoint agent/network settings, not XQL rule parameters.

Answer

The physical memory allocation limit on the Broker VM handling syslog collection.

Answer

The kernel bypass configuration parameters for Windows endpoints.

Question 8

When creating a widget for a custom dashboard in Cortex XDR, an analyst wants to display a visual trend of total alert counts categorized by severity over the last 30 days. Which data source and visualization type are most appropriate?

Accepted Answer

Use an XQL-based widget with a time-series chart configuration querying the `xdr_alerts` dataset.. Custom dashboards can utilize XQL queries to feed widgets, allowing time-series line or bar charts based on `xdr_alerts`.

Answer

Use a BIOC rule status widget configured for endpoint health metrics.

Answer

Use a Network Connection geographic map widget.

Answer

Use the Agent Version distribution widget.

Question 9

An investigator is analyzing an advanced threat campaign using the Cortex XDR Incident View and reporting tools. Which THREE elements are typically included in an exported Incident Report PDF generated from Cortex XDR? (Choose three)

Accepted Answer

The causality chain or alert timeline illustrating the progression of the attack.. Option B is correct because the Cortex XDR Incident Report PDF includes the causality chain/alert timeline, which visualizes the root cause and the sequence of events that make up the attack progression. Option D is correct because the report opens with an executive summary that communicates the incident's scope, severity, and key findings for management and stakeholders. Option E is correct because the report enumerates the impacted endpoints/assets and the associated users involved, which is essential for scoping and remediation tracking. Option A is not included, as the report does not embed analyst remediation script source code repositories, and Option C is not included, since full raw PCAP files for all network flows are not bundled into the Incident Report PDF.

Answer

Source code repositories of all custom scripts executed by the analyst during remediation.

Answer

Complete raw packet capture (PCAP) files for all network flows observed during the incident.

Question 10

A Cortex XDR administrator needs a recurring report that shows the top ten MITRE ATT&CK techniques observed across all incidents in the last seven days, broken down by severity. The report must be generated automatically every Monday at 06:00 and emailed to the security leadership team. Which Cortex XDR capability should the administrator configure to meet these requirements?

Accepted Answer

Create a custom dashboard widget with an XQL query grouped by technique and severity, then configure a scheduled report template that includes that widget and delivers it by email.. The requirement combines aggregation, visualization, scheduling, and email delivery. Cortex XDR achieves this through dashboard widgets backed by XQL for the grouped technique-and-severity view, plus a scheduled report template that bundles the widget and sends it to recipients. Rules and exclusions operate on live telemetry and cannot produce a recurring top-ten analytical report.

Answer

Configure an alert exclusion that suppresses all but the top ten techniques, then enable scheduled email notifications on the incident management page.

Answer

Create a correlation rule that groups incidents by ATT&CK technique and enable the built-in weekly incident summary email that ships with the Cortex XDR console.

Answer

Create a BIOC rule that matches ATT&CK technique identifiers and configure a notification email action on the rule so it fires every Monday at 06:00.

Question 11

A Cortex XDR engineer needs to build a recurring report that summarizes which MITRE ATT&CK techniques were observed across all incidents from the previous week, broken down by technique ID. The engineer wants the output to be generated automatically every Monday at 08:00 and emailed to the security leadership team. Which Cortex XDR capability should the engineer configure to meet these requirements?

Accepted Answer

A scheduled Report Template built from an XQL-based widget on a custom dashboard. Scheduled reporting that aggregates incident data into an ATT&CK technique breakdown requires an XQL-backed widget embedded in a dashboard and delivered through a Report Template with a recurring schedule and email recipients. BIOC rules, IOC feeds, and agent policies govern detection, ingestion, and endpoint behavior respectively, none of which produce periodic summarized reports.

Answer

A Cortex XDR agent policy with enhanced data collection and a report profile

Answer

A BIOC rule with a MITRE technique mapping and an email notification action

Answer

An IOC feed with a scheduled refresh interval and an email alert threshold

Question 12

An XDR engineer needs to schedule a recurring report that summarizes the count of alerts by MITRE ATT&CK tactic for the previous seven days, and deliver it as a CSV file every Monday at 08:00 to a distribution list. Which Cortex XDR feature should the engineer use to configure this?

