XDR-Engineer Hard Questions — 25 Difficult Questions

Question 1

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create exceptions for known benign alerts to prevent them from inflating incident priority scores.. Incident severity and scoring can be tuned via scoring rules, alert severity mappings, and exception configurations.

Answer

Reinstall the Cortex XDR Agent on all high-priority servers.

Answer

Modify the Broker VM packet buffer size.

Question 2

Which THREE factors should an administrator consider when planning a large-scale Cortex XDR agent deployment across enterprise endpoints? (Choose three)

Accepted Answer

Potential conflicts with legacy security software that should be uninstalled prior to deployment. Option B is correct because legacy or third-party security software (e.g., older antivirus, HIPS, or EDR agents) can conflict with the Cortex XDR agent's kernel-level drivers and network filtering, causing installation failures, performance degradation, or unprotected endpoints, so it should be identified and removed before rollout. Option D is correct because agents must reach the Cortex XDR management backend or a Broker VM over outbound TCP 443 (HTTPS), and large deployments require bandwidth planning plus firewall/proxy allow-listing of the relevant FQDNs to avoid registration and telemetry failures. Option E is correct because choosing a deployment mechanism that matches each OS ecosystem — GPO or SCCM for Windows, MDM (e.g., Intune, JAMF) for macOS, and appropriate tooling for Linux — ensures scalable, consistent installation and upgrade across heterogeneous enterprise endpoints. Option A is not appropriate because the Cortex XDR agent is an endpoint security agent, not a DNS server, and making it authoritative for a subnet would break name resolution. Option C is incorrect because granting permanent domain administrator rights to local users is a severe security violation and is not required for agent operation, which runs under the SYSTEM/service account context.

Answer

Configuring the agent to act as a primary DNS server for the local subnet

Answer

Ensuring local endpoint users have full domain administrator rights permanently

Question 3

A Cortex XDR engineer is planning the installation of the Broker VM in a demilitarized zone (DMZ) to collect logs from internet-facing servers. Which TWO configurations are required to ensure the Broker VM can securely communicate with the Cortex XDR cloud and internal log sources? (Choose two.)

Accepted Answer

Allow the Broker VM to communicate with internal log sources over the required protocols and ports.. The Broker VM in a DMZ requires outbound HTTPS access to the Cortex XDR cloud for management and updates, and it must be able to receive logs from internal sources. These two configurations ensure secure communication without exposing the Broker VM to inbound internet traffic. Inbound access from the internet or the cloud is not needed and would increase the attack surface.

Answer

Configure the Broker VM to use a static public IP address for cloud communication.

Answer

Configure inbound access from the internet to the Broker VM on TCP 443 for log ingestion.

Answer

Enable inbound access from the Cortex XDR cloud to the Broker VM on TCP 443 for management.

Question 4

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Accepted Answer

Cortex XSOAR Server Audit and Server logs (/var/log/demisto/server.log). Option D is correct because Cortex XSOAR Server Audit and Server logs, including /var/log/demisto/server.log, record API activity, automation execution, and integration errors, which are essential for diagnosing a failing Cortex XDR API query or automation script. Option E is correct because integration debug logs, viewed via Docker container logs for the specific integration instance, show the actual HTTP requests, responses, and errors exchanged with the Cortex XDR API, directly revealing the root cause. Option A is not relevant because Windows Event Viewer Security logs on unmanaged workstations do not capture Cortex XDR API or automation activity. Option B is not relevant because BIOS firmware event logs relate to hardware/firmware events, not API or script failures. Option C is not relevant because Cortex XDR Agent installation MSI error logs only cover agent installation issues, not API query or automation script failures.

Answer

Windows Event Viewer Security log on unmanaged workstations

Answer

Local BIOS firmware event logs

Answer

Cortex XDR Agent installation MSI error logs

Question 5

A Cortex XDR administrator is investigating an incident where a PowerShell script executed on multiple endpoints, but the Cortex XDR agent did not generate any alerts. The administrator confirms the script is malicious and should have been detected by the Behavioral Threat protection module. Which action should the administrator take first to troubleshoot the missing alerts?

