XDR-Engineer Ingestion And Automation Practice Test 4 — 15 Questions

Question 1

An organization requires high availability and load balancing for their Broker VM log ingestion tier. Which TWO architectural considerations or configurations support this requirement? (Choose two)

Accepted Answer

Deploying multiple Broker VMs behind an external Layer 4 load balancer for syslog/network log ingestion. Option A is correct because deploying multiple Broker VMs behind an external Layer 4 load balancer provides both high availability and load distribution for syslog and network log ingestion, since L4 (TCP/UDP) load balancing can spread flows across brokers and remove failed nodes from rotation. Option E is correct because configuring redundant collector instances across multiple Broker VMs ensures that if one collector or VM fails, another continues ingesting and forwarding logs, which is the core of an HA ingestion tier. Option B is wrong because sharing a single static IP across independent, uncoordinated cloud regions without routing is not a valid HA or load-balancing design and would cause traffic blackholing or conflicts. Option C is wrong because running multiple active database instances on the same Broker VM container kernel does not provide HA or load balancing and risks resource contention and data corruption. Option D is wrong because disabling network encryption weakens security and does not deliver high availability or load balancing.

Answer

Sharing a single static IP address across independent uncoordinated cloud regions without routing

Answer

Running multiple active database instances on the same Broker VM container kernel

Answer

Disabling all network encryption to speed up packet forwarding

Question 2

Which TWO tasks can an automation playbook in Cortex XDR / XSOAR execute automatically upon detecting a confirmed threat? (Choose two)

Accepted Answer

Isolate compromised endpoints from the network. Option A is correct because Cortex XDR/XSOAR playbooks can invoke the endpoint isolation action, which cuts the compromised host off from the network (except for the management channel to Cortex XDR) to contain lateral movement and exfiltration. Option D is correct because playbooks can automatically run indicator enrichment tasks that query threat intelligence integrations such as VirusTotal to add reputation, detection ratios, and context to hashes, IPs, domains, or URLs. Options B and C are incorrect because RAM upgrades and vendor hardware orders are physical procurement/logistics activities outside the scope of a security automation playbook. Option E is also incorrect because repainting office walls is a facilities task with no relation to threat detection or response automation.

Answer

Automatically upgrade the physical RAM on compromised servers

Answer

Order replacement laptop hardware from vendors

Answer

Repaint the interior office walls of the SOC

Question 3

An administrator is setting up automated alert ingestion from a third-party SIEM into Cortex XSOAR. Which TWO integration methods or components are typically used to achieve this? (Choose two)

Accepted Answer

Webhook integrations that listen for incoming HTTP POST alerts pushed from the third-party system. Option B is correct because Cortex XSOAR supports webhook-based integrations where the third-party SIEM pushes alerts via HTTP POST to an XSOAR listener endpoint, enabling near real-time automated ingestion. Option E is correct because polling-based API integrations are also a standard method, where XSOAR queries the SIEM's alert queue or REST API on a scheduled interval to fetch new alerts. Together, webhook push and scheduled API polling are the two typical mechanisms for automated third-party alert ingestion. Options A, C, and D are incorrect because floppy disks, manual CSV export with printing, and parallel port cable bridging are obsolete or manual transport methods that do not provide automated, programmatic alert ingestion into Cortex XSOAR.

Answer

Direct physical floppy disk transport

Answer

Manual CSV export and physical printing

Answer

Local parallel port cable bridging

Question 4

An administrator needs to troubleshoot an AWS S3 bucket integration via Broker VM where logs are failing to ingest. Which TWO diagnostic steps should be taken? (Choose two)

Accepted Answer

Verify that the AWS IAM policy has s3:GetObject and s3:ListBucket permissions. Option C is correct because an S3 bucket integration requires the IAM principal used by the Broker VM to have s3:GetObject (to read the log objects) and s3:ListBucket (to enumerate the bucket contents); missing either permission causes Access Denied errors that halt ingestion. Option E is correct because the Broker VM runs the S3 polling connector inside a container, so inspecting the container logs is the direct way to surface polling failures, authentication errors, or endpoint connectivity issues. Option A is wrong because local monitor resolution has no bearing on S3 log ingestion. Option B is wrong because disconnecting enterprise firewalls is a disruptive, unsafe action and would not isolate an S3 polling problem. Option D is wrong because reinstalling the Windows OS on an S3 server is nonsensical—S3 is a managed AWS service, not a Windows host.

