scenario questions

A Cortex XDR administrator is troubleshooting a Windows endpoint where the agent is installed and running but does not appear in the management console. The administrator confirms the endpoint has internet access. Which agent configuration element is MOST likely misconfigured?

An administrator needs to temporarily disable the Cortex XDR agent protection on an endpoint to perform maintenance. What is required to perform this action locally using cytool?

Which THREE parameters or settings can be managed within a Data Collection profile in Cortex XDR? (Choose three)

An XDR engineer is analyzing a Cortex XDR incident and wants to determine the root cause of a process that was flagged as malicious. The engineer needs to see the full process execution chain, including parent and child processes, with command-line arguments and user context. Which Cortex XDR feature should the engineer use?

A Cortex XDR administrator is troubleshooting an agent on a Windows endpoint that is not enforcing malware prevention. The agent status shows as connected, and the malware prevention module is enabled in the agent settings profile. Which action should the administrator take next to diagnose why malware prevention is not blocking threats?

An administrator needs to deploy the Cortex XDR agent to endpoints using an existing Active Directory Group Policy Object (GPO). Which package format should the administrator download from the Cortex XDR management console?

An administrator wants to ensure that all critical severity alerts generated in Cortex XDR are immediately brought to the attention of the SOC by triggering an audible notification and high-priority banner in the console. Where are console notification preferences managed?

Which TWO components or files are typically required when deploying the Cortex XDR agent on Windows endpoints? (Choose two)

An administrator wants to create a custom BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR to detect unexpected execution of PowerShell scripts downloading files from the internet. Which tool within the Cortex XDR management console should the administrator use to write and test this logic?

An administrator needs to deploy Cortex XDR agents to a network segment where endpoints do not have direct internet access to the Cortex XDR cloud. Which component should be deployed to act as a proxy and forward agent traffic?

An administrator running a Windows endpoint needs to temporarily disable Cortex XDR agent protection for troubleshooting purposes using the `cytool` utility. What requirement must be met before the protection can be disabled?

An administrator is preparing to deploy the Cortex XDR agent to a large group of Windows endpoints. To ensure the agent can be installed silently without interactive prompts and to control the installation path, which method should the administrator use?

An administrator is reviewing XQL search performance issues and query timeouts when investigating historical logs. Which THREE methods can the administrator use to optimize query performance? (Choose three)

An administrator is configuring log forwarding from a Cortex XDR Broker VM to an external SIEM and encounters connection timeouts. Which THREE troubleshooting actions should the administrator take? (Choose three)

An administrator is designing a scheduled report distribution list in Cortex XDR. Which TWO formats can be selected when generating and exporting scheduled reports? (Choose two)

An analyst is reviewing an incident where a suspicious process spawned a child process. The analyst wants to check if any other endpoint in the enterprise has ever executed this exact child process image file name combined with a specific command-line argument. Which search method is most efficient?

An organization experiences repeated false positive alerts from a specific legitimate administrative script that matches a built-in Cortex XDR behavioral Analytics detection. How should the administrator handle this built-in detection alert to prevent future false positives without disabling protection entirely?

A Cortex XDR administrator is planning to deploy agents to a large number of endpoints across multiple geographic locations. To optimize bandwidth and reduce latency for agent communication, the administrator decides to deploy Broker VMs. Which component of the Cortex XDR architecture is responsible for forwarding endpoint data to the Cortex XDR cloud when a Broker VM is used?

An administrator needs to quickly identify which Cortex XDR agent version is installed on a specific Windows endpoint that is experiencing performance issues. The administrator has access to the Cortex XDR management console. Where can this information be found?

An administrator is deploying a Broker VM in a DMZ to ingest logs via API from an external cloud provider. The Broker VM fails to authenticate with the external API endpoint due to self-signed certificate validation errors. What is the correct procedure to resolve this on the Broker VM?

An engineer is tuning a custom BIOC rule that triggers on suspicious command-line patterns. During a red-team exercise the rule failed to fire even though the malicious command was executed. Review shows the rule matched on a process image name that the attacker replaced with a renamed copy of the same binary. Which adjustment best restores detection while limiting false positives?

An analyst is investigating an incident in Cortex XDR and wants to gather more forensic data from an endpoint. Which TWO live response actions can the analyst execute directly from the Cortex XDR console? (Choose two)

An administrator is troubleshooting an issue where custom Correlation Rules in Cortex XDR are not generating expected incidents. Which THREE diagnostic steps should the administrator perform? (Choose three)

Which THREE actions occur on a Windows endpoint when the Cortex XDR agent isolates the host during an active security incident? (Choose three)

An XDR engineer is configuring a Cortex XDR scheduled query to detect potential ransomware activity. The query must identify processes that create a high number of file write operations to unique file extensions within a short time window. Which TWO XQL stages are essential to achieve this detection? (Choose two.)

A Cortex XDR administrator needs to prevent end users on Windows endpoints from disabling the Cortex XDR agent from the system tray, while still allowing administrators to stop the service for maintenance. Which agent configuration should the administrator apply?

An administrator is setting up automated alert ingestion from a third-party SIEM into Cortex XSOAR. Which TWO integration methods or components are typically used to achieve this? (Choose two)

An administrator is designing a Cortex XDR deployment for a network with strict egress filtering. The security team wants to ensure that agents can communicate with the Cortex XDR cloud and receive updates. Which outbound communication method should be allowed to meet this requirement with minimal open ports?

A Cortex XDR administrator is building an automation playbook that must enrich an incident with threat intelligence from an external API. The API requires a bearer token and returns JSON. The administrator wants the playbook to handle API rate limits gracefully by retrying after a delay when a 429 status code is received. Which Cortex XDR Automation configuration should the administrator use to implement this retry logic?

An administrator is preparing to deploy Cortex XDR agents in a hardened enterprise environment with strict endpoint security controls. Which TWO actions should the administrator perform on the endpoints to prevent interference with agent installation and operation? (Choose two)

An engineer is configuring Data Export Service (DES) to stream Cortex XDR logs to a cloud storage bucket. Which THREE cloud storage providers are natively supported destinations for DES? (Choose three)

An analyst wants to write an advanced XQL query that correlates network connection events with process execution events using a common join key (`causality_id`). Which XQL command operator is used to combine two datasets based on a matching field?

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which TWO locations or methods should the administrator check to diagnose the root cause of the failure? (Choose two)

An administrator needs to ingest CEF (Common Event Format) logs from a third-party security device using the Broker VM. Which collector type must be enabled on the Broker VM configuration page in Cortex XDR?

