Certified XDR Engineer (XDR-Engineer) (XDR-Engineer) — Questions 151–225

Microsoft Windows is an officially supported platform for Cortex XDR agent installation, covering supported workstation and server releases. It satisfies the stem's requirement for supported operating systems, since the agent ships native installers for Windows endpoints managed by the console.

Correct. Cortex XDR REST API endpoints authenticate using specific header keys and accept JSON payloads.

macOS Big Sur and later block kernel extensions, requiring system extensions and network filters to be approved. An MDM profile with the system extension and network filter payloads pre-approves them silently, delivering full agent functionality without per-endpoint user prompts.

The Broker VM sits inside the network boundary, receiving agent traffic and forwarding it to the Cortex XDR cloud over permitted channels. This satisfies the strict outbound filtering constraint, since agents never require direct internet access.

The SERVER parameter (or equivalent, such as SERVER_ADDR) is used during agent installation to specify the address of the Broker VM. This directs the agent to send its data to the Broker VM instead of directly to the Cortex XDR cloud. This is the standard method for integrating agents with a Broker VM in environments without direct internet access.

Agent-to-console traffic traverses the local network path, so an incorrect or unauthenticated proxy silently drops outbound requests. Verifying proxy settings and profile credentials restores the agent's connection to the Cortex XDR cloud management console, satisfying the stem's communication-failure constraint.

The Broker VM acts as a proxy for agent communications, threat intelligence updates, and local file analysis in isolated networks.

Webhook integration satisfies the requirement by POSTing JSON alert payloads to external HTTP endpoints, letting Cortex XDR push high-severity incident notifications into Slack, PagerDuty or XSOAR. Unlike email or syslog, this channel supports third-party automation platforms, enabling security personnel to receive and act on alerts through their existing tooling.

The Cortex XDR Agent is installed on endpoints and is responsible for collecting telemetry data such as process execution, network connections, and file operations. It sends this data to the Cortex XDR management console for analysis and detection. This directly fulfills the requirement to ingest endpoint telemetry from Windows endpoints.

Correlation Rules can be scoped to specific endpoint groups. If the rule is scoped to a group that does not contain the endpoints generating the activity, it will not trigger incidents even if the query returns results globally. The administrator should verify the rule's scope and ensure it includes all relevant endpoints. This is a common oversight when rules are created without adjusting the default scope.

Cortex XDR agents on Linux rely on a kernel module for deep visibility and protection. After a kernel upgrade, the existing module may not load because it was built for the previous kernel. Rebuilding the module against the new kernel headers restores compatibility. This directly addresses the incompatibility that caused the agents to stop reporting while processes still run.

The Broker VM needs outbound access to cloud APIs, but the forward proxy blocks direct egress. Setting HTTP_PROXY and HTTPS_PROXY environment variables, or the equivalent Broker VM configuration menu entries, directs its enrichment traffic through the proxy, satisfying the internal-network constraint.

The Incident View's export function generates CSV or JSON files containing the raw artefacts and event logs tied to that alert, giving the analyst a portable record for offline sharing without needing live console access or manual copying.

Endpoint isolation in Cortex XDR severs network communication to contain the threat while preserving the agent's management channel so responders can continue collecting evidence and running response actions. This directly satisfies both goals: stopping lateral spread and keeping the host available for investigation.

The exported PDF reconstructs the attack's progression, mapping each alert to its parent process and root cause. This causality chain satisfies the investigator's need to understand how the campaign unfolded across endpoints within the Incident View report.

Cortex XDR agent settings profiles allow administrators to specify proxy settings, including authentication credentials. By configuring the agent to use the system proxy and providing credentials, the agent can authenticate to the web proxy automatically. This enables seamless communication with the Cortex XDR cloud without manual intervention on each endpoint.

Alert exclusions let you suppress alerts that match precise conditions such as process name, signer, or command-line arguments, which eliminates the noisy legitimate activity. Because the exclusion is attribute-scoped, other executions of the same technique that do not match the benign pattern still generate alerts, maintaining coverage.

Accurate time synchronization (NTP) is critical for TLS validation, log timestamping, and cluster coordination.

Settings -> Configurations -> Roles holds Cortex XDR's RBAC role definitions, where permissions for incidents, XQL queries, firewall rules, agent settings and BIOC rules are scoped independently. Creating a tier-1 role here grants view and query rights while withholding modification rights, satisfying the least-privilege constraint.

