3.1 Onboard Data Sources (e.g., NGFW, Network, Cloud, Identity) XDR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of an identity source that can be onboarded to the XDR platform?

   • AAzure Active Directory
   • BCisco ASA
   • CVMware vCenter
   • DAmazon S3
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A large enterprise is onboarding multiple Palo Alto Networks NGFWs from different regions into a single Cortex XDR tenant. The security team wants to ensure that log ingestion is resilient and that no logs are lost if a firewall loses connectivity. What is the best approach?

   • AUse the native NGFW connector for each firewall and enable the built-in log forwarding retry mechanism.
   • BInstall the Cortex XDR agent on each firewall to buffer logs locally.
   • CConfigure a third-party log management system to aggregate logs and forward them to Cortex XDR.
   • DConfigure each NGFW to send logs to a local syslog collector, and then forward the syslog to Cortex XDR.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   After onboarding a Palo Alto Networks NGFW as a data source, a security analyst notices that the log volume in Cortex XDR is much lower than expected. The NGFW is generating traffic, and the connector status shows 'Connected'. What should the analyst check first?

   • AConfirm that the NGFW's log storage is not full.
   • BVerify that the NGFW is sending all log types, such as threat and traffic logs, to the Cortex XDR collector.
   • CReview the NGFW's firewall rules to ensure that traffic is allowed to the Cortex XDR collector.
   • DCheck the Cortex XDR agent status on the NGFW management interface.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Where in the Cortex XDR management console would you go to configure a new data source connector?

   • AInvestigation > Forensics
   • BSettings > Data Sources
   • CAlerts > Incident Management
   • DResponse > Actions
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team is onboarding Google Cloud Platform (GCP) audit logs into Cortex XDR. They have created a Pub/Sub topic and subscription for the logs. What is the next step in the Cortex XDR console?

   • AConfigure the GCP connector with the service account key and Pub/Sub subscription details.
   • BEnable VPC Flow Logs and send them to Cortex XDR.
   • CInstall the Cortex XDR agent on a GCP VM to forward the logs.
   • DExport the audit logs to a Cloud Storage bucket and upload them manually.
   Reveal Solution Discussion Select an answer first