XDR-Engineer Ingestion And Automation Practice Test 3 — 15 Questions

Question 1

An enterprise environment uses a forward proxy for all outbound internet traffic. The Broker VM deployed in the internal network cannot reach external cloud APIs for threat intelligence enrichment. How should the administrator configure the Broker VM to route traffic through the forward proxy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the proxy settings using the Broker VM configuration menu or environment variables (HTTP_PROXY / HTTPS_PROXY). Broker VM proxy settings are configured during or after deployment via the Broker VM CLI or configuration menu to set HTTP_PROXY/HTTPS_PROXY environment variables.

Answer

Deploy a secondary Broker VM in the DMZ to act as an internal DNS forwarder

Answer

Modify the Windows Registry on the Broker VM host machine

Answer

Write a custom automation playbook in Cortex XSOAR to tunnel packets through ICMP

Question 2

An administrator has deployed a Broker VM and enabled the Active Directory (AD) collector to ingest user and group mapping data. The connection test fails with a 'Kerberos Authentication Failed' error. What is the most likely cause of this failure?

Accepted Answer

The Broker VM system clock is out of sync with the Domain Controller by more than five minutes. Kerberos authentication relies on time-stamped tickets to prevent replay attacks. If the Broker VM's system clock differs from the Domain Controller's by more than five minutes (the default Kerberos tolerance), the Key Distribution Center (KDC) rejects the authentication request, producing a 'Kerberos Authentication Failed' error. Therefore, the most likely cause is a clock skew exceeding the allowed threshold.

Answer

The Broker VM firewall is blocking ICMP ping requests

Answer

The Cortex XDR agent on the domain controller has been uninstalled

Answer

The Broker VM has exceeded its maximum disk storage allocation

Question 3

When testing a newly configured API integration instance in Cortex XSOAR, what is the standard action used to verify connectivity and authentication credentials?

Accepted Answer

Run the 'test-module' command. The 'test-module' command is the standard mechanism in Cortex XSOAR to test API connectivity and credentials.

Answer

Reboot the Cortex XDR management server tenant

Answer

Restart the Broker VM container service

Answer

Execute a full endpoint isolation workflow

Question 4

An administrator is configuring automated incident enrichment in Cortex XDR. Whenever a new malware incident is generated, the system should automatically query VirusTotal using an integration. Where should this automated workflow be built and attached?

Accepted Answer

As an automated Playbook attached to Incident Trigger rules in the Automation module. Automated workflows triggered by incident creation are built as Playbooks in Cortex XSOAR / XDR Automation and attached to Incident Classification or Trigger rules.

Answer

Inside the Cortex XDR Agent installation policy settings

Answer

Inside the Broker VM local crontab configuration file

Answer

As a local cron job running on each individual endpoint

Question 5

An enterprise security team wants to ingest NetFlow records from core routers into Cortex XDR. Which component and collector combination supports NetFlow/IPFIX ingestion?

Accepted Answer

Broker VM with the NetFlow / IPFIX Collector enabled. NetFlow/IPFIX ingestion in Cortex XDR is supported through the Broker VM with the NetFlow/IPFIX Collector enabled. The Broker VM acts as a collector that receives flow data from routers and forwards it to Cortex XDR for analysis. This is the designed architecture for network flow ingestion.

Answer

Direct API streaming from router CLI to the XDR cloud storage bucket

Answer

Cortex XDR Agent installed directly on the core routers via SSH

Answer

Cortex XSOAR integration instance using SNMP polling

Question 6

An administrator is configuring data forwarding filters in Cortex XDR to send specific severity alerts to a SIEM. The requirement is to forward all 'High' and 'Critical' severity alerts while excluding 'Low' and 'Medium' alerts. Where is this filter configured?

Accepted Answer

Under Settings > Configurations > Data Forwarding rules. Data forwarding filters that determine which alerts (by severity, type, etc.) are sent to external systems like a SIEM are configured under Settings > Configurations > Data Forwarding rules. This is where administrators define the severity thresholds and alert criteria that control what leaves Cortex XDR.

