3.3 Configure Broker VM Applets and Clusters XDR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What should you check first if a Broker VM applet in a cluster is not forwarding data?

   • AThe XDR service's global status page
   • BThe applet's connection status in the XDR console
   • CThe applet's IP address configuration
   • DThe cluster's load balancer settings
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is deploying Palo Alto Networks XDR and needs to ingest syslog data from a legacy network appliance that does not support direct API integration. The security team wants to forward these logs to the Cortex XDR cloud without exposing the appliance to the internet. What should the administrator configure on the Broker VM to meet this requirement?

   • AConfigure the legacy appliance to write logs to a shared folder that the Broker VM can access via the Windows applet.
   • BDeploy a second Broker VM as a collector and configure the legacy appliance to forward syslog directly to the Cortex XDR cloud.
   • CInstall and configure the Syslog applet on the Broker VM, pointing it to the legacy appliance as the log source, and verify the Broker VM can reach the Cortex XDR cloud.
   • DInstall the Palo Alto Networks Firewall applet on the Broker VM and configure it to pull logs from the legacy appliance's management interface.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization is deploying a Broker VM cluster to handle a large and variable volume of logs. The cluster is expected to scale up during peak hours and scale down during off-peak hours. The administrator wants to ensure that the cluster can automatically adjust its capacity based on the current load. What is the most appropriate approach?

   • ADeploy a larger cluster with more nodes than necessary to handle the peak load at all times.
   • BConfigure the cluster to automatically add or remove nodes based on the queue size and processing rate.
   • CManually add or remove nodes from the cluster based on the expected peak and off-peak hours.
   • DUse a load balancer to distribute the load across a fixed number of Broker VMs.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is monitoring a Broker VM cluster and notices that one node is consistently showing a higher 'Queue Size' metric than the other nodes. The administrator has verified that the applet configuration is identical across all nodes. What is the most likely cause of this imbalance?

   • AThe node is receiving a higher volume of logs from its assigned data sources.
   • BThe node is not properly connected to the cluster and is working in isolation.
   • CThe node has a hardware failure that is causing it to process logs slower.
   • DThe node's network connection to the Cortex XDR cloud is slower, causing a backlog.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An administrator is configuring a Broker VM cluster with three nodes. The cluster is intended to handle a high volume of logs from multiple sources. During the configuration, the administrator must decide on the cluster parameters. Which of the following parameters is most critical for ensuring the cluster can handle the expected load and provide high availability?

   • AThe shared secret used for inter-node communication, which must be strong and unique.
   • BThe network latency between the nodes, which should be minimized for efficient cluster communication.
   • CThe distribution of applets across the nodes, ensuring that no single node is overloaded.
   • DThe number of nodes in the cluster, which should be an odd number to ensure a quorum for failover decisions.
   Reveal Solution Discussion Select an answer first