XDR-Engineer Practice Questions

Question 1

An administrator wants to check the operational status and resource utilization of a Cortex XDR Broker VM. Where can the administrator monitor this directly within the Cortex XDR management console?

Accepted Answer

Go to Settings > Configurations > Broker VM.. The Broker VM monitoring interface is located under Settings > Configurations > Broker VM.

Answer

Go to XQL Search using dataset = broker_vm_logs.

Answer

Go to Dashboards > Broker VM Performance.

Answer

Go to Endpoint Management > Broker VM.

Question 2

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

Accepted Answer

Scheduled Reports in the Reporting menu. Cortex XDR's Reporting menu includes a Scheduled Reports feature that lets administrators define report templates (including incident reports filtered to critical severity), set a weekly schedule, and configure email delivery to recipients such as the security operations team. This is the native, purpose-built capability for recurring PDF report distribution.

Answer

Incident Export via Syslog

Answer

Data Export Service

Answer

BIOC Alert Notifications

Question 3

An administrator has deployed a Broker VM and enabled the Active Directory (AD) collector to ingest user and group mapping data. The connection test fails with a 'Kerberos Authentication Failed' error. What is the most likely cause of this failure?

Accepted Answer

The Broker VM system clock is out of sync with the Domain Controller by more than five minutes. Kerberos authentication relies on time-stamped tickets to prevent replay attacks. If the Broker VM's system clock differs from the Domain Controller's by more than five minutes (the default Kerberos tolerance), the Key Distribution Center (KDC) rejects the authentication request, producing a 'Kerberos Authentication Failed' error. Therefore, the most likely cause is a clock skew exceeding the allowed threshold.

Answer

The Broker VM firewall is blocking ICMP ping requests

Answer

The Cortex XDR agent on the domain controller has been uninstalled

Answer

The Broker VM has exceeded its maximum disk storage allocation

Question 4

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

Accepted Answer

Change the incident status to Resolved and select the appropriate resolution reason (e.g., False Positive).. Incidents in Cortex XDR are resolved by changing their status to 'Resolved' and assigning an appropriate resolution status such as False Positive or Benign True Positive.

Answer

Delete the agent from Endpoint Management.

Answer

Put the agent into Bypass mode.

Answer

Purge all logs using the XQL delete command.

Question 5

An administrator wants to check the total license utilization and expiration date for their Cortex XDR tenant. Where can this be reviewed?

Accepted Answer

Settings > Configurations > Licenses. License details and usage quotas are found under Settings > Configurations > Licenses.

Answer

Dashboards > License Widget

Answer

Help > About Cortex XDR

Answer

Endpoints > Licensing Status

Question 6

An administrator is reviewing incident triage notes and wants to export audit logs showing all administrative actions taken in the Cortex XDR console over the past 90 days. Where should the administrator navigate?

Accepted Answer

Settings > Configurations > Audit Trail. Audit logs tracking administrator logins, configuration changes, and policy modifications are located under Settings > Configurations > Audit Trail.

Answer

Dashboards > Audit Reports

Answer

Incident Response > Activity Log

Answer

Help > System Logs

Question 7

An administrator wants to configure email notifications whenever a critical severity incident is detected by Cortex XDR. Where is this notification setting configured?

Accepted Answer

Settings > Configurations > Notifications (or Incident Notifications). Incident notification settings, including email integrations and webhook alerts, are configured under Settings > Configurations > Integrations > Email or Notifications.

Answer

Dashboards > Alert Rules

Answer

Endpoints > Policy > Alerts

Answer

XQL Search > Alert Action

Question 8

An administrator is reviewing the Cortex XDR console to plan endpoint groupings. Which TWO criteria can be used to organize endpoints into groups for policy assignment? (Choose two)

Accepted Answer

Operating system type (Windows, macOS, Linux). Option C is correct because Cortex XDR endpoint groups can be defined by operating system type (Windows, macOS, Linux), which is a standard grouping criterion used to target platform-specific policies and prevention profiles. Option E is correct because Cortex XDR supports grouping endpoints by IP address subnets or network ranges, allowing administrators to apply location- or network-based policies to endpoints in specific segments. Options A, B, and D are not valid grouping criteria in Cortex XDR: printer driver versions, desktop wallpaper resolution settings, and monitor serial numbers are not endpoint attributes the console uses for policy-assignment grouping.

Answer

Installed printer driver versions

Answer

Local user desktop wallpaper resolution settings

Answer

Physical serial number of the endpoint monitor

Question 9

An administrator is troubleshooting a scenario where Cortex XDR incident severities appear misaligned with organizational priority. Which THREE components or features can the administrator adjust to tune incident scoring and severity? (Choose three)

Accepted Answer

Create exceptions for known benign alerts to prevent them from inflating incident priority scores.. Incident severity and scoring can be tuned via scoring rules, alert severity mappings, and exception configurations.

Answer

Reinstall the Cortex XDR Agent on all high-priority servers.

Answer

Modify the Broker VM packet buffer size.

