XDR-Engineer Maintenance And Troubleshooting — All Questions With Answers

Question 1hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

An endpoint running Cortex XDR Agent has experienced repeated kernel panics after a content update. The administrator needs to boot the endpoint into safe mode or disable the prevention modules remotely using the command line tool. Which utility should the administrator invoke locally via script or recovery environment?

Question 2mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An endpoint user reports that a legitimate internal application is being blocked by Cortex XDR Exploit Protection. The administrator wants to create an exception without completely disabling the module. Which mechanism should the administrator use in the Cortex XDR console?

Question 3easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator notices that a newly installed Cortex XDR Agent on a Windows endpoint is not communicating with the Cortex XDR management console. Which log file should the administrator review first on the local endpoint to troubleshoot agent installation and service startup issues?

Question 4easymultiple choice

Read the full network assurance explanation →

An administrator is troubleshooting a Broker VM that cannot ingest CEF logs from a third-party SIEM. Which service status command should the administrator run inside the Broker VM shell to verify that the syslog collector service is running?

Question 5mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to collect troubleshooting logs from a misbehaving Cortex XDR Agent on a Windows endpoint. Which cytool command generates a comprehensive support file archive?

Question 6hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

An enterprise environment uses a proxy server for all outbound internet traffic. How must the administrator configure the Cortex XDR Agent to ensure it can successfully connect through the proxy to the Cortex XDR cloud?

Question 7hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator is investigating an incident and notices that data from a specific cloud data source integrated via Cortex XDR Cloud Data Collector is delayed by several hours. Where should the administrator check first to diagnose the ingestion delay?

Question 8hardmultiple choice

Read the full network assurance explanation →

An administrator needs to troubleshoot an issue where syslog messages sent to a Cortex XDR Broker VM are dropped. Which log file on the Broker VM contains syslog ingestion errors and parser exceptions?

Question 9easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator notices that an endpoint has been offline for over 30 days and wants to remove it from the Cortex XDR active license count. What action should be taken in the console?

Question 10mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to deploy the Cortex XDR Agent to hundreds of endpoints using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch is required during silent installation to specify the management console registration token?

Question 11hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting a scenario where Cortex XDR incident causality chains appear broken or incomplete. Which local agent component or setting is primarily responsible for tracking process creation and parent-child lineage for causality analysis?

Question 12mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator notices that a Linux endpoint running Cortex XDR Agent has high CPU utilization caused by the agent process. Which command can the administrator use via cytool to temporarily modify debug logging levels or diagnostic tracing to assist support without uninstalling?

Question 13mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to troubleshoot an endpoint where the Cortex XDR agent has been tampered with or corrupted. Which TWO actions can the administrator take to repair or reinstall the agent safely? (Choose two)

Question 14mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator has a Windows endpoint that is repeatedly crashing during boot after a recent agent content update. The administrator needs to boot the endpoint into Safe Mode to remove the problematic agent files, but the Cortex XDR Agent is blocking Safe Mode. What is the recommended method to allow Safe Mode boot?

Question 15mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting a performance issue on a Windows endpoint. They suspect the Cortex XDR agent's kernel-level driver is causing high CPU usage. They need to obtain detailed diagnostic logs from the agent without disrupting the endpoint's protection. Which action should they take?

Question 16hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a specific BIOC rule is not generating alerts on a group of endpoints. The administrator has confirmed that the BIOC rule is enabled and the endpoints are online. Which Cortex XDR feature should the administrator use to test the BIOC rule against historical data to verify its logic?

Question 17mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting a performance issue on a Cortex XDR Broker VM. The broker is currently handling a high volume of traffic from thousands of endpoints. The administrator suspects that the broker is overwhelmed and wants to verify the current CPU and memory utilization. Which action should the administrator take to obtain this information?

Question 18mediummulti select

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting an issue where the Cortex XDR agent on a Linux endpoint fails to start after a recent update. The administrator needs to collect relevant logs to diagnose the problem. Which two actions should they take? (Choose two.)

Question 19mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator needs to install the Cortex XDR agent on a large number of Windows endpoints using Microsoft Endpoint Configuration Manager (MECM/SCCM). The administrator wants to ensure the agent is installed silently without user interaction and with the correct tenant settings preconfigured. Which installation method should the administrator use?