Accepted Answer

Create a Scheduled Report in the Cortex XDR Reports module and select CSV as the output format and the MITRE ATT&CK tactic field as the grouping.. Scheduled Reports in Cortex XDR are the built-in mechanism for recurring, formatted reporting with selectable output types and email delivery. Grouping by MITRE ATT&CK tactic is natively supported because alert records carry that field. Alternative approaches such as dashboards, correlation rules, or case templates do not combine scheduling, CSV output, and distribution-list delivery in a single supported configuration.

Answer

Build an XQL query in the Query Center and pin the result to a custom dashboard, then configure the dashboard to email a PDF snapshot weekly.

Answer

Configure a Report Template under Cases and attach it to an incident, then rely on the incident owner to manually export and send the file each week.

Answer

Define a Correlation Rule that triggers on alert creation and uses a webhook to POST the aggregated counts to the distribution list every Monday.

Question 13

During an investigation, a SOC analyst needs to determine which user account was associated with a specific process execution that triggered a Cortex XDR alert. The analyst has the Causality ID from the alert. Which Cortex XDR feature or query approach should the analyst use to identify the responsible user?

Accepted Answer

Run an XQL query on the xdr_data dataset filtering by the Causality ID and project the actor_effective_username field.. The xdr_data dataset in Cortex XDR stores detailed endpoint telemetry, including process causality chains and effective usernames. By filtering on the Causality ID from the alert and projecting actor_effective_username, the analyst directly identifies the user account responsible for the process execution. This approach is precise and leverages native XQL capabilities.

Answer

Check the Audit Log in Cortex XDR, which records the username of the endpoint user for every process execution.

Answer

Open the Incident View and look at the 'Assigned User' field, which lists the account that triggered the alert.

Answer

Use the Threat Intelligence module to look up the Causality ID, which resolves to the user account in the threat feed.

Question 14

An analyst configures a scheduled report in Cortex XDR to summarize alert volumes per endpoint group every Monday. After the first run, the recipient inboxes show the report was generated but the attached data only covers the previous 24 hours instead of the entire preceding week. Which configuration element most likely caused this truncated reporting window?

Accepted Answer

The report's time range was left at the default relative window rather than being set to the intended seven-day period.. Scheduled reports in Cortex XDR honor the time range saved in the report definition. When an analyst expects a week of data but receives a single day, the stored relative range is the usual culprit because the default lookback is short. Editing the report to use an explicit seven-day window aligns the generated dataset with the intended weekly summary.

Answer

The report schedule used a cron expression that fires daily, overwriting the weekly aggregation with the latest single day.

Answer

The endpoint groups were assigned to the report but no data sources were enabled, so only real-time telemetry was included.

Answer

The distribution list exceeded the maximum recipients, so the system truncated the payload to the most recent events.

Question 15

An engineer is tuning detection coverage in Cortex XDR and wants to confirm whether a specific built-in Analytics BIOC is currently enabled, which MITRE ATT&CK technique it maps to, and whether it has generated any alerts in the past 24 hours. Which approach most directly provides all three pieces of information in one place?

Accepted Answer

Open the BIOC rule in the Cortex XDR management console, review its enabled state and MITRE mapping, then query the alerts dataset in XQL filtered by that BIOC name and a 24-hour window. Confirming a built-in Analytics BIOC's enablement and MITRE mapping requires inspecting the rule definition itself, and confirming recent alert activity requires querying the alerts dataset with a time filter. The rule view and an XQL query on alerts together answer all three questions authoritatively, whereas agent diagnostics, IOC feeds, and incident timelines provide only partial or indirect evidence.

Answer

Run a Cortex XDR agent diagnostic on the endpoint and inspect the local BIOC catalog file for the rule state and technique mapping

Answer

Export the IOC feed configuration and cross-reference technique IDs against the indicator list

Answer

Review the incident timeline of the most recent incident and infer the rule state from the alerts it contains