XDR-Engineer Maintenance And Troubleshooting Practice Test 4 — 15 Questions

Question 1

An administrator is troubleshooting an issue where certain PowerShell scripts executed via Cortex XDR Remote Actions fail with exit code errors. Which THREE factors should the administrator check? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the script syntax and dependencies for missing PowerShell modules or inaccessible file paths on the host.. Option B is correct because exit code errors frequently stem from the script itself — a syntax mistake, a missing PowerShell module (e.g., not available in the system context), or a file path that does not exist on the endpoint will cause the script to terminate with a non-zero exit code. Option C is correct because Cortex XDR Remote Actions execute scripts non-interactively in the background under the system account, so any cmdlet or script that triggers a GUI prompt (e.g., Read-Host, Out-GridView, credential pop-ups) will hang or fail with an exit code. Option D is correct because the target endpoint's PowerShell execution policy (Restricted, AllSigned, RemoteSigned, Bypass, etc.) governs whether the delivered script can run at all; if it is set to Restricted or AllSigned without a valid signature, execution is blocked and an exit code error results. Option A is not required because Cortex XDR Remote Actions do not depend on Kerberos constrained delegation across the domain — WinRM connectivity to the endpoint is what matters, not domain-wide delegation. Option E is incorrect because the Broker VM is used for network/agent communication and does not need PowerShell remoting enabled; PowerShell execution happens on the target endpoint, not on the Broker VM.

Answer

Ensure that WinRM is configured with Kerberos delegation across the entire Active Directory domain.

Answer

Verify that the Cortex XDR Broker VM has PowerShell remoting enabled.

Question 2

An administrator is reviewing XQL search performance issues and query timeouts when investigating historical logs. Which THREE methods can the administrator use to optimize query performance? (Choose three)

Accepted Answer

Apply explicit dataset filters and equality checks early in the query pipeline before performing complex aggregations.. Option A is correct because applying explicit dataset filters and equality checks early in the XQL pipeline reduces the volume of events that must be processed by later stages, so expensive aggregations run against a much smaller, already-narrowed result set. Option C is correct because XQL performance is heavily time-bound; restricting the query to the smallest necessary time window limits how many indexed partitions and raw log records the engine must scan, directly reducing query time and timeout risk. Option E is correct because filtering on specific indexed fields lets the query engine use its indexes for fast lookups, whereas broad wildcard searches across all text attributes force full-text scans that are far slower and more resource-intensive. Option B is not appropriate because exporting raw logs to a spreadsheet does not optimize XQL query performance and is impractical for large historical datasets. Option D is not correct because increasing Broker VM CPU does not accelerate the cloud XQL execution engines, which run in the cloud rather than on the local Broker VM.

Answer

Export all raw logs to a local spreadsheet application for filtering.

Answer

Increase the Broker VM CPU allocation to accelerate cloud XQL execution engines.

Question 3

An administrator is setting up Cloud Data Collectors in Cortex XDR to ingest logs from Microsoft Entra ID (Azure AD). Which TWO prerequisites must be verified during troubleshooting if ingestion fails? (Choose two)

Accepted Answer

Ensure the corresponding API permissions and administrative consent are granted in the cloud provider portal.. Option A is correct because ingesting Microsoft Entra ID (Azure AD) logs through a Cloud Data Collector requires an app registration in the cloud provider portal with the appropriate API permissions (for example, Microsoft Graph/Office 365 Management APIs) and tenant-wide admin consent granted, otherwise the collector cannot authenticate and pull audit/sign-in logs. Option E is correct because the Cloud Data Collector must be able to reach the cloud API endpoint (for example, graph.microsoft.com and the Office 365 Management API endpoints over TCP 443); if outbound network access, proxy, or firewall rules block these endpoints, ingestion fails even with correct permissions. Option B is wrong because Cortex XDR Agents are endpoint agents for Windows/macOS/Linux hosts, not something installed on Microsoft Entra ID tenant servers, and Entra ID is a cloud service. Option C is wrong because AD DS LDAP port 389 is irrelevant to cloud-to-cloud Entra ID log ingestion via a Cloud Data Collector. Option D is wrong because a local Broker VM with a syslog listener is used for on-premises/syslog-based log collection, not for API-based Microsoft Entra ID ingestion through a Cloud Data Collector.

Answer

Install the Cortex XDR Agent on the Microsoft Entra ID cloud tenant servers.

Answer

Verify that Active Directory Domain Services (AD DS) LDAP port 389 is open to all endpoints.

Answer

Ensure a local Broker VM is configured with a syslog listener port for Azure AD logs.