Unisolation reverses the network containment applied to the endpoint. Selecting the endpoint in Endpoint Management and clicking 'Unisolate' lifts the isolation policy, restoring normal network communication once the alert is confirmed as a false positive.

`filter` is a core XQL stage that restricts result rows to those matching a boolean expression, satisfying the stem's requirement for data manipulation and shaping. It operates on already-ingested event fields, narrowing the dataset before later stages such as `fields` or `sort` process it.

Incident Rules map alert fields to actions, so a rule matching custom BIOC alerts can add the 'Tier-3-Investigation' label and route assignment to the escalation group automatically, satisfying both the tagging and assignment constraints in the stem.

Cortex XDR Agent Settings profiles include a Proxy Settings section where you can define the proxy server address, port, and credentials. Applying this profile to the Linux endpoints allows the agents to use the authenticated proxy for communication. This is the supported method for configuring proxy settings centrally.

The Cortex XDR management console provides a dedicated section for agent installation where administrators can download the agent package pre-configured with the tenant ID and other settings. This is the correct location to obtain the installation package for distribution. The package ensures that agents automatically register with the correct tenant upon installation.

The Enable Live Terminal toggle in the package creation wizard preconfigures the agent during installation so it accepts interactive remote shell sessions initiated from the Cortex XDR console. Because the administrator wants no post-install change, baking this into the package is the correct approach. It maps directly to the agent-side capability that allows the Live Terminal feature to function on the endpoint.

Cortex XDR supports allowlisting based on digital signatures. By adding the vendor's certificate to the allowlist, any executable signed with that certificate is automatically allowed to run, even if it triggers behavioral rules. This approach is secure and scalable, as it trusts the vendor's signing authority and covers future versions signed with the same certificate. It is the recommended method for trusted software.

The Log Collector service is the Broker VM component responsible for receiving endpoint logs and forwarding them to Cortex XDR. If it is stopped or misconfigured, the Broker VM can still appear online in the console while telemetry silently stops flowing. Checking this service directly addresses the symptom of missing endpoint logs.

The xdr_alerts dataset holds alert records with severity and timestamp fields, so an XQL query aggregating counts grouped by severity over 30 days feeds a time-series chart, which plots that trend visually. This matches the requirement for total alert counts by severity across time.

The File Collector on Broker VM is designed to read log files from a local directory, parse them according to configured parsers, and forward the data to Cortex XDR. It supports JSON, XML, and other formats, making it suitable for ingesting third-party EDR logs stored as JSON files. This is the correct component for file-based ingestion.

openssl s_client performs a TLS handshake against the specified host and port, confirming both network reachability and certificate negotiation with the SIEM listener. This isolates whether forwarding failures stem from connectivity, firewall rules or TLS mismatches.

Syslog forwarders transmit to the Broker VM over port 514, so the firewall must permit that inbound traffic from the internal forwarders. Without this rule the segregated zone's logs never reach the Broker VM, breaking collection; the prerequisite is therefore an inbound UDP/TCP 514 allowance.

Adding process path exclusions or qualifying criteria narrows the rule so legitimate deployment activity no longer matches, reducing false positives while preserving true detections. This tuning step satisfies the requirement to address excessive false positives during normal software deployments.

Custom scanning and monitoring path exclusions let the administrator omit the database files and directories from malware scans and behavioural monitoring, directly preventing the file locks and I/O contention that agent scanning would otherwise cause on critical database servers. This satisfies the stem's requirement to avoid performance interference during scans.

Scheduling upgrades within maintenance windows directly satisfies the requirement to minimise user disruption across the enterprise. Cortex XDR agent upgrades can trigger endpoint reboots and consume CPU during content updates, so confining deployment to approved low-usage periods prevents business-hours performance impact and avoids interrupting active investigations.

Cortex XDR provides separate agent installers for Windows, macOS and Linux because each platform uses different package formats and installation mechanisms. Generating and downloading the matching package per OS type is therefore required for successful deployment across the mixed environment.

The Broker VM sits between isolated or restricted data sources and the Cortex XDR cloud, collecting and aggregating logs locally and proxying agent traffic. This satisfies the constraint that some sources cannot directly connect to the cloud.

Multiple Broker VMs behind an external Layer 4 load balancer distribute syslog and network log ingestion across nodes, removing the single point of failure and providing horizontal scaling, which directly satisfies the high availability and load balancing requirement for the ingestion tier.