Question 20hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A security engineer is investigating a series of alerts indicating that a Cortex XDR agent on a Linux server is repeatedly failing to connect to the Broker VM. The agent logs show 'connection refused' errors. The engineer confirms that the Broker VM is up and running, and other agents are communicating fine. Which of the following is the most likely cause of this specific agent's connectivity issue?

Question 21easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator needs to verify that the Cortex XDR agent on a Windows endpoint is functioning correctly and has the latest content updates. Which action should they take?

Question 22mediummulti select

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator needs to ensure that a specific BIOC rule does not trigger false positives on a set of developer workstations while still detecting the malicious behavior on other endpoints. The administrator wants to create an exception for the BIOC rule. Which two actions must the administrator take? (Choose two.)

Question 23hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting an issue where the Cortex XDR agent on a macOS endpoint is not blocking malicious files as expected. The administrator has confirmed that the agent is running and connected to the console. Which action should they take next to diagnose the issue?

Question 24easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why an endpoint is not receiving updated security policies from the management console. The administrator verifies that the endpoint is online and the agent is running. Which agent component is responsible for fetching and applying policies from the Cortex XDR management console?

Question 25mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a Cortex XDR agent on a Windows endpoint fails to register with the Cortex XDR management server after a network change. The administrator verifies that the endpoint can reach the management server on TCP 443 and that the agent service is running. Which log file should the administrator review first to identify the cause of the registration failure?

Question 26hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting an issue where a custom BIOC rule is not triggering alerts on a specific endpoint. The administrator confirms that the rule is enabled, the endpoint is online, and the agent version supports the rule. Which action should the administrator take next to verify whether the BIOC rule is being evaluated on the endpoint?

Question 27mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is investigating an incident where a process attempted to access the LSASS process on a Windows server. The administrator notices that the Cortex XDR agent did not block the attempt, even though the endpoint is protected by a Malware Prevention policy set to block. Which of the following is the MOST likely reason?

Question 28easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to check the operational status and resource utilization of a Cortex XDR Broker VM. Where can the administrator monitor this directly within the Cortex XDR management console?

Question 29hardmultiple choice

Read the full network assurance explanation →

An administrator is troubleshooting a scenario where Cortex XDR Agent data is not appearing in the management console. Firewall rules restrict outbound traffic. Which destination port and protocol must be opened outbound from the endpoints to the Cortex XDR management console for agent telemetry?

Question 30easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to verify whether Cortex XDR Agents are successfully receiving policy updates from the Cortex XDR management console. Where should the administrator check in the management console?

Question 31mediummultiple choice

Read the full network assurance explanation →

An administrator is troubleshooting an issue where Cortex XDR Broker VM cannot forward logs from a syslog source. Which CLI command on the Broker VM can the administrator use to verify active syslog listening ports and network connectivity status?

Question 32mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator notices that a specific BIOC alert is triggering false positives across multiple developer workstations. What is the most efficient way to tune this behavior in Cortex XDR without writing custom XQL exclusion queries?

Question 33easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to verify if a specific endpoint has the latest content version applied. Where is this information visible in the Cortex XDR management console?

Question 34easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to run an ad-hoc query to investigate failed logon attempts across all endpoints over the last 24 hours. Which tool in Cortex XDR should the administrator use?

Question 35hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to update the Cortex XDR Broker VM software version. What is the recommended and supported method to perform this upgrade?

Question 36mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An endpoint has been isolated via the Cortex XDR management console to contain a suspected active breach. Once the threat is remediated, how does the administrator restore network connectivity to the endpoint?

Question 37mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting a Cortex XDR script execution failure via Remote Actions. Which condition must be met on a Windows endpoint for a PowerShell remediation script to run successfully?

Question 38mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator is reviewing incident triage notes and wants to export audit logs showing all administrative actions taken in the Cortex XDR console over the past 90 days. Where should the administrator navigate?

Question 39hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR Agent on a macOS endpoint is failing to start its kernel extension (Endpoint Security extension). Which diagnostic command should be run locally in the macOS Terminal to verify system extension approval status?