Which menu path in the Cortex XDR management console should an administrator navigate to view the overall health, status, and log forwarding statistics of deployed Broker VMs?

When troubleshooting a Cortex XDR agent installation failure on Windows, which log file generated by the installer provides the most detailed error codes and execution steps?

A Cortex XDR engineer is investigating a series of alerts related to a suspicious PowerShell script execution. The engineer wants to determine if the same script has been executed on other endpoints in the environment over the past 60 days. Which Cortex XDR capability should the engineer use to efficiently search across all endpoints for this specific script hash?

An administrator is configuring custom BIOC rules in Cortex XDR. Which TWO elements are mandatory when defining a new BIOC rule? (Choose two)

Which TWO tasks can an automation playbook in Cortex XDR / XSOAR execute automatically upon detecting a confirmed threat? (Choose two)

A Cortex XDR administrator wants to create a custom BIOC rule that detects when a process creates a scheduled task using schtasks.exe with a specific suspicious argument pattern. The rule must trigger only when the parent process is NOT explorer.exe. Which BIOC rule configuration achieves this?

An administrator needs to ingest Office 365 audit logs into Cortex XDR. Which integration method is officially supported and recommended by Palo Alto Networks for this data source?

A Cortex XDR administrator is investigating an incident where a process attempted to access the LSASS process on a Windows server. The administrator wants to retrieve the raw event data for this activity to understand the full context, including the command line and parent process. Which Cortex XDR feature should the administrator use to obtain this detailed event information?

An administrator is planning the initial deployment of Cortex XDR agents across a mixed environment of Windows and macOS endpoints. Which firewall port and protocol must be opened outbound from the endpoints to ensure successful registration and telemetry reporting to the Cortex XDR management console?

A security engineer is planning the installation of Cortex XDR agents on a large number of endpoints across different operating systems. The engineer must ensure that the agents can be deployed silently and that they automatically register with the correct Cortex XDR tenant. Which TWO installation considerations are essential for a successful mass deployment? (Choose two.)

An administrator is planning to deploy Cortex XDR agents on macOS endpoints and needs to ensure that the agents have the necessary permissions to monitor system activity. Which TWO actions must be performed on each macOS endpoint? (Choose two.)

An administrator manages a Cortex XDR deployment where endpoints connect to the Cortex XDR server through an internal proxy. The security team requires that all agent-to-server communication use the proxy, but also wants the agent to bypass the proxy when reaching internal Cortex XDR appliances on the local network. Which configuration in the agent installation package achieves this?

An administrator needs to install the Cortex XDR agent on a fleet of headless Linux servers using a silent installation script. Which parameter must be included alongside the installation package to successfully bind the agent to the correct Cortex XDR tenant?

A Cortex XDR administrator is investigating why a specific endpoint is not receiving updated policy settings from the management console. The endpoint shows as connected in the console, and the agent version is up to date. The administrator suspects a communication issue between the agent and the console. Which log should they review first to diagnose the problem?

A Cortex XDR administrator wants new Windows endpoints to receive the latest agent version automatically when a new agent release becomes available, without manually reinstalling. Which agent configuration should the administrator enable?

An XDR engineer is configuring a Cortex XDR data forwarding rule to send only endpoint alert data to a third-party SIEM. The SIEM requires that the forwarded payload include the raw event fields and be delivered in JSON format. Which data forwarding destination type should the engineer select?

A Cortex XDR administrator is creating an automation script that must run only when a specific indicator (e.g., a file hash) is found on more than 10 endpoints within the last hour. The script should then block the hash across all endpoints. Which Cortex XDR feature should be used to implement this logic?

An administrator is setting up Cloud Data Collectors in Cortex XDR to ingest logs from Microsoft Entra ID (Azure AD). Which TWO prerequisites must be verified during troubleshooting if ingestion fails? (Choose two)

A detection engineer needs a Cortex XDR alert that fires only when a process writes a suspicious registry Run key and, within the same causality chain, subsequently spawns a script interpreter. The engineer wants the correlation to consider parent-child lineage rather than two unrelated events sharing an endpoint. Which mechanism should be used to express this lineage-aware condition?

An analyst wants to view the complete Attack Story (causality chain) of an incident to understand how an initial phishing email led to credential dumping. Where in the Cortex XDR console should the analyst navigate?

A Cortex XDR administrator is troubleshooting why a custom BIOC rule is not generating alerts on a group of endpoints. The administrator has verified that the rule is enabled and the endpoints are online. Which two actions should the administrator take to further troubleshoot the issue? (Choose two.)

An administrator wants to verify whether Cortex XDR successfully collected telemetry from a newly installed agent. Which reporting or query tool can be used to quickly list all active agents and their last seen timestamp?

Which role is required within Cortex XDR for a user to configure API keys, data integration settings, and automation playbooks?

A security administrator is planning to deploy the Cortex XDR agent to 500 Linux servers across multiple data centers. The organization wants to minimize administrative effort and ensure the agent is always running with the latest features. The servers have varying Linux distributions and kernel versions. Which deployment method should the administrator use?

An automation playbook in Cortex XSOAR needs to execute a custom Python script that interacts with an internal legacy database not covered by existing Marketplace integrations. Which component should the administrator use to securely run this custom script?

An administrator needs to verify whether Cortex XDR Agents are successfully receiving policy updates from the Cortex XDR management console. Where should the administrator check in the management console?

An engineer needs to write an XQL query to search for all events where a process named "cmd.exe" spawned a process named "powershell.exe". Which XQL dataset and query structure should be used?

An administrator is planning network integration for Cortex XDR by forwarding syslog data from third-party security devices. Which component must be configured to receive syslog messages and forward them securely to the Cortex XDR cloud tenant?

An administrator is reviewing incident triage notes and wants to export audit logs showing all administrative actions taken in the Cortex XDR console over the past 90 days. Where should the administrator navigate?

An administrator notices that several Cortex XDR agents are showing a 'Disconnected' status in the management console. What is a common initial cause to investigate?

An administrator wants to ensure high availability and load balancing for log collection using Cortex XDR Broker VMs. Which TWO architectural best practices should be implemented? (Choose two)

An administrator is setting up agent settings profiles in Cortex XDR. What is the primary purpose of creating multiple agent settings profiles?

An engineer is tuning detection coverage in Cortex XDR and wants to confirm whether a specific built-in Analytics BIOC is currently enabled, which MITRE ATT&CK technique it maps to, and whether it has generated any alerts in the past 24 hours. Which approach most directly provides all three pieces of information in one place?

