1.2 Explain the Deployment and Functionality of Cortex XDR Components XDR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What security capability is provided by the Cortex XDR agent?

   • AEmail spam filtering
   • BNetwork firewall and VPN services
   • CMalware prevention and behavioral threat detection
   • DWeb content filtering at the network level
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is deploying the Broker VM to inspect traffic from a span port. They also want to integrate with a third-party EDR product that sends alerts via API. They have limited resources and want to minimize the number of virtual appliances. What is the best approach?

   • ADeploy a single Broker VM that handles both traffic inspection and the third-party API integration.
   • BUse Cloud Identity Engine to integrate with the third-party EDR.
   • CUse the XDR Collector for the third-party API integration and the Broker VM for traffic inspection.
   • DDeploy two separate Broker VMs: one for traffic inspection and one for the API integration.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company needs to ingest logs from a legacy security appliance that only supports syslog. They want to use the XDR Collector. What is the correct approach?

   • AInstall the Cortex XDR agent on the appliance to collect logs.
   • BConfigure the XDR Collector to receive syslog from the appliance and forward it to Cortex XDR.
   • CManually upload log files to the Cortex XDR console.
   • DUse the Broker VM to receive syslog and convert it to API calls.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company uses Okta for identity management and wants to use Cloud Identity Engine to provide user context to Cortex XDR. What is a prerequisite?

   • AInstall the Cortex XDR agent on Okta's servers.
   • BDeploy the Cloud Identity Engine connector on a server that can reach Okta and Cortex XDR.
   • CCreate a local user database in Cortex XDR and manually sync it with Okta.
   • DConfigure the XDR Collector to pull user data from Okta.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is deploying Cortex XDR and needs to inspect network traffic from a span port. They plan to use the Broker VM. What is a required step during the Broker VM deployment?

   • AConfigure the Broker VM to use DHCP to simplify network setup.
   • BAssign a static IP address to the Broker VM and ensure it can reach the Cortex XDR cloud.
   • CInstall the Broker VM on the same host as the endpoints to reduce latency.
   • DDeploy the Broker VM in the cloud to inspect traffic from on-premises endpoints.
   Reveal Solution Discussion Select an answer first