Question 40easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to check the total license utilization and expiration date for their Cortex XDR tenant. Where can this be reviewed?

Question 41hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

Question 42easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to temporarily disable the Cortex XDR agent protection on an endpoint to perform maintenance. What is required to perform this action locally using cytool?

Question 43mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting why a Cortex XDR Agent is failing to communicate with the cloud management console. Which TWO network or configuration checks should the administrator perform? (Choose two)

Question 44hardmultiple choice

Read the full network assurance explanation →

An administrator is troubleshooting an issue where Cortex XDR cannot forward alerts to a third-party SIEM via HTTPS Syslog. Which test tool can be executed from the Broker VM to verify network reachability and TLS handshake success against the remote SIEM listener?

Question 45mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to ensure high availability and load balancing for log collection using Cortex XDR Broker VMs. Which TWO architectural best practices should be implemented? (Choose two)

Question 46hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting an issue where certain PowerShell scripts executed via Cortex XDR Remote Actions fail with exit code errors. Which THREE factors should the administrator check? (Choose three)

Question 47hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is reviewing XQL search performance issues and query timeouts when investigating historical logs. Which THREE methods can the administrator use to optimize query performance? (Choose three)

Question 48mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is setting up Cloud Data Collectors in Cortex XDR to ingest logs from Microsoft Entra ID (Azure AD). Which TWO prerequisites must be verified during troubleshooting if ingestion fails? (Choose two)

Question 49hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is configuring log forwarding from a Cortex XDR Broker VM to an external SIEM and encounters connection timeouts. Which THREE troubleshooting actions should the administrator take? (Choose three)

Question 50mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator notices that Cortex XDR content updates are failing to apply to endpoints in a secured network segment. Which TWO potential causes should the administrator investigate? (Choose two)

Question 51hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting an issue where custom Correlation Rules in Cortex XDR are not generating expected incidents. Which THREE diagnostic steps should the administrator perform? (Choose three)

Question 52easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to configure email notifications whenever a critical severity incident is detected by Cortex XDR. Where is this notification setting configured?

Question 53mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is reviewing endpoint isolation troubleshooting steps. Which TWO behaviors occur on a Windows endpoint when it is isolated via Cortex XDR? (Choose two)

Question 54hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

Question 55mediummultiple choice

Read the full network assurance explanation →

A Cortex XDR administrator needs to verify that the Broker VM is receiving and forwarding endpoint telemetry to the Cortex XDR management console. The Broker VM appears online in the console, but no new endpoint logs have appeared for several hours. Which Broker VM component should the administrator check first to confirm that log ingestion is functioning?

Question 56hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is investigating an incident where a PowerShell script executed on multiple endpoints, but the Cortex XDR agent did not generate any alerts. The administrator confirms the script is malicious and should have been detected by the Behavioral Threat protection module. Which action should the administrator take first to troubleshoot the missing alerts?

Question 57hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A security operations team has deployed Cortex XDR agents to a large fleet of Linux servers. After a kernel upgrade on several servers, the agents stop reporting and the endpoints show as disconnected in the console. The administrator confirms the servers are reachable and the agent processes are running. Which action should the administrator take to restore agent functionality?

Question 58easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is investigating an incident and needs to confirm whether a specific endpoint has an active agent that is reporting to the console. The administrator has the endpoint's hostname. Which Cortex XDR console area should be used to quickly locate the endpoint and view its agent status?

Question 59hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is investigating why a specific endpoint is not receiving updated policy settings from the management console. The endpoint shows as connected in the console, and the agent version is up to date. The administrator suspects a communication issue between the agent and the console. Which log should they review first to diagnose the problem?

Question 60hardmulti select

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a custom BIOC rule that was expected to trigger on specific process behavior is not generating alerts. The rule is enabled and assigned to the relevant endpoint policy. Which two actions should the administrator take to diagnose the issue? (Choose two.)

Question 61mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator notices that the Broker VM's disk usage is consistently above 90%, and some endpoints are intermittently failing to send logs. The administrator needs to reduce disk pressure without losing critical data. Which action should be taken first?

