Ingestion And Automation practice questions

In the Cortex XaaS cloud storage bucket configuration properties

Why it fails: XaaS cloud storage buckets are not used for defining log parser mappings.

Directly inside the broker VM configuration file using a local JSON editor

Why it fails: Broker VM handles forwarding, but parsing rules are defined within the XDR console.

In the Cortex XDR agent installation script via command-line switches

Why it fails: Agent installation scripts do not handle custom log payload mappings.

POST /public_api/v1/incidents/get_all_incidents/ with a severity filter

Why it fails: Incidents API retrieves security alerts and incidents, not endpoint inventory state.

PUT /public_api/v1/audits/get_actions/ with an agent version parameter

Why it fails: Audits API retrieves administrative audit logs, not current endpoint operational data.

GET /public_api/v1/file/file_metadata/ with a SHA256 parameter

Why it fails: File metadata API is used for hash reputation and file analysis, not endpoint health checks.

Forward the raw email to the Cortex XDR Agent collector service

Why it fails: Agent collectors handle endpoint and network logs, not direct playbook email parsing.

Trigger the 'Device-Control-Block' command against the email sender

Why it fails: Device-control commands manage USB and peripheral blocking, not email IOC extraction.

Execute a raw regex match script via PowerShell on a Broker VM worker

Why it fails: XSOAR has native parsing commands; custom PowerShell scripts on Broker VMs are not needed for email text parsing.

The log forwarding protocol must be changed from HTTPS to UDP

Why it fails: Protocol choice does not dictate schema mapping success.

The Cortex XDR agent license does not support custom parsing

Why it fails: Custom log mapping is a standard feature of Cortex XDR data integration.

The physical room number where the server rack is installed

Why it fails: Forwarding filters match log fields such as endpoint name, IP address or event type; a room number is not a telemetry attribute. It is tempting because asset inventories do record physical location, so it would be correct when scoping by an inventory tag rather than by log content.

The name of the physical building security guard on duty

Why it fails: Building guard rosters are physical-security personnel data, absent from Cortex XDR log schemas, so no forwarding filter can match on them. It is tempting because Cortex XDR ingests many endpoint and identity fields, and an administrator might assume any organisational attribute is filterable, but criteria must reference actual log or endpoint fields.

The local cafeteria menu schedule

Why it fails: Cafeteria menus are unrelated to Cortex XDR forwarding filters, which accept criteria such as log type, endpoint name, IP address or OS. It is tempting as a humorous distractor, but no telemetry field maps to menu data, so it cannot target logs or endpoints.

Disable SSL/TLS verification on the firewall sending the syslog events.

Why it fails: Disabling SSL/TLS verification affects transport encryption only; logs already reach the Collector, so parsing, not delivery, is failing. This setting is relevant when certificate errors block ingestion, not when received events never appear in Query Builder.

Generate a new API key in the Cortex XDR management console and assign it to the syslog source.

Why it fails: Incorrect. Syslog ingestion via Broker VM does not utilize Cortex XDR API keys.

Restart the Cortex XDR Agent on all managed endpoints to enable syslog forwarding.

Why it fails: Incorrect. Syslog collectors are handled by Broker VMs, not individual Cortex XDR endpoints.

Endpoint Tagging Policy

Why it fails: Endpoint Tagging Policy assigns metadata tags to endpoints for grouping and policy targeting; it forwards no alert data externally. It is tempting because tagging does feed contextual data into Cortex XDR, and would be the right choice when scoping endpoint groups for policy enforcement rather than SIEM forwarding.

Local Agent Settings Profile

Why it fails: Incorrect. Agent settings manage endpoint behavior, not server-side SIEM integrations.

Hash Exception Rule

Why it fails: Incorrect. Hash exceptions are used for preventing specific files from executing.

Open Endpoint Management > Agent States > Collectors.

Why it fails: Incorrect. Endpoint Management focuses on agent software versions and isolation status.

Select Response > Automation > Integrations.

Why it fails: Incorrect. Response and automation settings are for XSOAR or built-in response playbooks.

Go to Incidents > Alert Overview > Collector Health.

Why it fails: Incorrect. The Incidents view is for security alerts, not infrastructure configuration.

Bind the API key to a specific endpoint group using an agent criteria filter.

Why it fails: Incorrect. API keys are scoped by role and permissions, not by endpoint groups.

Configure a local system account on the Broker VM to proxy incoming API REST calls.

Why it fails: Incorrect. API calls are sent directly to the Cortex XDR tenant cloud URL, not proxied via Broker VM local accounts.

Install the Cortex XDR API forwarder agent package directly onto the SIEM server.

Why it fails: Incorrect. No special agent package is needed on the SIEM server to consume APIs.

Use the 'LEEF' format and apply custom field mappings to preserve endpoint event hierarchy.

Why it fails: LEEF is a proprietary normalized format that requires field mapping and does not preserve the original endpoint event hierarchy. Applying custom mappings still transforms the payload and adds overhead. This option does not deliver the unmodified raw telemetry the SIEM expects, so it fails the stated requirement.

Configure the forwarding rule to send only alert metadata without endpoint telemetry to reduce bandwidth.

