3.4 Configure XDR Collectors XDR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An administrator notices that an XDR Collector is consuming excessive CPU and memory on a critical production server. The collector is configured to collect logs from multiple directories, including some high-volume application logs. The administrator needs to reduce the collector's resource usage without losing important security data. What should the administrator do?

   • AReduce the collection frequency and exclude low-value log directories.
   • BMove the collector to a different server with more resources.
   • CIncrease the collector's log buffer size to improve performance.
   • DDisable the collector entirely to free up resources.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a prerequisite for installing an XDR Collector?

   • AA valid Cortex XDR tenant with the Collector Management feature enabled
   • BA public IP address for the collector to receive inbound connections
   • CA Palo Alto Networks firewall configured to forward logs to the collector
   • DA dedicated physical server with at least 32 GB of RAM
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization is deploying an XDR Collector on a server that uses a proxy requiring authentication. The security team wants the collector to authenticate to the proxy automatically. Which configuration should be applied?

   • AEnter the proxy URL and port in the collector settings, leaving authentication fields blank.
   • BConfigure the collector to use the system proxy settings, which include the authenticated proxy.
   • CProvide the proxy username and password in the collector's proxy configuration.
   • DDisable the proxy and use a direct connection, bypassing authentication.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a common characteristic of manual XDR Collector deployment?

   • AIt requires a separate collector for each data source type
   • BIt requires a user to run the installer and provide configuration details during setup
   • CIt uses a centralized management server to push the collector to multiple machines
   • DIt is the only method that supports proxy configuration
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is evaluating whether to deploy XDR Collectors on its servers. The security team wants to understand the primary role of the collector in the XDR ecosystem. Which statement accurately describes the collector's role?

   • AIt provides a VPN connection for remote users to access the corporate network.
   • BIt collects telemetry data from the host and forwards it to the XDR cloud for analysis.
   • CIt acts as a firewall, blocking malicious traffic at the network edge.
   • DIt replaces the need for a SIEM by performing real-time correlation on the host.
   Reveal Solution Discussion Select an answer first