Question 62hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a custom Correlation Rule is not generating incidents. The rule is enabled and scheduled to run every hour. The administrator checks the rule's configuration and sees that it uses a query that references the 'action_process_image_name' field. However, no incidents have been generated despite the query returning results when run manually in the Query Builder. What is the most likely cause?

Question 63easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to quickly identify which Cortex XDR agent version is installed on a specific Windows endpoint that is experiencing performance issues. The administrator has access to the Cortex XDR management console. Where can this information be found?

Question 64hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is investigating an incident where a process attempted to access the LSASS process on a Windows server. The administrator wants to retrieve the raw event data for this activity to understand the full context, including the command line and parent process. Which Cortex XDR feature should the administrator use to obtain this detailed event information?

Question 65hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting an issue where the Cortex XDR agent on a Windows endpoint is not blocking a known malicious file, even though the prevention policy is set to block. The administrator has confirmed that the policy is applied and the agent is connected. Which of the following is the most likely reason for the agent's failure to block?

Question 66mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator notices that the Cortex XDR agent on a Windows endpoint is not reporting any new events to the Cortex XDR management console for the past 24 hours, although the endpoint is online and other agents are reporting normally. The administrator verifies that the agent service is running. Which of the following is the MOST likely cause?

Question 67hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a specific endpoint is not receiving updated policy settings from the Cortex XDR management console. The administrator confirms that the endpoint is online and the agent is running. The agent version is up to date. Which of the following should the administrator check FIRST to resolve this issue?

Question 68mediummulti select

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a custom BIOC rule is not generating alerts on a group of endpoints. The administrator has verified that the rule is enabled and the endpoints are online. Which two actions should the administrator take to further troubleshoot the issue? (Choose two.)

Question 69hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting a Broker VM that is experiencing high CPU usage and is not processing logs from endpoints as expected. The administrator checks the Broker VM's system resources and finds that CPU usage is consistently above 90%. Which of the following is the MOST likely cause?

Question 1hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

An endpoint running Cortex XDR Agent has experienced repeated kernel panics after a content update. The administrator needs to boot the endpoint into safe mode or disable the prevention modules remotely using the command line tool. Which utility should the administrator invoke locally via script or recovery environment?

Question 2mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An endpoint user reports that a legitimate internal application is being blocked by Cortex XDR Exploit Protection. The administrator wants to create an exception without completely disabling the module. Which mechanism should the administrator use in the Cortex XDR console?

Question 3easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator notices that a newly installed Cortex XDR Agent on a Windows endpoint is not communicating with the Cortex XDR management console. Which log file should the administrator review first on the local endpoint to troubleshoot agent installation and service startup issues?

Question 4easymultiple choice

Read the full network assurance explanation →

An administrator is troubleshooting a Broker VM that cannot ingest CEF logs from a third-party SIEM. Which service status command should the administrator run inside the Broker VM shell to verify that the syslog collector service is running?

Question 5mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to collect troubleshooting logs from a misbehaving Cortex XDR Agent on a Windows endpoint. Which cytool command generates a comprehensive support file archive?

Question 6hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

An enterprise environment uses a proxy server for all outbound internet traffic. How must the administrator configure the Cortex XDR Agent to ensure it can successfully connect through the proxy to the Cortex XDR cloud?

Question 7hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator is investigating an incident and notices that data from a specific cloud data source integrated via Cortex XDR Cloud Data Collector is delayed by several hours. Where should the administrator check first to diagnose the ingestion delay?

Question 8hardmultiple choice

Read the full network assurance explanation →

An administrator needs to troubleshoot an issue where syslog messages sent to a Cortex XDR Broker VM are dropped. Which log file on the Broker VM contains syslog ingestion errors and parser exceptions?

Question 9easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator notices that an endpoint has been offline for over 30 days and wants to remove it from the Cortex XDR active license count. What action should be taken in the console?

Question 10mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to deploy the Cortex XDR Agent to hundreds of endpoints using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch is required during silent installation to specify the management console registration token?

Question 11hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting a scenario where Cortex XDR incident causality chains appear broken or incomplete. Which local agent component or setting is primarily responsible for tracking process creation and parent-child lineage for causality analysis?