Answer

Change the local monitor resolution on the administrator workstation

Answer

Disconnect all enterprise physical firewalls

Answer

Reinstall the Windows operating system on the AWS S3 server

Question 5

An administrator is writing a custom Python automation script within a Cortex XSOAR integration. Which TWO standard practices should be followed to ensure proper execution and error handling within the platform? (Choose two)

Accepted Answer

Return results using structured 'CommandResults' objects containing standard outputs and human-readable text. Option B is correct because Cortex XSOAR integrations should return structured CommandResults objects, which carry the standard context outputs (readable by playbooks) and the human-readable entry text shown in the War Room, ensuring downstream automation can consume the data reliably. Option C is correct because integration code must catch exceptions and report failures through return_error(), which produces a proper error entry in the War Room instead of letting the script crash and lose the failure context. The unmarked options are inappropriate: A writes to hypervisor kernel memory (impossible and unsafe from a containerized integration), D uses CPU-spinning infinite loops that would hang the integration worker, and E leaks credentials into public logs, violating security best practices.

Answer

Write raw binary data directly to the host hypervisor kernel memory space

Answer

Execute infinite `while` loops without sleep intervals to maximize CPU usage

Answer

Print debug passwords in plain text to public stdout logs

Question 6

An automation engineer is building a Cortex XSOAR playbook that is triggered by a Cortex XDR incident. The playbook needs to fetch all associated endpoint artifacts using the Cortex XDR integration. Which parameter is required in the command execution to ensure all relevant forensics files are retrieved?

Accepted Answer

Provide the unique Agent ID and the absolute file path of the artifact.. When fetching endpoint files or running get-file commands in XSOAR using the Cortex XDR integration, providing the specific agent ID and file path or artifact identifier is required to target the correct machine.

Answer

Specify the cloud storage bucket ARN where the endpoint stores its local cache.

Answer

Enter the firewall security policy rule ID that triggered the alert.

Answer

Supply the global tenant ID and the Active Directory Distinguished Name of the host.

Question 7

When configuring the Cortex XDR API to ingest custom threat intelligence feeds, which authentication header and format must be used for the HTTP POST request to ensure successful ingestion?

Accepted Answer

Use 'x-api-key' and 'Authorization: Bearer <token>' headers with a JSON formatted payload.. Cortex XDR APIs authenticate via specific header fields including x-suid and Authorization containing the generated API key ID and secret, structured in a JSON payload format.

Answer

Use OAuth 2.0 client credentials grant type with a form-urlencoded body.

Answer

Use basic authentication with base64 encoded local administrator credentials and XML payloads.

Answer

Use SNMP v3 community strings injected into the custom HTTP header fields.

Question 8

An administrator has deployed a Broker VM to act as a syslog collector and agent installer. During the configuration of the Broker VM in the Cortex XDR console, the status remains 'Disconnected'. What is the most likely cause of this issue?

Accepted Answer

Outbound connectivity on TCP port 443 from the Broker VM to the Cortex XDR tenant is blocked.. The Broker VM communicates with the Cortex XDR tenant over outbound TCP 443 to register and maintain its connection. If outbound 443 is blocked by a firewall or proxy, the Broker VM cannot reach the tenant and will show as 'Disconnected' in the console. This is the most common cause of a Broker VM failing to connect after deployment.

Answer

The Cortex XDR agent license count has been exceeded on the tenant.

Answer

The Broker VM requires an active inbound SSH session from the administrator's workstation.

Answer

Syslog UDP port 514 is closed on the internal firewall.

Question 9

An administrator wants to create a BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR that triggers an alert whenever a PowerShell script attempts to download and execute a payload from an external IP address. Which data source must be enabled and properly ingested for this rule to function effectively?

Accepted Answer

Cortex XDR agent process execution logs and network event logs.. BIOC rules looking for script execution and network connections rely on process execution logs and network event logs generated by the Cortex XDR agent.

Answer

NetFlow logs exported exclusively from core enterprise routers.

Answer

Active Directory authentication logs via Windows Event Forwarding.

Answer

DNS query logs collected via external DNS sinkholes.

Question 10

An organization is onboarding a new cloud environment into Cortex XDR. Which THREE mechanisms or components can be utilized to ingest cloud audit logs and telemetry data into Cortex XDR? (Choose three)

Accepted Answer

Cloud Storage integration (e.g., AWS S3 bucket polling) to ingest logs.. Option A is correct because Cortex XDR supports Cloud Storage integrations that poll object storage such as AWS S3 buckets to pull cloud audit logs and telemetry into the platform. Option B is correct because API-based ingestion, using scheduled polling scripts or built-in integrations against cloud provider APIs (e.g., AWS CloudTrail, Azure Activity Log, GCP Audit Logs), is a supported method for bringing cloud logs into Cortex XDR. Option C is correct because the native Cloud Connector configuration onboards cloud accounts to provide cloud infrastructure visibility and ingest audit/telemetry data directly. Option D is not a supported ingestion mechanism, since Cortex XDR does not rely on manual USB transfers by administrative personnel. Option E is not applicable, as Cortex XDR ingests cloud logs through APIs, storage integrations, and connectors rather than physical tap appliances performing kernel-level packet inspection on virtual switches.