An administrator needs to onboard a new log source into Cortex XDR. The source is a Linux server that writes application logs to a local file. The administrator wants the logs parsed into Cortex XDR fields without installing a full endpoint agent. Which ingestion method is most appropriate?

An organization is deploying Cortex XDR agents across a restricted corporate network where endpoints cannot reach the public internet. How must the administrator configure the environment to ensure agents can successfully connect to the Cortex XDR server?

A Cortex XDR engineer needs to reduce alert fatigue caused by a noisy built-in Analytics BIOC. Rather than disabling the rule entirely, the security team wants to keep the detection but suppress matching alerts whenever the triggering process is a known signed internal IT automation binary. Which action should the engineer configure in Cortex XDR?

What is the primary function of the Cortex XDR 'Content Pack' in Marketplace?

An administrator wants to ensure that all Cortex XDR agents automatically receive the latest content updates (such as exploit signatures and analytics rules) without manual intervention. What is the default behavior of the Cortex XDR agent regarding content updates?

An administrator wants to configure email notifications whenever a critical severity incident is detected by Cortex XDR. Where is this notification setting configured?

An administrator is configuring a Broker VM in Cortex XDR to act as a log collector for third-party security devices. Which TWO log ingestion formats are natively supported by the Cortex XDR Broker VM Log Collector? (Choose two)

An administrator wants to prevent users from disabling the Cortex XDR agent on their Windows endpoints. Which agent setting should be configured to enforce this restriction?

An enterprise has deployed Cortex XDR agents across Windows and Linux hosts. A security engineer notices that a specific custom BIOC rule is triggering successfully on Windows endpoints but fails to fire on Linux endpoints despite identical malicious commands being executed. What is the most likely cause?

An XDR engineer needs to create a Cortex XDR report that shows the number of alerts per severity level for the last 7 days. The report should be generated automatically every Monday at 8:00 AM and emailed to the security team. Which component in Cortex XDR should the engineer use to configure this?

An administrator is reviewing endpoint isolation troubleshooting steps. Which TWO behaviors occur on a Windows endpoint when it is isolated via Cortex XDR? (Choose two)

An XDR engineer is tuning the noise generated by a custom BIOC rule that fires on process executions containing the string 'powershell'. The engineer wants to suppress alerts only when the parent process is a known software deployment agent and the command line also contains 'Invoke-WebRequest'. Which mechanism should be used to implement this narrowly scoped exception without disabling the rule?

A Cortex XDR engineer is configuring the alert notification path so that high-severity incidents reach the on-call SOC analyst quickly. The team wants notifications delivered to an external collaboration platform and also wants an automated action to run when the alert fires. Which TWO Cortex XDR capabilities should the engineer configure to meet these requirements? (Choose two.)

A Cortex XDR engineer is deploying the Broker VM in a high-security environment where outbound internet access is restricted. The Broker VM must be able to receive updates and communicate with the Cortex XDR cloud. Which configuration should the engineer implement to allow this communication?

A security analyst is reviewing an incident in Cortex XDR and wants to understand the sequence of events that led to a detection, including which process launched which child process and how the activity unfolded over time. Which Cortex XDR feature should the analyst use to view this ordered chain of related events?

An administrator needs to deploy Cortex XDR agents to a large fleet of Windows endpoints via Group Policy Object (GPO). Which installation package type and parameter should the administrator utilize to ensure a silent installation without user interaction?

An administrator needs to ensure that unauthorized USB storage devices are blocked from being used on corporate endpoints. Which Cortex XDR feature should be configured?

Which TWO of the following data sources can be natively onboarded and collected using a Cortex XDR Broker VM? (Choose two)

Which THREE advanced troubleshooting steps can an administrator take when analyzing a malfunctioning Cortex XDR agent on a Linux endpoint? (Choose three)

Which THREE factors should an administrator consider when planning a large-scale Cortex XDR agent deployment across enterprise endpoints? (Choose three)

An administrator is configuring a Cortex XDR integration with a third-party SIEM using the Cortex XDR API. The SIEM needs to retrieve alerts periodically. Which API endpoint and HTTP method should be used to fetch alerts?

An analyst builds a custom dashboard widget in Cortex XDR that shows the count of alerts grouped by MITRE ATT&CK technique. The widget works, but the team also wants a second widget that shows the same alert counts split by the assigned alert owner so managers can track workload. The analyst wants to reuse the existing query with minimal changes. Which adjustment should the analyst make to the widget's XQL query?

Which command-line utility can an administrator use on a Windows endpoint to check the status, connection state, and version of an installed Cortex XDR agent?

A Cortex XDR administrator is investigating an incident and needs to confirm whether a specific endpoint has an active agent that is reporting to the console. The administrator has the endpoint's hostname. Which Cortex XDR console area should be used to quickly locate the endpoint and view its agent status?

An administrator is planning firewall rules for endpoints with Cortex XDR agents installed in an environment with strict outbound filtering. Which destination port and protocol must be allowed outbound to the Cortex XDR management tenant for agent telemetry and command-and-control?

Which TWO authentication methods are commonly supported when configuring API integrations in Cortex XSOAR? (Choose two)

An administrator needs to update the Cortex XDR Broker VM software version. What is the recommended and supported method to perform this upgrade?

When planning agent deployment strategies across different operating systems, which TWO package formats are utilized for macOS and Linux endpoints respectively? (Choose two)

An administrator is planning a Cortex XDR deployment across a segmented network architecture where endpoints reside in a zone without direct internet access, but have access to a local proxy. Which TWO configuration steps are required to route agent traffic through this proxy? (Choose two)

An organization wants to ingest custom syslog data from a third-party firewall into Cortex XDR and build detection rules around it. Which feature enables parsing and structuring this unformatted log data so it can be queried effectively using XQL?

An administrator needs to uninstall a protected Cortex XDR agent from a Windows endpoint for troubleshooting purposes. What is required to complete the uninstallation successfully?

An administrator is designing an automated incident response playbook in Cortex XSOAR. Which TWO core concepts are essential for passing data between playbook tasks? (Choose two)

A security analyst wants to review all alerts that were generated on a specific endpoint over the past 30 days and see which ones were already resolved versus still open. Which Cortex XDR view should the analyst open to accomplish this?

When setting up data forwarding from Cortex XDR to a third-party SIEM using the Cortex XDR Data Forwarder, which protocol is commonly used to stream the logs?

An administrator is planning the deployment of Cortex XDR agents to a large number of endpoints that are located in a remote branch office with limited bandwidth. The administrator wants to minimize the impact on the WAN link during agent installation and content updates. Which deployment method should be used to achieve this goal?