Question 4

An administrator is configuring log forwarding from a Cortex XDR Broker VM to an external SIEM and encounters connection timeouts. Which THREE troubleshooting actions should the administrator take? (Choose three)

Accepted Answer

Check if the SIEM requires mutual TLS (mTLS) authentication and ensure valid client certificates are configured on the Broker VM.. Option A is correct because connection timeouts during log forwarding can result from the SIEM requiring mutual TLS (mTLS), where the Broker VM must present a valid client certificate; verifying and configuring the correct client certificate on the Broker VM resolves handshake failures that manifest as timeouts. Option B is correct because examining the Broker VM export logs reveals queue backups or explicit delivery error responses from the SIEM receiver, which directly indicate whether logs are being buffered due to unreachable or rejecting endpoints. Option C is correct because verifying the destination SIEM listener IP address and port are reachable from the Broker VM using tools like nc or telnet confirms basic network connectivity and isolates firewall, routing, or listener-binding issues causing the timeouts. Option D is not relevant because restarting the Cortex XDR management console web server does not address Broker VM-to-SIEM network or authentication problems. Option E is not appropriate because reinstalling the Windows operating system on the SIEM receiver is a drastic, unrelated action that does not troubleshoot the forwarding connection.

Answer

Restart the Cortex XDR management console web server.

Answer

Reinstall the Windows operating system on the SIEM receiver.

Question 5

An administrator notices that Cortex XDR content updates are failing to apply to endpoints in a secured network segment. Which TWO potential causes should the administrator investigate? (Choose two)

Accepted Answer

Firewall rules blocking outbound HTTPS traffic to Content CDN distribution domains.. Option B is correct because Cortex XDR agents retrieve content updates from Palo Alto Networks Content CDN distribution domains over outbound HTTPS (TCP 443), so firewall rules blocking that traffic will prevent updates from being applied to endpoints in the secured segment. Option D is correct because in environments where endpoints reach the internet through a proxy, the agent must authenticate to the proxy to download content packages; proxy authentication failures therefore directly cause content update failures. Option A is not correct because Broker VM database corruption affects Broker VM functions such as local agent communication and content caching, not the fundamental CDN download path described here. Option C is not correct because insufficient space in the /boot partition does not block Cortex XDR content downloads; content is stored in the agent's content directories, not /boot. Option E is not correct because resolving Active Directory domain controllers is unrelated to downloading Cortex XDR content updates from the Content CDN.

Answer

Broker VM database corruption.

Answer

Lack of available disk space in the /boot partition of the endpoint.

Answer

Failure of the local endpoint DNS server to resolve Active Directory domain controllers.

Question 6

An administrator is troubleshooting an issue where certain PowerShell scripts executed via Cortex XDR Remote Actions fail with exit code errors. Which THREE factors should the administrator check? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check rule status to ensure the rule is enabled and assigned to the correct scope or endpoint group.. Troubleshooting correlation rules involves validating query logic, reviewing time windows, and checking matching criteria.

Answer

Restart all endpoint agents associated with the correlation rule.

Answer

Reboot the Broker VM log collector service.

Question 7

An administrator wants to configure email notifications whenever a critical severity incident is detected by Cortex XDR. Where is this notification setting configured?

Accepted Answer

Settings > Configurations > Notifications (or Incident Notifications). Incident notification settings, including email integrations and webhook alerts, are configured under Settings > Configurations > Integrations > Email or Notifications.

Answer

Dashboards > Alert Rules

Answer

Endpoints > Policy > Alerts

Answer

XQL Search > Alert Action

Question 8

An administrator is reviewing endpoint isolation troubleshooting steps. Which TWO behaviors occur on a Windows endpoint when it is isolated via Cortex XDR? (Choose two)

Accepted Answer

All network traffic is blocked except for communication with the Cortex XDR management console and designated exceptions.. Option C is correct because Cortex XDR network isolation works by blocking all inbound and outbound network traffic on the endpoint while still permitting the agent's communication with the Cortex XDR management console (and any configured isolation exceptions), so the endpoint remains reachable for management. Option E is correct because isolation is designed to contain a threat without losing control: the administrator can still manage the endpoint and execute remote response actions (such as live terminal, file retrieval, or additional response scripts) from the Cortex XDR console. Option A is incorrect because isolation does not disable the local agent's prevention modules; endpoint protection continues to run and enforce policy. Option B is incorrect because isolation does not power off or shut down the endpoint after any timeout. Option D is incorrect because isolation does not disable local user login or blank the physical screen; the user can still log in locally, only network connectivity is restricted.

Answer

All local agent prevention modules are automatically disabled.

Answer

The endpoint automatically shuts down after 10 minutes of isolation.

Answer

Local user login is completely disabled and the physical screen turns black.

Question 9

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

Accepted Answer

Create exceptions for known benign alerts to prevent them from inflating incident priority scores.. Incident severity and scoring can be tuned via scoring rules, alert severity mappings, and exception configurations.

Answer

Reinstall the Cortex XDR Agent on all high-priority servers.

Answer

Modify the Broker VM packet buffer size.