Answer

In the Cortex XDR Agent installation package configuration properties

Answer

Inside the Cortex XSOAR incident layout editor

Answer

On the Broker VM local routing table configuration

Question 7

An administrator is troubleshooting an API rate-limiting error (HTTP 429 Too Many Requests) occurring in a custom Cortex XSOAR automation playbook that queries an external threat intel API. How should the integration or playbook be modified to handle this gracefully?

Accepted Answer

Implement exponential backoff and retry logic within the integration command or playbook task. Handling rate limits requires implementing backoff and retry logic or adjusting polling intervals within the integration/playbook.

Answer

Disable SSL certificate validation on the API integration instance

Answer

Switch the integration protocol from HTTPS to raw TCP sockets

Answer

Increase the Broker VM CPU allocation to bypass API server limits

Question 8

What is the primary purpose of using a Broker VM in a Cortex XDR deployment architecture?

Accepted Answer

To act as a local log collector, aggregator, and agent proxy for data sources that cannot directly connect to the Cortex XDR cloud. Broker VMs act as intermediary collectors and forwarders for logs, threat intel, and cloud integrations in environments where direct cloud access is restricted.

Answer

To host the core Cortex XDR multi-tenant cloud database

Answer

To run local endpoint antivirus scans on unmanaged guest laptops

Answer

To replace all physical firewalls and routers within the corporate perimeter

Question 9

An administrator needs to ingest Office 365 audit logs into Cortex XDR. Which integration method is officially supported and recommended by Palo Alto Networks for this data source?

Accepted Answer

Office 365 Management Activity API integration. Office 365 logs are ingested using the Office 365 Management Activity API integration via Broker VM or cloud-to-cloud integration.

Answer

Local WMI polling from a Windows domain controller

Answer

SNMP trap listener configured on the endpoint agent

Answer

Syslog forwarding from Microsoft Outlook client applications

Question 10

Which TWO of the following data sources can be natively onboarded and collected using a Cortex XDR Broker VM? (Choose two)

Accepted Answer

AWS CloudTrail log buckets. Option A (AWS CloudTrail log buckets) is correct because the Cortex XDR Broker VM can natively collect cloud audit logs by connecting to AWS S3 buckets where CloudTrail stores its log files, using the broker's cloud data collection capability. Option E (Syslog / CEF data streams from network security devices) is correct because the Broker VM includes a Syslog Collector that natively receives and parses Syslog and CEF-formatted events from firewalls, proxies, and other network security appliances. The remaining options are not supported: Bluetooth proximity logs from mobile phones are not a Broker VM data source, hardware serial numbers via SNMP are not natively onboarded by the Broker VM, and kernel memory dumps from unmanaged switches are neither a supported collection method nor a standard Broker VM integration.

Answer

Local Bluetooth proximity logs from mobile phones

Answer

Physical desktop hardware serial numbers via SNMP

Answer

Direct kernel memory dumps from unmanaged switches

Question 11

An administrator is configuring a new integration in Cortex XSOAR and needs to ensure secure credential handling. Which TWO practices are recommended when managing API keys and secrets? (Choose two)

Accepted Answer

Store API keys using the integration parameter type 'Encrypted' / 'Password'. Option A is correct because Cortex XSOAR provides dedicated parameter types such as 'Encrypted' and 'Password' that mask and securely store sensitive values like API keys in the integration configuration, preventing them from being exposed in plain text in the UI or logs. Option C is correct because periodic key rotation limits the window of exposure if a credential is compromised and is a standard security practice mandated by most organizational policies and compliance frameworks. Option B is incorrect because hardcoding secrets in Python source code exposes them to anyone with repository or content-pack access and makes rotation difficult. Option D is incorrect because writing API keys in plain text in an incident description field exposes them to all users with incident access and to audit logs. Option E is incorrect because sharing credentials across tenants via public GitHub repositories is a severe security violation that leaks secrets to unauthorized parties.

