5.2 Troubleshoot Data Management Issues (e.g., Data Ingestion, Parsing) XDR-ENGINEER Practice Questions (Page 6)

Questions 26–27

1. 26foundation · easy

   Which symptom is most likely to indicate a data ingestion problem rather than a parsing problem?

   • AEvents are received but timestamps are in the wrong timezone.
   • BSome events are duplicated in the XDR platform.
   • CThe data source shows a healthy status, but no new events have been received for several hours.
   • DLogs are present in the XDR platform but fields such as source IP and user are empty.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the first step in a systematic troubleshooting methodology for data management issues?

   • AContact the data source vendor for support.
   • BReboot the XDR platform to clear any temporary errors.
   • CImmediately change the parsing rules to see if the issue resolves.
   • DIdentify the problem and gather relevant information from logs and metrics.
   Reveal Solution Discussion Select an answer first