Answer

Manual USB drive data transfer initiated by cloud administrative personnel.

Answer

Direct kernel-level packet inspection via physical tap appliances attached to cloud virtual switches.

Question 11

When setting up automated alert response actions using Cortex XDR built-in response actions or XSOAR integrations, which THREE actions can be automatically initiated directly against an endpoint agent? (Choose three)

Accepted Answer

Initiate a file quarantine and retrieval request for forensic analysis.. Option A is correct because Cortex XDR's built-in response actions include quarantining files on the endpoint agent and retrieving them for forensic analysis, allowing automated containment and evidence collection. Option D is correct because terminating a malicious process is a standard endpoint response action that the agent can execute directly on the host. Option E is correct because endpoint isolation is a core Cortex XDR/XSOAR response action that cuts the agent's network connectivity (except to the management console) to stop lateral movement. Options B and C are not valid: full OS reinstallation from a recovery partition and remote BIOS firmware reflashing are not built-in Cortex XDR agent response actions and would require separate imaging or firmware management tooling.

Answer

Force a full operating system reinstallation from a clean recovery partition.

Answer

Reflash the target endpoint device BIOS firmware remotely.

Question 12

An XDR engineer is configuring a Cortex XDR data forwarding rule to send only endpoint alert data to a third-party SIEM. The SIEM requires that the forwarded payload include the raw event fields and be delivered in JSON format. Which data forwarding destination type should the engineer select?

Accepted Answer

HTTP. HTTP forwarding is the correct choice because it delivers structured JSON payloads over HTTPS and can include raw event fields, which is exactly what the third-party SIEM requires. Syslog, Email, and SMB do not provide JSON-formatted data with raw event fields in a manner suitable for direct SIEM ingestion.

Answer

SMB

Answer

Email

Answer

Syslog

Question 13

A Cortex XDR administrator is building an automation playbook that must enrich an incident with threat intelligence from an external API. The API requires a bearer token and returns JSON. The administrator wants the playbook to handle API rate limits gracefully by retrying after a delay when a 429 status code is received. Which Cortex XDR Automation configuration should the administrator use to implement this retry logic?

Accepted Answer

Use a conditional task that checks the HTTP status code and loops back to the API call task with a sleep task for the delay.. Cortex XDR Automation playbooks can implement retry logic by evaluating the API response status code and using conditional branching with a sleep task before re-invoking the API call. This approach handles 429 rate limit responses gracefully. Built-in retry parameters or instance-level settings do not provide this capability for arbitrary external APIs, so a playbook-level loop is the correct design.

Answer

Configure the integration command with a 'retry' parameter set to the number of attempts and a 'delay' parameter in seconds.

Answer

Set the integration instance timeout to a high value so the API call waits until the rate limit resets.

Answer

Enable the 'Ignore rate limit' option in the integration instance settings to bypass 429 responses automatically.

Question 14

An XDR engineer needs to automate the enrichment of Cortex XDR incidents with threat intelligence from an external MISP instance. The MISP API requires an authentication key and returns JSON. Which Cortex XDR automation component should be used to create a custom integration that queries MISP and updates incident fields?

Accepted Answer

Cortex XDR Integrations. Integrations are the automation component designed to connect to external systems, handle authentication such as MISP API keys, and parse JSON responses. They enable custom commands that can be invoked by playbooks to enrich incidents. Scripts, Playbooks, and Dashboards do not provide the API connectivity and parsing capabilities required for this scenario.

Answer

Cortex XDR Scripts

Answer

Cortex XDR Dashboards

Answer

Cortex XDR Playbooks

Question 15

An administrator is setting up a Cortex XDR Broker VM to collect logs from a remote site. The Broker VM must be able to receive logs from syslog sources and forward them to the Cortex XDR management console. Which Broker VM component is responsible for receiving syslog traffic?

Accepted Answer

Syslog Collector. The Syslog Collector is the Broker VM component that listens for and receives syslog traffic from remote sources, then forwards it to the Cortex XDR console. Network Mapper, Data Forwarder, and Log Stash do not perform this function, making Syslog Collector the correct choice for collecting syslog logs at a remote site.

Answer

Network Mapper

Answer

Data Forwarder

Answer

Log Stash