XDR-Engineer Ingestion And Automation — 20 Questions

Question 1

An administrator has configured a Cortex XDR data ingestion rule for a custom log source, but fields are appearing under the 'general_fields' object rather than their designated mapped schema columns. What is the most likely reason for this parsing failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The custom log mapping configuration has incorrect field names or unmatched JSON/regex keys. If custom fields do not map correctly, it is usually because the JSON key names or regex capture groups do not match the custom log mapping definition.

Answer

The log forwarding protocol must be changed from HTTPS to UDP

Answer

The Cortex XDR agent license does not support custom parsing

Question 2

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

Accepted Answer

Upload the custom CA certificate bundle into the Broker VM trust store via the Broker VM management page. To trust self-signed certificates on a Broker VM, the administrator must upload the custom CA certificate bundle via the Broker VM management interface.

Answer

Add the target API IP address to the Broker VM local hosts file

Answer

Modify the Broker VM system kernel parameters to ignore cipher mismatches

Answer

Disable SSL/TLS verification globally for all Cortex XDR broker app modules

Question 3

A security analyst needs to ingest custom JSON-formatted security logs from an in-house application into Cortex XDR. Where should the administrator define the custom log mapping to ensure fields are parsed correctly under the generic log profile schema?

Accepted Answer

In the Cortex XDR console under Settings > Configurations > Data Integration > Custom Log Mapping. Custom log mappings are configured in the Cortex XDR management console under Settings > Configurations > Data Integration > Log Stitching and Parsing / Custom Log Mapping.

Answer

In the Cortex XaaS cloud storage bucket configuration properties

Answer

Directly inside the broker VM configuration file using a local JSON editor

Answer

In the Cortex XDR agent installation script via command-line switches

Question 4

An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?

Accepted Answer

A Condition (or Decision) block that evaluates the sandbox verdict output. Conditional routing in playbooks is handled using Decision or Condition tasks to evaluate previous task outputs.

Answer

A Data Collection task pointing to the endpoint agent

Answer

A Post-Processing script executed directly on the Broker VM

Answer

A Manual Approval step without automated logic branching

Question 5

Which menu path in the Cortex XDR management console should an administrator navigate to view the overall health, status, and log forwarding statistics of deployed Broker VMs?

Accepted Answer

Settings > Configurations > Data Integration > Broker VM. Broker VM monitoring and status can be checked under Settings > Configurations > Data Integration > Broker VM.

Answer

Incidents > Response > Broker Status

Answer

Marketplace > Integrations > Instances

Answer

Endpoints > Management > Agent Status

Question 6

When configuring an integration instance in Cortex XSOAR (or Cortex XDR Automation) for a third-party threat intelligence feed, what is the primary purpose of the instance name?

Accepted Answer

To uniquely identify a specific configuration and credential set for an integration. Integration instances allow administrators to configure multiple instances of the same integration with different parameters, each identified by a unique instance name.

Answer

To determine the operating system kernel executing the automation script

Answer

To define the encryption key used for secure payload transit

Answer

To specify the physical network interface the integration binds to

Question 7

An administrator is troubleshooting a Cortex XDR syslog integration where logs from a high-throughput network device are being dropped or delayed. The Broker VM resource utilization for CPU and memory is normal. Which underlying collector configuration setting should be adjusted to handle the high burst rate?

Accepted Answer

Increase the syslog collector worker threads and queue size parameters in the Broker VM configuration. Syslog collectors using UDP/TCP can experience buffer drops if the queue size or worker thread allocation is insufficient.

Answer

Switch the syslog transport from TCP to ICMP tunneling

Answer

Enable verbose kernel debugging on the Cortex XDR agent

Answer

Decrease the agent keep-alive interval to force faster handshakes

Question 8

An organization requires that logs ingested via the Cortex XDR Syslog Collector be secured using TLS encryption (Syslog-over-TLS). What must the administrator configure on the Broker VM to support this requirement?

Accepted Answer

Configure the syslog collector instance on the Broker VM with a valid SSL/TLS certificate and private key. To configure Syslog-over-TLS, the administrator must provide the valid server certificate and private key on the Broker VM syslog collector configuration.

Answer

Install an external IPsec VPN tunnel between the syslog source and the Cortex XDR cloud tenant

Answer

Modify the Windows Registry keys on the domain controller

Answer

Configure a reverse proxy on the endpoint agent with port forwarding

Question 9

An administrator is configuring a Syslog Collector agent on Cortex XDR to ingest logs from a third-party firewall. Which log collection protocol and transport layer combination is natively supported by the Cortex XDR Collector for receiving unencrypted syslog messages?

Accepted Answer

Syslog over UDP and TCP. Cortex XDR Syslog Collector natively supports receiving syslog messages over UDP and TCP.

Answer

Syslog over HTTP/HTTPS

Answer

Syslog over SSH tunneling

Answer

Syslog over FTP/SFTP

Question 10

An administrator needs to write a custom automation script in Cortex XSOAR to query the Cortex XDR API for all endpoints that have not checked in within the last 7 days. Which API endpoint and filtering mechanism should the script use?

Accepted Answer

GET /public_api/v1/endpoints/get_endpoint/ with an explicit JSON filter for last_seen timestamp. The Cortex XDR public API uses the `/public_api/v1/endpoints/get_endpoint/` endpoint with custom filters based on operational status and last seen timestamp.

Answer

POST /public_api/v1/incidents/get_all_incidents/ with a severity filter

Answer

PUT /public_api/v1/audits/get_actions/ with an agent version parameter

Answer

GET /public_api/v1/file/file_metadata/ with a SHA256 parameter

Question 11

When setting up data forwarding from Cortex XDR to a third-party SIEM using the Cortex XDR Data Forwarder, which protocol is commonly used to stream the logs?

