XDR-Engineer Ingestion And Automation Practice Test 3 — 15 Questions

Question 1

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Accepted Answer

Cortex XSOAR Server Audit and Server logs (/var/log/demisto/server.log). Troubleshooting API and automation issues involves reviewing the Cortex XSOAR integration debug logs and the Audit Trail / Server logs.

Answer

Windows Event Viewer Security log on unmanaged workstations

Answer

Local BIOS firmware event logs

Answer

Cortex XDR Agent installation MSI error logs

Question 2

Which TWO authentication methods are commonly supported when configuring API integrations in Cortex XSOAR? (Choose two)

Accepted Answer

API Key / Token Authentication. API integrations commonly use API Key authentication and OAuth2.

Answer

Rotary dial pulse signaling

Answer

Physical punch cards

Answer

Plain text Telnet login prompts

Question 3

An administrator is designing an automated incident response playbook in Cortex XSOAR. Which TWO core concepts are essential for passing data between playbook tasks? (Choose two)

Accepted Answer

Incident Context (Context Data) to store and retrieve structured key-value data. Playbooks use Incident Context (The War Room / Context Data) and task outputs/arguments to pass data between tasks.

Answer

Static global environment variables hardcoded in the server kernel

Answer

Direct memory pointer references in C++ syntax

Answer

Manual USB flash drive transfer between server nodes

Question 4

An organization requires high availability and load balancing for their Broker VM log ingestion tier. Which TWO architectural considerations or configurations support this requirement? (Choose two)

Accepted Answer

Deploying multiple Broker VMs behind an external Layer 4 load balancer for syslog/network log ingestion. High availability for Broker VMs involves deploying multiple Broker VMs behind a load balancer and configuring collectors across instances.

Answer

Sharing a single static IP address across independent uncoordinated cloud regions without routing

Answer

Running multiple active database instances on the same Broker VM container kernel

Answer

Disabling all network encryption to speed up packet forwarding

Question 5

Which TWO tasks can an automation playbook in Cortex XDR / XSOAR execute automatically upon detecting a confirmed threat? (Choose two)

Accepted Answer

Isolate compromised endpoints from the network. Playbooks can automatically isolate endpoints and execute containment or enrichment tasks.

Answer

Automatically upgrade the physical RAM on compromised servers

Answer

Order replacement laptop hardware from vendors

Answer

Repaint the interior office walls of the SOC

Question 6

When configuring advanced data forwarding filters in Cortex XDR, which TWO criteria parameters can an administrator use to precisely target specific log types or endpoints? (Choose two)

Accepted Answer

Log dataset type (e.g., xdr_data, endpoints, network). Data forwarding rules allow filtering by log type (e.g., agent datasets, audit logs) and endpoint attributes or criteria.

Answer

The physical room number where the server rack is installed

Answer

The name of the physical building security guard on duty

Answer

The local cafeteria menu schedule

Question 7

An administrator is setting up automated alert ingestion from a third-party SIEM into Cortex XSOAR. Which TWO integration methods or components are typically used to achieve this? (Choose two)

Accepted Answer

Webhook integrations that listen for incoming HTTP POST alerts pushed from the third-party system. Alert ingestion is commonly achieved via REST API polling integrations or webhook listener integrations.

Answer

Direct physical floppy disk transport

Answer

Manual CSV export and physical printing

Answer

Local parallel port cable bridging

Question 8

An administrator needs to troubleshoot an AWS S3 bucket integration via Broker VM where logs are failing to ingest. Which TWO diagnostic steps should be taken? (Choose two)

Accepted Answer

Verify that the AWS IAM policy has s3:GetObject and s3:ListBucket permissions. Troubleshooting cloud integrations involves verifying IAM permissions and checking Broker VM container logs.

Answer

Change the local monitor resolution on the administrator workstation

Answer

Disconnect all enterprise physical firewalls

Answer

Reinstall the Windows operating system on the AWS S3 server

Question 9

An administrator is configuring a new Syslog data collector in Cortex XDR to ingest logs from a third-party firewall. The logs are arriving at the Cortex XDR Collector, but they are not appearing in the Query Builder. Which step should the administrator perform to resolve this issue?

