Certified XDR Engineer (XDR-Engineer) (XDR-Engineer) — Questions 151–225

An enterprise plans to deploy Cortex XDR agents to servers that run resource-intensive, mission-critical database applications. During the installation planning phase, which configuration step should the administrator take to minimize potential performance impact?

When planning the deployment of Cortex XDR preventive capabilities, which mode should an administrator initially use to evaluate security posture without risking business disruption?

An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?

When configuring advanced data forwarding filters in Cortex XDR, which TWO criteria parameters can an administrator use to precisely target specific log types or endpoints? (Choose two)

An administrator is investigating an incident and notices that data from a specific cloud data source integrated via Cortex XDR Cloud Data Collector is delayed by several hours. Where should the administrator check first to diagnose the ingestion delay?

During a large-scale Cortex XDR agent deployment using a Software Distribution Tool, administrators notice that multiple endpoints show identical agent IDs (UUIDs) in the Cortex XDR management console, causing telemetry to overwrite. What caused this issue?

An endpoint user reports that a legitimate internal application is being blocked by Cortex XDR Exploit Protection. The administrator wants to create an exception without completely disabling the module. Which mechanism should the administrator use in the Cortex XDR console?

An administrator has configured a new AWS CloudTrail integration via Broker VM to ingest cloud logs into Cortex XDR. However, no logs are appearing in the XDR database. Upon reviewing the Broker VM logs, the administrator notices an 'AccessDenied' error from AWS. What is the most likely root cause?

An administrator is configuring a Broker VM instance in the Cortex XDR console. After deploying the OVA template in the hypervisor, what is the mandatory next step required to link the Broker VM to the Cortex XDR cloud tenant?

When testing a newly configured API integration instance in Cortex XSOAR, what is the standard action used to verify connectivity and authentication credentials?

An administrator needs to troubleshoot an AWS S3 bucket integration via Broker VM where logs are failing to ingest. Which TWO diagnostic steps should be taken? (Choose two)

An administrator is managing custom IOC (Indicator of Compromise) feeds in Cortex XDR. Which THREE file formats or ingestion methods are supported when importing custom IOC indicators? (Choose three)

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

An administrator has deployed a Broker VM and enabled the Active Directory (AD) collector to ingest user and group mapping data. The connection test fails with a 'Kerberos Authentication Failed' error. What is the most likely cause of this failure?

When configuring a custom Malware Protection profile, an administrator wants to enable prevention for greyware (Potentially Unwanted Applications - PUA). What action does the Cortex XDR agent take when a PUA is detected and the profile action is set to 'Block'?

An enterprise security team wants to ingest NetFlow records from core routers into Cortex XDR. Which component and collector combination supports NetFlow/IPFIX ingestion?

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

An administrator notices that Cortex XDR content updates are failing to apply to endpoints in a secured network segment. Which TWO potential causes should the administrator investigate? (Choose two)

An administrator wants to configure local log retention settings and verify the ingestion rate of raw endpoint telemetry within Cortex XDR. Where can the administrator monitor platform license consumption and data ingestion metrics?

An administrator is deploying the Cortex XDR agent on a virtual desktop infrastructure (VDI) non-persistent pool. Which configuration consideration is critical to ensure proper management and prevent duplicate endpoint entries in the Cortex XDR console?

What is the primary function of an Agent Settings profile in Cortex XDR?

An administrator deployed a new Cortex XDR agent profile, but a specific subset of endpoints in the finance department is failing to receive the policy updates. What is the most likely troubleshooting step on the endpoint?

An administrator is deploying the Cortex XDR agent in a Linux environment and encounters dependency issues during the RPM installation. Specifically, the system reports missing kernel headers. What is the impact on Cortex XDR functionality if kernel headers or required kernel development packages are missing?

An administrator is configuring data forwarding filters in Cortex XDR to send specific severity alerts to a SIEM. The requirement is to forward all 'High' and 'Critical' severity alerts while excluding 'Low' and 'Medium' alerts. Where is this filter configured?

Where should an administrator navigate in the Cortex XDR management console to create and manage security profiles such as Malware Protection and Exploit Protection?

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

Where in the Cortex XDR web interface can an administrator generate API keys (API Key and Incident ID / Key) required for external integrations and scripts to authenticate with the Cortex XDR API?

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Where in the Cortex XDR management console can an administrator review the connection status, agent version, and operating system of all registered endpoints?

An automation engineer is building a Cortex XSOAR playbook that is triggered by a Cortex XDR incident. The playbook needs to fetch all associated endpoint artifacts using the Cortex XDR integration. Which parameter is required in the command execution to ensure all relevant forensics files are retrieved?

Where within the Cortex XDR console should an administrator configure scheduled reporting to automatically email executive summaries to stakeholders on a weekly basis?

Which TWO actions can an administrator perform from the Endpoint Management view in the Cortex XDR management console? (Choose two)

Which type of profile in Cortex XDR controls the collection of endpoint telemetry used for threat hunting and forensic analysis?

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

An analyst is investigating an alert generated by Analytics where a user account executed an unusual command. The analyst wants to view all other actions performed by that same user across any endpoint during a 24-hour window. Which query technique in XQL best fulfills this requirement?

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

An organization requires that Cortex XDR agent installation packages be deployed silently without displaying any user interface or rebooting the workstation. Which command-line arguments should be used with a Windows MSI installer package?