Custom Agent Settings profiles with exclusions stop the Cortex XDR agent from scanning database files and directories, reducing CPU, disk and memory contention. This directly minimises performance impact on resource-intensive, mission-critical database servers during installation.

Telemetry and Monitoring mode lets Cortex XDR collect endpoint data and generate alerts without blocking or terminating processes, so the administrator can assess detection coverage and false positives before enabling prevention, avoiding disruption to business operations.

If the Broker VM is handling more endpoints or data sources than its capacity, CPU usage can spike. The Broker VM has sizing guidelines based on the number of endpoints. Exceeding those guidelines leads to performance degradation. Checking the configuration and comparing to recommended limits is a key troubleshooting step.

Cortex XDR tenants are region-specific and store all data within the tenant's region. Deploying a tenant per region ensures endpoint telemetry and alerts remain in that region, satisfying data residency. Each tenant is managed independently, but that is the standard approach when strict regional isolation is required.

A Condition (or Decision) block evaluates the sandbox task's verdict output, branching the workflow only when the malicious hash is confirmed. This satisfies the stem's requirement for conditional isolation, since the endpoint-isolation action executes solely on a true verdict, preventing unnecessary containment when analysis returns clean or inconclusive results.

Cloning a golden image duplicates the agent's embedded UUID, so every cloned endpoint registers with the same identity and overwrites shared telemetry. Proper unregistration before imaging, or post-deployment re-registration, prevents this collision, satisfying the requirement for unique agent IDs.

Report Templates in Cortex XDR can embed dashboard widgets that are backed by XQL queries, and they support recurring schedules with email distribution. Grouping incident data by MITRE technique ID is achievable through the underlying query, so a weekly emailed summary of observed techniques fits this feature directly.

CloudTrail delivers logs to S3, so the Broker VM must read that bucket. An AccessDenied error confirms the supplied IAM identity lacks s3:GetObject or ListBucket permissions, blocking ingestion. Granting the required S3 read permissions to that role or user resolves the failure.

The Causality View visualizes the process tree and related events linked by causality IDs, allowing the engineer to pivot from the process that created the scheduled task to any network connections it spawned. This directly traces the relationship within the same chain.

The test-module command is the built-in integration health check. It executes the instance's configured test API call, validating that the server URL, API key, and authentication credentials are correct before the integration is used in playbooks.

S3 ingestion via Broker VM requires the IAM identity to read bucket contents. Missing s3:GetObject or s3:ListBucket causes access-denied failures, so confirming both actions are granted isolates permission problems from network or Broker VM faults.

CSV file upload is supported for custom IOC ingestion in Cortex XDR, satisfying the requirement to import indicators in bulk via a structured file. The comma-separated format maps columns to indicator fields such as type, value and severity, allowing the platform to parse and apply them directly to detection logic.

Scheduled Reports in the Reporting menu lets you define a recurring weekly schedule, select critical endpoint incidents as the data source, and deliver the output as a PDF by email — matching every constraint in the stem without manual export.

If the endpoint is not assigned to the correct policy, it will not receive the intended settings. Policy assignment is based on endpoint groups and rules. Checking the assignment is a logical first step because it is a common cause of policy not applying. The administrator should ensure the endpoint is in the right group and that the policy is applied to that group.

Kerberos tolerates only five minutes of clock skew between the Broker VM and the Domain Controller; beyond that, ticket validation fails and the AD collector cannot authenticate. Resynchronising the Broker VM's system clock via NTP resolves the 'Kerberos Authentication Failed' error.

With the profile action set to Block, the Cortex XDR agent quarantines the greyware file and terminates its running process, neutralising the PUA before it can execute further. This satisfies the requirement to enable prevention rather than mere detection.

The Broker VM HTTP Collector is designed to receive logs via HTTP POST, including JSON payloads from webhooks. It can parse and forward data to Cortex XDR for normalization and correlation. This matches the application's capability and the requirement for field mapping.

Enabling the NetFlow/IPFIX Collector on a Broker VM lets Cortex XDR receive flow exports directly from routers, satisfying the stem's requirement to ingest NetFlow records. The Broker VM terminates the UDP export stream and forwards parsed flows to Cortex XDR, so no agent deployment on routers is needed.

An XQL query widget in the Dashboards menu aggregates raw alert data, letting you group by endpoint and sort by count descending, then limit to 10. This satisfies the stem's requirement for a ranked top-10 view over a rolling 7-day window, which prebuilt widget templates cannot express.

