3.1 Onboard Data Sources (e.g., NGFW, Network, Cloud, Identity) XDR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Palo Alto Networks NGFW is being onboarded to Cortex XDR. The firewall is behind a NAT device and does not have a public IP address. The Cortex XDR connector requires the firewall to initiate an outbound connection. What is the impact of this setup?

   • AThe NAT device must be configured to forward inbound connections to the NGFW.
   • BThe NGFW cannot be onboarded because it must have a public IP address.
   • CThe NGFW can be onboarded as long as it can initiate outbound connections to the Cortex XDR tenant.
   • DThe Cortex XDR agent must be installed on the NAT device to proxy the connection.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is configuring a new data source connector in Cortex XDR for a custom network appliance that sends logs in CEF format. After configuring the connector, what is the most important step to ensure the data is usable for detection?

   • AVerify that the connector is receiving logs and that the logs are being parsed into the expected fields.
   • BConfirm that the appliance is sending logs to the correct IP address and port.
   • CEnsure that the appliance's logs are in a supported format, such as syslog.
   • DCreate a detection rule that uses the new data source.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization uses AWS as its primary cloud provider and wants to ingest CloudTrail logs into Cortex XDR for security monitoring. They have already created an S3 bucket to store the logs. What is the next step to enable ingestion?

   • AConfigure CloudTrail to send logs directly to the Cortex XDR tenant's public endpoint.
   • BCreate an IAM role that grants Cortex XDR read access to the S3 bucket, and configure the cloud connector in the Cortex XDR console.
   • CDownload the CloudTrail logs from S3 and manually upload them to Cortex XDR.
   • DInstall the Cortex XDR agent on an EC2 instance and configure it to forward CloudTrail logs.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company is onboarding AWS CloudTrail logs into Cortex XDR. They have a multi-account AWS organization and want to ingest logs from all accounts. They have set up a centralized S3 bucket in the management account. What is the best way to configure the connector?

   • ACreate a separate connector for each AWS account and configure each to access its own S3 bucket.
   • BEnable S3 replication to copy logs to a bucket in the Cortex XDR region.
   • CConfigure the CloudTrail trail in each account to deliver logs to the centralized S3 bucket, and use one connector with an IAM role that has read access to that bucket.
   • DUse AWS Lambda to copy logs from each account's S3 bucket to the Cortex XDR tenant.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What information is typically required when configuring a connector for a cloud data source like AWS?

   • AThe syslog server address
   • BThe hostname of the cloud load balancer
   • CThe IP address of the cloud server
   • DThe access key and secret key for the cloud account
   Reveal Solution Discussion Select an answer first