Why it fails: Sending only alert metadata omits the raw endpoint telemetry that the SIEM requires. The scenario specifically states the SIEM expects each event to include raw endpoint telemetry in its original structure. This option reduces data volume but fails the core requirement, making it unsuitable for this use case.

Enable the 'CEF' format and map all endpoint fields to Common Event Format headers before forwarding.

Why it fails: CEF is a normalized, text-based format that remaps original endpoint fields into CEF headers. While useful for SIEMs that prefer CEF, it transforms the payload and strips the original structure. This violates the requirement to send unmodified raw telemetry, and it introduces additional mapping overhead that the engineer explicitly wants to avoid.

Configure the application to send logs in CEF format and enable the CEF parser in the collector.

Why it fails: While CEF is a common format, the scenario states the application can only send logs over HTTP, not necessarily in CEF. The HTTP Log Collector does not have a built-in CEF parser option; it requires a custom format definition. Assuming CEF would not work unless the application is modified to output CEF.

Enable the Syslog Collector and configure the application to send logs via Syslog over TCP.

Why it fails: The application can only send logs over HTTP, so Syslog is not an option. The Syslog Collector is designed for Syslog protocols, not HTTP. Using it would require changing the application's output, which is not feasible per the scenario.

Use the Broker VM to receive HTTP logs and forward them to the Cortex XDR management console.

Why it fails: Broker VM can forward logs, but the HTTP Log Collector is a separate component that directly receives HTTP logs. The Broker VM does not parse logs; it only forwards them. The parsing must occur at the collector level using a custom format.

Enable TLS encryption and use the default syslog port 514.

Why it fails: TLS is not mentioned in the scenario; the firewall sends logs over plain TCP. Using TLS would require the firewall to be configured for TLS, which is not stated. Port 514 is typically for UDP syslog, not TCP, and the default TCP port is 514 as well but TLS would change the port.

Configure the collector to use UDP and set the format to RFC 3164.

Why it fails: The firewall sends logs over TCP in RFC 5424 format. Using UDP and RFC 3164 would mismatch both the transport protocol and the format, leading to failed ingestion or incorrect parsing. The collector must match the sender's settings.

Set the collector to listen on a random port and use automatic format detection.

Why it fails: Automatic format detection is not a feature of the Syslog Collector; it requires explicit format selection. Also, using a random port would require the firewall to be configured to send to that port, which is not specified. The collector should use a known port.

Cortex XDR Data Forwarding with syslog filters

Why it fails: Data Forwarding simply streams raw or filtered alerts to external destinations like syslog or SIEM. It does not perform enrichment or modify alert content. While you can filter which alerts are forwarded, there is no capability to query threat intelligence and append it to the alert. Therefore, it cannot satisfy the requirement for automatic enrichment before ticketing.

Cortex XDR Broker VM with Threat Intelligence add-on

Why it fails: The Broker VM is used for log collection, network traffic mirroring, and acting as a proxy for external integrations. It does not have a Threat Intelligence add-on that enriches alerts. Enrichment is handled by the automation engine, not the Broker VM. Thus, this option misrepresents the Broker VM's role and cannot fulfill the enrichment requirement.

Cortex XDR API with external scripts polling for new alerts

Why it fails: Using the API with custom scripts is possible, but it requires developing and maintaining external code, which is not a native Cortex XDR component. The scenario asks for a Cortex XDR component to be configured, implying an integrated feature. While API scripts can enrich, they are not the built-in automation engine and introduce additional complexity and potential points of failure.

File Collector watching the remote server's C$ administrative share

Why it fails: File Collector ingests files from a configured local or mounted path and does not parse Windows Event Log channels. Pointing it at an administrative share would only transfer raw files and would not extract event records with their fields intact. Additionally, continuously reading the .evtx files over SMB is not the supported method for real-time Windows event ingestion.

Syslog Collector with a listening port on the Broker VM

Why it fails: The Syslog Collector receives syslog streams pushed by a device; it does not connect outbound to pull Windows Event Logs over SMB. Since the segmented VLAN only permits outbound SMB from the server and no syslog forwarding is configured on the endpoint, this component cannot retrieve the logs. It is designed for network devices and appliances that emit syslog, not for Windows event channels accessed via remote WMI/SMB.

Network Mapper with SNMP walk enabled for Windows hosts

Why it fails: Network Mapper discovers hosts and open ports using active scanning, and SNMP polling retrieves management OIDs, not Windows Event Log records. It cannot read the Security or System event channels over SMB, so it would not deliver the log data required. This component is used for asset discovery and topology mapping, not for event log ingestion from Windows servers.

Set the forwarding format to CSV.

Why it fails: The forwarding format determines how data is structured (e.g., JSON, CEF). CSV is not a supported format for Cortex XDR data forwarding, and even if it were, it would not affect the inclusion of severity or hostname. The format choice does not control which alerts are forwarded or what fields are included.

Add a filter condition for 'alert timestamp' to be within the last 24 hours.

Why it fails: While filtering by timestamp can be useful, the requirement is to include the timestamp in the forwarded data, not to filter by it. Adding a time-based filter would restrict which alerts are forwarded but does not ensure the timestamp field is present in the forwarded payload.