When configuring an integration instance in Cortex XSOAR (or Cortex XDR Automation) for a third-party threat intelligence feed, what is the primary purpose of the instance name?

An administrator is troubleshooting an issue where certain PowerShell scripts executed via Cortex XDR Remote Actions fail with exit code errors. Which THREE factors should the administrator check? (Choose three)

A junior analyst needs a quick count of how many alerts each severity produced over the last seven days to prepare a management summary. Which Cortex XDR capability is the most direct way to obtain this aggregated view without writing complex query logic?

An XDR engineer needs to create a scheduled report in Cortex XDR that delivers a daily PDF summary of all critical alerts to the security leadership team. The report must include a breakdown of alerts by severity and a trend chart over the last 7 days. Which component of Cortex XDR should the engineer use to configure this?

A Cortex XDR administrator is troubleshooting an issue where the Cortex XDR agent on a Windows endpoint is not blocking a known malicious file, even though the prevention policy is set to block. The administrator has confirmed that the policy is applied and the agent is connected. Which of the following is the most likely reason for the agent's failure to block?

An administrator is planning a Cortex XDR agent rollout across a mixed environment of Windows, macOS, and Linux servers. Which TWO key prerequisites must be verified prior to deployment? (Choose two)

A Cortex XDR administrator needs a recurring report that shows the top ten MITRE ATT&CK techniques observed across all incidents in the last seven days, broken down by severity. The report must be generated automatically every Monday at 06:00 and emailed to the security leadership team. Which Cortex XDR capability should the administrator configure to meet these requirements?

An administrator is planning the deployment of Cortex XDR agent tamper protection. Which TWO administrative actions or scenarios are protected against when tamper protection is enabled on endpoints? (Choose two)

An administrator wants to check the total license utilization and expiration date for their Cortex XDR tenant. Where can this be reviewed?

A Cortex XDR administrator needs to ensure that all Windows endpoints in a specific department use the same behavioral threat prevention settings and that changes apply immediately when the profile is edited. Which configuration approach should the administrator use?

An organization requires that logs ingested via the Cortex XDR Syslog Collector be secured using TLS encryption (Syslog-over-TLS). What must the administrator configure on the Broker VM to support this requirement?

An organization is onboarding a new cloud environment into Cortex XDR. Which THREE mechanisms or components can be utilized to ingest cloud audit logs and telemetry data into Cortex XDR? (Choose three)

An administrator is configuring a Cortex XDR agent settings profile to minimize the impact on a high-performance computing (HPC) cluster while maintaining essential security monitoring. Which TWO configuration changes should the administrator make to reduce agent resource consumption? (Choose two.)

A security team wants Cortex XDR to automatically create a case and assign it to the on-call analyst whenever a high-severity alert is generated from a specific BIOC rule. They have already verified the BIOC rule fires correctly. Which Cortex XDR feature should they configure to achieve this automated response?

An administrator needs to ensure that Cortex XDR agents on macOS endpoints can perform full disk scans without being blocked by macOS privacy protections. Which Cortex XDR agent configuration is required?

When installing the Cortex XDR agent on a macOS endpoint, which additional operating system configuration must be completed to ensure full visibility and prevention capabilities?

A security administrator is preparing to deploy Cortex XDR agents to a mix of Windows and Linux servers. The administrator wants to ensure that the agents can communicate with the Cortex XDR management console even when endpoints are behind a restrictive firewall. Which Cortex XDR agent configuration should be verified?

An administrator is investigating high memory utilization on a Cortex XDR Broker VM deployed in the environment. Which THREE diagnostic steps or log reviews should the administrator perform? (Choose three)

An administrator is configuring a Cortex XDR Automation playbook to automatically enrich alerts with threat intelligence. The playbook must query an external threat intelligence platform and add the results to the alert. Which Cortex XDR Automation component should be used to perform this action?

An administrator is troubleshooting an issue where Cortex XDR Broker VM cannot forward logs from a syslog source. Which CLI command on the Broker VM can the administrator use to verify active syslog listening ports and network connectivity status?

An administrator is troubleshooting a Cortex XDR syslog integration where logs from a high-throughput network device are being dropped or delayed. The Broker VM resource utilization for CPU and memory is normal. Which underlying collector configuration setting should be adjusted to handle the high burst rate?

An administrator is preparing to deploy the Cortex XDR agent across 5,000 Windows endpoints using an Active Directory Group Policy Object (GPO). Which installation package format should the administrator export from the Cortex XDR management console?

An engineer is writing an XQL query to investigate rare process executions. The query needs to calculate the distinct count of endpoints where each process image name was executed, filtering out processes that appeared on more than 50 hosts. Which XQL snippet correctly implements this filter after aggregation?

An administrator wants to check the operational status and resource utilization of a Cortex XDR Broker VM. Where can the administrator monitor this directly within the Cortex XDR management console?

Which command-line utility is installed natively with the Cortex XDR agent on Windows endpoints to manage agent settings, check connection status, and troubleshoot locally?

Which TWO settings can be configured within a Malware Protection profile in Cortex XDR? (Choose two)

A Cortex XDR administrator is planning to deploy the agent on a Windows Server 2019 that hosts a Microsoft SQL Server database. The database server has high I/O and memory usage. The administrator wants to ensure that the Cortex XDR agent does not degrade database performance. Which action should the administrator take?

Which TWO actions can be performed directly within the Cortex XDR Data Integration management interface? (Choose two)

An administrator is configuring a Cortex XDR agent settings profile for a group of Windows servers that run a legacy line-of-business application. The application is known to trigger behavioral threat protection alerts due to its unusual memory allocation patterns. The administrator needs to prevent these false positives without disabling the entire behavioral threat module. Which Cortex XDR agent configuration should be used?

An organization is deploying the Cortex XDR Broker VM on-premises to support log ingestion and agent proxying. Which THREE network and system prerequisites must be verified before deployment? (Choose three)

An administrator wants to verify if a specific endpoint has the latest content version applied. Where is this information visible in the Cortex XDR management console?

An administrator is configuring log forwarding to an external SIEM using Syslog. Which THREE configuration parameters must typically be defined to establish the Syslog destination successfully? (Choose three)

A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?

An administrator wants to run an ad-hoc query to investigate failed logon attempts across all endpoints over the last 24 hours. Which tool in Cortex XDR should the administrator use?

