3.1 Onboard Data Sources (e.g., NGFW, Network, Cloud, Identity) XDR-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security team has just deployed a new Palo Alto Networks NGFW in a remote branch office. They want to send its traffic logs to Cortex XDR for analysis. The NGFW is already registered with the Palo Alto Networks support portal. What is the most efficient way to begin ingesting these logs?

   • AInstall the Cortex XDR agent on the NGFW management interface and configure it to forward logs to the Cortex XDR tenant.
   • BDeploy a third-party log collector on the branch network and configure it to push logs to Cortex XDR using the API.
   • CConfigure a syslog server on the NGFW and then manually upload the syslog files to Cortex XDR on a daily basis.
   • DIn the Cortex XDR console, use the NGFW connector to configure the firewall to send logs directly to the Cortex XDR tenant.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company wants to ingest logs from its network switches into Cortex XDR. The switches can send syslog to a central collector. The security team has configured the syslog collector in Cortex XDR and pointed the switches to it. What should they do next to ensure the logs are usable?

   • AInstall the Cortex XDR agent on the switches to improve log collection.
   • BVerify that the syslog messages are being parsed into the expected fields in Cortex XDR.
   • CCreate a detection rule that uses the switch logs.
   • DConfigure the switches to send logs in CEF format instead of syslog.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which protocol is commonly used by network devices to send logs to the Cortex XDR Broker VM for onboarding?

   • ASMTP
   • BNetFlow
   • CSNMP
   • DSyslog
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What does it mean when the XDR platform 'normalizes' ingested data?

   • AIt compresses data to save storage space
   • BIt encrypts the data to protect it in transit
   • CIt deduplicates identical events
   • DIt converts data into a standard format for analysis
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   After onboarding a Palo Alto Networks NGFW, a security analyst notices that threat logs are appearing in Cortex XDR, but traffic logs are not. The NGFW is configured to send both types to the same collector. What is the most likely cause?

   • AThe traffic log forwarding profile is not configured on the NGFW.
   • BThe NGFW's traffic log storage is full.
   • CThe Cortex XDR connector is only configured to accept threat logs.
   • DThe traffic logs are being sent to a different collector.
   Reveal Solution Discussion Select an answer first