XDR-Engineer Maintenance And Troubleshooting Practice Test 2 — 15 Questions

Question 1

A Cortex XDR administrator is troubleshooting why a specific BIOC rule is not generating alerts on a group of endpoints. The administrator has confirmed that the BIOC rule is enabled and the endpoints are online. Which Cortex XDR feature should the administrator use to test the BIOC rule against historical data to verify its logic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BIOC Rule Simulator. The BIOC Rule Simulator is designed to test BIOC rules against historical data. It allows administrators to validate rule logic, ensuring that the rule would have generated alerts if the activity occurred. This is the most efficient way to troubleshoot why a BIOC rule is not firing, as it directly evaluates the rule against past events.

Answer

Query Builder

Answer

Live Terminal

Answer

Action Center

Question 2

An administrator is troubleshooting a performance issue on a Cortex XDR Broker VM. The broker is currently handling a high volume of traffic from thousands of endpoints. The administrator suspects that the broker is overwhelmed and wants to verify the current CPU and memory utilization. Which action should the administrator take to obtain this information?

Accepted Answer

In the Cortex XDR management console, navigate to Settings > Broker VMs and select the specific broker to view its resource utilization metrics.. The Cortex XDR management console includes a dedicated section for Broker VM management and monitoring. Under Settings > Broker VMs, administrators can view live CPU and memory utilization for each broker, which directly addresses the need to verify if the broker is overwhelmed. This is the supported and most efficient method, avoiding the need for direct SSH access or non-existent commands.

Answer

Run the 'broker_status' command from the Cortex XDR agent on any managed endpoint to query the broker's performance counters.

Answer

Check the Windows Event Log on the Broker VM for performance monitor entries that report CPU and memory usage.

Answer

Access the Broker VM console via SSH and run the 'top' command to view real-time CPU and memory usage.

Question 3

A Cortex XDR administrator is troubleshooting why a specific BIOC rule is not generating alerts on a group of endpoints. The administrator has confirmed that the BIOC rule is enabled and the endpoints are online. Which Cortex XDR feature should the administrator use to test the BIOC rule against historical data to verify its logic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run the 'cytool' command with the 'support' parameter to generate a support bundle.. For a Linux endpoint where the Cortex XDR agent fails to start, the administrator should collect a support bundle using cytool and check the systemd journal for the agent service. These actions provide the necessary logs to diagnose the startup failure without requiring the agent to be operational.

Answer

Run 'service cortex-xdr status' to check the agent status.

Answer

Enable debug logging by editing the agent configuration file and restarting the agent.

Answer

Review the Windows Event Viewer for Cortex XDR errors.

Question 4

A Cortex XDR administrator needs to install the Cortex XDR agent on a large number of Windows endpoints using Microsoft Endpoint Configuration Manager (MECM/SCCM). The administrator wants to ensure the agent is installed silently without user interaction and with the correct tenant settings preconfigured. Which installation method should the administrator use?

Accepted Answer

Create an application in MECM that runs the agent MSI with the /quiet and /norestart flags, and include the tenant ID in the command line.. The correct approach is to deploy the agent through MECM as an application, using the MSI with silent flags and embedding the tenant ID in the command line. This ensures a silent, unattended installation that automatically registers with the correct tenant. MECM provides robust reporting and troubleshooting capabilities, which are essential for large-scale deployments. Other methods may work but lack the automation, reliability, and preconfiguration needed for enterprise-wide rollouts.

Answer

Use a PowerShell script that downloads the agent installer from the Cortex XDR console and runs it with default settings.

Answer

Deploy the agent using a Group Policy Object (GPO) with the MSI file and a transform (MST) file containing the tenant ID.

Answer

Deploy the agent using a logon script that executes the installer with the /passive flag.

Question 5

A security engineer is investigating a series of alerts indicating that a Cortex XDR agent on a Linux server is repeatedly failing to connect to the Broker VM. The agent logs show 'connection refused' errors. The engineer confirms that the Broker VM is up and running, and other agents are communicating fine. Which of the following is the most likely cause of this specific agent's connectivity issue?