An organization wants to configure granular reporting and alerting based on MITRE ATT&CK techniques. Within Cortex XDR, which THREE methods or views allow security teams to analyze detections mapped against the MITRE ATT&CK framework? (Choose three)

An organization needs to forward all Cortex XDR incidents and alerts to an external SIEM platform in real time. Which Cortex XDR feature should the administrator configure?

An administrator is writing a custom Python automation script within a Cortex XSOAR integration. Which TWO standard practices should be followed to ensure proper execution and error handling within the platform? (Choose two)

An administrator needs to deploy the Cortex XDR agent across a multi-tenant environment using a single management console. How should the administrator structure the deployment to isolate endpoint data between different business units?

An administrator notices that a specific BIOC alert is triggering false positives across multiple developer workstations. What is the most efficient way to tune this behavior in Cortex XDR without writing custom XQL exclusion queries?

An administrator created a new BIOC detection rule, but test alerts are not appearing in the Incident triage view. Upon checking the rule status, it is active and enabled. What is a common reason why a valid BIOC rule might fail to generate alerts?

An administrator is troubleshooting a scenario where Cortex XDR Agent data is not appearing in the management console. Firewall rules restrict outbound traffic. Which destination port and protocol must be opened outbound from the endpoints to the Cortex XDR management console for agent telemetry?

An endpoint running the Cortex XDR agent has been isolated due to a confirmed security incident. The incident responder needs to allow a specific remote management IP address to communicate with the isolated endpoint for remediation. How can this be achieved?

An XDR engineer needs to schedule a recurring report that summarizes the count of alerts by MITRE ATT&CK tactic for the previous seven days, and deliver it as a CSV file every Monday at 08:00 to a distribution list. Which Cortex XDR feature should the engineer use to configure this?

A security administrator is installing a Cortex XDR Broker VM in a highly secure environment where internet access is restricted. The Broker VM must be able to communicate with the Cortex XDR cloud to receive updates and forward data. Which network configuration must be allowed to ensure successful operation?

An administrator wants to create a BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR that triggers an alert whenever a PowerShell script attempts to download and execute a payload from an external IP address. Which data source must be enabled and properly ingested for this rule to function effectively?

An administrator is preparing to deploy Cortex XDR agents in an environment utilizing a software restriction policy and Application Whitelisting. What must the administrator verify before running the agent installation?

An administrator is planning a Cortex XDR deployment across an enterprise network. Which TWO prerequisites must be verified regarding network connectivity and name resolution for successful agent deployment and operation? (Choose two)

An analyst is investigating an incident and notices that a custom Analytics BIOC rule generated too many false positives due to a legitimate administrative tool. What is the recommended method to tune this rule without completely disabling it?

Which THREE operating systems are officially supported for Cortex XDR agent deployments? (Choose three)

When configuring the Cortex XDR API to ingest custom threat intelligence feeds, which authentication header and format must be used for the HTTP POST request to ensure successful ingestion?

An administrator is installing the Cortex XDR agent on a fleet of macOS endpoints running macOS Big Sur and later. The administrator notices that agent extensions are not automatically approved. Which deployment step must be completed to ensure full functionality without manual user intervention?

An architect is designing a Cortex XDR deployment for an organization with strict outbound internet filtering. Agents cannot connect directly to the public cloud. Which architectural component must be installed within the DMZ or internal network to act as a proxy and forward agent traffic to the Cortex XDR cloud?

An administrator is planning to deploy Cortex XDR agents to a group of endpoints that do not have direct internet access. The administrator has deployed a Broker VM to act as a proxy. Which agent installation parameter must be specified during installation to ensure the agent communicates with the Broker VM instead of the Cortex XDR cloud?

An administrator is troubleshooting why a Cortex XDR Agent is failing to communicate with the cloud management console. Which TWO network or configuration checks should the administrator perform? (Choose two)

During the planning phase of a Cortex XDR deployment, an organization decides to deploy Cortex XDR agents in a disconnected environment without direct internet access to the Cortex XDR cloud. Which architecture component must be installed to facilitate agent communication and updates?

An administrator is setting up alert notification rules in Cortex XDR. Which TWO delivery channels can be configured to notify security personnel when high-severity incidents occur? (Choose two)

A Cortex XDR administrator needs to ensure that endpoint telemetry data is ingested from all Windows endpoints in the organization. Which Cortex XDR component is responsible for collecting this data directly from the endpoints?

A Cortex XDR administrator is troubleshooting why a custom Correlation Rule is not generating incidents. The rule is enabled and scheduled to run every hour. The administrator checks the rule's configuration and sees that it uses a query that references the 'action_process_image_name' field. However, no incidents have been generated despite the query returning results when run manually in the Query Builder. What is the most likely cause?

A security operations team has deployed Cortex XDR agents to a large fleet of Linux servers. After a kernel upgrade on several servers, the agents stop reporting and the endpoints show as disconnected in the console. The administrator confirms the servers are reachable and the agent processes are running. Which action should the administrator take to restore agent functionality?

An enterprise environment uses a forward proxy for all outbound internet traffic. The Broker VM deployed in the internal network cannot reach external cloud APIs for threat intelligence enrichment. How should the administrator configure the Broker VM to route traffic through the forward proxy?

An analyst is reviewing an incident and wants to quickly export the raw artifact details and event logs associated with the specific alert for offline sharing. Which feature in the Incident View should the analyst use?

A security analyst receives a Cortex XDR alert indicating a possible credential-dumping attempt on a finance workstation. The analyst wants to preserve volatile evidence and prevent the threat from spreading to other hosts while still allowing the incident to be investigated. Which Cortex XDR action should the analyst take on the affected endpoint?

An investigator is analyzing an advanced threat campaign using the Cortex XDR Incident View and reporting tools. Which THREE elements are typically included in an exported Incident Report PDF generated from Cortex XDR? (Choose three)

A Cortex XDR administrator is planning to deploy agents to endpoints that are behind a web proxy that requires authentication. The administrator wants to ensure that the agents can register and communicate with the Cortex XDR cloud without manual intervention. What should the administrator do?

A Cortex XDR engineer is asked to reduce alert fatigue from a built-in Analytics BIOC that fires on legitimate administrative activity in the environment, while preserving detection of the malicious behavior the rule targets. The engineer must keep the rule active and avoid weakening coverage for genuinely malicious activity. Which TWO actions should the engineer take? (Choose two.)

An administrator wants to ensure high availability and load balancing for log collection and agent proxying using Broker VMs. Which TWO best practices should be considered during the planning phase? (Choose two)

An administrator wants to configure role-based access control (RBAC) so that a newly formed tier-1 SOC team can view incidents and run XQL queries, but cannot modify firewall rules, agent settings, or create custom BIOC rules. Where should the administrator configure this role?