Accepted Answer

Verify that the Behavioral Threat protection module is enabled in the agent policy.. Behavioral Threat protection must be enabled in the agent policy to detect malicious script behavior. If disabled, no alerts will be generated regardless of script activity. Verifying the policy setting is the quickest way to identify why alerts are missing, before investigating other potential causes like connectivity or allow lists.

Answer

Review the endpoint's local agent logs for script execution events.

Answer

Ensure the script's hash is not in the allow list.

Answer

Check the Cortex XDR management console for agent connectivity issues.

Question 6

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

Accepted Answer

The underlying XQL query string that defines the detection logic.. Option C is correct because a scheduled XQL rule fundamentally requires the XQL query string itself, which defines the detection logic that runs against the Cortex XDR dataset to identify matching events. Option D is correct because the rule must map the query results to alert attributes—severity, alert name, and description—so that generated alerts are meaningful and actionable in the incident view. Option E is correct because a scheduled rule must specify the schedule frequency (how often the query executes) and the time range of data evaluated per run, which together control detection cadence and coverage. Options A and B are incorrect because physical memory allocation on a Broker VM for syslog collection and kernel bypass configuration for Windows endpoints are unrelated to defining a scheduled XQL alert rule; they concern infrastructure sizing and endpoint agent/network settings, not XQL rule parameters.

Answer

The physical memory allocation limit on the Broker VM handling syslog collection.

Answer

The kernel bypass configuration parameters for Windows endpoints.

Question 7

An automation playbook in Cortex XSOAR requires parsing a raw email message payload received in an incident. Which built-in automation command or integration should the playbook use to extract indicators of compromise (IOCs) such as URLs, IPs, and file hashes from the email body?

Accepted Answer

Run the 'ExtractIOCs' parsing command on the email body field. ExtractIOCs is a core Cortex XSOAR parsing command used to extract indicators from unstructured text like emails.

Answer

Forward the raw email to the Cortex XDR Agent collector service

Answer

Trigger the 'Device-Control-Block' command against the email sender

Answer

Execute a raw regex match script via PowerShell on a Broker VM worker

Question 8

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

Accepted Answer

Run 'top' or 'htop' via SSH on the Broker VM to identify which specific processes are consuming excessive memory.. Option B is correct because running 'top' or 'htop' over SSH on the Broker VM provides real-time per-process memory (RES/%MEM) visibility, letting the administrator pinpoint which service (e.g., broker, collector, or forwarding process) is driving high utilization. Option C is correct because the Cortex XDR console's Settings > Configurations > Broker VM page surfaces built-in system health metrics (CPU, memory, disk, and service status), giving an authoritative, supported view of Broker VM resource consumption without needing to guess. Option D is correct because collector logs under /var/log/pan/ record ingestion activity and errors, so reviewing them can reveal event loops, repeated retries, or memory leaks that spike during high event ingestion. Option A is not appropriate because recompiling the Linux kernel on a vendor-supplied Broker VM appliance is unsupported and would not address application-level memory consumption. Option E is not appropriate because changing the disk partition table with fdisk is unrelated to memory utilization and risks corrupting the appliance's storage layout.

Answer

Recompile the Linux kernel on the Broker VM appliance to optimize memory paging.

Answer

Change the Broker VM disk partition table using fdisk.

Question 9

A Cortex XDR Agent on a macOS endpoint is failing to start its kernel extension (Endpoint Security extension). Which diagnostic command should be run locally in the macOS Terminal to verify system extension approval status?

Accepted Answer

systemextensionsctl list. On macOS, system extensions (including Endpoint Security extensions) are managed by the systemextensionsctl command. Running 'systemextensionsctl list' displays all installed system extensions and their approval status, which is critical for diagnosing why a kernel extension might fail to start. This command is the correct local diagnostic tool for verifying system extension approval.

