3.1 Onboard Data Sources (e.g., NGFW, Network, Cloud, Identity) XDR-ENGINEER Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A security operations team wants to enrich alerts with user information from Okta, their identity provider. They have already configured the Okta connector in Cortex XDR and it shows 'Connected'. What should they do to confirm that the identity data is being used for enrichment?

   • AVerify that the Okta connector is sending logs to the Cortex XDR collector.
   • BEnsure that the Okta API token has read-only permissions.
   • CCheck the Cortex XDR console for user information in recent alerts.
   • DReview the Okta system log for connector activity.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which component acts as the central repository for NGFW logs before they are ingested by the XDR platform?

   • ACortex Data Lake
   • BCortex XDR Broker VM
   • CCortex XSOAR
   • DPanorama
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following correctly lists the categories of data sources that can be onboarded to the Palo Alto Networks XDR platform?

   • ANGFW, network, cloud, and identity
   • BFirewall, switch, router, and proxy
   • COn-premises, cloud, and hybrid
   • DEndpoint, server, and application
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company wants to enrich its Cortex XDR alerts with user identity information from its on-premises Active Directory. They have a domain controller that can communicate with the Cortex XDR tenant. What should they configure to enable this enrichment?

   • AExport the Active Directory database and upload it to Cortex XDR as a custom identity source.
   • BInstall the Cortex XDR agent on the domain controller and enable identity collection.
   • CEnable LDAP forwarding on the domain controller to send authentication logs to Cortex XDR.
   • DConfigure the Active Directory connector in the Cortex XDR console with the domain controller's credentials.
   Reveal Solution Discussion Select an answer first