SecOps-Pro Cortex XDR Practice Test 1 — 15 Questions

Question 1

Which component of Cortex XDR is responsible for collecting data from non-endpoint sources like network devices or firewalls?

Accepted Answer

Cortex XDR Collector. Cortex XDR Collectors are used to ingest logs and telemetry from third-party sources and infrastructure.

Answer

Cortex Data Lake

Answer

Broker Service

Answer

Cortex XDR Agent

Question 2

You are creating a custom BIOC rule to detect suspicious PowerShell execution. The rule must trigger when PowerShell is executed with an encoded command. Which field should you focus on in the rule builder?

Accepted Answer

actor_process_command_line. The command line arguments contain the encoded script block, which is essential for detecting obfuscated PowerShell activity.

Answer

file_hash

Answer

target_process_path

Answer

process_name

Question 3

When configuring a Behavioral Threat Protection (BTP) profile, what is the impact of setting the protection mode to 'Block'?

Accepted Answer

The agent will terminate the process chain if suspicious behavior is detected.. The 'Block' mode in BTP forces the agent to kill the process if the behavioral pattern matches a known malicious sequence, even without a specific file hash match.

Answer

The agent will sandbox the process for further analysis.

Answer

The agent will report the event but allow the process to continue.

Answer

The agent will block only known malicious file hashes.

Question 4

You need to prevent the execution of a specific malicious script across the entire enterprise. What is the most efficient way to achieve this using Cortex XDR?

Accepted Answer

Add the script's hash to the Blocklist in IOC management.. Creating a Hash-based Blocklist (IOC) is the standard, enterprise-wide method to block known malicious files.

Answer

Create a manual exception in the Endpoint Policy.

Answer

Disable the script execution globally.

Answer

Use the Response feature to quarantine the file on one host.

Question 5

During an investigation, you observe multiple alerts originating from a single endpoint. You want to group these alerts into a single incident to simplify the analysis. Which feature allows this?

Accepted Answer

Manual Incident Creation. Cortex XDR uses Incident Stitching based on causality and correlation logic to group related alerts into an incident automatically or manually.

Answer

Alert Grouping policy

Answer

Alert Suppression

Answer

Correlation Rule Execution

Question 6

Where do you configure the settings to ensure that the Cortex XDR agent receives regular updates from the Cortex XDR console?

Accepted Answer

Content Update Policy. Update policies control when and how agents receive software and content updates.

Answer

Global Settings

Answer

Incident Management Settings

Answer

Endpoint Policy

Question 7

An analyst is reviewing the 'Causality View' of an alert. What does a dotted line between two processes signify?

Accepted Answer

An indirect association or cross-process activity.. In Cortex XDR Causality view, a dotted line represents an indirect relationship or a connection where the parent-child relationship is not strictly enforced via process spawning (e.g., network activity or cross-process injection).

Answer

An alert that has been suppressed.

Answer

A direct process spawn.

Answer

A process that has been quarantined.

Question 8

A security analyst needs to review logs from an endpoint that is reporting as 'Disconnected' in the Cortex XDR console. What is the first step to troubleshoot this communication issue?

Accepted Answer

Run the cytool utility to check the connectivity status on the affected endpoint.. Checking the connectivity status and agent service logs on the endpoint itself is the standard procedure to identify why the agent cannot reach the Cortex XDR cloud.

Answer

Increase the log retention period in the console.

Answer

Reinstall the Cortex XDR agent via the portal.

Answer

Disable the firewall on the endpoint.

Question 9

Which view in the Cortex XDR console provides the most comprehensive timeline of all activities related to a specific endpoint?

Accepted Answer

Endpoint View. The Endpoint View provides a detailed historical log of processes, network connections, and file modifications on a per-host basis.

Answer

Alert View

Answer

Incident View

Answer

Dashboard View

Question 10

A legitimate administrative script is being flagged by a BIOC rule. To stop the alerts without disabling the rule, what is the best approach?

Accepted Answer

Create an exception for the BIOC rule based on the process path or hash.. Adding an exception for that specific process or behavior path allows the administrative script to run while keeping the BIOC active for other threats.

Answer

Disable the BIOC rule entirely.

Answer

Change the BIOC rule to 'Alert' mode.

Answer

Move the endpoint to a different policy group.

Question 11

When performing a 'Live Terminal' session on an endpoint, what must be true for the connection to succeed?

Accepted Answer

The 'Live Terminal' feature must be enabled in the Endpoint Policy.. Live Terminal requires the agent to be online and the 'Live Terminal' capability to be explicitly enabled in the Endpoint Policy.

Answer

The endpoint must be running an older version of the agent.

Answer

The analyst must be logged into the endpoint via SSH first.

Answer

The endpoint must be in the same network as the analyst.

Question 12

You are investigating a ransomware incident. You want to see the parent process that spawned the malicious file. Which feature should you use?

Accepted Answer

Causality View. The Causality View visualizes the entire process execution chain, clearly showing the parent-child relationships leading to the alert.

Answer

Alert Details

Answer

Endpoint Activity Logs

Answer

Incident Summary

Question 13

What is the primary function of the 'Cortex XDR Data Lake'?

Accepted Answer

Store and analyze logs from various data sources.. The Data Lake is the centralized storage and processing engine for all collected logs and telemetry from agents, firewalls, and other sources.

Answer

Host the management console UI.

Answer

Manage agent installation packages.

Answer

Provide real-time endpoint protection.

Question 14

You notice that your custom BIOC rule is not firing on a host where the malicious activity is confirmed. What is a common reason for this?

Accepted Answer

The endpoint has not received the updated policy containing the BIOC.. If the agent has not yet received the latest policy update containing the new BIOC, it will not enforce the rule.

Answer

The agent is not configured to send BIOC logs.

Answer

The BIOC rule is disabled by default.

Answer

The BIOC rule requires a full agent reboot.

Question 15

What does the 'Cortex XDR Agent' do if it cannot communicate with the cloud for an extended period?

Accepted Answer

Continues to function using locally stored policies.. The agent is designed to continue protecting the endpoint using its locally stored policies and protection engines even when offline.

Answer

Enters a default 'Allow All' state.

Answer

Stops all security monitoring.

Answer

Automatically uninstalls itself.