XDR-Engineer Multiple Select — 60 Questions

Question 1

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Accepted Answer

Cortex XSOAR Server Audit and Server logs (/var/log/demisto/server.log). Troubleshooting API and automation issues involves reviewing the Cortex XSOAR integration debug logs and the Audit Trail / Server logs.

Answer

Windows Event Viewer Security log on unmanaged workstations

Answer

Local BIOS firmware event logs

Answer

Cortex XDR Agent installation MSI error logs

Question 2

An administrator is troubleshooting an issue where custom Correlation Rules in Cortex XDR are not generating expected incidents. Which THREE diagnostic steps should the administrator perform? (Choose three)

Accepted Answer

Check rule status to ensure the rule is enabled and assigned to the correct scope or endpoint group.. Troubleshooting correlation rules involves validating query logic, reviewing time windows, and checking matching criteria.

Answer

Restart all endpoint agents associated with the correlation rule.

Answer

Reboot the Broker VM log collector service.

Question 3

Which TWO actions can be performed directly within the Cortex XDR Data Integration management interface? (Choose two)

Accepted Answer

Define custom log parsing and mapping rules. Data Integration interface allows configuring Broker VMs and defining custom log mappings.

Answer

Provision physical server rack enclosures

Answer

Configure corporate Wi-Fi guest portal splash pages

Answer

Flash BIOS firmware on enterprise routers

Question 4

An organization requires high availability and load balancing for their Broker VM log ingestion tier. Which TWO architectural considerations or configurations support this requirement? (Choose two)

Accepted Answer

Deploying multiple Broker VMs behind an external Layer 4 load balancer for syslog/network log ingestion. High availability for Broker VMs involves deploying multiple Broker VMs behind a load balancer and configuring collectors across instances.

Answer

Sharing a single static IP address across independent uncoordinated cloud regions without routing

Answer

Running multiple active database instances on the same Broker VM container kernel

Answer

Disabling all network encryption to speed up packet forwarding

Question 5

An administrator is configuring a new integration in Cortex XSOAR and needs to ensure secure credential handling. Which TWO practices are recommended when managing API keys and secrets? (Choose two)

Accepted Answer

Store API keys using the integration parameter type 'Encrypted' / 'Password'. API keys and secrets should be stored securely using integration parameters configured as password/credential types and managed securely.

Answer

Hardcode the API keys directly into the playbook Python script source code

Answer

Publish the API keys in plain text within the incident description field for team visibility

Answer

Share integration credentials across all tenants via public GitHub repositories

Question 6

An administrator is designing an automated incident response playbook in Cortex XSOAR. Which TWO core concepts are essential for passing data between playbook tasks? (Choose two)

Accepted Answer

Incident Context (Context Data) to store and retrieve structured key-value data. Playbooks use Incident Context (The War Room / Context Data) and task outputs/arguments to pass data between tasks.

Answer

Static global environment variables hardcoded in the server kernel

Answer

Direct memory pointer references in C++ syntax

Answer

Manual USB flash drive transfer between server nodes

Question 7

An administrator is configuring log forwarding from a Cortex XDR Broker VM to an external SIEM and encounters connection timeouts. Which THREE troubleshooting actions should the administrator take? (Choose three)

Accepted Answer

Check if the SIEM requires mutual TLS (mTLS) authentication and ensure valid client certificates are configured on the Broker VM.. SIEM forwarding troubleshooting involves verifying network connectivity, TLS/certificate parameters, and destination port accessibility.

Answer

Restart the Cortex XDR management console web server.

Answer

Reinstall the Windows operating system on the SIEM receiver.

Question 8

An administrator is reviewing endpoint isolation troubleshooting steps. Which TWO behaviors occur on a Windows endpoint when it is isolated via Cortex XDR? (Choose two)

Accepted Answer

All network traffic is blocked except for communication with the Cortex XDR management console and designated exceptions.. Network isolation blocks all inbound and outbound network traffic except for communication with the Cortex XDR management console.

Answer

All local agent prevention modules are automatically disabled.

Answer

The endpoint automatically shuts down after 10 minutes of isolation.

Answer

Local user login is completely disabled and the physical screen turns black.

Question 9

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

Accepted Answer

Run 'top' or 'htop' via SSH on the Broker VM to identify which specific processes are consuming excessive memory.. Broker VM troubleshooting involves checking system resource consumption, container/service status, and collector log outputs.

Answer

Recompile the Linux kernel on the Broker VM appliance to optimize memory paging.

Answer

Change the Broker VM disk partition table using fdisk.

Question 10

An administrator notices that Cortex XDR content updates are failing to apply to endpoints in a secured network segment. Which TWO potential causes should the administrator investigate? (Choose two)

Accepted Answer

Firewall rules blocking outbound HTTPS traffic to Content CDN distribution domains.. Content update failures on isolated endpoints usually stem from firewall blocking content distribution URLs or proxy issues.

Answer

Broker VM database corruption.

Answer

Lack of available disk space in the /boot partition of the endpoint.

Answer

Failure of the local endpoint DNS server to resolve Active Directory domain controllers.

Question 11

An administrator is troubleshooting why a Cortex XDR Agent is failing to communicate with the cloud management console. Which TWO network or configuration checks should the administrator perform? (Choose two)

Accepted Answer

Check local proxy configurations and ensure the agent profile has correct proxy credentials defined if required.. Agent connectivity troubleshooting requires checking outbound HTTPS reachability to the tenant and verifying valid agent proxy or DNS resolution settings.

