5.2 Troubleshoot Data Management Issues (e.g., Data Ingestion, Parsing) XDR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An administrator is setting up a new data source in Cortex XDR to ingest logs from a cloud-based application via API. The source is configured, but no data is appearing. The API endpoint is reachable from the administrator's workstation. What is the most likely cause of the issue?

   • AThe Cortex XDR collector does not have network access to the API endpoint.
   • BThe Cortex XDR tenant is not licensed for API-based data sources.
   • CThe API endpoint is not generating any logs.
   • DThe administrator's workstation is blocking the API traffic.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An administrator notices that the Cortex XDR ingestion dashboard shows a growing backlog of events from a high-volume firewall source. Events are being ingested, but with a delay of several hours. The collector's CPU and memory usage are normal. What should the administrator investigate next?

   • ACheck the Cortex XDR tenant for any active maintenance windows.
   • BCheck if the firewall's syslog rate exceeds the collector's configured maximum event rate.
   • CRestart the collector service to clear the backlog.
   • DVerify that the firewall's syslog destination is set to the correct port.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A team is ingesting logs from a network appliance. The parsing rule was working, but after a firmware update on the appliance, the 'action' field is no longer being populated. The raw logs show the action is now in a different position in the message. What is the best way to resolve this?

   • AIgnore the 'action' field since it is not critical for security monitoring.
   • BRevert the firmware update on the appliance to restore the old log format.
   • CContact the appliance vendor to request a fix for the log format.
   • DUpdate the parsing rule to match the new log format and test it against a sample.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What does assessing data quality in the XDR platform primarily involve?

   • AEnsuring that all data is encrypted at rest.
   • BConfirming that all data sources are using the same vendor.
   • CVerifying that data is stored in the correct region.
   • DEvaluating ingested data for completeness, accuracy, and consistency.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A security analyst notices that logs from a firewall are not appearing in the XDR platform. Which initial step should the analyst take to troubleshoot data ingestion?

   • ADisable and re-enable the firewall's logging feature to force a fresh data stream.
   • BCheck the firewall's local storage to see if logs are being generated and retained.
   • CRebuild the parsing rules for the firewall logs to ensure they match the expected schema.
   • DVerify that the firewall is reachable from the XDR platform and that the configured ingestion credentials are valid.
   Reveal Solution Discussion Select an answer first