XDR-Engineer Multiple Select — 60 Questions

Question 1

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

Accepted Answer

Operating system type (Windows, macOS, Linux). Option C is correct because Cortex XDR endpoint groups can be defined by operating system type (Windows, macOS, Linux), which is a standard grouping criterion used to target platform-specific policies and prevention profiles. Option E is correct because Cortex XDR supports grouping endpoints by IP address subnets or network ranges, allowing administrators to apply location- or network-based policies to endpoints in specific segments. Options A, B, and D are not valid grouping criteria in Cortex XDR: printer driver versions, desktop wallpaper resolution settings, and monitor serial numbers are not endpoint attributes the console uses for policy-assignment grouping.

Answer

Installed printer driver versions

Answer

Local user desktop wallpaper resolution settings

Answer

Physical serial number of the endpoint monitor

Question 2

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

Accepted Answer

Create exceptions for known benign alerts to prevent them from inflating incident priority scores.. Incident severity and scoring can be tuned via scoring rules, alert severity mappings, and exception configurations.

Answer

Reinstall the Cortex XDR Agent on all high-priority servers.

Answer

Modify the Broker VM packet buffer size.

Question 3

Which THREE factors should an administrator consider when planning a large-scale Cortex XDR agent deployment across enterprise endpoints? (Choose three)

Accepted Answer

Potential conflicts with legacy security software that should be uninstalled prior to deployment. Option B is correct because legacy or third-party security software (e.g., older antivirus, HIPS, or EDR agents) can conflict with the Cortex XDR agent's kernel-level drivers and network filtering, causing installation failures, performance degradation, or unprotected endpoints, so it should be identified and removed before rollout. Option D is correct because agents must reach the Cortex XDR management backend or a Broker VM over outbound TCP 443 (HTTPS), and large deployments require bandwidth planning plus firewall/proxy allow-listing of the relevant FQDNs to avoid registration and telemetry failures. Option E is correct because choosing a deployment mechanism that matches each OS ecosystem — GPO or SCCM for Windows, MDM (e.g., Intune, JAMF) for macOS, and appropriate tooling for Linux — ensures scalable, consistent installation and upgrade across heterogeneous enterprise endpoints. Option A is not appropriate because the Cortex XDR agent is an endpoint security agent, not a DNS server, and making it authoritative for a subnet would break name resolution. Option C is incorrect because granting permanent domain administrator rights to local users is a severe security violation and is not required for agent operation, which runs under the SYSTEM/service account context.

Answer

Configuring the agent to act as a primary DNS server for the local subnet

Answer

Ensuring local endpoint users have full domain administrator rights permanently

Question 4

A Cortex XDR engineer is planning the installation of the Broker VM in a demilitarized zone (DMZ) to collect logs from internet-facing servers. Which TWO configurations are required to ensure the Broker VM can securely communicate with the Cortex XDR cloud and internal log sources? (Choose two.)

Accepted Answer

Allow the Broker VM to communicate with internal log sources over the required protocols and ports.. The Broker VM in a DMZ requires outbound HTTPS access to the Cortex XDR cloud for management and updates, and it must be able to receive logs from internal sources. These two configurations ensure secure communication without exposing the Broker VM to inbound internet traffic. Inbound access from the internet or the cloud is not needed and would increase the attack surface.

Answer

Configure the Broker VM to use a static public IP address for cloud communication.

Answer

Configure inbound access from the internet to the Broker VM on TCP 443 for log ingestion.

Answer

Enable inbound access from the Cortex XDR cloud to the Broker VM on TCP 443 for management.

Question 5

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Accepted Answer

Cortex XSOAR Server Audit and Server logs (/var/log/demisto/server.log). Option D is correct because Cortex XSOAR Server Audit and Server logs, including /var/log/demisto/server.log, record API activity, automation execution, and integration errors, which are essential for diagnosing a failing Cortex XDR API query or automation script. Option E is correct because integration debug logs, viewed via Docker container logs for the specific integration instance, show the actual HTTP requests, responses, and errors exchanged with the Cortex XDR API, directly revealing the root cause. Option A is not relevant because Windows Event Viewer Security logs on unmanaged workstations do not capture Cortex XDR API or automation activity. Option B is not relevant because BIOS firmware event logs relate to hardware/firmware events, not API or script failures. Option C is not relevant because Cortex XDR Agent installation MSI error logs only cover agent installation issues, not API query or automation script failures.