Question 12mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator notices that a Linux endpoint running Cortex XDR Agent has high CPU utilization caused by the agent process. Which command can the administrator use via cytool to temporarily modify debug logging levels or diagnostic tracing to assist support without uninstalling?

Question 13mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to troubleshoot an endpoint where the Cortex XDR agent has been tampered with or corrupted. Which TWO actions can the administrator take to repair or reinstall the agent safely? (Choose two)

Question 14mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator has a Windows endpoint that is repeatedly crashing during boot after a recent agent content update. The administrator needs to boot the endpoint into Safe Mode to remove the problematic agent files, but the Cortex XDR Agent is blocking Safe Mode. What is the recommended method to allow Safe Mode boot?

Question 15mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting a performance issue on a Windows endpoint. They suspect the Cortex XDR agent's kernel-level driver is causing high CPU usage. They need to obtain detailed diagnostic logs from the agent without disrupting the endpoint's protection. Which action should they take?

Question 16hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a specific BIOC rule is not generating alerts on a group of endpoints. The administrator has confirmed that the BIOC rule is enabled and the endpoints are online. Which Cortex XDR feature should the administrator use to test the BIOC rule against historical data to verify its logic?

Question 17mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting a performance issue on a Cortex XDR Broker VM. The broker is currently handling a high volume of traffic from thousands of endpoints. The administrator suspects that the broker is overwhelmed and wants to verify the current CPU and memory utilization. Which action should the administrator take to obtain this information?

Question 18mediummulti select

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting an issue where the Cortex XDR agent on a Linux endpoint fails to start after a recent update. The administrator needs to collect relevant logs to diagnose the problem. Which two actions should they take? (Choose two.)

Question 19mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator needs to install the Cortex XDR agent on a large number of Windows endpoints using Microsoft Endpoint Configuration Manager (MECM/SCCM). The administrator wants to ensure the agent is installed silently without user interaction and with the correct tenant settings preconfigured. Which installation method should the administrator use?

Question 20hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A security engineer is investigating a series of alerts indicating that a Cortex XDR agent on a Linux server is repeatedly failing to connect to the Broker VM. The agent logs show 'connection refused' errors. The engineer confirms that the Broker VM is up and running, and other agents are communicating fine. Which of the following is the most likely cause of this specific agent's connectivity issue?

Question 21easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator needs to verify that the Cortex XDR agent on a Windows endpoint is functioning correctly and has the latest content updates. Which action should they take?

Question 22mediummulti select

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator needs to ensure that a specific BIOC rule does not trigger false positives on a set of developer workstations while still detecting the malicious behavior on other endpoints. The administrator wants to create an exception for the BIOC rule. Which two actions must the administrator take? (Choose two.)

Question 23hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting an issue where the Cortex XDR agent on a macOS endpoint is not blocking malicious files as expected. The administrator has confirmed that the agent is running and connected to the console. Which action should they take next to diagnose the issue?

Question 24easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why an endpoint is not receiving updated security policies from the management console. The administrator verifies that the endpoint is online and the agent is running. Which agent component is responsible for fetching and applying policies from the Cortex XDR management console?

Question 25mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a Cortex XDR agent on a Windows endpoint fails to register with the Cortex XDR management server after a network change. The administrator verifies that the endpoint can reach the management server on TCP 443 and that the agent service is running. Which log file should the administrator review first to identify the cause of the registration failure?

Question 26hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting an issue where a custom BIOC rule is not triggering alerts on a specific endpoint. The administrator confirms that the rule is enabled, the endpoint is online, and the agent version supports the rule. Which action should the administrator take next to verify whether the BIOC rule is being evaluated on the endpoint?

Question 27mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is investigating an incident where a process attempted to access the LSASS process on a Windows server. The administrator notices that the Cortex XDR agent did not block the attempt, even though the endpoint is protected by a Malware Prevention policy set to block. Which of the following is the MOST likely reason?

Question 28easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to check the operational status and resource utilization of a Cortex XDR Broker VM. Where can the administrator monitor this directly within the Cortex XDR management console?

