3.1 Onboard Data Sources (e.g., NGFW, Network, Cloud, Identity) XDR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the first step in onboarding a cloud-based data source, such as AWS CloudTrail, into the XDR platform?

   • ADeploying the Cortex XDR agent on cloud instances
   • BConfiguring a syslog forwarder in the cloud
   • CEnabling the cloud provider's native logging service
   • DCreating an IAM role with the necessary permissions
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   After configuring a data source connector, how can you verify that data is being successfully ingested into the XDR platform?

   • ARestart the XDR management server
   • BCheck the connector status in the Data Sources page
   • CReview the firewall logs for blocked traffic
   • DContact support to confirm the configuration
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of onboarding identity sources, such as Active Directory, into the XDR platform?

   • ATo block malicious users in real time
   • BTo enrich XDR data with user and group information
   • CTo replace the need for endpoint agents
   • DTo store authentication logs for compliance
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company wants to ingest traffic logs from its Cisco switches and routers into Cortex XDR to gain network visibility. The devices are on a separate management VLAN and can reach the internet. What is the required first step to onboard these network devices?

   • ACreate a new data source type in the Cortex XDR console and upload the device configuration files.
   • BEnable NetFlow export on the devices and point it to the Cortex XDR tenant's public IP.
   • CConfigure each device to send syslog messages to the Cortex XDR collector IP address.
   • DInstall the Cortex XDR agent on each switch and router.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is onboarding Azure Activity Logs into Cortex XDR. They have created an event hub and configured the diagnostic settings to stream the logs. What is the next step in the Cortex XDR console?

   • AEnable Network Watcher to forward the logs to Cortex XDR.
   • BConfigure the Azure connector with the event hub namespace and policy name.
   • CCreate a storage account and upload the logs manually.
   • DInstall the Cortex XDR agent on an Azure VM to forward the logs.
   Reveal Solution Discussion Select an answer first