5.2 Troubleshoot Data Management Issues (e.g., Data Ingestion, Parsing) XDR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which observation would most likely indicate a data quality problem?

   • AAn increase in the number of users accessing the platform.
   • BA change in the platform's default timezone setting.
   • CA decrease in the number of false positives in alerts.
   • DA sudden increase in events with missing or malformed fields.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which action is part of validating a data source in the XDR platform?

   • ADeleting and re-adding the source to the platform.
   • BModifying the parsing rules for the source's logs.
   • CChecking the source's status in the platform to ensure it is 'connected'.
   • DReviewing the source's firewall rules to ensure they allow all traffic.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of monitoring the ingestion pipeline in the XDR platform?

   • ATo generate compliance reports for auditors.
   • BTo detect bottlenecks and ensure data is processed in a timely manner.
   • CTo rewrite parsing rules for all data sources.
   • DTo delete old data from the platform to free up storage.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst is investigating a potential incident and queries Cortex XDR for authentication events from a specific server. The results show that the 'source_ip' field is populated with the server's own IP address for all events, even though the analyst knows the events originated from various remote workstations. What does this anomaly most likely indicate?

   • AThe remote workstations are all connecting through a VPN that terminates on the server.
   • BThe Cortex XDR agent on the server is misconfigured and overwriting the source IP.
   • CThe server is the only device generating authentication events.
   • DThe server is configured to log events with its own IP as the source, which is a parsing issue.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A team is onboarding a new data source that sends logs in a key-value format. The administrator has created a parsing rule, but the 'source_ip' field is not being populated for some events. The raw logs show that the 'source_ip' key is present in all events, but its value is sometimes empty. What is the most likely cause?

   • AThe source is not sending the 'source_ip' key in some events.
   • BThe ingestion pipeline is dropping events with empty 'source_ip' values.
   • CThe Cortex XDR schema requires 'source_ip' to be a valid IP address.
   • DThe parsing rule is not handling events where the 'source_ip' value is empty.
   Reveal Solution Discussion Select an answer first