Answer

Check that the Broker VM has direct SSH access to the endpoint.

Answer

Verify that UDP port 514 is listening locally on the endpoint.

Answer

Verify that inbound TCP port 22 is open on the endpoint for remote management.

Question 12

An administrator is setting up Cloud Data Collectors in Cortex XDR to ingest logs from Microsoft Entra ID (Azure AD). Which TWO prerequisites must be verified during troubleshooting if ingestion fails? (Choose two)

Accepted Answer

Ensure the corresponding API permissions and administrative consent are granted in the cloud provider portal.. Cloud Data Collectors connecting to external APIs require correct tenant permissions, API keys, or service principal credentials.

Answer

Install the Cortex XDR Agent on the Microsoft Entra ID cloud tenant servers.

Answer

Verify that Active Directory Domain Services (AD DS) LDAP port 389 is open to all endpoints.

Answer

Ensure a local Broker VM is configured with a syslog listener port for Azure AD logs.

Question 13

When planning agent deployment strategies across different operating systems, which TWO package formats are utilized for macOS and Linux endpoints respectively? (Choose two)

Accepted Answer

PKG format for macOS endpoints. macOS uses PKG installer packages, while Linux distributions typically use RPM or DEB packages.

Answer

MSI format for Linux endpoints

Answer

EXE format for macOS endpoints

Answer

DMG format for headless Linux servers

Question 14

An administrator is reviewing XQL search performance issues and query timeouts when investigating historical logs. Which THREE methods can the administrator use to optimize query performance? (Choose three)

Accepted Answer

Apply explicit dataset filters and equality checks early in the query pipeline before performing complex aggregations.. Optimizing XQL queries involves narrowing time ranges, filtering early, and utilizing indexed fields.

Answer

Export all raw logs to a local spreadsheet application for filtering.

Answer

Increase the Broker VM CPU allocation to accelerate cloud XQL execution engines.

Question 15

An administrator is planning a Cortex XDR deployment across an enterprise network. Which TWO prerequisites must be verified regarding network connectivity and name resolution for successful agent deployment and operation? (Choose two)

Accepted Answer

DNS resolution capable of resolving the Cortex XDR tenant domain name. Agents require outbound HTTPS (TCP 443) connectivity and valid DNS resolution to connect to the Cortex XDR cloud tenant.

Answer

Inbound TCP port 8080 access from the cloud tenant to every individual endpoint

Answer

Bidirectional UDP port 514 syslog peering across all local subnets

Answer

Active Directory LDAP bind access configured directly on the agent CLI

Question 16

An administrator is configuring a Broker VM in Cortex XDR to act as a log collector for third-party security devices. Which TWO log ingestion formats are natively supported by the Cortex XDR Broker VM Log Collector? (Choose two)

Accepted Answer

Syslog (UDP and TCP). The Broker VM Log Collector module natively supports ingestion protocols such as Syslog (UDP/TCP) and HTTP/HTTPS APIs.

Answer

Apple Filing Protocol (AFP) file streaming

Answer

NetBIOS Datagram Service (UDP port 138)

Answer

Direct raw disk imaging via NFS v3

Question 17

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

Accepted Answer

Operating system type (Windows, macOS, Linux). Endpoints can be grouped based on operating system, naming conventions, IP subnets, or domain membership.

Answer

Installed printer driver versions

Answer

Local user desktop wallpaper resolution settings

Answer

Physical serial number of the endpoint monitor

Question 18

An administrator is preparing to uninstall the Cortex XDR agent from a protected Windows endpoint for troubleshooting purposes. Which THREE methods or tools can be used to successfully remove the agent? (Choose three)

Accepted Answer

Using the Windows 'Add or Remove Programs' interface provided the uninstallation password is supplied.. Cortex XDR agent uninstallation is strictly controlled. It can be performed using the Uninstallation Password via Windows Apps, via the cytool utility with the proper password, or by sending an uninstall command from the Cortex XDR management console.

Answer

Deleting the Cortex XDR program files folder directly in Windows Explorer while the services are running.

Answer

Running the standard Windows Registry Editor to delete the primary endpoint MAC address key.

Question 19

An organization is deploying the Cortex XDR Broker VM on-premises to support log ingestion and agent proxying. Which THREE network and system prerequisites must be verified before deployment? (Choose three)

Accepted Answer

Static IP addressing or reserved DHCP lease for the Broker VM.. Deploying a Broker VM requires provisioning adequate virtual hardware resources, ensuring outbound connectivity to the cloud, and configuring proper network reachability for log sources.

Answer

Direct root SSH access enabled by default from external public IP addresses.

Answer

Local installation of a full Microsoft SQL Server database instance on the VM.

Question 20

An administrator is planning an automated deployment of Cortex XDR agents using an enterprise software distribution tool. Which TWO advantages does using an MSI package offer over an EXE package in this scenario? (Choose two)

Accepted Answer

Standardized installation parameters and property passing (e.g., /qn, /norestart). MSI packages offer standard command-line properties, easy integration with GPO/SCCM, and built-in support for transforms (MST).

Answer

Built-in capability to execute shell scripts on Linux servers

Answer

Automatic conversion of EXE payloads into macOS PKG files

Answer

Exemption from all Windows User Account Control (UAC) prompts without admin rights