1.4 Demonstrate Understanding of Data Retention and Compute Units XDR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is planning its Cortex XDR rollout and expects a steady, predictable volume of endpoint telemetry with occasional short bursts during malware campaigns. They want to avoid over-provisioning compute units while ensuring they can handle the bursts without performance degradation. What is the most appropriate approach to compute unit allocation?

   • APurchase compute units only for storage capacity, since processing is handled by the endpoints themselves.
   • BDo not purchase any compute units initially; the platform will allocate them automatically as data arrives.
   • CPurchase compute units based on the highest single-day ingestion volume ever recorded to ensure capacity is always available.
   • DPurchase a baseline number of compute units to cover average daily ingestion and rely on the platform's automatic scaling to absorb short bursts.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When planning compute unit allocation, what should be considered to optimize cost and performance?

   • AThe number of administrators who will access the console
   • BThe brand of endpoint devices being monitored
   • CThe expected data ingestion rate and retention period
   • DThe geographic location of the data center
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a potential consequence of setting very long retention periods without adjusting compute units?

   • AImproved query performance due to more historical data
   • BAutomatic deletion of data to maintain performance
   • CIncreased compute unit consumption and potential performance degradation
   • DReduced storage costs because data is compressed
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company runs Cortex XDR with a 90-day retention period. They are planning a major marketing campaign that will temporarily double their endpoint telemetry volume for two weeks. They want to avoid any performance degradation and also avoid paying for unused compute capacity after the campaign ends. What is the best approach?

   • APermanently increase the compute unit allocation to the peak level needed during the campaign.
   • BReduce the retention period to 30 days during the campaign to offset the increased ingestion volume.
   • CDisable automatic scaling and manually monitor usage to adjust compute units daily.
   • DRely on automatic scaling to handle the increased volume during the campaign, then scale back down afterward.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What role do compute units play in XDR?

   • AThey provide the processing power needed to analyze and store data
   • BThey define the encryption algorithm used for data at rest
   • CThey control the retention period for each data type
   • DThey determine the maximum number of endpoints that can be onboarded
   Reveal Solution Discussion Select an answer first