5.2 Troubleshoot Data Management Issues (e.g., Data Ingestion, Parsing) XDR-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An administrator is troubleshooting why no data is appearing in Cortex XDR from a new endpoint group. The agents on the endpoints show as 'connected' in the console. Which of the following is the most likely reason for the missing data?

   • AThe data collection profile for the endpoint group is not configured to send the required event types.
   • BThe endpoints are not running any applications that generate logs.
   • CThe Cortex XDR tenant is out of storage space.
   • DThe endpoints are in a different time zone than the Cortex XDR tenant.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which issue is most likely to be caused by a parsing error?

   • AEvents are received but the user field contains the raw log message instead of the username.
   • BThe platform is slow to search across ingested events.
   • CThe data source is listed as 'disconnected' in the platform.
   • DThe XDR platform receives no data from a configured source.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An administrator is reviewing data quality in Cortex XDR and notices that events from a specific Linux server have a 'user' field that is consistently populated with the value 'unknown'. The raw logs from the server contain the correct username. What is the most likely cause?

   • AThe Linux server is sending logs in a format that the parsing rule does not fully understand.
   • BThe Linux server's users are all configured with the username 'unknown'.
   • CThe 'user' field is not a standard field in the Cortex XDR schema.
   • DThe Cortex XDR agent on the Linux server is not running with sufficient privileges.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of data parsing in the XDR platform?

   • ATo encrypt log data before it is stored in the platform.
   • BTo convert raw log data into a structured format with consistent field names and values.
   • CTo compress log data to reduce storage costs.
   • DTo route log data to different collectors based on the source type.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is ingesting logs from a custom application that uses a non-standard timestamp format. The parsing rule correctly extracts all other fields, but the 'event_time' field is empty. The raw log contains a timestamp like '2024-03-15T14:30:00.123Z'. The administrator has verified the timestamp is present in the raw log. What is the most likely reason the field is empty?

   • AThe application is sending the timestamp in a different field than expected.
   • BThe ingestion pipeline is stripping the timestamp before parsing.
   • CThe Cortex XDR schema does not support the 'event_time' field.
   • DThe parsing rule is not configured to recognize the ISO 8601 timestamp format.
   Reveal Solution Discussion Select an answer first