Accepted Answer

The Linux server's firewall is blocking outbound traffic to the Broker VM on the required port.. The 'connection refused' error indicates that the agent's connection attempt reached the Broker VM but was actively rejected on the port. Since the Broker VM is healthy and other agents connect, the problem is isolated to the Linux server. A local firewall blocking outbound traffic to the required port is the most likely cause. The engineer should verify firewall rules and ensure the port is open.

Answer

The Broker VM's disk is full, causing it to reject new connections from some agents.

Answer

The Broker VM's SSL certificate has expired, causing all agents to fail connection.

Answer

The Cortex XDR agent on the Linux server has not been assigned a valid license.

Question 6

A Cortex XDR administrator needs to verify that the Cortex XDR agent on a Windows endpoint is functioning correctly and has the latest content updates. Which action should they take?

Accepted Answer

Check the agent's status in the Cortex XDR management console under Endpoints > Endpoint Management.. The Cortex XDR management console provides a centralized view of endpoint status, including agent connectivity and content version. Checking the Endpoint Management page allows the administrator to quickly verify that the agent is functioning and has the latest content updates, without needing to access each endpoint individually.

Answer

Run 'cytool info' on the endpoint to display agent details.

Answer

Review the agent's local log file for content update entries.

Answer

Open Windows Defender Security Center and check the Cortex XDR integration status.

Question 7

A Cortex XDR administrator needs to ensure that a specific BIOC rule does not trigger false positives on a set of developer workstations while still detecting the malicious behavior on other endpoints. The administrator wants to create an exception for the BIOC rule. Which two actions must the administrator take? (Choose two.)

Accepted Answer

Create a BIOC exception rule that specifies the BIOC rule name and the endpoint group containing the developer workstations.. The administrator must create a BIOC exception rule that is scoped to the endpoint group containing the developer workstations and includes conditions that match the specific benign activity. This allows the BIOC to continue detecting malicious behavior on other endpoints while suppressing false positives on the developer workstations. Disabling the rule or changing its severity would impact all endpoints and is not appropriate.

Answer

Add the developer workstations to a new endpoint group and apply the exception to that group only.

Answer

Modify the BIOC rule's severity to 'Informational' so that it does not generate incidents for the developer workstations.

Answer

Disable the BIOC rule entirely and create a new BIOC rule that excludes the developer workstations.

Question 8

A Cortex XDR administrator is troubleshooting why a specific BIOC rule is not generating alerts on a group of endpoints. The administrator has confirmed that the BIOC rule is enabled and the endpoints are online. Which Cortex XDR feature should the administrator use to test the BIOC rule against historical data to verify its logic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the macOS system log for kernel extension loading errors related to Cortex XDR.. On macOS, the Cortex XDR agent uses a system extension to provide real-time protection. If the extension fails to load due to security policies or errors, malware blocking will not function. Reviewing the macOS system log for extension-related errors is the most direct way to diagnose why blocking is not occurring, as it will reveal if the extension is blocked or failed to load.

Answer

Check the agent's security policy in the console to ensure that malware blocking is enabled.

Answer

Run 'cytool diagnose' on the endpoint to perform a self-test.

Answer

Reinstall the Cortex XDR agent on the endpoint.

Question 9

A Cortex XDR administrator is troubleshooting why a specific BIOC rule is not generating alerts on a group of endpoints. The administrator has confirmed that the BIOC rule is enabled and the endpoints are online. Which Cortex XDR feature should the administrator use to test the BIOC rule against historical data to verify its logic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Cortex XDR agent's communication component (e.g., the 'cytool' or agent service).. The communication component of the Cortex XDR agent is responsible for fetching policies from the management console. This component periodically connects to the console to check for updates and retrieve new policies. If an endpoint is not receiving policy updates, the administrator should verify that the communication component is running and that the endpoint can reach the console. Other components handle local application or storage, not retrieval.

Answer

The Cortex XDR agent's policy manager component.

Answer

The Cortex XDR agent's local database.

Answer

The Cortex XDR agent's content update module.

