XDR-Analyst Practice Test — Free Certified XDR Analyst (XDR-Analyst) Questions with Explanations

An XDR analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst notices that the network alerts lack associated endpoint process information, even though the same host is involved. What is the most likely cause for this missing correlation?

An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?

An analyst needs to change the status of an incident from 'Under Investigation' to 'Resolved' after completing remediation. Which section of the Incident View allows updating the incident status?

A Cortex XDR analyst sees an alert for a user account that authenticated successfully from an unfamiliar ASN, then immediately triggered a privileged role assignment in Azure AD. Which Cortex XDR capability should the analyst use FIRST to correlate the identity activity with endpoint and network telemetry in a single timeline?

A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three regional offices. The company wants to minimize the number of open inbound firewall ports on their network while still allowing agents to receive policy updates and send telemetry. Which deployment consideration should the architect prioritize?

An analyst is investigating a Cortex XDR incident that contains an alert for a suspicious PowerShell script execution on a Windows endpoint. The analyst wants to see the exact command line and parent process that triggered the alert without leaving the incident view. Which action should the analyst take?

An XDR Analyst is investigating a newly generated incident in Palo Alto Networks Cortex XDR and notices that multiple disparate alerts from different endpoints and network sensors have been automatically grouped together. Which core mechanism of Cortex XDR is primarily responsible for intelligently grouping these related alerts into a single incident?

A security team is deploying Cortex XDR agents to 8,000 endpoints across three geographic regions. The network team requires that all agent-to-cloud communication be routed through a controlled, on-premises egress point rather than allowing direct internet access from each endpoint. Which Cortex XDR component should the administrator deploy to satisfy this requirement?

A security team is planning a Cortex XDR deployment for a small business with 250 endpoints and no existing on-premises security infrastructure. The administrator must decide how to retrieve and distribute the endpoint agent installer. Which Cortex XDR capability should be used to obtain the installer package directly from the management console?

A Cortex XDR incident contains 15 alerts that were automatically stitched together. The analyst determines that 3 of these alerts are false positives caused by a legitimate administrative script. The analyst wants to remove these 3 alerts from the incident without affecting the other 12 alerts. What is the correct action?

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

An organization notices an increase in credential dumping attacks against local Active Directory environments. They want to configure Cortex XDR Identity Analytics to trigger high-severity alerts when abnormal Kerberos ticket requests (such as potential Silver or Golden ticket activities) are detected. Where should the analyst enable or tune these specific identity behavior analytics rules?

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

An analyst investigating a ransomware incident on a Windows endpoint needs to determine which process originally created the malicious executable that was later detected. The analyst opens the Cortex XDR Causality Chain view for the alert. Which element of the Causality Chain directly identifies the parent process responsible for spawning the malicious file?

An administrator is setting up syslog log collection on a Broker VM. By default, which UDP and TCP port does the Broker VM Syslog collector listen on for incoming syslog messages from network devices?

An administrator is designing a Cortex XDR deployment for a company with a main data center and a remote branch office connected by a low-bandwidth WAN link. The branch has 200 endpoints that must remain manageable even if the WAN link fails temporarily. Which deployment consideration best supports this requirement?

You are configuring integration between Cortex XDR and an external Identity Provider (IdP) to ingest user authentication logs for ITDR. Which component is primarily responsible for securely forwarding these IdP telemetry logs to the Cortex XDR data lake?

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

A Cortex XDR analyst is examining an alert where a user account successfully authenticated from two different countries within a 10-minute window. The analyst suspects impossible travel. Which Cortex XDR feature would provide a visual representation of the user's login locations and times to confirm this?

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?