Question 10

A Cortex XDR administrator needs to verify that the Broker VM is receiving and forwarding endpoint telemetry to the Cortex XDR management console. The Broker VM appears online in the console, but no new endpoint logs have appeared for several hours. Which Broker VM component should the administrator check first to confirm that log ingestion is functioning?

Accepted Answer

The Broker VM Log Collector service. When a Broker VM is online but endpoint logs stop arriving, the first component to verify is the Log Collector service, which is responsible for receiving and forwarding endpoint telemetry. Other broker services handle different data types or unrelated functions, so they would not explain the absence of Cortex XDR agent logs.

Answer

The Broker VM Syslog Collector service

Answer

The Cortex XDR agent content update scheduler

Answer

The Cortex XDR management console database replication status

Question 11

A Cortex XDR administrator is investigating an incident where a PowerShell script executed on multiple endpoints, but the Cortex XDR agent did not generate any alerts. The administrator confirms the script is malicious and should have been detected by the Behavioral Threat protection module. Which action should the administrator take first to troubleshoot the missing alerts?

Accepted Answer

Verify that the Behavioral Threat protection module is enabled in the agent policy.. Behavioral Threat protection must be enabled in the agent policy to detect malicious script behavior. If disabled, no alerts will be generated regardless of script activity. Verifying the policy setting is the quickest way to identify why alerts are missing, before investigating other potential causes like connectivity or allow lists.

Answer

Review the endpoint's local agent logs for script execution events.

Answer

Ensure the script's hash is not in the allow list.

Answer

Check the Cortex XDR management console for agent connectivity issues.

Question 12

A security operations team has deployed Cortex XDR agents to a large fleet of Linux servers. After a kernel upgrade on several servers, the agents stop reporting and the endpoints show as disconnected in the console. The administrator confirms the servers are reachable and the agent processes are running. Which action should the administrator take to restore agent functionality?

Accepted Answer

Rebuild the agent's kernel module against the new kernel version. On Linux, the Cortex XDR agent depends on a kernel module that must match the running kernel. A kernel upgrade can render the existing module unloadable, causing agents to stop reporting even though their processes run. Rebuilding the module against the new kernel headers restores the agent's kernel-level functionality and connectivity.

Answer

Restart the Cortex XDR management console service

Answer

Disable the agent's kernel-level protection and rely on user-mode monitoring

Answer

Reinstall the Cortex XDR agent using the original installation package

Question 13

A Cortex XDR administrator is investigating an incident and needs to confirm whether a specific endpoint has an active agent that is reporting to the console. The administrator has the endpoint's hostname. Which Cortex XDR console area should be used to quickly locate the endpoint and view its agent status?

Accepted Answer

The Endpoints page under the Inventory section. The Endpoints page under Inventory is the central place to search for a managed endpoint by hostname and view its agent status, including last seen time and operational state. Other console areas focus on incidents, policy configuration, or audit events, none of which directly provide endpoint agent connectivity status.

Answer

The Incidents page under the Detection section

Answer

The Policy Management page under the Configuration section

Answer

The Audit Log page under the Settings section

Question 14

A Cortex XDR administrator is investigating why a specific endpoint is not receiving updated policy settings from the management console. The endpoint shows as connected in the console, and the agent version is up to date. The administrator suspects a communication issue between the agent and the console. Which log should they review first to diagnose the problem?

Accepted Answer

The connectivity log (e.g., C:\ProgramData\PaloAltoNetworks\Cortex XDR\Logs\Connectivity.log).. When an endpoint is not receiving policy updates despite being connected, the connectivity log on the endpoint is the most direct source of information. It records the agent's communication with the management console, including any errors or failed requests. Reviewing this log first can quickly identify issues such as network blocks, authentication failures, or server unavailability.

Answer

The Windows Event Log under Applications and Services Logs > Cortex XDR.

Answer

The Broker VM's log on the management server.

Answer

The agent's operational log (e.g., C:\ProgramData\PaloAltoNetworks\Cortex XDR\Logs\Agent.log).

Question 15

A Cortex XDR administrator is troubleshooting why a custom BIOC rule that was expected to trigger on specific process behavior is not generating alerts. The rule is enabled and assigned to the relevant endpoint policy. Which two actions should the administrator take to diagnose the issue? (Choose two.)

Accepted Answer

Verify that the BIOC rule's condition syntax and field names match the actual event schema. When a BIOC rule does not trigger, the most common causes are incorrect condition syntax or field names and a mismatch between the rule and the agent's content or policy. Verifying the rule's logic against the event schema and confirming that the agent has the correct content and policy assignment are the two essential diagnostic steps.

Answer

Restart the Cortex XDR management console to force rule recompilation

Answer

Change the rule's severity to Critical to ensure it generates an incident

Answer

Disable all other BIOC rules to isolate the non-triggering rule