Accepted Answer

HTTP/HTTPS or Syslog. Cortex XDR Data Forwarder typically streams logs to SIEMs using HTTPS or syslog protocols.

Answer

NetBIOS Name Service (NBNS)

Answer

Dynamic Host Configuration Protocol (DHCP)

Answer

Remote Desktop Protocol (RDP)

Question 12

An administrator needs to ingest CEF (Common Event Format) logs from a third-party security device using the Broker VM. Which collector type must be enabled on the Broker VM configuration page in Cortex XDR?

Accepted Answer

Generic Syslog / CEF Collector. CEF logs are ingested using the Syslog / CEF collector app on the Broker VM.

Answer

AWS CloudTrail App Collector

Answer

Office 365 Management Activity Collector

Answer

Active Directory WMI Collector

Question 13

An automation playbook in Cortex XSOAR requires parsing a raw email message payload received in an incident. Which built-in automation command or integration should the playbook use to extract indicators of compromise (IOCs) such as URLs, IPs, and file hashes from the email body?

Accepted Answer

Run the 'ExtractIOCs' parsing command on the email body field. ExtractIOCs is a core Cortex XSOAR parsing command used to extract indicators from unstructured text like emails.

Answer

Forward the raw email to the Cortex XDR Agent collector service

Answer

Trigger the 'Device-Control-Block' command against the email sender

Answer

Execute a raw regex match script via PowerShell on a Broker VM worker

Question 14

An administrator has configured a new AWS CloudTrail integration via Broker VM to ingest cloud logs into Cortex XDR. However, no logs are appearing in the XDR database. Upon reviewing the Broker VM logs, the administrator notices an 'AccessDenied' error from AWS. What is the most likely root cause?

Accepted Answer

The IAM role or user credentials provided to the Broker VM lack permissions to read from the S3 bucket. AWS CloudTrail ingestion requires an IAM role with sufficient permissions to access the designated S3 bucket containing the logs.

Answer

The Cortex XDR agent license has expired for cloud log ingestion

Answer

The AWS region ID is misspelled in the local hosts configuration file

Answer

The Broker VM has insufficient RAM allocated to run the S3 polling daemon

Question 15

Which role is required within Cortex XDR for a user to configure API keys, data integration settings, and automation playbooks?

Accepted Answer

Account Admin or Security Administrator role. Administrative tasks such as configuring data integration and API keys require an Administrator role or equivalent permissions.

Answer

Endpoint Viewer role

Answer

Standard User role

Answer

SOC Analyst Tier 1 role

Question 16

An automation playbook in Cortex XSOAR needs to execute a custom Python script that interacts with an internal legacy database not covered by existing Marketplace integrations. Which component should the administrator use to securely run this custom script?

Accepted Answer

A custom Python Integration running inside an isolated Docker container managed by the engine/server. Custom scripts and integrations in Cortex XSOAR execute within a Docker container environment managed by integration containers or custom Python scripts.

Answer

A local Windows batch script executed by the Cortex XDR endpoint agent

Answer

Direct execution via SSH on the Cortex XDR multi-tenant cloud backend

Answer

A direct SQL query string passed unencrypted through the Syslog collector port

Question 17

Where in the Cortex XDR web interface can an administrator generate API keys (API Key and Incident ID / Key) required for external integrations and scripts to authenticate with the Cortex XDR API?

Accepted Answer

Settings > Configurations > Integrations > API Keys. API keys are generated under Settings > Configurations > Integrations > API Keys.

Answer

Marketplace > Settings > Credentials

Answer

Endpoints > Policy > Authentication

Answer

Incidents > Actions > Generate Key

Question 18

What is the primary function of the Cortex XDR 'Content Pack' in Marketplace?

Accepted Answer

To provide pre-packaged integrations, playbooks, dashboards, and automation building blocks. Content packs in Marketplace package pre-built integrations, playbooks, dashboards, and incident types.

Answer

To install local antivirus signatures directly onto endpoint file systems

Answer

To store encrypted backups of Cortex XDR database records

Answer

To compile raw C++ source code for custom endpoint isolation drivers

Question 19

An enterprise environment uses a forward proxy for all outbound internet traffic. The Broker VM deployed in the internal network cannot reach external cloud APIs for threat intelligence enrichment. How should the administrator configure the Broker VM to route traffic through the forward proxy?

Accepted Answer

Configure the proxy settings using the Broker VM configuration menu or environment variables (HTTP_PROXY / HTTPS_PROXY). Broker VM proxy settings are configured during or after deployment via the Broker VM CLI or configuration menu to set HTTP_PROXY/HTTPS_PROXY environment variables.

Answer

Deploy a secondary Broker VM in the DMZ to act as an internal DNS forwarder

Answer

Modify the Windows Registry on the Broker VM host machine

Answer

Write a custom automation playbook in Cortex XSOAR to tunnel packets through ICMP

Question 20

An administrator has deployed a Broker VM and enabled the Active Directory (AD) collector to ingest user and group mapping data. The connection test fails with a 'Kerberos Authentication Failed' error. What is the most likely cause of this failure?

Accepted Answer

The Broker VM system clock is out of sync with the Domain Controller by more than five minutes. Active Directory collectors communicating via Kerberos require accurate time synchronization and correct domain/SPN configurations.

Answer

The Broker VM firewall is blocking ICMP ping requests

Answer

The Cortex XDR agent on the domain controller has been uninstalled

Answer

The Broker VM has exceeded its maximum disk storage allocation