Answer

Windows Event Viewer Security log on unmanaged workstations

Answer

Local BIOS firmware event logs

Answer

Cortex XDR Agent installation MSI error logs

Question 6

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

Accepted Answer

The underlying XQL query string that defines the detection logic.. Option C is correct because a scheduled XQL rule fundamentally requires the XQL query string itself, which defines the detection logic that runs against the Cortex XDR dataset to identify matching events. Option D is correct because the rule must map the query results to alert attributes—severity, alert name, and description—so that generated alerts are meaningful and actionable in the incident view. Option E is correct because a scheduled rule must specify the schedule frequency (how often the query executes) and the time range of data evaluated per run, which together control detection cadence and coverage. Options A and B are incorrect because physical memory allocation on a Broker VM for syslog collection and kernel bypass configuration for Windows endpoints are unrelated to defining a scheduled XQL alert rule; they concern infrastructure sizing and endpoint agent/network settings, not XQL rule parameters.

Answer

The physical memory allocation limit on the Broker VM handling syslog collection.

Answer

The kernel bypass configuration parameters for Windows endpoints.

Question 7

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

Accepted Answer

Run 'top' or 'htop' via SSH on the Broker VM to identify which specific processes are consuming excessive memory.. Option B is correct because running 'top' or 'htop' over SSH on the Broker VM provides real-time per-process memory (RES/%MEM) visibility, letting the administrator pinpoint which service (e.g., broker, collector, or forwarding process) is driving high utilization. Option C is correct because the Cortex XDR console's Settings > Configurations > Broker VM page surfaces built-in system health metrics (CPU, memory, disk, and service status), giving an authoritative, supported view of Broker VM resource consumption without needing to guess. Option D is correct because collector logs under /var/log/pan/ record ingestion activity and errors, so reviewing them can reveal event loops, repeated retries, or memory leaks that spike during high event ingestion. Option A is not appropriate because recompiling the Linux kernel on a vendor-supplied Broker VM appliance is unsupported and would not address application-level memory consumption. Option E is not appropriate because changing the disk partition table with fdisk is unrelated to memory utilization and risks corrupting the appliance's storage layout.

Answer

Recompile the Linux kernel on the Broker VM appliance to optimize memory paging.

Answer

Change the Broker VM disk partition table using fdisk.

Question 8

A security operations team wants Cortex XDR to push high-severity alerts into their existing ticketing platform automatically, without an analyst manually exporting each incident. Which TWO built-in integration capabilities allow Cortex XDR to deliver alerts to an external system? (Choose two.)

Accepted Answer

Enabling a Cortex XDR API key and calling the public REST endpoints to poll incidents on a schedule.. Automated external delivery in Cortex XDR is achieved through supported integration surfaces: forwarding alerts to an external destination and using the authenticated public REST API to retrieve incidents programmatically. Both are documented, secure, and designed for machine consumption. Console scraping, agent database sharing, and mailbox parsing are unsupported and insecure, so they fail the requirement.

Answer

Publishing the XDR console URL with embedded credentials so the ticketing tool can scrape the incident table.

Answer

Relying on the built-in email notification for every alert and letting the ticketing platform parse the mailbox.

Answer

Exporting the local agent database and mounting it on the ticketing server as a shared volume.

Question 9

An administrator is writing a custom Python automation script within a Cortex XSOAR integration. Which TWO standard practices should be followed to ensure proper execution and error handling within the platform? (Choose two)

Accepted Answer

Return results using structured 'CommandResults' objects containing standard outputs and human-readable text. Option B is correct because Cortex XSOAR integrations should return structured CommandResults objects, which carry the standard context outputs (readable by playbooks) and the human-readable entry text shown in the War Room, ensuring downstream automation can consume the data reliably. Option C is correct because integration code must catch exceptions and report failures through return_error(), which produces a proper error entry in the War Room instead of letting the script crash and lose the failure context. The unmarked options are inappropriate: A writes to hypervisor kernel memory (impossible and unsafe from a containerized integration), D uses CPU-spinning infinite loops that would hang the integration worker, and E leaks credentials into public logs, violating security best practices.

Answer

Write raw binary data directly to the host hypervisor kernel memory space

Answer

Execute infinite `while` loops without sleep intervals to maximize CPU usage

Answer

Print debug passwords in plain text to public stdout logs

Question 10

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

Accepted Answer

TCP port 443 for cloud tenant and agent communication. Option A is correct because the Cortex XDR Broker VM uses TCP 443 to communicate outbound with the Cortex XDR cloud tenant and to receive agent traffic, which is the standard secure HTTPS channel for registration, policy, and telemetry. Option B is correct because the Broker VM's syslog ingestion component listens on UDP/TCP 514 by default (and can be set to custom ports) to collect syslog from firewalls, proxies, and other log sources. Option C is wrong because Telnet on TCP 23 is an insecure legacy management protocol and is not used for Broker VM syslog or agent communication. Option D is wrong because TFTP on UDP 69 is a trivial file-transfer protocol, not an agent staging or communication mechanism for the Broker VM. Option E is wrong because RDP on TCP 3389 is a Windows remote-desktop service, not a log-streaming or agent-communication channel for the Broker VM.