Question 29hardmultiple choice

Read the full network assurance explanation →

An administrator is troubleshooting a scenario where Cortex XDR Agent data is not appearing in the management console. Firewall rules restrict outbound traffic. Which destination port and protocol must be opened outbound from the endpoints to the Cortex XDR management console for agent telemetry?

Question 30easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to verify whether Cortex XDR Agents are successfully receiving policy updates from the Cortex XDR management console. Where should the administrator check in the management console?

Question 31mediummultiple choice

Read the full network assurance explanation →

An administrator is troubleshooting an issue where Cortex XDR Broker VM cannot forward logs from a syslog source. Which CLI command on the Broker VM can the administrator use to verify active syslog listening ports and network connectivity status?

Question 32mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator notices that a specific BIOC alert is triggering false positives across multiple developer workstations. What is the most efficient way to tune this behavior in Cortex XDR without writing custom XQL exclusion queries?

Question 33easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to verify if a specific endpoint has the latest content version applied. Where is this information visible in the Cortex XDR management console?

Question 34easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to run an ad-hoc query to investigate failed logon attempts across all endpoints over the last 24 hours. Which tool in Cortex XDR should the administrator use?

Question 35hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to update the Cortex XDR Broker VM software version. What is the recommended and supported method to perform this upgrade?

Question 36mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An endpoint has been isolated via the Cortex XDR management console to contain a suspected active breach. Once the threat is remediated, how does the administrator restore network connectivity to the endpoint?

Question 37mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting a Cortex XDR script execution failure via Remote Actions. Which condition must be met on a Windows endpoint for a PowerShell remediation script to run successfully?

Question 38mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator is reviewing incident triage notes and wants to export audit logs showing all administrative actions taken in the Cortex XDR console over the past 90 days. Where should the administrator navigate?

Question 39hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR Agent on a macOS endpoint is failing to start its kernel extension (Endpoint Security extension). Which diagnostic command should be run locally in the macOS Terminal to verify system extension approval status?

Question 40easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to check the total license utilization and expiration date for their Cortex XDR tenant. Where can this be reviewed?

Question 41hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

Question 42easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to temporarily disable the Cortex XDR agent protection on an endpoint to perform maintenance. What is required to perform this action locally using cytool?

Question 43mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting why a Cortex XDR Agent is failing to communicate with the cloud management console. Which TWO network or configuration checks should the administrator perform? (Choose two)

Question 44hardmultiple choice

Read the full network assurance explanation →

An administrator is troubleshooting an issue where Cortex XDR cannot forward alerts to a third-party SIEM via HTTPS Syslog. Which test tool can be executed from the Broker VM to verify network reachability and TLS handshake success against the remote SIEM listener?

Question 45mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to ensure high availability and load balancing for log collection using Cortex XDR Broker VMs. Which TWO architectural best practices should be implemented? (Choose two)

Question 46hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting an issue where certain PowerShell scripts executed via Cortex XDR Remote Actions fail with exit code errors. Which THREE factors should the administrator check? (Choose three)

Question 47hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is reviewing XQL search performance issues and query timeouts when investigating historical logs. Which THREE methods can the administrator use to optimize query performance? (Choose three)

Question 48mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is setting up Cloud Data Collectors in Cortex XDR to ingest logs from Microsoft Entra ID (Azure AD). Which TWO prerequisites must be verified during troubleshooting if ingestion fails? (Choose two)

Question 49hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is configuring log forwarding from a Cortex XDR Broker VM to an external SIEM and encounters connection timeouts. Which THREE troubleshooting actions should the administrator take? (Choose three)

Question 50mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator notices that Cortex XDR content updates are failing to apply to endpoints in a secured network segment. Which TWO potential causes should the administrator investigate? (Choose two)

Question 51hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting an issue where custom Correlation Rules in Cortex XDR are not generating expected incidents. Which THREE diagnostic steps should the administrator perform? (Choose three)

Question 52easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator wants to configure email notifications whenever a critical severity incident is detected by Cortex XDR. Where is this notification setting configured?

