XDR-Engineer Practice Questions

Question 1

An automation playbook in Cortex XSOAR needs to execute a custom Python script that interacts with an internal legacy database not covered by existing Marketplace integrations. Which component should the administrator use to securely run this custom script?

Accepted Answer

A custom Python Integration running inside an isolated Docker container managed by the engine/server. Custom scripts and integrations in Cortex XSOAR execute within a Docker container environment managed by integration containers or custom Python scripts.

Answer

A local Windows batch script executed by the Cortex XDR endpoint agent

Answer

Direct execution via SSH on the Cortex XDR multi-tenant cloud backend

Answer

A direct SQL query string passed unencrypted through the Syslog collector port

Question 2

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Accepted Answer

Cortex XSOAR Server Audit and Server logs (/var/log/demisto/server.log). Troubleshooting API and automation issues involves reviewing the Cortex XSOAR integration debug logs and the Audit Trail / Server logs.

Answer

Windows Event Viewer Security log on unmanaged workstations

Answer

Local BIOS firmware event logs

Answer

Cortex XDR Agent installation MSI error logs

Question 3

An endpoint user reports that a legitimate internal application is being blocked by Cortex XDR Exploit Protection. The administrator wants to create an exception without completely disabling the module. Which mechanism should the administrator use in the Cortex XDR console?

Accepted Answer

Add a profile exception under Settings > Configurations > Agent Configurations specifying the exploit module and application path.. BIOC (Behavioral Indicator of Compromise) and Exploit Protection exceptions can be managed via Exception profiles or profile exclusions in Cortex XDR.

Answer

Disable behavioral threat protection globally.

Answer

Create a correlation rule to suppress alerts from that path.

Answer

Modify the Broker VM ingestion filter.

Question 4

An enterprise environment uses a proxy server for all outbound internet traffic. How must the administrator configure the Cortex XDR Agent to ensure it can successfully connect through the proxy to the Cortex XDR cloud?

Accepted Answer

Configure the proxy address, port, and authentication credentials within the Agent Configuration profile under Settings.. Proxy settings for the Cortex XDR agent are configured within the Agent Configuration profile in the Cortex XDR management console before installation or pushed via update.

Answer

Configure the proxy settings inside the Traps.properties file locally on each endpoint.

Answer

Modify the Windows Registry key 'ProxyServer' manually on every endpoint without console involvement.

Answer

Configure the proxy settings on the Broker VM only.

Question 5

An administrator is troubleshooting an issue where custom Correlation Rules in Cortex XDR are not generating expected incidents. Which THREE diagnostic steps should the administrator perform? (Choose three)

Accepted Answer

Check rule status to ensure the rule is enabled and assigned to the correct scope or endpoint group.. Troubleshooting correlation rules involves validating query logic, reviewing time windows, and checking matching criteria.

Answer

Restart all endpoint agents associated with the correlation rule.

Answer

Reboot the Broker VM log collector service.

Question 6

An automation playbook in Cortex XSOAR requires parsing a raw email message payload received in an incident. Which built-in automation command or integration should the playbook use to extract indicators of compromise (IOCs) such as URLs, IPs, and file hashes from the email body?

Accepted Answer

Run the 'ExtractIOCs' parsing command on the email body field. ExtractIOCs is a core Cortex XSOAR parsing command used to extract indicators from unstructured text like emails.

Answer

Forward the raw email to the Cortex XDR Agent collector service

Answer

Trigger the 'Device-Control-Block' command against the email sender

Answer

Execute a raw regex match script via PowerShell on a Broker VM worker

Question 7

What is the primary function of the Cortex XDR 'Content Pack' in Marketplace?

Accepted Answer

To provide pre-packaged integrations, playbooks, dashboards, and automation building blocks. Content packs in Marketplace package pre-built integrations, playbooks, dashboards, and incident types.

Answer

To install local antivirus signatures directly onto endpoint file systems

Answer

To store encrypted backups of Cortex XDR database records

Answer

To compile raw C++ source code for custom endpoint isolation drivers

Question 8

An administrator is configuring automated incident enrichment in Cortex XDR. Whenever a new malware incident is generated, the system should automatically query VirusTotal using an integration. Where should this automated workflow be built and attached?

Accepted Answer

As an automated Playbook attached to Incident Trigger rules in the Automation module. Automated workflows triggered by incident creation are built as Playbooks in Cortex XSOAR / XDR Automation and attached to Incident Classification or Trigger rules.

