Evidence Review And Response Actions

An administrator needs to automate a remediation workflow so that whenever a specific critical alert severity is triggered, Cortex XDR automatically runs a script to collect forensic artifacts. Where must this automation be configured?

An analyst identifies a custom, benign internal tool that is continuously flagged by a BIOC rule in Cortex XDR. To prevent future alerts without disabling the entire rule globally, what is the best practice method to create an exception?

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

An organization experiences a false positive alert caused by a legitimate administrative script executed via PowerShell. The analyst wants to create an exception that applies specifically to this script's command-line arguments without whitelisting PowerShell entirely. What type of exception should be configured?

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

An analyst wants to prevent Cortex XDR from generating alerts on a specific signature-based detection (such as a known vulnerability scanner tool) across a specific endpoint group. Where should this exclusion be created?

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

An analyst is investigating a suspected phishing attack and needs to review the command line arguments passed to a suspicious email attachment execution. Where can the analyst find this evidence in Cortex XDR?

An analyst wants to ensure that any file evaluated with a specific SHA-256 hash is immediately blocked from execution across all endpoints managed by Cortex XDR, regardless of its WildFire verdict. Where should this hash be added?

An analyst needs to change the status of an incident from 'Under Investigation' to 'Resolved' after completing remediation. Which section of the Incident View allows updating the incident status?

An analyst is investigating an incident and wants to export the full incident report and associated artifact list for compliance reporting. Which option should the analyst select in Cortex XDR?

An analyst writes an XQL query to investigate lateral movement. Which dataset table in Cortex XDR contains comprehensive network connection telemetry across endpoints?

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

An analyst notices suspicious network connections originating from an unknown process on an endpoint. To block outbound communication for this process without isolating the entire host, what action can be taken?

Which TWO automated or manual response actions can be executed directly on an endpoint from the Cortex XDR Incident Response toolbox? (Choose two)

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

An analyst is reviewing the Causality Chain for an alert. Which TWO key insights does this view provide? (Choose two)

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

Which TWO pieces of information are displayed in the Incident summary dashboard of Cortex XDR? (Choose two)

When managing exclusions and exceptions in Cortex XDR, which THREE best practices should an analyst follow to maintain security posture? (Choose three)

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

When reviewing identity alerts in Cortex XDR, which TWO anomalous behaviors might indicate compromised credentials? (Choose two)

Which TWO actions can an analyst take when closing an incident in Cortex XDR? (Choose two)

Which TWO forensic logs or artifacts are most valuable when investigating a suspected ransomware attack on an endpoint? (Choose two)

An analyst is performing advanced threat hunting in Cortex XDR using XQL. Which THREE clauses or functions are commonly used when constructing analytical queries for evidence review? (Choose three)

Which TWO details are typically reviewed when inspecting an alert in the Cortex XDR Incident Viewer? (Choose two)

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

When an endpoint is isolated during an incident response action in Cortex XDR, which TWO types of network traffic are generally permitted to ensure continued management and minimal disruption? (Choose two)

When responding to a malware alert, an analyst decides to quarantine the offending file. Which TWO outcomes occur when Cortex XDR performs a file quarantine? (Choose two)

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

An analyst is investigating an alert involving suspicious PowerShell execution. To thoroughly review the evidence, which THREE investigative steps should the analyst take within Cortex XDR? (Choose three)

Which TWO actions are available to an analyst when managing an incident's assignment in Cortex XDR? (Choose two)

An administrator needs to configure automated incident response actions in Cortex XDR. Which THREE components are critical for building a successful automated response workflow? (Choose three)

Which TWO details does the Cortex XDR Incident Graph display during evidence review? (Choose two)

Which TWO evidence sources help an analyst investigate whether an unauthorized user accessed a compromised workstation locally? (Choose two)

An analyst discovers that a malicious payload communicated with an external Command and Control (C2) server. Which TWO evidence sources should the analyst review to identify the C2 communication details? (Choose two)