Question 53mediummulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is reviewing endpoint isolation troubleshooting steps. Which TWO behaviors occur on a Windows endpoint when it is isolated via Cortex XDR? (Choose two)

Question 54hardmulti select

Read the full Maintenance And Troubleshooting explanation →

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

Question 55mediummultiple choice

Read the full network assurance explanation →

A Cortex XDR administrator needs to verify that the Broker VM is receiving and forwarding endpoint telemetry to the Cortex XDR management console. The Broker VM appears online in the console, but no new endpoint logs have appeared for several hours. Which Broker VM component should the administrator check first to confirm that log ingestion is functioning?

Question 56hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is investigating an incident where a PowerShell script executed on multiple endpoints, but the Cortex XDR agent did not generate any alerts. The administrator confirms the script is malicious and should have been detected by the Behavioral Threat protection module. Which action should the administrator take first to troubleshoot the missing alerts?

Question 57hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A security operations team has deployed Cortex XDR agents to a large fleet of Linux servers. After a kernel upgrade on several servers, the agents stop reporting and the endpoints show as disconnected in the console. The administrator confirms the servers are reachable and the agent processes are running. Which action should the administrator take to restore agent functionality?

Question 58easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is investigating an incident and needs to confirm whether a specific endpoint has an active agent that is reporting to the console. The administrator has the endpoint's hostname. Which Cortex XDR console area should be used to quickly locate the endpoint and view its agent status?

Question 59hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is investigating why a specific endpoint is not receiving updated policy settings from the management console. The endpoint shows as connected in the console, and the agent version is up to date. The administrator suspects a communication issue between the agent and the console. Which log should they review first to diagnose the problem?

Question 60hardmulti select

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a custom BIOC rule that was expected to trigger on specific process behavior is not generating alerts. The rule is enabled and assigned to the relevant endpoint policy. Which two actions should the administrator take to diagnose the issue? (Choose two.)

Question 61mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator notices that the Broker VM's disk usage is consistently above 90%, and some endpoints are intermittently failing to send logs. The administrator needs to reduce disk pressure without losing critical data. Which action should be taken first?

Question 62hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a custom Correlation Rule is not generating incidents. The rule is enabled and scheduled to run every hour. The administrator checks the rule's configuration and sees that it uses a query that references the 'action_process_image_name' field. However, no incidents have been generated despite the query returning results when run manually in the Query Builder. What is the most likely cause?

Question 63easymultiple choice

Read the full Maintenance And Troubleshooting explanation →

An administrator needs to quickly identify which Cortex XDR agent version is installed on a specific Windows endpoint that is experiencing performance issues. The administrator has access to the Cortex XDR management console. Where can this information be found?

Question 64hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is investigating an incident where a process attempted to access the LSASS process on a Windows server. The administrator wants to retrieve the raw event data for this activity to understand the full context, including the command line and parent process. Which Cortex XDR feature should the administrator use to obtain this detailed event information?

Question 65hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting an issue where the Cortex XDR agent on a Windows endpoint is not blocking a known malicious file, even though the prevention policy is set to block. The administrator has confirmed that the policy is applied and the agent is connected. Which of the following is the most likely reason for the agent's failure to block?

Question 66mediummultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator notices that the Cortex XDR agent on a Windows endpoint is not reporting any new events to the Cortex XDR management console for the past 24 hours, although the endpoint is online and other agents are reporting normally. The administrator verifies that the agent service is running. Which of the following is the MOST likely cause?

Question 67hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a specific endpoint is not receiving updated policy settings from the Cortex XDR management console. The administrator confirms that the endpoint is online and the agent is running. The agent version is up to date. Which of the following should the administrator check FIRST to resolve this issue?

Question 68mediummulti select

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting why a custom BIOC rule is not generating alerts on a group of endpoints. The administrator has verified that the rule is enabled and the endpoints are online. Which two actions should the administrator take to further troubleshoot the issue? (Choose two.)

Question 69hardmultiple choice

Read the full Maintenance And Troubleshooting explanation →

A Cortex XDR administrator is troubleshooting a Broker VM that is experiencing high CPU usage and is not processing logs from endpoints as expected. The administrator checks the Broker VM's system resources and finds that CPU usage is consistently above 90%. Which of the following is the MOST likely cause?