XDR-Engineer Timed Practice Test 3 — 10 Questions

Question 1

An administrator is troubleshooting a scenario where Cortex XDR Agent data is not appearing in the management console. Firewall rules restrict outbound traffic. Which destination port and protocol must be opened outbound from the endpoints to the Cortex XDR management console for agent telemetry?

10 minute time limit — choose an answer to begin.

Accepted Answer

TCP port 443. Cortex XDR agents communicate outbound to the Cortex XDR tenant over TCP port 443 (HTTPS).

Answer

TCP port 389 and 636

Answer

TCP port 22 and 8080

Answer

UDP port 514

Question 2

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

Accepted Answer

Configure an isolation exception rule specifying the permitted IP address.. Cortex XDR allows administrators to configure isolation exception rules that specify IP addresses or hostnames permitted to communicate with an isolated endpoint. This is the supported mechanism to allow a remediation server or management IP to reach an isolated endpoint while keeping all other traffic blocked. The exception is configured in the isolation policy or as a standalone exception rule.

Answer

Add the IP address to the Data Collection profile under restricted hosts.

Answer

Create a firewall policy on the next-generation firewall to bypass XDR isolation.

Answer

Disable the agent service via Live Terminal using the 'net stop' command.

Question 3

An administrator configured a new Agent Settings profile in Cortex XDR, but endpoints in the 'Finance' folder are not applying the new tamper protection password. What is the most likely reason for this behavior?

Accepted Answer

The Agent Settings profile priority for the Finance folder is set lower than a conflicting child assignment or inheritance is broken.. Cortex XDR applies Agent Settings profiles based on folder hierarchy and assignment priority. If the Finance folder has a lower-priority profile than a conflicting child assignment, or if inheritance from the parent is broken, the tamper protection password from the new profile will not be applied. Profile precedence and folder inheritance are the most common reasons a configuration appears not to take effect on a subset of endpoints.

Answer

Tamper protection passwords can only be configured globally and cannot be overridden by profile.

Answer

Tamper protection configuration changes require a manual service restart on every agent.

Answer

Agents require a full endpoint reboot before downloading any configuration changes.

Question 4

An administrator has deployed a Broker VM to act as a syslog collector and agent installer. During the configuration of the Broker VM in the Cortex XDR console, the status remains 'Disconnected'. What is the most likely cause of this issue?

Accepted Answer

Outbound connectivity on TCP port 443 from the Broker VM to the Cortex XDR tenant is blocked.. The Broker VM communicates with the Cortex XDR tenant over outbound TCP 443 to register and maintain its connection. If outbound 443 is blocked by a firewall or proxy, the Broker VM cannot reach the tenant and will show as 'Disconnected' in the console. This is the most common cause of a Broker VM failing to connect after deployment.

Answer

The Cortex XDR agent license count has been exceeded on the tenant.

Answer

The Broker VM requires an active inbound SSH session from the administrator's workstation.

Answer

Syslog UDP port 514 is closed on the internal firewall.

Question 5

A security operations team wants Cortex XDR to push high-severity alerts into their existing ticketing platform automatically, without an analyst manually exporting each incident. Which TWO built-in integration capabilities allow Cortex XDR to deliver alerts to an external system? (Choose two.)

Accepted Answer

Enabling a Cortex XDR API key and calling the public REST endpoints to poll incidents on a schedule.. Automated external delivery in Cortex XDR is achieved through supported integration surfaces: forwarding alerts to an external destination and using the authenticated public REST API to retrieve incidents programmatically. Both are documented, secure, and designed for machine consumption. Console scraping, agent database sharing, and mailbox parsing are unsupported and insecure, so they fail the requirement.

Answer

Publishing the XDR console URL with embedded credentials so the ticketing tool can scrape the incident table.

Answer

Relying on the built-in email notification for every alert and letting the ticketing platform parse the mailbox.

Answer

Exporting the local agent database and mounting it on the ticketing server as a shared volume.

Question 6

An administrator wants to run an ad-hoc query to investigate failed logon attempts across all endpoints over the last 24 hours. Which tool in Cortex XDR should the administrator use?

Accepted Answer

XQL Search. XQL Search is the native query tool in Cortex XDR used to search and analyze collected endpoint and network datasets.

Answer

BIOC Generator

Answer

Correlation Rules Builder

Answer

Query Builder for Syslog

Question 7

What is the primary purpose of using a Broker VM in a Cortex XDR deployment architecture?

Accepted Answer

To act as a local log collector, aggregator, and agent proxy for data sources that cannot directly connect to the Cortex XDR cloud. Broker VMs act as intermediary collectors and forwarders for logs, threat intel, and cloud integrations in environments where direct cloud access is restricted.

Answer

To host the core Cortex XDR multi-tenant cloud database

Answer

To run local endpoint antivirus scans on unmanaged guest laptops

Answer

To replace all physical firewalls and routers within the corporate perimeter

Question 8

An administrator is writing a custom Python automation script within a Cortex XSOAR integration. Which TWO standard practices should be followed to ensure proper execution and error handling within the platform? (Choose two)

Accepted Answer

Return results using structured 'CommandResults' objects containing standard outputs and human-readable text. Option B is correct because Cortex XSOAR integrations should return structured CommandResults objects, which carry the standard context outputs (readable by playbooks) and the human-readable entry text shown in the War Room, ensuring downstream automation can consume the data reliably. Option C is correct because integration code must catch exceptions and report failures through return_error(), which produces a proper error entry in the War Room instead of letting the script crash and lose the failure context. The unmarked options are inappropriate: A writes to hypervisor kernel memory (impossible and unsafe from a containerized integration), D uses CPU-spinning infinite loops that would hang the integration worker, and E leaks credentials into public logs, violating security best practices.

Answer

Write raw binary data directly to the host hypervisor kernel memory space

Answer

Execute infinite `while` loops without sleep intervals to maximize CPU usage

Answer

Print debug passwords in plain text to public stdout logs

Question 9

An administrator needs to deploy the Cortex XDR agent across a multi-tenant environment using a single management console. How should the administrator structure the deployment to isolate endpoint data between different business units?

Accepted Answer

Create distinct agent installation packages with embedded registration tokens tied to specific Cortex XDR folders and assign RBAC scopes. Cortex XDR supports multi-tenancy through child tenants or by using endpoint groups and granular role-based access control (RBAC).

Answer

Modify the Windows Registry on each endpoint to point to separate cloud regions

Answer

Deploy multiple Broker VMs on the same subnet and assign static VLAN tags

Answer

Install multiple instances of the Cortex XDR agent side-by-side on each endpoint

Question 10

A Cortex XDR engineer is configuring a Broker VM to collect logs from a third-party EDR solution that writes to a local folder on the Broker VM as JSON files. The engineer needs Cortex XDR to parse these files and map the fields into the XDR data model. Which component should the engineer configure on the Broker VM to achieve this?

Accepted Answer

File Collector. The File Collector on a Broker VM is specifically built to ingest logs from files on the local filesystem, including JSON, and to apply parsing rules that map fields into the Cortex XDR schema. It is the only listed component that can read files and forward their contents to Cortex XDR for analysis.

Answer

Syslog Collector

Answer

Windows Event Collector

Answer

Network Mapper