When conducting a comprehensive post-incident review and remediation verification in Cortex XDR, which THREE actions should an analyst perform? (Choose three)

An analyst is investigating an incident where a malicious file was dropped via email. Which TWO evidence artifacts should the analyst inspect to correlate the email vector with the endpoint execution? (Choose two)

An analyst wants to create a robust incident response workflow in Cortex XDR that incorporates both manual analyst review and automated remediation. Which THREE capabilities support this integrated approach? (Choose three)

When investigating an endpoint compromise, an analyst suspects DLL sideloading was used to execute malicious code. Which TWO telemetry indicators should the analyst examine? (Choose two)

An organization wants to configure Cortex XDR to automatically respond to high-severity ransomware alerts. Which THREE elements must be correctly configured to ensure successful automated mitigation? (Choose three)

Which TWO views in Cortex XDR are primarily used to monitor overall alert and incident status across the SOC? (Choose two)

An analyst is reviewing a Cortex XDR alert for a suspicious process on a Windows endpoint. They need to determine the parent process that spawned the suspicious executable to understand the attack chain. Which Cortex XDR feature or view should the analyst use to see the process lineage and related causality information?

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint wrote a suspicious executable to a network share. To determine whether the file was previously seen and analyzed by Palo Alto Networks WildFire, which action should the analyst take from the alert's causality view?

An analyst is investigating a Cortex XDR incident involving a Windows endpoint. The analyst needs to retrieve a copy of a suspicious executable from the endpoint's disk to submit to WildFire for further analysis, without executing the file locally. Which response action should the analyst use?

During a live investigation, an analyst needs to isolate a Windows endpoint from the network while preserving the ability to run response actions and pull files for forensic review. Which Cortex XDR action best satisfies this requirement?

An analyst is reviewing a Cortex XDR incident where an attacker used a legitimate remote monitoring and management (RMM) tool to maintain persistence. The analyst wants to identify all endpoints where the same RMM tool has been installed and running over the past 30 days. Which Cortex XDR capability should the analyst use?

An analyst determines that a compromised endpoint is beaconing to a known malicious domain. The analyst wants to immediately stop the endpoint from reaching that domain while keeping the rest of the host's business traffic intact. Which Cortex XDR response action should the analyst choose?

After containing a malware outbreak, an analyst needs to document the incident in Cortex XDR. The analyst wants to add a note summarizing the root cause and remediation steps to the incident for future reference. Which action should the analyst take?

An analyst is reviewing a Cortex XDR incident that contains a 'Behavioral Threat' alert for a process that spawned a child process with suspicious command-line arguments. The analyst wants to see the full process lineage, including the parent process, command line, and the user account that initiated it, to determine if this is a false positive. Which Cortex XDR feature should the analyst use to obtain this information?

An analyst investigating a ransomware incident on a Windows endpoint needs to determine which process originally created the malicious executable that was later detected. The analyst opens the Cortex XDR Causality Chain view for the alert. Which element of the Causality Chain directly identifies the parent process responsible for spawning the malicious file?

An analyst is investigating a potential data exfiltration incident. They have identified a suspicious external IP address that the endpoint communicated with. To gather more context, they want to see all historical network connections involving that IP address across the organization. Which Cortex XDR capability should the analyst use?

An analyst is investigating a Cortex XDR incident involving a suspicious process on a Windows endpoint. The analyst wants to gather volatile evidence from the endpoint before taking containment actions. Which TWO response actions can be used to collect volatile evidence? (Choose two.)

A Cortex XDR analyst is reviewing an endpoint alert and wants to capture volatile evidence from the affected host before initiating remediation. The analyst decides to run a live terminal session on the endpoint through the Cortex XDR console. Which statement accurately describes the capability and limitation of this live terminal session?

A Cortex XDR analyst is investigating an incident where a user's endpoint was compromised. The analyst needs to determine if the attacker moved laterally to other endpoints by leveraging stolen credentials. Which Cortex XDR data source should the analyst query to identify successful and failed authentication attempts across the environment?

