SecOps-Pro Cortex XDR — 30 Questions

Question 1

During an investigation, you observe multiple alerts originating from a single endpoint. You want to group these alerts into a single incident to simplify the analysis. Which feature allows this?

Accepted Answer

Manual Incident Creation. Manual Incident Creation in Cortex XDR allows an analyst to create a new incident and then attach or group multiple related alerts into it, enabling consolidated investigation and response. This is the feature that directly supports grouping alerts from a single endpoint into one incident. It gives the analyst control over incident scope and correlation when automated grouping has not occurred.

Answer

Alert Grouping policy

Answer

Alert Suppression

Answer

Correlation Rule Execution

Question 2

Where do you configure the settings to ensure that the Cortex XDR agent receives regular updates from the Cortex XDR console?

Accepted Answer

Content Update Policy. Update policies control when and how agents receive software and content updates.

Answer

Global Settings

Answer

Incident Management Settings

Answer

Endpoint Policy

Question 3

Which view in the Cortex XDR console provides the most comprehensive timeline of all activities related to a specific endpoint?

Accepted Answer

Endpoint View. The Endpoint View in the Cortex XDR console provides a comprehensive timeline of all activities related to a specific endpoint, including process executions, network connections, file operations, and alerts. It aggregates endpoint telemetry into a single chronological view, making it the most complete source for endpoint-centric investigation. This is why it is the correct answer.

Answer

Alert View

Answer

Incident View

Answer

Dashboard View

Question 4

Which configuration setting in the Malware profile determines if the agent should move a file to a secure location upon detection?

Accepted Answer

File Action. The 'Quarantine' action in the Malware profile instructs the agent to move the malicious file to a hidden, encrypted folder on the endpoint.

Answer

Endpoint Protection Rule

Answer

Detection Mode

Answer

Scan Frequency

Answer

Remediation Policy

Question 5

An analyst is investigating a malware alert on a Windows endpoint. In the Cortex XDR alert details, the Causality View shows a process named `powershell.exe` with a child process `rundll32.exe`. The analyst right-clicks `rundll32.exe` and selects 'Add to Block List'. What is the immediate effect of this action?

Accepted Answer

The file hash of `rundll32.exe` is added to the Block List, and any future execution of that specific hash is blocked on all endpoints managed by the Cortex XDR tenant.. The 'Add to Block List' action in the Causality View adds the selected process's file hash to the tenant-wide block list. This prevents any endpoint from executing that exact file in the future. It does not terminate the running process, create exceptions, or quarantine files. The action is immediate and affects all managed endpoints.

Answer

The `rundll32.exe` process is quarantined and moved to a secure folder, and its hash is added to the Block List for the next 24 hours.

Answer

A new exception is created in the Behavioral Threat Protection (BTP) profile to allow `rundll32.exe` to run, but only on the affected endpoint.

Answer

The `rundll32.exe` process is terminated and its hash is added to the Block List, preventing execution of that exact file on all endpoints in the organization.

Question 6

A Cortex XDR administrator needs to ensure that a PowerShell script executed on a Windows endpoint is scanned by the local WildFire engine before it is allowed to run, even if the endpoint is offline. The administrator creates a new Malware profile. Which action setting for the Portable Executable and DLL file type should be selected to meet this requirement?

Accepted Answer

Set the action to 'Local Analysis' for the Portable Executable and DLL file type.. The requirement is to scan a PowerShell script with the local WildFire engine before execution, even when offline. Local Analysis is the only action that performs an on-endpoint scan and makes an allow/block decision based on the verdict. Other actions like Block, Report, or Quarantine do not provide this pre-execution analysis capability.

Answer

Set the action to 'Block' for the Portable Executable and DLL file type.

Answer

Set the action to 'Quarantine' for the Portable Executable and DLL file type.

Answer

Set the action to 'Report' for the Portable Executable and DLL file type.

Question 7

A Cortex XDR administrator is configuring a new exception rule to prevent false positives from a custom administrative tool. The tool performs actions that trigger Behavioral Threat Protection (BTP) alerts. The administrator wants to ensure the exception applies only to this tool and does not weaken security posture. Which two criteria can be used to define the exception in a BTP profile? (Choose two.)