An administrator configured a new Agent Settings profile in Cortex XDR, but endpoints in the 'Finance' folder are not applying the new tamper protection password. What is the most likely reason for this behavior?

An administrator has deployed a Broker VM to act as a syslog collector and agent installer. During the configuration of the Broker VM in the Cortex XDR console, the status remains 'Disconnected'. What is the most likely cause of this issue?

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Endpoint Configuration Manager (SCCM). Which command-line switch should be included with the MSI installer to perform a silent installation without user interaction?

An administrator is troubleshooting a Cortex XDR script execution failure via Remote Actions. Which condition must be met on a Windows endpoint for a PowerShell remediation script to run successfully?

An administrator is designing a custom Alert-based BIOC rule in Cortex XDR. The requirement is to trigger an alert only when three distinct failed login events occur within a 5-minute window from the same source IP address. How should the aggregation and time window be configured?

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

An administrator needs to write a custom automation script in Cortex XSOAR to query the Cortex XDR API for all endpoints that have not checked in within the last 7 days. Which API endpoint and filtering mechanism should the script use?

An administrator needs to troubleshoot an endpoint where the Cortex XDR agent has been tampered with or corrupted. Which TWO actions can the administrator take to repair or reinstall the agent safely? (Choose two)

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

An endpoint has been isolated via the Cortex XDR management console to contain a suspected active breach. Once the threat is remediated, how does the administrator restore network connectivity to the endpoint?

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

An analyst is troubleshooting a complex multi-stage attack in Cortex XDR. Which THREE analytical tools or views in the console help reconstruct the sequence of events across endpoints? (Choose three)

An administrator needs to upgrade a large fleet of Linux endpoints running the Cortex XDR agent. What is the recommended best practice for performing this upgrade via the Cortex XDR management console?

What is the function of an Exploit Protection profile in Cortex XDR?

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

An administrator is planning network connectivity for a Broker VM that needs to forward logs to an external SIEM while also communicating with Cortex XDR. Which network configuration requirement must be met?

When setting up automated alert response actions using Cortex XDR built-in response actions or XSOAR integrations, which THREE actions can be automatically initiated directly against an endpoint agent? (Choose three)

An administrator notices that several macOS endpoints have incomplete Cortex XDR agent functionality because required operating system permissions were not granted during installation. Which component or setting must be configured to resolve this?

An administrator is troubleshooting an API rate-limiting error (HTTP 429 Too Many Requests) occurring in a custom Cortex XSOAR automation playbook that queries an external threat intel API. How should the integration or playbook be modified to handle this gracefully?

An administrator is troubleshooting a Broker VM that is failing to pull updates from the Cortex XDR cloud. Upon inspecting the Broker VM system logs, the administrator notices SSL handshake errors. What is the most likely root cause?

An administrator is configuring a Syslog Collector agent on Cortex XDR to ingest logs from a third-party firewall. Which log collection protocol and transport layer combination is natively supported by the Cortex XDR Collector for receiving unencrypted syslog messages?

An administrator is troubleshooting a Broker VM that cannot ingest CEF logs from a third-party SIEM. Which service status command should the administrator run inside the Broker VM shell to verify that the syslog collector service is running?

During a troubleshooting session, an administrator needs to collect all Cortex XDR agent troubleshooting logs into a single compressed archive directly from the Windows endpoint command line. Which cytool command should be executed?

An organization utilizes custom correlation rules in Cortex XDR. An engineer needs to export these custom BIOC rules to backup configurations or migrate them to another Cortex XDR tenant. Which administrative feature supports this?

Which TWO criteria can be used to dynamically group endpoints and assign agent profiles in Cortex XDR? (Choose two)

An administrator is planning the deployment of Cortex XDR agents across endpoints and needs to configure Agent Settings profiles. Which TWO configurations can be managed directly within an Agent Settings profile? (Choose two)

Where can an administrator view the status and health of all deployed Broker VMs directly within the Cortex XDR management console?

Which TWO of the following capabilities are provided by Cortex XDR Behavioral Threat Analytics (Analytics BIOCs)? (Choose two)

An administrator needs to upgrade the Cortex XDR agents across all enterprise endpoints. Where should the administrator upload and manage the new agent software versions before rolling them out?

An administrator is planning an automated deployment of Cortex XDR agents using an enterprise software distribution tool. Which TWO advantages does using an MSI package offer over an EXE package in this scenario? (Choose two)

An administrator is configuring a new integration in Cortex XSOAR and needs to ensure secure credential handling. Which TWO practices are recommended when managing API keys and secrets? (Choose two)

An administrator is configuring automated incident enrichment in Cortex XDR. Whenever a new malware incident is generated, the system should automatically query VirusTotal using an integration. Where should this automated workflow be built and attached?

A Cortex XDR Agent on a macOS endpoint is failing to start its kernel extension (Endpoint Security extension). Which diagnostic command should be run locally in the macOS Terminal to verify system extension approval status?

An administrator needs to temporarily disable the Cortex XDR agent on a Windows endpoint to troubleshoot a conflicting third-party application. Which method should be used?

Which TWO actions can an administrator take if a Cortex XDR agent fails to register with the cloud management console after installation? (Choose two)

An organization is preparing to deploy the Cortex XDR agent using Microsoft Active Directory Group Policy Objects (GPO). Which installation package format is natively supported for GPO deployment of the agent on Windows endpoints?