An analyst is reviewing a Cortex XDR incident involving a compromised Linux server. The analyst needs to retrieve the contents of a suspicious file located at /tmp/malware.bin from the endpoint for further analysis. Which response action should the analyst use?

An analyst is reviewing a Cortex XDR incident where a suspicious PowerShell script was executed on an endpoint. The analyst wants to see the exact command-line arguments that were passed to PowerShell at the time of execution. Which Cortex XDR feature should the analyst use to find this information?

An analyst is reviewing a Cortex XDR alert for a suspicious PowerShell script that was executed on a Windows endpoint. The analyst wants to gather additional context about the script's execution. Which TWO data sources are available directly in the Cortex XDR alert details to help understand the script's behavior? (Choose two.)

An analyst is investigating a series of alerts related to a suspicious scheduled task created on a Windows endpoint. They want to determine the user account that created the task and the exact command that was scheduled. Which Cortex XDR data source should the analyst review to find this information?

An analyst is investigating a Cortex XDR incident and wants to add a note to the incident timeline to document the steps taken so far. Where in the Cortex XDR console can the analyst add this note?

After containing a malware outbreak, a Cortex XDR analyst needs to verify that the malicious file was removed from all affected endpoints. The analyst wants to confirm the current state of the endpoints without waiting for the next scheduled scan. Which Cortex XDR action allows the analyst to query endpoint file system state on demand and return results to the console?

An analyst is investigating a security incident and needs to review the timeline of events that occurred on a compromised endpoint. The analyst wants to see a chronological list of all alerts, process executions, and network connections related to the incident. Which Cortex XDR view should the analyst use?

An analyst is reviewing a Cortex XDR incident where an endpoint has been compromised by malware that established persistence via a scheduled task. The analyst wants to remove the scheduled task remotely. Which response action should the analyst use?

During an investigation, a Cortex XDR analyst notices that an endpoint generated a high volume of network connection events to a suspicious external IP address. The analyst wants to isolate the host from the network while still allowing the Cortex XDR agent to communicate with the console for continued investigation. Which Cortex XDR response action should the analyst use?

An analyst is reviewing a Cortex XDR incident involving a suspicious PowerShell script that was executed on multiple endpoints. The analyst needs to gather evidence to determine the script's origin and impact. Which TWO actions should the analyst take to collect relevant evidence from the endpoints? (Choose two.)

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint spawned a child process with a suspicious command line. The analyst wants to see the exact parent-child process relationship and the full command line of the parent process to determine if this is a true positive. Which pane in the Cortex XDR Alert view provides this information?

An analyst is investigating a Cortex XDR alert indicating a possible ransomware attack. The analyst wants to isolate the affected endpoint from the network while preserving the ability to remotely investigate and remediate. Which Cortex XDR response action should the analyst take?

An analyst is reviewing an incident in Cortex XDR and wants to add a note explaining the steps taken during the investigation. Where should the analyst add this note?

An analyst is reviewing a Cortex XDR incident and wants to identify which endpoints are affected and what user accounts were involved. Which TWO pieces of information can be directly obtained from the Incident Details page to help with this assessment? (Choose two.)

During an investigation of a suspected data exfiltration incident, an analyst observes that a finance workstation initiated an outbound SMB connection to an unfamiliar internal host on port 445 at 02:14. The analyst wants to determine whether lateral movement occurred before sensitive files were staged. Which TWO Cortex XDR evidence sources should the analyst review to correlate the SMB session with the originating process and the remote endpoint's activity? (Choose two.)

An analyst is reviewing a Cortex XDR incident involving a Windows endpoint that exhibited suspicious registry modifications. The analyst needs to determine whether a persistence mechanism was established by a specific process. Which Cortex XDR evidence source should the analyst review to see the registry key path, the value data written, and the process that performed the modification?

After containing a ransomware incident on a Windows endpoint, an analyst needs to preserve volatile evidence for later forensic analysis before the endpoint is reimaged. Which Cortex XDR response action should the analyst use to capture a snapshot of the endpoint's memory and running processes?