Answer

Hardcode the API keys directly into the playbook Python script source code

Answer

Publish the API keys in plain text within the incident description field for team visibility

Answer

Share integration credentials across all tenants via public GitHub repositories

Question 12

Which TWO actions can be performed directly within the Cortex XDR Data Integration management interface? (Choose two)

Accepted Answer

Define custom log parsing and mapping rules. Option B is correct because the Cortex XDR Data Integration management interface lets you create custom log parsing and mapping rules so that ingested third-party logs are normalized into Cortex XDR's schema for detection and search. Option D is correct because the same interface is where you deploy, configure, and monitor Broker VM instances, which act as the on-premises collectors/proxies that forward data to Cortex XDR. The remaining options are unrelated to Cortex XDR data integration: A concerns physical datacenter hardware provisioning, C concerns wireless guest-network portals, and E concerns router firmware maintenance, none of which are functions of the Cortex XDR Data Integration UI.

Answer

Provision physical server rack enclosures

Answer

Configure corporate Wi-Fi guest portal splash pages

Answer

Flash BIOS firmware on enterprise routers

Question 13

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Accepted Answer

Cortex XSOAR Server Audit and Server logs (/var/log/demisto/server.log). Option D is correct because Cortex XSOAR Server Audit and Server logs, including /var/log/demisto/server.log, record API activity, automation execution, and integration errors, which are essential for diagnosing a failing Cortex XDR API query or automation script. Option E is correct because integration debug logs, viewed via Docker container logs for the specific integration instance, show the actual HTTP requests, responses, and errors exchanged with the Cortex XDR API, directly revealing the root cause. Option A is not relevant because Windows Event Viewer Security logs on unmanaged workstations do not capture Cortex XDR API or automation activity. Option B is not relevant because BIOS firmware event logs relate to hardware/firmware events, not API or script failures. Option C is not relevant because Cortex XDR Agent installation MSI error logs only cover agent installation issues, not API query or automation script failures.

Answer

Windows Event Viewer Security log on unmanaged workstations

Answer

Local BIOS firmware event logs

Answer

Cortex XDR Agent installation MSI error logs

Question 14

Which TWO authentication methods are commonly supported when configuring API integrations in Cortex XSOAR? (Choose two)

Accepted Answer

API Key / Token Authentication. Option A (API Key / Token Authentication) is correct because Cortex XSOAR integrations commonly authenticate to third-party REST APIs by sending a static API key or bearer token in a header or query parameter, which the integration's configuration parameters store and reference. Option C (OAuth2, using either the Authorization Code or Client Credentials flow) is correct because XSOAR supports OAuth2-based integrations where the integration generates and refreshes access tokens against the vendor's authorization server, with Client Credentials used for machine-to-machine access and Authorization Code for user-delegated access. The remaining options are not authentication methods for API integrations: rotary dial pulse signaling and physical punch cards are obsolete telephony and data-entry mechanisms, and plain text Telnet login prompts are an insecure legacy remote-shell authentication method, none of which Cortex XSOAR uses to authenticate API integrations.

Answer

Rotary dial pulse signaling

Answer

Physical punch cards

Answer

Plain text Telnet login prompts

Question 15

An administrator is designing an automated incident response playbook in Cortex XSOAR. Which TWO core concepts are essential for passing data between playbook tasks? (Choose two)

Accepted Answer

Incident Context (Context Data) to store and retrieve structured key-value data. Option B is correct because Cortex XSOAR stores and shares structured key-value data across playbook tasks in the Incident Context, which tasks read from and write to using context paths (e.g., ${incident.customFields}), making it the primary data-passing mechanism. Option D is correct because each playbook task produces outputs and accepts inputs, and the playbook engine maps prior task outputs (or context keys) into subsequent task inputs/arguments, which is how data flows from one task to the next. Option A is wrong because there is no such thing as static global environment variables hardcoded in the server kernel for playbook data passing. Option C is wrong because XSOAR playbooks are not written using C++ direct memory pointer references. Option E is wrong because manual USB transfer is not an automated data-passing method within a playbook.

Answer

Static global environment variables hardcoded in the server kernel

Answer

Direct memory pointer references in C++ syntax

Answer

Manual USB flash drive transfer between server nodes