An analyst notices that an endpoint has been isolated due to a severe security incident, but investigation reveals the alert was a false positive. What is the correct procedure to restore network connectivity to the endpoint?

An engineer is writing an XQL query to investigate endpoint activity. Which TWO commands are valid XQL query operators used for data manipulation and shaping? (Choose two)

An organization requires all custom BIOC alerts to be automatically tagged with the label 'Tier-3-Investigation' and assigned directly to a specific escalation group. Where can an administrator configure this automatic handling?

An administrator needs to ensure that Cortex XDR agents on a set of Linux endpoints can communicate with the Cortex XDR management console through a forward proxy. The proxy requires authentication. Which configuration should the administrator apply to the agent?

A Cortex XDR administrator is planning to deploy agents to a large number of endpoints using a third-party software distribution tool. The administrator needs to obtain the agent installation package that includes the tenant-specific configuration. Where should the administrator download this package?

A security administrator is creating a new agent installation package for a group of Windows endpoints that must be able to receive and act on live terminal commands from the Cortex XDR management console. The administrator wants the package to be preconfigured so no post-install policy change is needed. Which setting in the installation package creation wizard controls this capability?

A Cortex XDR administrator wants to ensure that a specific Windows executable is always allowed to run, even if it exhibits behavior that might otherwise be blocked by the Behavioral Threat protection module. The executable is digitally signed by a trusted vendor. Which Cortex XDR feature should the administrator use to achieve this?

A Cortex XDR administrator needs to verify that the Broker VM is receiving and forwarding endpoint telemetry to the Cortex XDR management console. The Broker VM appears online in the console, but no new endpoint logs have appeared for several hours. Which Broker VM component should the administrator check first to confirm that log ingestion is functioning?

When creating a widget for a custom dashboard in Cortex XDR, an analyst wants to display a visual trend of total alert counts categorized by severity over the last 30 days. Which data source and visualization type are most appropriate?

A Cortex XDR engineer is configuring a Broker VM to collect logs from a third-party EDR solution that writes to a local folder on the Broker VM as JSON files. The engineer needs Cortex XDR to parse these files and map the fields into the XDR data model. Which component should the engineer configure on the Broker VM to achieve this?

An administrator is troubleshooting an issue where Cortex XDR cannot forward alerts to a third-party SIEM via HTTPS Syslog. Which test tool can be executed from the Broker VM to verify network reachability and TLS handshake success against the remote SIEM listener?

An administrator is configuring a Cortex XDR Broker VM to collect logs from third-party syslog sources within a segregated network zone. Which prerequisite must be met on the network firewall to allow the Broker VM to successfully receive syslog data?

An analyst notices that a custom BIOC rule is generating too many false positives during normal software deployments. What is the most appropriate next step in detection engineering for this rule?

An administrator is planning the deployment of Cortex XDR agent protection on servers running critical databases. To prevent potential performance interference or locks on specific database files during agent scans, what should the administrator configure?

An administrator is planning an upgrade cycle for Cortex XDR agents. Which TWO best practices should be followed to ensure a smooth upgrade process across the enterprise? (Choose two)

An administrator is preparing to deploy Cortex XDR agents across a mixed environment of Windows, macOS, and Linux systems. What must the administrator do regarding installation packages?

What is the primary purpose of using a Broker VM in a Cortex XDR deployment architecture?

An organization requires high availability and load balancing for their Broker VM log ingestion tier. Which TWO architectural considerations or configurations support this requirement? (Choose two)

An enterprise plans to deploy Cortex XDR agents to servers that run resource-intensive, mission-critical database applications. During the installation planning phase, which configuration step should the administrator take to minimize potential performance impact?

When planning the deployment of Cortex XDR preventive capabilities, which mode should an administrator initially use to evaluate security posture without risking business disruption?

A Cortex XDR administrator is troubleshooting a Broker VM that is experiencing high CPU usage and is not processing logs from endpoints as expected. The administrator checks the Broker VM's system resources and finds that CPU usage is consistently above 90%. Which of the following is the MOST likely cause?

A security architect is planning a Cortex XDR deployment for a large enterprise with 8,000 endpoints across three geographic regions. The company requires that all endpoint telemetry and alerts be stored within the region where each endpoint resides, and that no data leaves that region. Which Cortex XDR deployment architecture should the architect recommend?

An administrator is building a playbook in Cortex XDR incident response automation. The playbook needs to isolate an endpoint only if a specific malicious process hash is confirmed by a secondary sandbox analysis task. Which element should be used in the playbook workflow to enforce this conditional logic?

During a large-scale Cortex XDR agent deployment using a Software Distribution Tool, administrators notice that multiple endpoints show identical agent IDs (UUIDs) in the Cortex XDR management console, causing telemetry to overwrite. What caused this issue?

A Cortex XDR engineer needs to build a recurring report that summarizes which MITRE ATT&CK techniques were observed across all incidents from the previous week, broken down by technique ID. The engineer wants the output to be generated automatically every Monday at 08:00 and emailed to the security leadership team. Which Cortex XDR capability should the engineer configure to meet these requirements?

An administrator has configured a new AWS CloudTrail integration via Broker VM to ingest cloud logs into Cortex XDR. However, no logs are appearing in the XDR database. Upon reviewing the Broker VM logs, the administrator notices an 'AccessDenied' error from AWS. What is the most likely root cause?

An XDR engineer is investigating an incident where an alert shows a suspicious scheduled task created on a server. The engineer wants to determine whether the same process that created the task also initiated outbound network connections within the same causality chain. Which Cortex XDR capability should the engineer use to trace this relationship?

When testing a newly configured API integration instance in Cortex XSOAR, what is the standard action used to verify connectivity and authentication credentials?

An administrator needs to troubleshoot an AWS S3 bucket integration via Broker VM where logs are failing to ingest. Which TWO diagnostic steps should be taken? (Choose two)

An administrator is managing custom IOC (Indicator of Compromise) feeds in Cortex XDR. Which THREE file formats or ingestion methods are supported when importing custom IOC indicators? (Choose three)

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

A Cortex XDR administrator is troubleshooting why a specific endpoint is not receiving updated policy settings from the Cortex XDR management console. The administrator confirms that the endpoint is online and the agent is running. The agent version is up to date. Which of the following should the administrator check FIRST to resolve this issue?