Accepted Answer

File hash (SHA256). BTP exceptions can be defined using process name and file hash (SHA256). These criteria allow precise targeting of the custom administrative tool, ensuring that only its known behavior is excluded. Process name alone might be spoofed, but combined with hash it provides strong specificity. Other options like user name or command line are not supported for BTP exceptions, making them incorrect.

Answer

Parent process name

Answer

Command line arguments

Answer

User name

Question 8

A Cortex XDR administrator needs to ensure that all endpoint agents automatically receive the latest security policies and content updates without manual intervention. Which component is responsible for this?

Accepted Answer

Cortex XDR Content Delivery Network (CDN). The Cortex XDR Content Delivery Network (CDN) is the component that delivers security content and policy updates to endpoints. Agents periodically check the CDN for new content and download it automatically, ensuring they have the latest protections without requiring manual action from administrators. This is essential for maintaining up-to-date defenses.

Answer

Cortex XDR Agent

Answer

Cortex XDR Management Server

Answer

Cortex XDR Data Lake

Question 9

A Cortex XDR analyst is creating a custom detection rule using the XQL query language. The analyst wants to ensure the rule triggers only when a specific process (e.g., 'powershell.exe') is executed with a command line containing 'Invoke-Expression' and establishes a network connection to an external IP address within 5 minutes. Which TWO XQL operators or clauses should the analyst use to correlate the process execution and network connection events? (Choose two.)

Accepted Answer

comp. To correlate process execution and network connection events in XQL, the analyst can use the 'join' operator to combine datasets based on a common field like process ID. Alternatively, the 'comp' stage can compare field values across stages. Both methods allow linking events within a specified time frame, enabling detection of the described behavior.

Answer

filter

Answer

window

Answer

union

Question 10

A Cortex XDR administrator needs to ensure that all endpoints in a high-security zone automatically block known malicious files based on threat intelligence. The administrator wants to minimize manual intervention and ensure the block is applied even if the endpoint is offline. Which configuration should be used?

Accepted Answer

Create a Malware profile with action set to Block and assign it to the endpoint group.. A Malware profile with the action set to Block provides local, policy-based blocking of known malicious files. It is enforced by the endpoint agent even when offline, ensuring continuous protection. Assigning it to the endpoint group applies the policy to all relevant endpoints. Other options either focus on behavior, require online connectivity, or are manual, failing to meet the automatic and offline requirements.

Answer

Set up an IOC rule to block execution of known malicious files.

Answer

Configure a Behavioral Threat Protection profile with blocking enabled.

Answer

Use the Incident Response action to quarantine files on all endpoints.

Question 11

A Cortex XDR analyst receives an alert about a suspicious PowerShell script executed on a server. The analyst wants to quickly determine the script's content and its network connections without disrupting the server. Which combination of Cortex XDR features should the analyst use?

Accepted Answer

Live Terminal to run PowerShell commands and Endpoint Investigation to query network events.. Live Terminal provides a remote shell to inspect the script's content and execute diagnostic commands without disrupting the server. Endpoint Investigation allows querying of network events related to the script's execution. This combination enables a thorough, non-disruptive investigation. Other options either disrupt operations, lack necessary detail, or rely on potentially incomplete logs.

Answer

Incident Response to isolate the server and then analyze the script offline.

Answer

Use the Causality View to see the script's execution chain and then export the script from the alert details.

Answer

Query the Data Lake for PowerShell script block logging events and use Threat Intelligence to check network connections.

Question 12

A Cortex XDR administrator needs to prevent a known malicious driver (hash: 7a3b9c2d1e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b) from loading on all Windows endpoints in the organization. The administrator wants a policy-based, scalable solution that does not rely on manual intervention per endpoint. What should the administrator do?

Accepted Answer

Create a Malware profile in the endpoint policy and add the driver hash to the Blocklist.. The Malware profile within an endpoint policy allows administrators to define a blocklist of file hashes. When the policy is applied to endpoints, the Cortex XDR agent prevents those files from executing or loading. This provides a centralized, scalable way to block known malicious drivers across the enterprise without manual intervention.