Answer

TCP port 23 for Telnet remote management

Answer

UDP port 69 for Trivial File Transfer Protocol (TFTP) agent staging

Answer

TCP port 3389 for Remote Desktop Protocol (RDP) log streaming

Question 11

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

Accepted Answer

Agent software version. Option A (Agent software version) is correct because the Endpoint Management module in Cortex XDR displays the installed agent version for each enrolled endpoint, allowing analysts to verify whether agents are up to date and identify version drift across the fleet. Option C (Last seen timestamp) is correct because the console shows when each agent last communicated with the Cortex XDR management server, which is essential for spotting offline or unresponsive endpoints. The unmarked options do not belong: hard drive manufacturing serial numbers (B), BIOS cryptographic signature keys (D), and local administrator password hashes (E) are not status fields exposed in the Endpoint Management agent inventory, and password hashes in particular would never be surfaced in a management console for security reasons.

Answer

Hard drive manufacturing serial number

Answer

BIOS cryptographic signature key

Answer

Local administrator password hash

Question 12

A Cortex XDR engineer is configuring the alert notification path so that high-severity incidents reach the on-call SOC analyst quickly. The team wants notifications delivered to an external collaboration platform and also wants an automated action to run when the alert fires. Which TWO Cortex XDR capabilities should the engineer configure to meet these requirements? (Choose two.)

Accepted Answer

Create a script or playbook action and bind it to the alert through a playbook that triggers on the matching alert condition.. External notification integrations attached to alert notification rules handle delivery to collaboration platforms, while playbooks bound to alert conditions provide automated action execution. Together they cover both the notification and the automated response requirements without altering detection coverage or endpoint scan settings.

Answer

Raise the alert severity threshold in the BIOC so that only critical alerts are generated for the on-call team.

Answer

Increase the endpoint agent heartbeat interval so alerts are reported to the management console more frequently.

Answer

Enable the built-in malware signature pack and schedule a daily scan on all endpoints in the policy.

Question 13

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which TWO locations or methods should the administrator check to diagnose the root cause of the failure? (Choose two)

Accepted Answer

Windows Installer verbose installation logs generated with logging parameters (/L*v). Installation issues can be diagnosed using Windows Installer verbose logs and Event Viewer system/application logs.

Answer

The local BIOS/UEFI secure boot configuration summary file

Answer

The Cisco ISE policy enforcement cache database

Answer

The global Panorama traffic log buffer

Question 14

An administrator wants to ensure high availability and load balancing for log collection and agent proxying using Broker VMs. Which TWO best practices should be considered during the planning phase? (Choose two)

Accepted Answer

Ensure all Broker VMs are synchronized with accurate NTP time sources. Deploying multiple Broker VMs behind a load balancer and sizing them appropriately ensures high availability and scalability.

Answer

Assign identical MAC addresses to all Broker VM instances to simplify switch ARP tables

Answer

Configure all agents to connect to a single static Broker VM IP address without failover options

Answer

Run Broker VMs exclusively on physical bare-metal hardware without virtualization hypervisors

Question 15

A security engineer is planning the installation of Cortex XDR agents on a large number of endpoints across different operating systems. The engineer must ensure that the agents can be deployed silently and that they automatically register with the correct Cortex XDR tenant. Which TWO installation considerations are essential for a successful mass deployment? (Choose two.)

Accepted Answer

Ensure that the installation is performed with administrative privileges on each endpoint.. The two essential considerations are including the tenant ID or registration token and ensuring administrative privileges. The tenant ID ensures proper registration, and admin rights are needed for installation. Other factors like disabling security software, static IPs, or pre-installing content are not required and could introduce issues.

Answer

Configure the agent to use a static IP address for communication with the Cortex XDR cloud.

Answer

Disable all other security software on the endpoints before installation.

Answer

Pre-install the Cortex XDR content update package on each endpoint to reduce initial cloud traffic.

Question 16

A Cortex XDR administrator is troubleshooting why a custom BIOC rule that was expected to trigger on specific process behavior is not generating alerts. The rule is enabled and assigned to the relevant endpoint policy. Which two actions should the administrator take to diagnose the issue? (Choose two.)