Answer

macos-agent-check --status

Answer

kextstat | grep paloalto

Answer

cytool mac status

Question 10

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TCP port 443. Cortex XDR agents communicate outbound to the Cortex XDR tenant over TCP port 443 (HTTPS).

Answer

TCP port 389 and 636

Answer

TCP port 22 and 8080

Answer

UDP port 514

Question 11

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

Accepted Answer

Configure an isolation exception rule specifying the permitted IP address.. Cortex XDR allows administrators to configure isolation exception rules that specify IP addresses or hostnames permitted to communicate with an isolated endpoint. This is the supported mechanism to allow a remediation server or management IP to reach an isolated endpoint while keeping all other traffic blocked. The exception is configured in the isolation policy or as a standalone exception rule.

Answer

Add the IP address to the Data Collection profile under restricted hosts.

Answer

Create a firewall policy on the next-generation firewall to bypass XDR isolation.

Answer

Disable the agent service via Live Terminal using the 'net stop' command.

Question 12

An administrator configured a new Agent Settings profile in Cortex XDR, but endpoints in the 'Finance' folder are not applying the new tamper protection password. What is the most likely reason for this behavior?

Accepted Answer

The Agent Settings profile priority for the Finance folder is set lower than a conflicting child assignment or inheritance is broken.. Cortex XDR applies Agent Settings profiles based on folder hierarchy and assignment priority. If the Finance folder has a lower-priority profile than a conflicting child assignment, or if inheritance from the parent is broken, the tamper protection password from the new profile will not be applied. Profile precedence and folder inheritance are the most common reasons a configuration appears not to take effect on a subset of endpoints.

Answer

Tamper protection passwords can only be configured globally and cannot be overridden by profile.

Answer

Tamper protection configuration changes require a manual service restart on every agent.

Answer

Agents require a full endpoint reboot before downloading any configuration changes.

Question 13

An administrator is writing a custom Python automation script within a Cortex XSOAR integration. Which TWO standard practices should be followed to ensure proper execution and error handling within the platform? (Choose two)

Accepted Answer

Return results using structured 'CommandResults' objects containing standard outputs and human-readable text. Option B is correct because Cortex XSOAR integrations should return structured CommandResults objects, which carry the standard context outputs (readable by playbooks) and the human-readable entry text shown in the War Room, ensuring downstream automation can consume the data reliably. Option C is correct because integration code must catch exceptions and report failures through return_error(), which produces a proper error entry in the War Room instead of letting the script crash and lose the failure context. The unmarked options are inappropriate: A writes to hypervisor kernel memory (impossible and unsafe from a containerized integration), D uses CPU-spinning infinite loops that would hang the integration worker, and E leaks credentials into public logs, violating security best practices.

Answer

Write raw binary data directly to the host hypervisor kernel memory space

Answer

Execute infinite `while` loops without sleep intervals to maximize CPU usage

Answer

Print debug passwords in plain text to public stdout logs

Question 14

An administrator needs to deploy the Cortex XDR agent across a multi-tenant environment using a single management console. How should the administrator structure the deployment to isolate endpoint data between different business units?

Accepted Answer

Create distinct agent installation packages with embedded registration tokens tied to specific Cortex XDR folders and assign RBAC scopes. Cortex XDR supports multi-tenancy through child tenants or by using endpoint groups and granular role-based access control (RBAC).

Answer

Modify the Windows Registry on each endpoint to point to separate cloud regions

Answer

Deploy multiple Broker VMs on the same subnet and assign static VLAN tags

Answer

Install multiple instances of the Cortex XDR agent side-by-side on each endpoint

Question 15

An enterprise security team wants to ingest NetFlow records from core routers into Cortex XDR. Which component and collector combination supports NetFlow/IPFIX ingestion?

