Skip to exam content
← All Exams
Techclick Infosec

WAZUH-XDR Practice Test

Architecture · Agents & Log Collection · Decoders & Rules · FIM/SCA/Vuln · Active Response · Integrations & Compliance

60 questions · 90 min · 70% Techclick practice target

60
Questions
90
Minutes
70%
Techclick Practice Target

⚠️ Exam Rules

  • Once started, the timer cannot be paused
  • You can navigate freely — use Previous or the Navigator panel to revisit any question
  • Tab-switching triggers warnings (3 strikes = auto-submit)
  • Right-click and copy disabled during exam
  • If you fail, retry — questions and options reshuffle
Powered by Techclick Infosec Pvt Ltd

WAZUH-XDR practice test: what's covered

Questions in this Techclick bank58
Timer90 min
Techclick practice target70%
Official exam codeWAZUH-XDR

Free WAZUH-XDR sample questions

  1. In a standard Wazuh 4.x stack, which component is responsible for receiving events from agents, decoding them, applying rules, and generating alerts?

    • A. The Wazuh indexer
    • B. The Wazuh manager
    • C. The Wazuh dashboard
    • D. Filebeat
    Show answer

    Correct: B. The Wazuh manager (analysisd/remoted, etc.) receives agent events, decodes and correlates them against rules, and writes alerts. The indexer stores them, Filebeat ships them, and the dashboard visualizes them.

  2. An analyst is building the Wazuh central components and needs a full-text search and storage engine for alerts. Which component provides this, and what is it a fork of?

    • A. Wazuh indexer, a fork of OpenSearch
    • B. Wazuh dashboard, a fork of Grafana
    • C. Wazuh manager, a fork of Logstash
    • D. Filebeat, a fork of Fluentd
    Show answer

    Correct: A. The Wazuh indexer is a search and analytics engine based on OpenSearch (itself forked from Elasticsearch 7.10). It stores and indexes the alerts and telemetry that the manager produces.

  3. What is the role of Filebeat in a Wazuh deployment on the manager node?

    • A. It decodes raw agent logs into fields
    • B. It securely forwards the manager's alerts (alerts.json) to the Wazuh indexer
    • C. It runs vulnerability scans against agents
    • D. It serves the web UI to analysts
    Show answer

    Correct: B. Filebeat reads the manager's alerts.json output and ships it (typically over TLS) to the Wazuh indexer for storage and indexing. Decoding/rules happen in the manager, not Filebeat.

  4. By default, which port does the Wazuh manager listen on for encrypted agent communication (agent enrollment data and events)?

    • A. TCP 1514
    • B. TCP 1515
    • C. TCP 55000
    • D. TCP 9200
    Show answer

    Correct: A. Agents send events to the manager on TCP 1514 (remoted). 1515 is the enrollment daemon (authd), 55000 is the manager RESTful API, and 9200 is the indexer.

  5. Map the daemon to its default port for a self-registering agent. Which TWO pairings are correct? (Choose TWO)

    • A. wazuh-authd handles enrollment on TCP 1515
    • B. wazuh-remoted receives agent events on TCP 1514
    • C. wazuh-authd handles enrollment on TCP 1514
    • D. wazuh-remoted receives agent events on TCP 55000
    • E. wazuh-execd receives agent events on TCP 1515
    Show answer

    Correct: A and B. wazuh-authd listens on TCP 1515 to register agents and issue the key; wazuh-remoted then receives the agent's encrypted events on TCP 1514. The 55000 port is the manager API, not event ingest.

Last updated:

WAZUH-XDR practice test FAQ

Is this WAZUH-XDR practice test free?

Yes. You can start, finish and score it for free, and download the Techclick practice certificate.

How many questions are in the Techclick WAZUH-XDR practice test?

This bank has 58 original scenario-based questions with a 90-minute timer and a 70% Techclick practice target.

What is the official exam code and format?

WAZUH-XDR is the label Techclick uses for this practice set. Check the official Wazuh certification page for the current exam code.

Are these real WAZUH-XDR exam questions or dumps?

No. They are original practice questions written by Techclick. This is not the vendor's official exam and not leaked dumps.

Do I get a certificate?

Score 70% or higher to get a Techclick practice certificate and LinkedIn badge. It is not an official Wazuh certification.

What should I take after WAZUH-XDR?

Use the Wazuh practice exams page (linked above) to pick the next practice test in the same track.

Techclick Infosec
TECHCLICK INFOSEC
CYBERSECURITY · PRACTICE ASSESSMENT
🦉
PRACTICE ASSESSMENT
Wazuh XDR
Architecture · Agents & Log Collection · Decoders & Rules · FIM/SCA/Vuln · Active Response · Integrations & Compliance
AWARDED TO
{NAME}
SCORE
0%
DATE
--
TC-WAZUH-XDR-XXX
Practice certificate · not independently verified · Techclick Infosec Pvt Ltd · +91 92772 29456