5.3 Troubleshoot Cortex XDR Components (e.g., Agents, Collectors, Broker VM) XDR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An administrator notices that a Cortex XDR agent is consuming excessive CPU on an endpoint. Which of the following is the most likely cause of this performance issue?

   • AThe agent is not receiving updates from the management console, causing it to run outdated detection engines.
   • BThe agent is configured to send telemetry data to the management console every second.
   • CThe agent is configured to perform a full disk scan on every file access.
   • DThe agent is experiencing a conflict with another security product installed on the endpoint.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A user reports that their endpoint is not protected by Cortex XDR. The agent is installed, but the console shows the agent as 'Uninstalled'. What should you do to resolve this issue?

   • AReinstall the agent on the endpoint.
   • BCheck the endpoint's firewall rules for the agent's communication ports.
   • CUpdate the agent's registration token in the console.
   • DVerify that the endpoint has enough disk space for the agent.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company's Cortex XDR Collector is not ingesting logs from a specific source. The Collector is configured correctly, and other sources are working. What should you check to determine if the source is sending logs to the Collector?

   • AThe source device's log forwarding configuration.
   • BThe Cortex XDR tenant's log ingestion policy.
   • CThe Collector's service account permissions.
   • DThe Collector's disk space and memory usage.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An administrator is troubleshooting a data flow issue in Cortex XDR. The Collector is receiving data from a syslog source, but the data is not appearing in the Cortex XDR console. Which of the following components is most likely to be the source of the problem?

   • AThe syslog source is not configured to send data to the Collector.
   • BThe Collector is not forwarding the data to the Cortex XDR cloud.
   • CThe agent on the syslog source is not forwarding data to the Collector.
   • DThe Broker VM is not forwarding data from the Collector to the cloud.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A user reports that their endpoint is running slowly after a Cortex XDR agent update. The agent is running and connected to the console. Which action should you take to address the performance issue?

   • AIncrease the endpoint's memory allocation to the agent.
   • BCheck the agent's resource usage and adjust its scan schedule to run during off-peak hours.
   • CDisable the agent's real-time protection to reduce resource usage.
   • DReinstall the agent to revert to the previous version.
   Reveal Solution Discussion Select an answer first