Accepted Answer

Broker VM with the NetFlow / IPFIX Collector enabled. NetFlow/IPFIX ingestion in Cortex XDR is supported through the Broker VM with the NetFlow/IPFIX Collector enabled. The Broker VM acts as a collector that receives flow data from routers and forwards it to Cortex XDR for analysis. This is the designed architecture for network flow ingestion.

Answer

Direct API streaming from router CLI to the XDR cloud storage bucket

Answer

Cortex XDR Agent installed directly on the core routers via SSH

Answer

Cortex XSOAR integration instance using SNMP polling

Question 16

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

Accepted Answer

The administrator must provide the anti-tampering password configured in the Cortex XDR console.. Cortex XDR's anti-tampering feature requires the anti-tampering password — configured in the Agent Settings profile in the management console — before the agent's protection can be disabled locally using cytool. This prevents unauthorized users or malware from turning off endpoint protection. The administrator must supply this password when running the disable command.

Answer

A live terminal session must be opened from the cloud console to execute the command.

Answer

The agent must first be uninstalled and reinstalled in debug mode.

Answer

The endpoint must be disconnected from the active domain controller.

Question 17

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

Accepted Answer

Upload the custom CA certificate bundle into the Broker VM trust store via the Broker VM management page. To trust self-signed certificates on a Broker VM, the administrator must upload the custom CA certificate bundle via the Broker VM management interface.

Answer

Add the target API IP address to the Broker VM local hosts file

Answer

Modify the Broker VM system kernel parameters to ignore cipher mismatches

Answer

Disable SSL/TLS verification globally for all Cortex XDR broker app modules

Question 18

Which TWO diagnostic checks or operations can be performed locally on a Windows endpoint using the `cytool` command-line utility? (Choose two)

Accepted Answer

Collect troubleshooting logs into a support archive using `cytool log collect`.. cytool allows administrators to query agent status, check connectivity, manage protection settings, and gather troubleshooting logs locally.

Answer

Reconfigure the endpoint's DHCP IP address lease.

Answer

Perform a firmware update on the endpoint motherboard BIOS.

Answer

Modify local Active Directory Group Policy objects.

Question 19

An administrator needs to write a custom automation script in Cortex XSOAR to query the Cortex XDR API for all endpoints that have not checked in within the last 7 days. Which API endpoint and filtering mechanism should the script use?

Accepted Answer

GET /public_api/v1/endpoints/get_endpoint/ with an explicit JSON filter for last_seen timestamp. The correct API endpoint is GET /public_api/v1/endpoints/get_endpoint/ with a JSON filter specifying the last_seen timestamp condition. This endpoint retrieves endpoint details and supports filtering, allowing the script to query for endpoints not checked in within the last 7 days. Other endpoints are for different purposes and do not support this filtering.

Answer

POST /public_api/v1/incidents/get_all_incidents/ with a severity filter

Answer

PUT /public_api/v1/audits/get_actions/ with an agent version parameter

Answer

GET /public_api/v1/file/file_metadata/ with a SHA256 parameter

Question 20

A security engineer needs to prevent Cortex XDR agents on a group of Windows servers from automatically upgrading to newer agent versions, while still allowing content updates to be delivered. The servers are managed through an Agent Settings profile. Which configuration should the engineer apply?

Accepted Answer

Disable the 'Allow Agent Upgrade' setting in the Agent Settings profile and leave content updates enabled.. The requirement is to stop agent version upgrades while keeping content updates. Cortex XDR provides the 'Allow Agent Upgrade' setting within Agent Settings profiles to control automatic upgrades. Disabling this setting prevents version changes without affecting content delivery, which is managed separately. The other options either reference non-existent settings or use unsupported methods, so only the profile-based toggle achieves the goal.

Answer

Set the agent version to a fixed version in the Agent Settings profile and enable 'Content Update' only.

Answer

Create a new agent installation package with the desired version and deploy it via a software distribution tool, then disable automatic upgrades globally.

Answer

Modify the content update schedule to exclude agent binaries and enable 'Prevent Agent Downgrade'.