XDR-Engineer

XDR-Engineer practice questions, page 2 of 3, with answer review and explanations.

Question 6

What are two possible actions that can be triggered by a dashboard drilldown? (Choose two.)

  1. Initiate automated response actions.
  2. Navigate to a different dashboard.
  3. Send alerts to console users.
  4. Link to an XQL query.

Question 7

An administrator wants to employ reusable rules within custom parsing rules to apply consistent log field extraction across multiple data sources. Which section of the parsing rule should the administrator use to define these reusable rules in Cortex XDR?

  1. RULE
  2. INGEST
  3. FILTER
  4. CONST

Question 8

Which method will drop undesired logs and reduce the amount of data being ingested?

  1. [INGEST:vendor= “vendor”, product= “product”, target_dataset= “vendor_product_raw”, no_hit=drop] filter _raw_log not contains “undesired logs”;
  2. [COLLECT:vendor= “vendor”, product= “product”, target_dataset=*, no_hit=drop] drop _raw_log contains “undesired logs”;
  3. [INGEST:vendor= “vendor”, product= “product”, target_brokers= “vendor_product_raw”, no_hit=keep] filter _raw_log not contains “undesired logs”;
  4. [COLLECT:vendor= “vendor”, product= “product”, target_brokers=*, no_hit=drop] drop _raw_log contains “undesired logs”;

Question 9

A new parsing rule is created, and during testing and verification, all the logs for which field data is to be parsed out are missing. All the other logs from this data source appear as expected. What may be the cause of this behavior?

  1. The XDR Collector is dropping the logs.
  2. The filter stage is dropping the logs.
  3. The Broker VM is offline.
  4. The parsing rule corrupted the database.

Question 10

What should be configured in Cortex XDR to integrate asset data from Microsoft Azure for better visibility and incident investigation?

  1. Cloud Inventory
  2. Cloud Identity Engine
  3. Microsoft 365
  4. Azure Network Watcher