Accepted Answer

Verify that the BIOC rule's condition syntax and field names match the actual event schema. When a BIOC rule does not trigger, the most common causes are incorrect condition syntax or field names and a mismatch between the rule and the agent's content or policy. Verifying the rule's logic against the event schema and confirming that the agent has the correct content and policy assignment are the two essential diagnostic steps.

Answer

Restart the Cortex XDR management console to force rule recompilation

Answer

Change the rule's severity to Critical to ensure it generates an incident

Answer

Disable all other BIOC rules to isolate the non-triggering rule

Question 17

An administrator is configuring a Cortex XDR automation rule to trigger a playbook when a new alert matches specific conditions. The playbook must run only for alerts with a severity of High or Critical and only for alerts originating from the 'Malware' alert category. Which TWO configuration elements must be set in the automation rule to enforce these conditions? (Choose two.)

Accepted Answer

Alert category filter set to Malware. To enforce severity and category conditions in a Cortex XDR automation rule, the rule must include a severity filter set to High and Critical and an alert category filter set to Malware. These two filters determine which alerts trigger the playbook. Timeout, exclusion lists, and endpoint groups do not control alert selection based on severity or category.

Answer

Playbook timeout set to 300 seconds

Answer

Endpoint group scoped to the 'Malware' group

Answer

Exclusion list containing all Medium and Low severity alerts

Question 18

An administrator is troubleshooting why a Cortex XDR Agent is failing to communicate with the cloud management console. Which TWO network or configuration checks should the administrator perform? (Choose two)

Accepted Answer

Check local proxy configurations and ensure the agent profile has correct proxy credentials defined if required.. Option C is correct because Cortex XDR agents often sit behind corporate proxies, so the administrator must confirm the endpoint's local proxy settings and ensure the agent profile contains valid proxy credentials (username/password or certificate) if the proxy requires authentication; otherwise the agent cannot reach the cloud. Option D is correct because the agent communicates with the Cortex XDR management console over outbound TCP 443 to the tenant-specific URL (e.g., .xdr..paloaltonetworks.com), so any firewall, security gateway, or SSL-inspection device blocking that traffic will break communication. Option A is wrong because the Broker VM does not require SSH access to endpoints; it is used for local agent communication and log collection, not remote shell management. Option B is wrong because UDP 514 is syslog, not a Cortex XDR agent communication channel, and the agent does not listen on it for cloud connectivity. Option E is wrong because inbound TCP 22 (SSH) is not needed for the agent to reach the cloud console and is unrelated to agent-cloud communication.

Answer

Check that the Broker VM has direct SSH access to the endpoint.

Answer

Verify that UDP port 514 is listening locally on the endpoint.

Answer

Verify that inbound TCP port 22 is open on the endpoint for remote management.

Question 19

Which TWO criteria can be used to dynamically group endpoints and assign agent profiles in Cortex XDR? (Choose two)

Accepted Answer

Operating system type (e.g., Windows, macOS, Linux). Option B is correct because Cortex XDR dynamic endpoint groups can filter endpoints by operating system type (Windows, macOS, Linux), allowing an agent profile to be assigned automatically to all endpoints running a given OS. Option C is correct because hostname or naming-convention patterns (for example, matching a prefix like 'SRV-' or a regex) are supported dynamic filter criteria used to group endpoints and bind them to an agent profile. Option A is not a supported grouping criterion, as Cortex XDR does not use physical desk location numbers for dynamic endpoint grouping. Option D is nonsensical and not a valid attribute; BIOS serial numbers are not used as a color-based grouping criterion. Option E is irrelevant, since local account password expiration dates are not endpoint attributes exposed for dynamic grouping or agent profile assignment.

Answer

Physical office desk location number

Answer

BIOS manufacturer serial number color

Answer

Local user account password expiration date

Question 20

An administrator is managing custom IOC (Indicator of Compromise) feeds in Cortex XDR. Which THREE file formats or ingestion methods are supported when importing custom IOC indicators? (Choose three)

Accepted Answer

CSV file upload. In Cortex XDR, custom IOC indicators can be imported by uploading a CSV file (option B), which is the standard manual bulk-import format using columns such as indicator type, value, and severity. Cortex XDR also supports consuming external threat intelligence through a TAXII threat feed integration (option C), allowing automated polling of STIX/TAXII 1.x or 2.x servers for indicators. Additionally, indicators can be programmatically ingested via the Cortex XDR REST API (option D), enabling automated pipelines to push IOCs into the IOC store. Option A is incorrect because Cortex XDR does not compile or ingest C++ source code as an IOC format, and option E is incorrect because a Windows Registry Hive backup is a system artifact, not a supported IOC ingestion format or method.

Answer

Compiled C++ source code (.cpp)

Answer

Windows Registry Hive backup (.hiv)