XDR Engineer Practice Exam 2025: Latest Questions

An XDR administrator needs to deploy Cortex XDR agents to 500 Windows endpoints across multiple branch offices. Which deployment method would be MOST efficient for this scenario?

Which component of the Cortex XDR architecture is responsible for collecting and forwarding logs from third-party security products to the Cortex Data Lake?

A security analyst wants to create a custom alert that triggers when more than 10 failed login attempts occur from the same user within a 5-minute window. Which Cortex XDR feature should be used?

What is the primary purpose of agent profiles in Cortex XDR?

An organization wants to integrate their existing SIEM solution with Cortex XDR to enrich alerts with XDR context. Which integration method should they use?

A security team needs to automatically isolate any endpoint that generates a critical severity alert involving ransomware indicators. Which Cortex XDR capability should be configured to accomplish this?

After deploying Cortex XDR agents to Linux servers, the security team notices that agents are not appearing in the management console. The agent service is running on the endpoints. What is the MOST likely cause?

Which data source provides the MOST comprehensive visibility for detecting lateral movement within a network when integrated with Cortex XDR?

A security analyst is creating a playbook that should automatically execute when a malware alert is triggered, but only during business hours (9 AM to 5 PM). Which playbook component enables this time-based conditional execution?

What is the recommended approach for managing Cortex XDR agent updates in a production environment?

An administrator wants to create a custom XQL query to search for processes that created network connections to external IP addresses in the last 24 hours. Which dataset should be used as the primary source for this query?

During a security investigation, an analyst needs to pivot from an alert to see all related network activity for a specific host. Which Cortex XDR feature provides this capability?

A security team wants to automatically isolate endpoints when a critical severity alert is triggered for ransomware activity. What is the correct approach to implement this in Cortex XDR?

An organization is integrating third-party firewall logs into Cortex XDR. The logs are in CEF format. Which component is responsible for parsing and normalizing these logs before they are ingested?

What is the primary purpose of the Cortex XDR Analytics Engine?

A company needs to create a BIOC rule that detects when a user account is used to log in from more than three different countries within a 2-hour window. Which data source is most appropriate for this detection?

An administrator notices that some alerts are being generated for legitimate administrative tools like PsExec. What is the recommended best practice to handle these alerts?

A security operations team wants to enrich alerts with threat intelligence data from an external STIX/TAXII feed. What is the correct implementation approach in Cortex XDR?

During incident response, an analyst needs to retrieve a suspicious file from an endpoint for forensic analysis. The endpoint is online and managed by Cortex XDR. What is the most efficient method to accomplish this?

An organization is deploying Cortex XDR in a highly segmented network where endpoints in the production zone cannot directly communicate with the internet. What architectural component is required to enable these endpoints to communicate with the Cortex XDR management console?

An XDR administrator needs to create a custom XQL query to identify all processes that were executed from temporary directories across all endpoints in the last 24 hours. Which XQL dataset should be used as the primary source for this query?

A security team wants to automate the process of enriching alerts with threat intelligence data from an external TAXII feed before analyst review. What is the recommended approach in Cortex XDR?

Which Cortex XDR agent component is responsible for collecting network traffic data from endpoints for behavioral analysis?

A company has deployed Cortex XDR and wants to ingest authentication logs from their on-premises Active Directory domain controllers. The domain controllers cannot directly reach the internet. What is the correct method to collect these logs?

When creating a custom alert exclusion policy in Cortex XDR, what is the primary risk of using overly broad exclusion criteria?