5.2 Troubleshoot Data Management Issues (e.g., Data Ingestion, Parsing) XDR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What does validating a data source in the XDR platform primarily confirm?

   • AThat the source's logs are encrypted in transit.
   • BThat the source's logs are free of false positives.
   • CThat the source's logs are stored locally for at least 30 days.
   • DThat the source is correctly configured and actively sending data to the platform.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization has a data source that is sending logs to Cortex XDR, but the data volume is significantly lower than expected. The source status is 'healthy' and there are no parsing errors. The administrator suspects the source is not sending all its logs. What is the most effective way to validate the data source?

   • ARestart the source's logging service to ensure it is running correctly.
   • BReview the Cortex XDR ingestion dashboard for any throttling indicators.
   • CCheck the source's configuration to ensure it is set to 'send all logs'.
   • DCompare the number of events received in Cortex XDR with the source's own log count.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is reviewing data quality and notices that the 'event_time' field for events from a specific source is consistently 5 hours behind the actual time. The source is a network appliance that is configured to use UTC. What is the most likely cause?

   • AThe parsing rule is incorrectly extracting the time from the raw log.
   • BThe Cortex XDR tenant is configured to display times in a different time zone than UTC.
   • CThe network appliance's clock is not synchronized with an NTP server.
   • DThe ingestion pipeline is delaying events by 5 hours.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization is ingesting Windows Event Logs from a new domain controller. The data is arriving, but the Cortex XDR search interface shows the Event ID field is empty for all events from this source. Other fields like timestamp and hostname are populated correctly. What is the most likely cause of this issue?

   • AThe Cortex XDR tenant has reached its data ingestion quota for the day.
   • BThe domain controller is not generating Event ID data in its logs.
   • CThe network connection between the domain controller and the collector is dropping packets.
   • DThe source is sending logs in a format that the default parsing rule does not recognize for the Event ID field.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A team is onboarding a new custom application that sends JSON logs. The administrator has created a parsing rule, but the Cortex XDR search interface shows that the 'user' field is not being populated. The raw log clearly contains a 'user' key. What is the most efficient way to validate the parsing rule?

   • ARecreate the parsing rule from scratch to ensure it is correct.
   • BReview the documentation for the custom application to confirm the log format.
   • CUse the parsing rule test feature with a sample of the raw log to see how fields are extracted.
   • DCheck the data ingestion dashboard for parsing errors from this source.
   Reveal Solution Discussion Select an answer first