Answer

Add the driver hash to the BIOC rule set with an action of 'Block'.

Answer

Use the Cortex XDR API to push a script that adds the hash to the Windows Defender blocklist on each endpoint.

Answer

Configure a Restriction rule in the endpoint policy to deny execution of the driver file name.

Question 13

Which component of Cortex XDR is responsible for collecting data from non-endpoint sources like network devices or firewalls?

Accepted Answer

Cortex XDR Collector. The Cortex XDR Collector is the component designed to ingest logs and data from non-endpoint sources such as network devices, firewalls, and third-party systems. It forwards this telemetry into Cortex XDR for correlation and analytics. This makes it the correct answer for collecting from non-endpoint sources.

Answer

Cortex Data Lake

Answer

Broker Service

Answer

Cortex XDR Agent

Question 14

You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?

Accepted Answer

actor_process_command_line. To detect PowerShell executed with an encoded command, the rule must inspect the command line used to launch PowerShell. The 'actor_process_command_line' field captures the full command line of the process that initiated the action, including '-EncodedCommand' or '-enc' arguments. This is the correct field for detecting encoded PowerShell.

Answer

file_hash

Answer

target_process_path

Answer

process_name

Question 15

When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?

Accepted Answer

The agent will terminate the process chain if suspicious behavior is detected.. The 'Block' mode in BTP forces the agent to kill the process if the behavioral pattern matches a known malicious sequence, even without a specific file hash match.

Answer

The agent will sandbox the process for further analysis.

Answer

The agent will report the event but allow the process to continue.

Answer

The agent will block only known malicious file hashes.

Question 16

You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?

Accepted Answer

Add the script's hash to the Blocklist in IOC management.. Adding the malicious script's hash to the Blocklist in IOC management lets Cortex XDR block that exact file across all protected endpoints via the global IOC mechanism. Hash-based blocking is deterministic and applies enterprise-wide without needing per-endpoint exceptions or manual response actions. This is the most efficient way to prevent execution of a known malicious file at scale.

Answer

Create a manual exception in the Endpoint Policy.

Answer

Disable the script execution globally.

Answer

Use the Response feature to quarantine the file on one host.

Question 17

An analyst is reviewing the 'Causality View' of an alert. What does a dotted line between two processes signify?

Accepted Answer

An indirect association or cross-process activity.. In Cortex XDR Causality view, a dotted line represents an indirect relationship or a connection where the parent-child relationship is not strictly enforced via process spawning (e.g., network activity or cross-process injection).

Answer

An alert that has been suppressed.

Answer

A direct process spawn.

Answer

A process that has been quarantined.

Question 18

A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?

Accepted Answer

Run the cytool utility to check the connectivity status on the affected endpoint.. Checking the connectivity status and agent service logs on the endpoint itself is the standard procedure to identify why the agent cannot reach the Cortex XDR cloud.

Answer

Increase the log retention period in the console.

Answer

Reinstall the Cortex XDR agent via the portal.

Answer

Disable the firewall on the endpoint.

Question 19

A legitimate administrative script is being flagged by a BIOC rule. To stop the alerts without disabling the rule, what is the best approach?

Accepted Answer

Create an exception for the BIOC rule based on the process path or hash.. Creating an exception for the BIOC rule based on the process path or hash allows the legitimate administrative script to bypass the rule without disabling it entirely. This maintains detection for other processes while suppressing false positives for known good scripts. Exceptions are a standard feature in security tools to handle benign activity.

Answer

Disable the BIOC rule entirely.

Answer

Change the BIOC rule to 'Alert' mode.

Answer

Move the endpoint to a different policy group.

Question 20

When performing a 'Live Terminal' session on an endpoint, what must be true for the connection to succeed?

Accepted Answer

The 'Live Terminal' feature must be enabled in the Endpoint Policy.. Live Terminal requires the agent to be online and the 'Live Terminal' capability to be explicitly enabled in the Endpoint Policy.

Answer

The endpoint must be running an older version of the agent.

Answer

The analyst must be logged into the endpoint via SSH first.

Answer

The endpoint must be in the same network as the analyst.