Ingestion And Automation

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

An administrator is setting up automated alert ingestion from a third-party SIEM into Cortex XSOAR. Which TWO integration methods or components are typically used to achieve this? (Choose two)

An administrator needs to ingest CEF (Common Event Format) logs from a third-party security device using the Broker VM. Which collector type must be enabled on the Broker VM configuration page in Cortex XDR?

An administrator is configuring a new Syslog data collector in Cortex XDR to ingest logs from a third-party firewall. The logs are arriving at the Cortex XDR Collector, but they are not appearing in the Query Builder. Which step should the administrator perform to resolve this issue?

Which menu path in the Cortex XDR management console should an administrator navigate to view the overall health, status, and log forwarding statistics of deployed Broker VMs?

Which TWO tasks can an automation playbook in Cortex XDR / XSOAR execute automatically upon detecting a confirmed threat? (Choose two)

An administrator is configuring the Cortex XDR API integration for automated incident management and data ingestion. Which TWO actions must be performed in the Cortex XDR management console to properly set up API access? (Choose two)

An administrator needs to ingest Office 365 audit logs into Cortex XDR. Which integration method is officially supported and recommended by Palo Alto Networks for this data source?

A security analyst needs to ingest custom JSON-formatted security logs from an in-house application into Cortex XDR. Where should the administrator define the custom log mapping to ensure fields are parsed correctly under the generic log profile schema?

An automation playbook in Cortex XSOAR requires parsing a raw email message payload received in an incident. Which built-in automation command or integration should the playbook use to extract indicators of compromise (IOCs) such as URLs, IPs, and file hashes from the email body?

Which role is required within Cortex XDR for a user to configure API keys, data integration settings, and automation playbooks?

An automation playbook in Cortex XSOAR needs to execute a custom Python script that interacts with an internal legacy database not covered by existing Marketplace integrations. Which component should the administrator use to securely run this custom script?

What is the primary function of the Cortex XDR 'Content Pack' in Marketplace?

Which TWO of the following data sources can be natively onboarded and collected using a Cortex XDR Broker VM? (Choose two)

Which TWO authentication methods are commonly supported when configuring API integrations in Cortex XSOAR? (Choose two)

Where in the Cortex XDR management console can an administrator review the status and health of all connected data collectors, such as Broker VMs and agent collectors?

An administrator is designing an automated incident response playbook in Cortex XSOAR. Which TWO core concepts are essential for passing data between playbook tasks? (Choose two)

When setting up data forwarding from Cortex XDR to a third-party SIEM using the Cortex XDR Data Forwarder, which protocol is commonly used to stream the logs?

When configuring an integration instance in Cortex XSOAR (or Cortex XDR Automation) for a third-party threat intelligence feed, what is the primary purpose of the instance name?

An organization requires that logs ingested via the Cortex XDR Syslog Collector be secured using TLS encryption (Syslog-over-TLS). What must the administrator configure on the Broker VM to support this requirement?

An organization is onboarding a new cloud environment into Cortex XDR. Which THREE mechanisms or components can be utilized to ingest cloud audit logs and telemetry data into Cortex XDR? (Choose three)

An administrator is troubleshooting a Cortex XDR syslog integration where logs from a high-throughput network device are being dropped or delayed. The Broker VM resource utilization for CPU and memory is normal. Which underlying collector configuration setting should be adjusted to handle the high burst rate?

Which TWO actions can be performed directly within the Cortex XDR Data Integration management interface? (Choose two)

An XDR administrator needs to forward Cortex XDR alerts to an external SIEM. Which integration mechanism should be configured in the Cortex XDR management console under Data Collection?

An administrator is writing a custom Python automation script within a Cortex XSOAR integration. Which TWO standard practices should be followed to ensure proper execution and error handling within the platform? (Choose two)

An administrator wants to create a BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR that triggers an alert whenever a PowerShell script attempts to download and execute a payload from an external IP address. Which data source must be enabled and properly ingested for this rule to function effectively?

When configuring the Cortex XDR API to ingest custom threat intelligence feeds, which authentication header and format must be used for the HTTP POST request to ensure successful ingestion?

An enterprise environment uses a forward proxy for all outbound internet traffic. The Broker VM deployed in the internal network cannot reach external cloud APIs for threat intelligence enrichment. How should the administrator configure the Broker VM to route traffic through the forward proxy?

What is the primary purpose of using a Broker VM in a Cortex XDR deployment architecture?

An organization requires high availability and load balancing for their Broker VM log ingestion tier. Which TWO architectural considerations or configurations support this requirement? (Choose two)

An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?

When configuring advanced data forwarding filters in Cortex XDR, which TWO criteria parameters can an administrator use to precisely target specific log types or endpoints? (Choose two)

An administrator has configured a new AWS CloudTrail integration via Broker VM to ingest cloud logs into Cortex XDR. However, no logs are appearing in the XDR database. Upon reviewing the Broker VM logs, the administrator notices an 'AccessDenied' error from AWS. What is the most likely root cause?

When testing a newly configured API integration instance in Cortex XSOAR, what is the standard action used to verify connectivity and authentication credentials?

An administrator needs to troubleshoot an AWS S3 bucket integration via Broker VM where logs are failing to ingest. Which TWO diagnostic steps should be taken? (Choose two)

An administrator has deployed a Broker VM and enabled the Active Directory (AD) collector to ingest user and group mapping data. The connection test fails with a 'Kerberos Authentication Failed' error. What is the most likely cause of this failure?

An enterprise security team wants to ingest NetFlow records from core routers into Cortex XDR. Which component and collector combination supports NetFlow/IPFIX ingestion?

An administrator is configuring data forwarding filters in Cortex XDR to send specific severity alerts to a SIEM. The requirement is to forward all 'High' and 'Critical' severity alerts while excluding 'Low' and 'Medium' alerts. Where is this filter configured?

Where in the Cortex XDR web interface can an administrator generate API keys (API Key and Incident ID / Key) required for external integrations and scripts to authenticate with the Cortex XDR API?

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

An automation engineer is building a Cortex XSOAR playbook that is triggered by a Cortex XDR incident. The playbook needs to fetch all associated endpoint artifacts using the Cortex XDR integration. Which parameter is required in the command execution to ensure all relevant forensics files are retrieved?

An administrator has deployed a Broker VM to act as a syslog collector and agent installer. During the configuration of the Broker VM in the Cortex XDR console, the status remains 'Disconnected'. What is the most likely cause of this issue?

An administrator needs to write a custom automation script in Cortex XSOAR to query the Cortex XDR API for all endpoints that have not checked in within the last 7 days. Which API endpoint and filtering mechanism should the script use?

When setting up automated alert response actions using Cortex XDR built-in response actions or XSOAR integrations, which THREE actions can be automatically initiated directly against an endpoint agent? (Choose three)

An administrator is troubleshooting an API rate-limiting error (HTTP 429 Too Many Requests) occurring in a custom Cortex XSOAR automation playbook that queries an external threat intel API. How should the integration or playbook be modified to handle this gracefully?

An administrator is configuring a Syslog Collector agent on Cortex XDR to ingest logs from a third-party firewall. Which log collection protocol and transport layer combination is natively supported by the Cortex XDR Collector for receiving unencrypted syslog messages?

An administrator is configuring a new integration in Cortex XSOAR and needs to ensure secure credential handling. Which TWO practices are recommended when managing API keys and secrets? (Choose two)

An administrator is configuring automated incident enrichment in Cortex XDR. Whenever a new malware incident is generated, the system should automatically query VirusTotal using an integration. Where should this automated workflow be built and attached?