Accepted Answer

Configure a custom log mapping in the Broker VM configuration to parse the incoming syslog format.. To properly ingest and parse third-party logs via a Syslog collector, the administrator must define a custom parsing rule or select a predefined parser mapping in the Cortex XDR Broker VM configuration so the fields are correctly normalized before reaching the backend database.

Answer

Disable SSL/TLS verification on the firewall sending the syslog events.

Answer

Generate a new API key in the Cortex XDR management console and assign it to the syslog source.

Answer

Restart the Cortex XDR Agent on all managed endpoints to enable syslog forwarding.

Question 10

An administrator is writing a custom Python automation script within a Cortex XSOAR integration. Which TWO standard practices should be followed to ensure proper execution and error handling within the platform? (Choose two)

Accepted Answer

Return results using structured 'CommandResults' objects containing standard outputs and human-readable text. Custom scripts in XSOAR should return structured CommandResults objects and handle exceptions gracefully.

Answer

Write raw binary data directly to the host hypervisor kernel memory space

Answer

Execute infinite `while` loops without sleep intervals to maximize CPU usage

Answer

Print debug passwords in plain text to public stdout logs

Question 11

An XDR administrator needs to forward Cortex XDR alerts to an external SIEM. Which integration mechanism should be configured in the Cortex XDR management console under Data Collection?

Accepted Answer

Cortex XDR Streaming API. Cortex XDR provides direct integration with external SIEMs using the Syslog or HTTPS streaming feature available in the Data Collection configuration menu, allowing seamless alert forwarding.

Answer

Endpoint Tagging Policy

Answer

Local Agent Settings Profile

Answer

Hash Exception Rule

Question 12

An automation engineer is building a Cortex XSOAR playbook that is triggered by a Cortex XDR incident. The playbook needs to fetch all associated endpoint artifacts using the Cortex XDR integration. Which parameter is required in the command execution to ensure all relevant forensics files are retrieved?

Accepted Answer

Provide the unique Agent ID and the absolute file path of the artifact.. When fetching endpoint files or running get-file commands in XSOAR using the Cortex XDR integration, providing the specific agent ID and file path or artifact identifier is required to target the correct machine.

Answer

Specify the cloud storage bucket ARN where the endpoint stores its local cache.

Answer

Enter the firewall security policy rule ID that triggered the alert.

Answer

Supply the global tenant ID and the Active Directory Distinguished Name of the host.

Question 13

When configuring the Cortex XDR API to ingest custom threat intelligence feeds, which authentication header and format must be used for the HTTP POST request to ensure successful ingestion?

Accepted Answer

Use 'x-api-key' and 'Authorization: Bearer <token>' headers with a JSON formatted payload.. Cortex XDR APIs authenticate via specific header fields including x-suid and Authorization containing the generated API key ID and secret, structured in a JSON payload format.

Answer

Use OAuth 2.0 client credentials grant type with a form-urlencoded body.

Answer

Use basic authentication with base64 encoded local administrator credentials and XML payloads.

Answer

Use SNMP v3 community strings injected into the custom HTTP header fields.

Question 14

An administrator has deployed a Broker VM to act as a syslog collector and agent installer. During the configuration of the Broker VM in the Cortex XDR console, the status remains 'Disconnected'. What is the most likely cause of this issue?

Accepted Answer

Outbound connectivity on TCP port 443 from the Broker VM to the Cortex XDR tenant is blocked.. The Broker VM requires outbound HTTPS access (port 443) to the Cortex XDR tenant URL for registration and management heartbeat. Network connectivity or firewall blocks are the most frequent cause of disconnection.

Answer

The Cortex XDR agent license count has been exceeded on the tenant.

Answer

The Broker VM requires an active inbound SSH session from the administrator's workstation.

Answer

Syslog UDP port 514 is closed on the internal firewall.

Question 15

Where in the Cortex XDR management console can an administrator review the status and health of all connected data collectors, such as Broker VMs and agent collectors?

Accepted Answer

Navigate to Settings > Configurations > Data Collection > Broker VM.. The Data Collection menu in the Cortex XDR management console contains the Broker VM and collectors status pages, giving administrators complete visibility into collector health.

Answer

Open Endpoint Management > Agent States > Collectors.

Answer

Select Response > Automation > Integrations.

Answer

Go to Incidents > Alert Overview > Collector Health.