5.2 Troubleshoot Data Management Issues (e.g., Data Ingestion, Parsing) XDR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An administrator is troubleshooting a data ingestion issue where a specific source is not sending data. The source status in Cortex XDR shows as 'disconnected'. Which of the following is the most systematic next step?

   • AWait for the source to reconnect automatically.
   • BCheck the source's local logs and configuration to determine why it is disconnected.
   • CRestart the Cortex XDR tenant service to re-establish the connection.
   • DCreate a new data source in Cortex XDR to replace the disconnected one.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How would an analyst typically test a parsing rule in the XDR platform?

   • ABy submitting a sample log entry and reviewing the extracted fields.
   • BBy reviewing the rule's documentation and comments.
   • CBy waiting for the rule to be applied to live data and observing results.
   • DBy checking the rule's syntax in a code editor.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which resource would an analyst consult to understand the expected behavior of a data source during troubleshooting?

   • AThe analyst's personal notes from previous incidents.
   • BThe XDR platform's user forum.
   • CThe data source's marketing materials.
   • DThe platform's documentation and the data source's configuration guide.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is investigating a security incident and notices that the 'process_name' field for events from a specific endpoint is populated with the value 'unknown' for all events. The raw logs from the endpoint contain the correct process names. The endpoint is running a standard Windows configuration. What is the most likely cause?

   • AThe Cortex XDR agent on the endpoint is not collecting process information.
   • BThe Cortex XDR tenant is not licensed for process-level data.
   • CThe parsing rule for the endpoint's event type is not correctly extracting the process name.
   • DThe endpoint is running a process that is not recognized by Cortex XDR.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which platform tool or log would an analyst use to check for delays in data ingestion?

   • AThe parsing rule editor.
   • BThe ingestion pipeline monitoring dashboard or logs.
   • CThe data retention settings page.
   • DThe user management console.
   Reveal Solution Discussion Select an answer first