20+ practice questions focused on Ingestion And Automation — one of the most tested topics on the Certified XDR Engineer (XDR-Engineer) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Ingestion And Automation PracticeA security analyst needs to ingest custom JSON-formatted security logs from an in-house application into Cortex XDR. Where should the administrator define the custom log mapping to ensure fields are parsed correctly under the generic log profile schema?
Explanation: Custom log mapping for JSON logs is defined in the Cortex XDR console under Settings > Configurations > Data Integration > Custom Log Mapping. This allows administrators to map fields from the custom JSON to the generic log profile schema, ensuring proper parsing and normalization. This centralized configuration is the correct place to define such mappings.
An administrator needs to write a custom automation script in Cortex XSOAR to query the Cortex XDR API for all endpoints that have not checked in within the last 7 days. Which API endpoint and filtering mechanism should the script use?
Explanation: The correct API endpoint is GET /public_api/v1/endpoints/get_endpoint/ with a JSON filter specifying the last_seen timestamp condition. This endpoint retrieves endpoint details and supports filtering, allowing the script to query for endpoints not checked in within the last 7 days. Other endpoints are for different purposes and do not support this filtering.
An automation playbook in Cortex XSOAR requires parsing a raw email message payload received in an incident. Which built-in automation command or integration should the playbook use to extract indicators of compromise (IOCs) such as URLs, IPs, and file hashes from the email body?
Explanation: ExtractIOCs is a core Cortex XSOAR parsing command used to extract indicators from unstructured text like emails.
An administrator has configured a Cortex XDR data ingestion rule for a custom log source, but fields are appearing under the 'general_fields' object rather than their designated mapped schema columns. What is the most likely reason for this parsing failure?
Explanation: If custom fields do not map correctly, it is usually because the JSON key names or regex capture groups do not match the custom log mapping definition.
When configuring advanced data forwarding filters in Cortex XDR, which TWO criteria parameters can an administrator use to precisely target specific log types or endpoints? (Choose two)
Explanation: Option B is correct because Cortex XDR's advanced data forwarding filters let administrators select the log dataset type (for example xdr_data, endpoints, or network) so that only specific telemetry categories are forwarded to the destination. Option E is correct because alert severity levels (Low, Medium, High, Critical) are a supported filter criterion, allowing forwarding to be scoped to alerts of a given severity. Options A, C, and D are not valid filtering parameters in Cortex XDR; physical room numbers, security guard names, and cafeteria menus are unrelated to the data model and cannot be used to target log types or endpoints.
+15 more Ingestion And Automation questions available
Practice all Ingestion And Automation questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Ingestion And Automation. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Ingestion And Automation questions on the XDR-Engineer frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Ingestion And Automation is tested as part of the Certified XDR Engineer (XDR-Engineer) blueprint. Practicing with targeted Ingestion And Automation questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free XDR-Engineer practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Ingestion And Automation is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Ingestion And Automation practice session with instant scoring and detailed explanations.
Start Ingestion And Automation Practice →