An administrator has deployed a Broker VM and enabled the Active Directory (AD) collector to ingest user and group mapping data. The connection test fails with a 'Kerberos Authentication Failed' error. What is the most likely cause of this failure?

When configuring a custom Malware Protection profile, an administrator wants to enable prevention for greyware (Potentially Unwanted Applications - PUA). What action does the Cortex XDR agent take when a PUA is detected and the profile action is set to 'Block'?

A Cortex XDR engineer is configuring a new ingestion pipeline for a custom application that emits JSON logs over HTTP. The application can POST logs to a webhook but does not support syslog. The engineer wants the logs to be parsed, mapped to XDR fields, and available for correlation with endpoint telemetry. Which Cortex XDR component should be used to receive these logs?

An enterprise security team wants to ingest NetFlow records from core routers into Cortex XDR. Which component and collector combination supports NetFlow/IPFIX ingestion?

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

An administrator notices that Cortex XDR content updates are failing to apply to endpoints in a secured network segment. Which TWO potential causes should the administrator investigate? (Choose two)

What is the primary function of an Agent Settings profile in Cortex XDR?

An administrator is deploying the Cortex XDR agent in a Linux environment and encounters dependency issues during the RPM installation. Specifically, the system reports missing kernel headers. What is the impact on Cortex XDR functionality if kernel headers or required kernel development packages are missing?

An administrator is configuring data forwarding filters in Cortex XDR to send specific severity alerts to a SIEM. The requirement is to forward all 'High' and 'Critical' severity alerts while excluding 'Low' and 'Medium' alerts. Where is this filter configured?

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

A security engineer is planning the deployment of Cortex XDR agents to endpoints that are located in a remote office with limited bandwidth. The engineer wants to minimize the impact on the network during the initial agent registration and content updates. Which Cortex XDR component should be deployed on-premises to cache content and reduce WAN traffic?

Where in the Cortex XDR web interface can an administrator generate API keys (API Key and Incident ID / Key) required for external integrations and scripts to authenticate with the Cortex XDR API?

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

A Cortex XDR engineer is planning the installation of the Broker VM in a demilitarized zone (DMZ) to collect logs from internet-facing servers. Which TWO configurations are required to ensure the Broker VM can securely communicate with the Cortex XDR cloud and internal log sources? (Choose two.)

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Where in the Cortex XDR management console can an administrator review the connection status, agent version, and operating system of all registered endpoints?

An XDR engineer is building a scheduled query in Cortex XDR to detect unusual authentication patterns. The engineer needs the query to run every 15 minutes and only surface results when the count of failed logons for a user exceeds 10 within the window. Which configuration element in the scheduled query definition accomplishes this?

An automation engineer is building a Cortex XSOAR playbook that is triggered by a Cortex XDR incident. The playbook needs to fetch all associated endpoint artifacts using the Cortex XDR integration. Which parameter is required in the command execution to ensure all relevant forensics files are retrieved?

Where within the Cortex XDR console should an administrator configure scheduled reporting to automatically email executive summaries to stakeholders on a weekly basis?

A Cortex XDR administrator is investigating an incident where a PowerShell script executed on multiple endpoints, but the Cortex XDR agent did not generate any alerts. The administrator confirms the script is malicious and should have been detected by the Behavioral Threat protection module. Which action should the administrator take first to troubleshoot the missing alerts?

Which TWO actions can an administrator perform from the Endpoint Management view in the Cortex XDR management console? (Choose two)

An administrator is deploying Cortex XDR agents to a group of macOS endpoints. The organization uses a mobile device management (MDM) solution to push configurations. Which file format should the administrator use to deliver the agent settings profile via MDM?

Which type of profile in Cortex XDR controls the collection of endpoint telemetry used for threat hunting and forensic analysis?

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

An organization requires that Cortex XDR agent installation packages be deployed silently without displaying any user interface or rebooting the workstation. Which command-line arguments should be used with a Windows MSI installer package?

An administrator configured a new Agent Settings profile in Cortex XDR, but endpoints in the 'Finance' folder are not applying the new tamper protection password. What is the most likely reason for this behavior?

An administrator has deployed a Broker VM to act as a syslog collector and agent installer. During the configuration of the Broker VM in the Cortex XDR console, the status remains 'Disconnected'. What is the most likely cause of this issue?

A security operations team wants Cortex XDR to push high-severity alerts into their existing ticketing platform automatically, without an analyst manually exporting each incident. Which TWO built-in integration capabilities allow Cortex XDR to deliver alerts to an external system? (Choose two.)

An administrator is troubleshooting a Cortex XDR script execution failure via Remote Actions. Which condition must be met on a Windows endpoint for a PowerShell remediation script to run successfully?

A security engineer is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints that are managed by Microsoft Endpoint Configuration Manager (MECM). The organization wants to automate the installation and ensure that the agent is installed with the correct distribution package. What should the engineer do first to obtain the necessary installation package for MECM deployment?

A Cortex XDR administrator notices that the Cortex XDR agent on a Windows endpoint is not reporting any new events to the Cortex XDR management console for the past 24 hours, although the endpoint is online and other agents are reporting normally. The administrator verifies that the agent service is running. Which of the following is the MOST likely cause?

When creating an installation package in the Cortex XDR management console, what is the purpose of assigning an agent profile to the package?

An administrator is configuring network settings for Cortex XDR Broker VMs. Which TWO protocols and associated ports are commonly used when configuring the Broker VM for syslog ingestion and agent communication? (Choose two)

An administrator is setting up a Cortex XDR Broker VM to collect logs from a remote site with limited bandwidth. The administrator wants to minimize the amount of data sent over the WAN link while ensuring that critical security events are still ingested. Which feature should be enabled on the Broker VM?

A security administrator needs to block a known malicious executable from running across all Windows endpoints managed by Cortex XDR. The file is identified by its SHA-256 hash. The administrator wants the block to be enforced at the agent level without scanning file content. Which Cortex XDR feature should be used?

An endpoint has been isolated via the Cortex XDR management console to contain a suspected active breach. Once the threat is remediated, how does the administrator restore network connectivity to the endpoint?

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

An analyst is troubleshooting a complex multi-stage attack in Cortex XDR. Which THREE analytical tools or views in the console help reconstruct the sequence of events across endpoints? (Choose three)

An administrator needs to upgrade a large fleet of Linux endpoints running the Cortex XDR agent. What is the recommended best practice for performing this upgrade via the Cortex XDR management console?

What is the function of an Exploit Protection profile in Cortex XDR?

