Online Access Free XDR-Engineer Exam Questions

After deploying Cortex XDR agents to a large group of endpoints, some of the endpoints have a partially protected status. In which two places can insights into what is contributing to this status be located? (Choose two.)

• A.Management Audit Logs
• B.All Endpoints page
• C.XQL query of the endpoints dataset
• D.Asset Inventory

Which components may be included in a Cortex XDR content update?

• A.Behavioral Threat Protection (BTP) rules and local analysis logic
• B.Antivirus definitions and agent versions
• C.Firewall rules and antivirus definitions
• D.Device control profiles, agent versions, and kernel support

During deployment of Cortex XDR for Linux Agents, the security engineering team is asked to implement memory monitoring for agent health monitoring. Which agent service should be monitored to fulfill this request?

• A.pyxd
• B.clad
• C.pmd
• D.dypdng

A multinational company with over 300,000 employees has recently deployed Cortex XDR in North America.
The solution includes the Identity Threat Detection and Response (ITDR) add-on, and the Cortex team has onboarded the Cloud Identity Engine to the North American tenant. After waiting the required soak period and deploying enough agents to receive Identity and threat analytics detections, the team does not see user, group, or computer details for individuals from the European offices. What may be the reason for the issue?

• A.The XDR tenant is not in the same region as the Cloud Identity Engine
• B.The ITDR add-on is not compatible with the Cloud Identity Engine
• C.The Cloud Identity Engine plug-in has not been installed and configured
• D.The Cloud Identity Engine needs to be activated in all global regions

How are dynamic endpoint groups created and managed in Cortex XDR?

• A.Each endpoint can belong to multiple groups simultaneously, allowing different security policies to be applied to the same device at the same time
• B.Endpoint groups require intervention to update the group with new endpoints when a new device is added to the network
• C.After an endpoint group is created, its assigned security policy cannot be changed without deleting and recreating the group
• D.Endpoint groups are defined based on fields such as OS type, OS version, and network segment