3.1 Onboard Data Sources (e.g., NGFW, Network, Cloud, Identity) XDR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is onboarding their on-premises Active Directory into Cortex XDR for identity enrichment. They are concerned about the security of the credentials used by the connector. What is the best practice for storing and using the credentials?

   • AUse the domain administrator account to ensure the connector has full access.
   • BStore the credentials in a plain text file on the connector server.
   • CUse a dedicated service account with the minimum required permissions and store the credentials in a secure vault.
   • DUse a certificate instead of credentials for authentication.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is onboarding network device logs from multiple vendors into Cortex XDR. The devices send logs in different formats: some use syslog, some use CEF, and some use custom JSON. What is the best approach to normalize these logs for analysis?

   • AOnly onboard devices that support CEF format.
   • BConfigure a separate connector for each format and use parsing rules to normalize the data.
   • CUse a third-party log aggregator to convert all logs to a single format before sending to Cortex XDR.
   • DConvert all devices to send logs in syslog format.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is onboarding Azure Activity Logs into Cortex XDR. They have set up an event hub and configured the diagnostic settings. The connector is configured, but no logs are appearing. The event hub is receiving logs (verified in Azure). What is the most likely cause?

   • AThe diagnostic settings are sending logs to the wrong event hub.
   • BThe connector's access policy name or key is incorrect.
   • CThe event hub is not configured to send logs to Cortex XDR.
   • DThe Cortex XDR tenant is not in the same region as the event hub.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the typical method for onboarding network data sources, such as switches and routers, into the XDR platform?

   • ADeploying a Cortex XDR Broker VM to collect and forward logs
   • BUsing a log forwarding profile on each device
   • CConfiguring the devices to send logs directly to the Cortex Data Lake
   • DInstalling the Cortex XDR agent on each device
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of an identity data source that can be onboarded to the XDR platform?

   • AActive Directory
   • BCortex Data Lake
   • CPalo Alto Networks NGFW
   • DAmazon Web Services (AWS)
   Reveal Solution Discussion Select an answer first