Configure the SIEM to poll the Cortex XDR API every 5 minutes.

Why it fails: Polling the API is an alternative method to retrieve alerts, but the scenario specifies using data forwarding. Data forwarding is a push mechanism, so polling is not required. Moreover, polling would not inherently filter by severity or include hostname without additional query parameters.

Configure the SIEM to pull alerts from Cortex XDR using a syslog collector with a severity filter.

Why it fails: Cortex XDR does not support being pulled by a syslog collector; it pushes data via forwarding rules. The SIEM cannot initiate a pull from Cortex XDR. This option reverses the data flow and is technically incorrect. Data forwarding is a push mechanism from Cortex XDR to the syslog receiver, not a pull from the SIEM.

Use the Cortex XDR API to query alerts with severity High or Critical and push them to the SIEM via a custom script.

Why it fails: While API polling can retrieve alerts, it requires custom development and does not use the built-in data forwarding feature. The scenario implies using Cortex XDR's native forwarding capability. API scripts introduce maintenance overhead and potential latency. This option is not the intended configuration for a simple forwarding rule and does not leverage the platform's built-in syslog output.

Set up a Broker VM to collect all alerts and then filter them locally before forwarding to the SIEM.

Why it fails: The Broker VM is for log collection from external sources, not for filtering Cortex XDR alerts. Alerts are generated within Cortex XDR and forwarded directly. Using a Broker VM for this purpose would add unnecessary complexity and is not the designed workflow. The built-in data forwarding rule is the correct feature for this requirement.

Add the target API IP address to the Broker VM local hosts file

Why it fails: A hosts-file entry maps a hostname to an IP address and does nothing to make the Broker VM trust a self-signed certificate, so validation still fails. It is tempting because hosts entries do resolve name-resolution failures, and that would be the answer if DNS resolution, not certificate trust, were the problem.

Modify the Broker VM system kernel parameters to ignore cipher mismatches

Why it fails: Cipher mismatches concern negotiated encryption algorithms, not certificate trust, so altering kernel parameters cannot make a self-signed certificate validate. It is tempting because kernel-level TLS tuning does exist, and it would be the answer if the handshake failed on an unsupported cipher suite rather than on certificate validation.

Disable SSL/TLS verification globally for all Cortex XDR broker app modules

Why it fails: Disabling TLS verification globally removes certificate validation for every broker module, a security regression that does not install the required trust anchor. It is tempting because it does stop the error, and it would be the answer only in an isolated lab where no certificate can be imported.

A Data Collection task pointing to the endpoint agent

Why it fails: A Data Collection task gathers endpoint telemetry such as file or process data; it cannot branch on a sandbox verdict. Conditional gating requires a decision or condition task evaluating the prior analysis result. Data collection is tempting because it feeds later steps, but it performs no conditional evaluation itself.

A Post-Processing script executed directly on the Broker VM

Why it fails: Post-Processing scripts run on the Broker VM after the playbook completes, so they cannot evaluate a sandbox verdict mid-workflow and branch to isolation. They suit data enrichment or cleanup tasks outside the decision path; a conditional task is required here.

A Manual Approval step without automated logic branching

Why it fails: A manual approval step pauses for analyst input but performs no automated evaluation of the sandbox verdict, so isolation cannot be triggered by the hash confirmation itself. It fits workflows requiring human sign-off on high-impact actions, not automated conditional branching.

Incidents > Response > Broker Status

Why it fails: Incidents > Response contains investigation and response actions for detected incidents; no Broker Status view exists there, and it exposes no Broker health or log forwarding statistics. It is tempting because Brokers forward logs that generate incidents, and this path would be correct for triaging and responding to those alerts.

Marketplace > Integrations > Instances

Why it fails: Marketplace > Integrations > Instances lists installed third-party integration instances and their configuration, not Broker VM telemetry. It is tempting because Brokers are deployed as instances, and this path would be correct for installing or managing an integration pack rather than checking Broker health and log forwarding.

Endpoints > Management > Agent Status

Why it fails: Endpoints > Management > Agent Status reports endpoint agent connectivity and version data, not Broker VM health or log forwarding statistics. It is tempting because it is the console's central fleet-status view, and it would be correct for auditing whether endpoint agents are reporting to the management server.

To determine the operating system kernel executing the automation script

Why it fails: The instance name is a human-readable label distinguishing multiple configured instances of one integration, letting playbooks target a specific feed. It has no bearing on which kernel executes automation code; that is determined by the engine or container running the integration, not by any instance field.

To define the encryption key used for secure payload transit

Why it fails: The instance name is a human-readable label distinguishing multiple configured instances; it carries no cryptographic function. It is tempting because integrations do handle sensitive feed data, and would be correct if the question asked where credentials or API keys are stored for secure transit.

To specify the physical network interface the integration binds to

Why it fails: Instance names label and distinguish multiple configured instances of the same integration, so analysts can route commands and fetch indicators from a specific feed. Binding an integration to a physical network interface is not something Cortex XSOAR instance configuration exposes; egress routing is handled by the host or proxy settings instead.