Content updates are pulled from Content Delivery Network distribution domains over outbound HTTPS. If firewall rules block that traffic, endpoints in the secured segment cannot reach the CDN, so updates fail to download and apply.

An Agent Settings profile governs endpoint agent behaviour and administrative controls, including anti-tampering passwords, malware protection settings and operational parameters. It satisfies the requirement by centralising these configuration options, distinct from policy or exception profiles that govern detection and response actions.

Missing kernel headers prevent the Cortex XDR agent's kernel modules from compiling during RPM installation, so installation fails outright or the kernel-dependent prevention and monitoring modules never load. This directly satisfies the stem's constraint: the reported missing kernel headers block the kernel-level enforcement components the agent requires.

Data forwarding filters live under Settings > Configurations > Data Forwarding, where rules select which alerts reach the SIEM. Defining severity-based rules there forwards only High and Critical alerts, satisfying the requirement to exclude Low and Medium.

Endpoint groups in Cortex XDR can be filtered by operating system, letting the administrator apply distinct policy sets to Windows, macOS and Linux fleets. This satisfies the grouping criterion directly, since OS-specific settings such as exploit protection modules differ per platform.

The Broker VM is an on-premises virtual appliance that can act as a proxy and cache for Cortex XDR agents. It caches content updates and can also handle agent communication, thereby reducing bandwidth consumption on the WAN link. This is the recommended solution for remote offices with limited connectivity.

API keys for external integrations are generated under Settings > Configurations > Integrations > API Keys, where the administrator creates the API Key and Incident ID pair. This location satisfies the stem's requirement for authenticating scripts against the Cortex XDR API.

Exceptions suppress known benign alerts so they no longer contribute weight to incident scoring, preventing false positives from inflating severity. This satisfies the misalignment constraint by removing noise that skews the aggregate score away from genuine organisational priority.

The Broker VM needs to collect logs from internal servers, which may use various protocols such as Syslog (UDP/TCP 514) or others. Firewall rules must permit this traffic from the log sources to the Broker VM. This ensures that the Broker VM can receive and forward logs to the Cortex XDR cloud.

XSOAR server logs at /var/log/demisto/server.log and the Server Audit trail record API request handling, playbook execution errors and authentication failures. When a Cortex XDR API query or automation script fails, these reveal whether the fault lies in the integration call, credential permissions or the automation logic itself.

Endpoints > Endpoint Management lists every registered endpoint with its connection status, agent version and operating system, directly satisfying the stem's requirement to review all three attributes across all endpoints. This dedicated inventory view aggregates that metadata per endpoint, unlike dashboards or policy pages that show configuration rather than per-endpoint state.

Embedding a `comp count() as fail_count by user | filter fail_count > 10` stage in the XQL query itself ensures the scheduled query only returns rows where the threshold is met. This is the native way to apply conditional logic within a Cortex XDR scheduled query, producing alerts only when the aggregated count exceeds the defined limit.

The Cortex XDR get-file command retrieves artefacts from a specific endpoint, so it requires both the agent identifier to target the host and the absolute path of the file to collect. Without either, the integration cannot locate the forensic artefact.

Report Builder creates scheduled report templates and delivers them by email, satisfying the weekly executive-summary requirement. Configure the schedule and recipient list there, then Cortex XDR generates and sends the report automatically, so no manual export or external mail tooling is needed.

The Behavioral Threat protection module is responsible for detecting malicious script behavior. If it is disabled in the agent policy, no alerts will be generated. Checking the policy is the first step to ensure the module is active. This is a common misconfiguration that leads to missed detections.

Endpoint Management in Cortex XDR provides host containment controls, and network isolation severs all traffic except the management channel to the console. This contains a compromised endpoint mid-incident without powering it off, preserving forensic state.

Cortex XDR agent settings for macOS can be packaged into a .mobileconfig file, which is the standard format for configuration profiles on Apple devices. This file can be deployed via MDM to push settings such as agent behavior, tamper protection, and proxy configuration. It ensures the settings are applied securely and consistently across managed macOS endpoints.

The Data Collection profile governs which endpoint telemetry types Cortex XDR agents gather, such as process, network and file events. Enabling broader collection feeds threat hunting and forensic analysis, satisfying the requirement to control telemetry used for those investigations.

A scheduled XQL rule requires the query string itself, since that defines the detection logic executed on each run. Without the query, the schedule has nothing to evaluate and no alerts can be generated from matching events.