An administrator is troubleshooting a Cortex XDR agent on a Windows endpoint that is not communicating with the management console. The administrator runs 'cytool status' and sees that the agent is in a 'Disconnected' state. The network team confirms that the endpoint can reach the console on port 443. Which Cortex XDR component should the administrator check next to ensure proper agent-console communication?

An administrator wants to ensure that Cortex XDR agent logs are automatically uploaded to the Cortex XDR server for troubleshooting without manual intervention. Which profile governs log collection and forwarding behaviors?

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

An administrator is planning network connectivity for a Broker VM that needs to forward logs to an external SIEM while also communicating with Cortex XDR. Which network configuration requirement must be met?

An XDR engineer needs to automate the enrichment of Cortex XDR incidents with threat intelligence from an external MISP instance. The MISP API requires an authentication key and returns JSON. Which Cortex XDR automation component should be used to create a custom integration that queries MISP and updates incident fields?

A security engineer is planning to deploy Cortex XDR agents to a large fleet of Windows servers that have no direct internet access. The organization wants the agents to receive content updates without exposing each server to the internet. Which component should be deployed to meet this requirement?

When setting up automated alert response actions using Cortex XDR built-in response actions or XSOAR integrations, which THREE actions can be automatically initiated directly against an endpoint agent? (Choose three)

An administrator notices that several macOS endpoints have incomplete Cortex XDR agent functionality because required operating system permissions were not granted during installation. Which component or setting must be configured to resolve this?

A Cortex XDR administrator needs to deploy a new agent policy to a group of endpoints running macOS. The policy must enable the Behavioral Threat module and set the action to 'Block' for all severity levels. After creating the policy, the administrator assigns it to the endpoint group. However, the endpoints are not receiving the policy. Which step should the administrator verify first?

An administrator is troubleshooting an API rate-limiting error (HTTP 429 Too Many Requests) occurring in a custom Cortex XSOAR automation playbook that queries an external threat intel API. How should the integration or playbook be modified to handle this gracefully?

A Cortex XDR administrator is troubleshooting why a custom BIOC rule that was expected to trigger on specific process behavior is not generating alerts. The rule is enabled and assigned to the relevant endpoint policy. Which two actions should the administrator take to diagnose the issue? (Choose two.)

An administrator is troubleshooting a Broker VM that is failing to pull updates from the Cortex XDR cloud. Upon inspecting the Broker VM system logs, the administrator notices SSL handshake errors. What is the most likely root cause?

An administrator is configuring a Cortex XDR automation rule to trigger a playbook when a new alert matches specific conditions. The playbook must run only for alerts with a severity of High or Critical and only for alerts originating from the 'Malware' alert category. Which TWO configuration elements must be set in the automation rule to enforce these conditions? (Choose two.)

An administrator is configuring a Syslog Collector agent on Cortex XDR to ingest logs from a third-party firewall. Which log collection protocol and transport layer combination is natively supported by the Cortex XDR Collector for receiving unencrypted syslog messages?

During an investigation, a SOC analyst needs to determine which user account was associated with a specific process execution that triggered a Cortex XDR alert. The analyst has the Causality ID from the alert. Which Cortex XDR feature or query approach should the analyst use to identify the responsible user?

An organization utilizes custom correlation rules in Cortex XDR. An engineer needs to export these custom BIOC rules to backup configurations or migrate them to another Cortex XDR tenant. Which administrative feature supports this?

A Cortex XDR engineer is tuning detection coverage and wants to know which MITRE ATT&CK techniques the organization's current endpoint policies and analytics are actually detecting, so gaps can be prioritized. Which Cortex XDR capability should the engineer use to map existing detections to ATT&CK techniques and visualize coverage?

Which TWO criteria can be used to dynamically group endpoints and assign agent profiles in Cortex XDR? (Choose two)

An administrator is planning the deployment of Cortex XDR agents across endpoints and needs to configure Agent Settings profiles. Which TWO configurations can be managed directly within an Agent Settings profile? (Choose two)

A security operations team is implementing automated response actions in Cortex XDR. They need to ensure that when a high-severity alert is triggered, the system automatically isolates the endpoint and creates a case in their ticketing system. Which Cortex XDR component should they use to orchestrate this workflow?

Where can an administrator view the status and health of all deployed Broker VMs directly within the Cortex XDR management console?

Which TWO of the following capabilities are provided by Cortex XDR Behavioral Threat Analytics (Analytics BIOCs)? (Choose two)

An XDR engineer is creating a correlation rule in Cortex XDR to detect a sequence of events: a suspicious process creation followed by a network connection to a known malicious IP. The engineer wants the rule to trigger only if both events occur on the same endpoint within 5 minutes. Which configuration should the engineer use to achieve this?

An administrator is setting up a Cortex XDR Broker VM to collect logs from a remote site. The Broker VM must be able to receive logs from syslog sources and forward them to the Cortex XDR management console. Which Broker VM component is responsible for receiving syslog traffic?

A Cortex XDR administrator needs to forward only alerts with a severity of Critical to an external SIEM while sending all other alerts to a different destination. The administrator is configuring data forwarding rules. Which approach correctly achieves this requirement?

An administrator is planning an automated deployment of Cortex XDR agents using an enterprise software distribution tool. Which TWO advantages does using an MSI package offer over an EXE package in this scenario? (Choose two)

An administrator is configuring a new integration in Cortex XSOAR and needs to ensure secure credential handling. Which TWO practices are recommended when managing API keys and secrets? (Choose two)

An administrator is configuring automated incident enrichment in Cortex XDR. Whenever a new malware incident is generated, the system should automatically query VirusTotal using an integration. Where should this automated workflow be built and attached?

A Cortex XDR Agent on a macOS endpoint is failing to start its kernel extension (Endpoint Security extension). Which diagnostic command should be run locally in the macOS Terminal to verify system extension approval status?

A Cortex XDR administrator notices that the Broker VM's disk usage is consistently above 90%, and some endpoints are intermittently failing to send logs. The administrator needs to reduce disk pressure without losing critical data. Which action should be taken first?

Which TWO actions can an administrator take if a Cortex XDR agent fails to register with the cloud management console after installation? (Choose two)

An organization is preparing to deploy the Cortex XDR agent using Microsoft Active Directory Group Policy Objects (GPO). Which installation package format is natively supported for GPO deployment of the agent on Windows endpoints?

An analyst configures a scheduled report in Cortex XDR to summarize alert volumes per endpoint group every Monday. After the first run, the recipient inboxes show the report was generated but the attached data only covers the previous 24 hours instead of the entire preceding week. Which configuration element most likely caused this truncated reporting window?