Answer

Inside the Cortex XDR Agent installation policy settings

Answer

Inside the Broker VM local crontab configuration file

Answer

As a local cron job running on each individual endpoint

Question 9

An enterprise environment uses a forward proxy for all outbound internet traffic. The Broker VM deployed in the internal network cannot reach external cloud APIs for threat intelligence enrichment. How should the administrator configure the Broker VM to route traffic through the forward proxy?

Accepted Answer

Configure the proxy settings using the Broker VM configuration menu or environment variables (HTTP_PROXY / HTTPS_PROXY). Broker VM proxy settings are configured during or after deployment via the Broker VM CLI or configuration menu to set HTTP_PROXY/HTTPS_PROXY environment variables.

Answer

Deploy a secondary Broker VM in the DMZ to act as an internal DNS forwarder

Answer

Modify the Windows Registry on the Broker VM host machine

Answer

Write a custom automation playbook in Cortex XSOAR to tunnel packets through ICMP

Question 10

Which TWO actions can be performed directly within the Cortex XDR Data Integration management interface? (Choose two)

Accepted Answer

Define custom log parsing and mapping rules. Data Integration interface allows configuring Broker VMs and defining custom log mappings.

Answer

Provision physical server rack enclosures

Answer

Configure corporate Wi-Fi guest portal splash pages

Answer

Flash BIOS firmware on enterprise routers

Question 11

An organization requires high availability and load balancing for their Broker VM log ingestion tier. Which TWO architectural considerations or configurations support this requirement? (Choose two)

Accepted Answer

Deploying multiple Broker VMs behind an external Layer 4 load balancer for syslog/network log ingestion. High availability for Broker VMs involves deploying multiple Broker VMs behind a load balancer and configuring collectors across instances.

Answer

Sharing a single static IP address across independent uncoordinated cloud regions without routing

Answer

Running multiple active database instances on the same Broker VM container kernel

Answer

Disabling all network encryption to speed up packet forwarding

Question 12

An administrator needs to ingest Office 365 audit logs into Cortex XDR. Which integration method is officially supported and recommended by Palo Alto Networks for this data source?

Accepted Answer

Office 365 Management Activity API integration. Office 365 logs are ingested using the Office 365 Management Activity API integration via Broker VM or cloud-to-cloud integration.

Answer

Local WMI polling from a Windows domain controller

Answer

SNMP trap listener configured on the endpoint agent

Answer

Syslog forwarding from Microsoft Outlook client applications

Question 13

An XDR administrator needs to forward Cortex XDR alerts to an external SIEM. Which integration mechanism should be configured in the Cortex XDR management console under Data Collection?

Accepted Answer

Cortex XDR Streaming API. Cortex XDR provides direct integration with external SIEMs using the Syslog or HTTPS streaming feature available in the Data Collection configuration menu, allowing seamless alert forwarding.

Answer

Endpoint Tagging Policy

Answer

Local Agent Settings Profile

Answer

Hash Exception Rule

Question 14

An administrator is configuring a new integration in Cortex XSOAR and needs to ensure secure credential handling. Which TWO practices are recommended when managing API keys and secrets? (Choose two)

Accepted Answer

Store API keys using the integration parameter type 'Encrypted' / 'Password'. API keys and secrets should be stored securely using integration parameters configured as password/credential types and managed securely.

Answer

Hardcode the API keys directly into the playbook Python script source code

Answer

Publish the API keys in plain text within the incident description field for team visibility

Answer

Share integration credentials across all tenants via public GitHub repositories

Question 15

An administrator is troubleshooting an issue where Cortex XDR Broker VM cannot forward logs from a syslog source. Which CLI command on the Broker VM can the administrator use to verify active syslog listening ports and network connectivity status?

Accepted Answer

netstat -tulnp. The netstat command is used across Linux environments (including the Broker VM OS) to verify listening ports and active network connections.

Answer

pan_broker_status --syslog

Answer

traceroute -syslog

Answer

systemctl check-syslog

Certified XDR Engineer (XDR-Engineer) XDR-Engineer practice test

Three ways to study

Study XDR-Engineer by domain

Study XDR-Engineer by topic

Maintenance And Troubleshooting practice questions

Cortex XDR Agent Configuration practice questions

Detection And Reporting practice questions

Ingestion And Automation practice questions

Planning And Installation practice questions

XDR-Engineer fundamentals practice questions

XDR-Engineer scenario practice questions

XDR-Engineer troubleshooting practice questions

Certified XDR Engineer (XDR-Engineer) practice questions