Question 10

Which THREE factors should an administrator consider when planning a large-scale Cortex XDR agent deployment across enterprise endpoints? (Choose three)

Accepted Answer

Potential conflicts with legacy security software that should be uninstalled prior to deployment. Option B is correct because legacy or third-party security software (e.g., older antivirus, HIPS, or EDR agents) can conflict with the Cortex XDR agent's kernel-level drivers and network filtering, causing installation failures, performance degradation, or unprotected endpoints, so it should be identified and removed before rollout. Option D is correct because agents must reach the Cortex XDR management backend or a Broker VM over outbound TCP 443 (HTTPS), and large deployments require bandwidth planning plus firewall/proxy allow-listing of the relevant FQDNs to avoid registration and telemetry failures. Option E is correct because choosing a deployment mechanism that matches each OS ecosystem — GPO or SCCM for Windows, MDM (e.g., Intune, JAMF) for macOS, and appropriate tooling for Linux — ensures scalable, consistent installation and upgrade across heterogeneous enterprise endpoints. Option A is not appropriate because the Cortex XDR agent is an endpoint security agent, not a DNS server, and making it authoritative for a subnet would break name resolution. Option C is incorrect because granting permanent domain administrator rights to local users is a severe security violation and is not required for agent operation, which runs under the SYSTEM/service account context.

Answer

Configuring the agent to act as a primary DNS server for the local subnet

Answer

Ensuring local endpoint users have full domain administrator rights permanently

Question 11

A Cortex XDR engineer is planning the installation of the Broker VM in a demilitarized zone (DMZ) to collect logs from internet-facing servers. Which TWO configurations are required to ensure the Broker VM can securely communicate with the Cortex XDR cloud and internal log sources? (Choose two.)

Accepted Answer

Allow the Broker VM to communicate with internal log sources over the required protocols and ports.. The Broker VM in a DMZ requires outbound HTTPS access to the Cortex XDR cloud for management and updates, and it must be able to receive logs from internal sources. These two configurations ensure secure communication without exposing the Broker VM to inbound internet traffic. Inbound access from the internet or the cloud is not needed and would increase the attack surface.

Answer

Configure the Broker VM to use a static public IP address for cloud communication.

Answer

Configure inbound access from the internet to the Broker VM on TCP 443 for log ingestion.

Answer

Enable inbound access from the Cortex XDR cloud to the Broker VM on TCP 443 for management.

Question 12

When troubleshooting a failing Cortex XDR API query or automation script, which TWO logs or diagnostic tools should an administrator examine to diagnose the root cause? (Choose two)

Accepted Answer

Cortex XSOAR Server Audit and Server logs (/var/log/demisto/server.log). Option D is correct because Cortex XSOAR Server Audit and Server logs, including /var/log/demisto/server.log, record API activity, automation execution, and integration errors, which are essential for diagnosing a failing Cortex XDR API query or automation script. Option E is correct because integration debug logs, viewed via Docker container logs for the specific integration instance, show the actual HTTP requests, responses, and errors exchanged with the Cortex XDR API, directly revealing the root cause. Option A is not relevant because Windows Event Viewer Security logs on unmanaged workstations do not capture Cortex XDR API or automation activity. Option B is not relevant because BIOS firmware event logs relate to hardware/firmware events, not API or script failures. Option C is not relevant because Cortex XDR Agent installation MSI error logs only cover agent installation issues, not API query or automation script failures.

Answer

Windows Event Viewer Security log on unmanaged workstations

Answer

Local BIOS firmware event logs

Answer

Cortex XDR Agent installation MSI error logs

Question 13

An analyst is reviewing an incident and wants to quickly export the raw artifact details and event logs associated with the specific alert for offline sharing. Which feature in the Incident View should the analyst use?

Accepted Answer

Export options in the Incident View (CSV/JSON). Cortex XDR provides export options within incident views to download incident details, alerts, and observables as CSV or JSON.

Answer

Agent installation log collector

Answer

Cortex XSOAR Marketplace

Answer

Syslog alert routing daemon

Question 14

A Cortex XDR administrator is investigating an incident where a PowerShell script executed on multiple endpoints, but the Cortex XDR agent did not generate any alerts. The administrator confirms the script is malicious and should have been detected by the Behavioral Threat protection module. Which action should the administrator take first to troubleshoot the missing alerts?

Accepted Answer

Verify that the Behavioral Threat protection module is enabled in the agent policy.. Behavioral Threat protection must be enabled in the agent policy to detect malicious script behavior. If disabled, no alerts will be generated regardless of script activity. Verifying the policy setting is the quickest way to identify why alerts are missing, before investigating other potential causes like connectivity or allow lists.

Answer

Review the endpoint's local agent logs for script execution events.

Answer

Ensure the script's hash is not in the allow list.

Answer

Check the Cortex XDR management console for agent connectivity issues.

Question 15

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

Accepted Answer

Dashboards menu using a widget based on an XQL query. Custom dashboards and widgets in Cortex XDR are built and managed within the Dashboard module using either pre-built templates or custom XQL queries.

Answer

Agent Settings -> Profiles -> Analytics

Answer

Threat Intelligence -> Feed Management

Answer

Incident Response -> Playbooks

Certified XDR Engineer XDR-Engineer practice test

Three ways to study

Study XDR-Engineer by domain

Study XDR-Engineer by topic

Cortex XDR Agent Configuration practice questions

Ingestion And Automation practice questions

Maintenance And Troubleshooting practice questions

Detection And Reporting practice questions

Planning And Installation practice questions

XDR-Engineer fundamentals practice questions

XDR-Engineer scenario practice questions

XDR-Engineer troubleshooting practice questions

Certified XDR Engineer (XDR-Engineer) practice questions