XDR-Engineer Ingestion And Automation — Timed 10 Questions

Question 1

An administrator has configured a Cortex XDR data ingestion rule for a custom log source, but fields are appearing under the 'general_fields' object rather than their designated mapped schema columns. What is the most likely reason for this parsing failure?

10 minute time limit — choose an answer to begin.

Accepted Answer

The custom log mapping configuration has incorrect field names or unmatched JSON/regex keys. If custom fields do not map correctly, it is usually because the JSON key names or regex capture groups do not match the custom log mapping definition.

Answer

The log forwarding protocol must be changed from HTTPS to UDP

Answer

The Cortex XDR agent license does not support custom parsing

Question 2

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

Accepted Answer

Upload the custom CA certificate bundle into the Broker VM trust store via the Broker VM management page. To trust self-signed certificates on a Broker VM, the administrator must upload the custom CA certificate bundle via the Broker VM management interface.

Answer

Add the target API IP address to the Broker VM local hosts file

Answer

Modify the Broker VM system kernel parameters to ignore cipher mismatches

Answer

Disable SSL/TLS verification globally for all Cortex XDR broker app modules

Question 3

A security analyst needs to ingest custom JSON-formatted security logs from an in-house application into Cortex XDR. Where should the administrator define the custom log mapping to ensure fields are parsed correctly under the generic log profile schema?

Accepted Answer

In the Cortex XDR console under Settings > Configurations > Data Integration > Custom Log Mapping. Custom log mappings are configured in the Cortex XDR management console under Settings > Configurations > Data Integration > Log Stitching and Parsing / Custom Log Mapping.

Answer

In the Cortex XaaS cloud storage bucket configuration properties

Answer

Directly inside the broker VM configuration file using a local JSON editor

Answer

In the Cortex XDR agent installation script via command-line switches

Question 4

An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?

Accepted Answer

A Condition (or Decision) block that evaluates the sandbox verdict output. Conditional routing in playbooks is handled using Decision or Condition tasks to evaluate previous task outputs.

Answer

A Data Collection task pointing to the endpoint agent

Answer

A Post-Processing script executed directly on the Broker VM

Answer

A Manual Approval step without automated logic branching

Question 5

Which menu path in the Cortex XDR management console should an administrator navigate to view the overall health, status, and log forwarding statistics of deployed Broker VMs?

Accepted Answer

Settings > Configurations > Data Integration > Broker VM. Broker VM monitoring and status can be checked under Settings > Configurations > Data Integration > Broker VM.

Answer

Incidents > Response > Broker Status

Answer

Marketplace > Integrations > Instances

Answer

Endpoints > Management > Agent Status

Question 6

When configuring an integration instance in Cortex XSOAR (or Cortex XDR Automation) for a third-party threat intelligence feed, what is the primary purpose of the instance name?

Accepted Answer

To uniquely identify a specific configuration and credential set for an integration. Integration instances allow administrators to configure multiple instances of the same integration with different parameters, each identified by a unique instance name.

Answer

To determine the operating system kernel executing the automation script

Answer

To define the encryption key used for secure payload transit

Answer

To specify the physical network interface the integration binds to

Question 7

An administrator is troubleshooting a Cortex XDR syslog integration where logs from a high-throughput network device are being dropped or delayed. The Broker VM resource utilization for CPU and memory is normal. Which underlying collector configuration setting should be adjusted to handle the high burst rate?

Accepted Answer

Increase the syslog collector worker threads and queue size parameters in the Broker VM configuration. Syslog collectors using UDP/TCP can experience buffer drops if the queue size or worker thread allocation is insufficient.

Answer

Switch the syslog transport from TCP to ICMP tunneling

Answer

Enable verbose kernel debugging on the Cortex XDR agent

Answer

Decrease the agent keep-alive interval to force faster handshakes

Question 8

An organization requires that logs ingested via the Cortex XDR Syslog Collector be secured using TLS encryption (Syslog-over-TLS). What must the administrator configure on the Broker VM to support this requirement?

Accepted Answer

Configure the syslog collector instance on the Broker VM with a valid SSL/TLS certificate and private key. To configure Syslog-over-TLS, the administrator must provide the valid server certificate and private key on the Broker VM syslog collector configuration.

Answer

Install an external IPsec VPN tunnel between the syslog source and the Cortex XDR cloud tenant

Answer

Modify the Windows Registry keys on the domain controller

Answer

Configure a reverse proxy on the endpoint agent with port forwarding

Question 9

An administrator is configuring a Syslog Collector agent on Cortex XDR to ingest logs from a third-party firewall. Which log collection protocol and transport layer combination is natively supported by the Cortex XDR Collector for receiving unencrypted syslog messages?

Accepted Answer

Syslog over UDP and TCP. Cortex XDR Syslog Collector natively supports receiving syslog messages over UDP and TCP.

Answer

Syslog over HTTP/HTTPS

Answer

Syslog over SSH tunneling

Answer

Syslog over FTP/SFTP

Question 10

An administrator needs to write a custom automation script in Cortex XSOAR to query the Cortex XDR API for all endpoints that have not checked in within the last 7 days. Which API endpoint and filtering mechanism should the script use?

Accepted Answer

GET /public_api/v1/endpoints/get_endpoint/ with an explicit JSON filter for last_seen timestamp. The Cortex XDR public API uses the `/public_api/v1/endpoints/get_endpoint/` endpoint with custom filters based on operational status and last seen timestamp.

Answer

POST /public_api/v1/incidents/get_all_incidents/ with a severity filter

Answer

PUT /public_api/v1/audits/get_actions/ with an agent version parameter

Answer

GET /public_api/v1/file/file_metadata/ with a SHA256 parameter