xdr-engineer XDR Engineer Practice Questions

Cortex XDR provides a centralized mechanism for managing agent and content versions. The most efficient way to roll back a content update for a specific group of endpoints is to edit the Agent Settings profile applied to that group and select the desired previous, stable content version. The agents will automatically revert upon their next check-in, without requiring manual intervention on each endpoint.

False. Compute Unit consumption is based on a combination of factors, not just data volume. The main factors are the number of endpoints with the Pro agent enabled and the volume of third-party data ingested. The complexity of queries and analytics performed also contributes to compute usage, making it a more comprehensive metric than just raw data ingestion.

The primary purpose of endpoint groups is to serve as a target for policy application. By grouping endpoints based on criteria like OS, IP range, or Active Directory OU, administrators can apply tailored security profiles (Malware, Agent Settings, etc.) to different sets of endpoints, rather than applying one monolithic policy to all.

This regular expression SrcIP=([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+) specifically looks for the literal string SrcIP= followed by a capturing group (...). Inside the group, it matches one or more digits ([0-9]+) followed by a literal dot (\.) three times, and then a final set of one or more digits. This accurately and specifically captures an IPv4 address format. (.*) is too greedy and would capture the rest of the line, while (\d{1,3}) would only capture the first octet.

The most secure and precise method is to combine multiple attributes. A signer-based exception ensures that only scripts signed by the trusted internal CA are allowed, preventing spoofed scripts with the same name. Combining this with a path-based exception (C:\ProgramData\AdminScripts\Update-Inventory.ps1) ensures that the trusted script can only be run from its authorized location. A broad process or path exception would create a significant security blind spot.

For a large, geographically dispersed hybrid environment, a distributed Broker VM cluster is the optimal design. This architecture provides high availability through failover, reduces latency by processing logs closer to the source, and offers horizontal scalability by adding more nodes. A single cluster creates a single point of failure and introduces significant latency. Independent instances lack the centralized management and automatic failover capabilities inherent in a cluster. A cloud-only deployment would create unnecessary latency and cost for forwarding on-premises logs to the cloud for processing.

Enabling "Behavioral Threat Protection" is crucial as it analyzes process behavior rather than just static signatures, providing protection against malicious actions from legitimate-looking developer tools.

Setting "Unsigned Executable Files" to "Report" allows developers to run their custom binaries while still giving the security team visibility into this activity without blocking them.

True. The Broker VM is the primary component for collecting logs from on-premises third-party sources. It uses applets, such as the Syslog Collector applet, to ingest data from various sources like firewalls, proxies, and servers, then normalizes and forwards this data to the Cortex Data Lake for analysis.

This XQL query is the most accurate and effective. It correctly filters for process launch events (event_type = PROCESS_LAUNCH), specifically for psexec.exe, targets the critical servers by their endpoint group (agent_hostname in (group_name="EHR-Servers")), and critically, excludes legitimate traffic from the bastion host subnet (not actor_ip_address in("10.100.50.0/24")). The other options are flawed: one only counts usage, another incorrectly filters on pre-built stories and the wrong IP field, and the third checks for a causality ID without filtering by the crucial source IP.

The cytool checkin command forces the Cortex XDR agent to attempt an immediate check-in with the server. The output provides detailed information about the connection attempt, including TLS handshake errors, DNS resolution problems, or server connectivity issues. This makes it the most direct first step for diagnosing communication problems. cytool status provides general agent status but doesn't actively test connectivity. cytool runtime query is for querying agent processes, and cytool persist list shows the agent's database of persistent data.