Question 10

A Cortex XDR administrator is troubleshooting why a specific BIOC rule is not generating alerts on a group of endpoints. The administrator has confirmed that the BIOC rule is enabled and the endpoints are online. Which Cortex XDR feature should the administrator use to test the BIOC rule against historical data to verify its logic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

C:\Program Files\Palo Alto Networks\Traps\logs	laservice.log. The Cortex XDR agent service log, tlaservice.log, captures all communication with the management server, including registration handshakes and errors. When basic connectivity is confirmed but registration fails, this log provides the specific failure reason, such as certificate validation errors or server-side rejections. Other logs focus on different agent components and would not contain the relevant registration details.

Answer

C:\Program Files\Palo Alto Networks\Traps\logs\pmd.log

Answer

C:\Program Files\Palo Alto Networks\Traps\logs\cyverak.log

Answer

C:\Program Files\Palo Alto Networks\Traps\logs	laworker.log

Question 11

A Cortex XDR administrator is troubleshooting why a specific BIOC rule is not generating alerts on a group of endpoints. The administrator has confirmed that the BIOC rule is enabled and the endpoints are online. Which Cortex XDR feature should the administrator use to test the BIOC rule against historical data to verify its logic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the Cortex XDR management console's BIOC rule audit trail.. The Cortex XDR management console's BIOC rule audit trail logs rule evaluation activity, including when rules are processed and their outcomes. This allows administrators to confirm whether a custom BIOC rule is being evaluated on a specific endpoint. Without this verification, troubleshooting is guesswork. Other methods, such as checking agent logs or querying events, do not provide definitive evidence of rule evaluation.

Answer

Restart the Cortex XDR agent service on the endpoint to force rule re-evaluation.

Answer

Run a Cortex XDR query to search for the BIOC rule name in the endpoint's event data.

Answer

Check the Cortex XDR agent log for BIOC evaluation entries.

Question 12

A Cortex XDR administrator is investigating an incident where a process attempted to access the LSASS process on a Windows server. The administrator notices that the Cortex XDR agent did not block the attempt, even though the endpoint is protected by a Malware Prevention policy set to block. Which of the following is the MOST likely reason?

Accepted Answer

The process is on the allow list in the Malware Prevention policy.. Allow lists in the Malware Prevention policy can prevent the agent from blocking certain processes, even if they exhibit malicious behavior. If the process attempting LSASS access is on the allow list, the block will not occur. Reviewing the allow list is the most direct way to confirm this.

Answer

The agent is in 'Report' mode instead of 'Block' mode for that specific action.

Answer

The LSASS access attempt did not meet the threshold for blocking.

Answer

The agent's local analysis engine is disabled.

Question 13

An administrator wants to check the operational status and resource utilization of a Cortex XDR Broker VM. Where can the administrator monitor this directly within the Cortex XDR management console?

Accepted Answer

Go to Settings > Configurations > Broker VM.. The Broker VM monitoring interface is located under Settings > Configurations > Broker VM.

Answer

Go to XQL Search using dataset = broker_vm_logs.

Answer

Go to Dashboards > Broker VM Performance.

Answer

Go to Endpoint Management > Broker VM.

Question 14

An administrator is troubleshooting a scenario where Cortex XDR Agent data is not appearing in the management console. Firewall rules restrict outbound traffic. Which destination port and protocol must be opened outbound from the endpoints to the Cortex XDR management console for agent telemetry?

Accepted Answer

TCP port 443. Cortex XDR agents communicate outbound to the Cortex XDR tenant over TCP port 443 (HTTPS).

Answer

TCP port 389 and 636

Answer

TCP port 22 and 8080

Answer

UDP port 514

Question 15

An administrator needs to verify whether Cortex XDR Agents are successfully receiving policy updates from the Cortex XDR management console. Where should the administrator check in the management console?

Accepted Answer

Go to Endpoints > All Endpoints and check the Last Connected and Content Version columns.. The Status column and Agent Details view under Endpoints provide real-time connection status and policy sync timestamps.

Answer

Go to Incident Response > Investigations.

Answer

Go to Dashboards > Agent Health widget.

Answer

Go to Settings > Configurations > Agent Management.