Online Access Free XDR-Engineer Practice Test

An administrator wants to employ reusable rules within custom parsing rules to apply consistent log field extraction across multiple data sources. Which section of the parsing rule should the administrator use to define those reusable rules in Cortex XDR?

• A.FILTER
• B.CONST
• C.RULE
• D.INGEST

Which two steps should be considered when configuring the Cortex XDR agent for a sensitive and highly regulated environment? (Choose two.)

• A.Create an agent settings profile, enable content auto-update, and include a delay of four days
• B.Create an agent settings profile where the agent upgrade scope is maintenance releases only
• C.Enable minor content version updates
• D.Enable critical environment versions

Based on the Malware profile image below, what happens when a new custom-developed application attempts to execute on an endpoint?

• A.It will not execute
• B.It will execute after the second attempt
• C.It will immediately execute
• D.It will execute after one hour

How long is data kept in the temporary hot storage cache after being queried from cold storage?

• A.1 hour, re-queried to a maximum of 12 hours
• B.24 hours, re-queried to a maximum of 14 days
• C.24 hours, re-queried to a maximum of 7 days
• D.1 hour, re-queried to a maximum of 24 hours

After deploying Cortex XDR agents to a large group of endpoints, some of the endpoints have a partially protected status. In which two places can insights into what is contributing to this status be located? (Choose two.)

• A.Asset Inventory
• B.All Endpoints page
• C.XQL query of the endpoints dataset
• D.Management Audit Logs