XDR-Analyst Practice Test 10 — 10 Questions

Question 1

When reviewing the Incident View, an analyst notices an incident with an orange severity badge. What does this severity level typically indicate in Cortex XDR?

Accepted Answer

High severity incident. Cortex XDR uses standard severity levels (Low, Medium, High, Critical) represented by color-coded badges, where orange typically denotes High severity.

Answer

Critical severity incident requiring immediate containment

Answer

Low priority false positive

Answer

Informational event requiring no action

Question 2

An administrator is planning the deployment of Broker VM instances across a multi-site enterprise network. Which TWO best practices should be followed when planning Broker VM deployments?

Accepted Answer

Deploy Broker VM instances locally at remote sites or data centers to aggregate logs and reduce WAN bandwidth consumption. Option B is correct because deploying Broker VM instances locally at remote sites or data centers lets them aggregate and buffer logs close to the source, which reduces WAN bandwidth consumption and avoids sending raw telemetry across high-latency links. Option D is correct because Broker VM capacity is driven by throughput, so vCPU and RAM must be sized to the expected events-per-second (EPS) load to prevent dropped or delayed log forwarding. Option A is wrong because Broker VM is a server-side virtual appliance, not software installed on Windows 10 Pro workstations. Option C is wrong because the Broker VM is not designed as a permanent seven-year log archive; long-term retention belongs in the management console or a dedicated storage/SIEM repository. Option E is wrong because a single Broker VM cannot adequately serve 50,000 global endpoints over high-latency WAN links; multiple distributed instances are required for scale and locality.

Answer

Install the Broker VM directly on user workstations running Windows 10 Pro

Answer

Configure the Broker VM to store all enterprise log data locally on its virtual disk permanently for 7 years

Answer

Share a single Broker VM instance across 50,000 global endpoints separated by high-latency WAN links

Question 3

When planning a Cortex XDR deployment, an administrator must select the appropriate deployment method for endpoints. Which TWO methods are officially supported for mass-deploying the Cortex XDR agent across a Windows enterprise domain?

Accepted Answer

Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune using the .msi package. Option D is correct because Cortex XDR officially supports mass deployment on Windows domains through Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune, distributing the provided .msi package via standard software-deployment mechanisms. Option E is correct because Active Directory Group Policy Object (GPO) Software Installation is a documented, supported method for pushing the Cortex XDR agent .msi to domain-joined Windows endpoints at scale. Option A is not a supported mass-deployment method, since email self-installation is unreliable, unmanaged, and not an official enterprise deployment channel. Option B is not viable for mass deployment because manually visiting each workstation with a USB drive is unscalable and not an officially supported automated method. Option C is not acceptable because broadcasting binaries over unauthenticated public FTP servers is insecure and not a supported Cortex XDR deployment method.

Answer

Sending the installer executable as an email attachment to all employees with instructions to self-install

Answer

Manually walking to every workstation with a USB flash drive to execute the GUI installer interactively

Answer

Broadcasting the installer binary over unauthenticated public FTP servers

Question 4

An analyst is triaging a Cortex XDR incident that contains a mix of high and low severity alerts. The analyst wants to quickly identify which alerts are most critical to address first. Which column in the Incident View's Alerts tab should the analyst sort by to prioritize alerts based on their potential impact?

Accepted Answer

Severity. The Severity column provides a quick, at-a-glance indication of how critical each alert is. By sorting descending on Severity, the analyst can immediately see and address the most severe alerts first, ensuring that high-impact threats are handled promptly. This aligns with standard triage practices of focusing on the highest risk items.

Answer

Timestamp

Answer

Alert Name

Answer

Endpoint Name

Question 5

A Cortex XDR analyst is building an ITDR detection strategy for an environment using Microsoft Entra ID and on-premises Active Directory. The analyst wants to identify identity-based attacks that span both cloud and on-premises authentication. Which TWO Cortex XDR data sources provide the authentication telemetry needed to correlate cloud sign-ins with on-premises logons? (Choose two.)

Accepted Answer

Microsoft Entra ID sign-in and audit logs ingested via the Cortex XDR cloud identity connector.. Correlating cloud and on-premises identity attacks requires authentication telemetry from both planes. Entra ID sign-in and audit logs provide cloud authentication context, while domain controller Windows Security logs provide Kerberos, NTLM, and logon events. Together they let Cortex XDR link a cloud sign-in to an on-premises logon and expose hybrid attacks such as password spray or token theft spanning both environments.

Answer

DNS query logs from internal resolvers, including queries for external domains.

Answer

Endpoint process execution logs from user workstations, including command-line arguments.

Answer

Firewall traffic logs showing outbound connections to known malicious IP addresses.

Question 6

What is the primary function of the Cortex XDR Content Updates delivered automatically to endpoints?

Accepted Answer

To update detection rules, behavioral heuristics, and malware signatures on the agent. Cortex XDR Content Updates are automatic downloads that refresh the agent's detection content — including behavioral heuristics, detection rules, and malware signatures — without requiring a full agent upgrade. This ensures endpoints stay protected against emerging threats with minimal administrative overhead.

Answer

To upgrade the core operating system of the host endpoint

Answer

To upgrade the Broker VM hypervisor kernel version

Answer

To renew the TLS certificates of the Palo Alto Networks support portal

Question 7

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

Accepted Answer

It reduces alert fatigue by grouping related alerts into a single attack storyline.. The Incident Viewer's primary value is correlating multiple related alerts across machines into a single attack storyline, which reduces alert fatigue and helps analysts understand the full scope of an attack rather than investigating isolated alerts. By grouping alerts that share causality (same actor, same malware family, same timeline), it reveals the attack chain from initial access to impact.

Answer

It automatically upgrades endpoint operating system licenses.

Answer

It deletes duplicate log files to save storage space.

Answer

It provisions new virtual machines for containment.

Question 8

A security operations manager wants analysts to quickly see, for any user in Cortex XDR, a consolidated timeline of authentication events, accessed resources, and associated alerts across the environment. Which Cortex XDR feature should analysts use to obtain this per-user consolidated view?

Accepted Answer

User View. User View in Cortex XDR is purpose-built to consolidate a single user's authentication events, resource access, and related alerts into one investigative surface. It enables analysts to quickly assess whether an account's behavior is anomalous without manually correlating multiple log sources, which is exactly what the manager wants.

Answer

Incident Response Investigation

Answer

Threat Intelligence Management

Answer

Policy Audit

Question 9

A Cortex XDR analyst is investigating a suspected credential dumping attack on a Windows endpoint. The attacker used a tool that accessed LSASS memory to extract credentials. Which Cortex XDR capability would most directly detect this activity by monitoring for unauthorized access to LSASS?

Accepted Answer

Behavioral Indicator of Compromise (BIOC) rules. Behavioral Indicator of Compromise (BIOC) rules in Cortex XDR are specifically designed to detect malicious behaviors on endpoints, including unauthorized access to LSASS memory. By monitoring process access attempts with specific access rights, these rules can identify credential dumping tools in real time, providing direct detection of the attack technique.

Answer

Host firewall rule violation

Answer

Analytics alert on unusual network traffic

Answer

File quarantine action log

Question 10

What THREE conditions can cause data stitching failures between network logs and endpoint telemetry in Cortex XDR? (Choose three)

Accepted Answer

Significant time skew or clock desynchronization between data sources. Data stitching in Cortex XDR correlates network logs with endpoint telemetry by matching on common fields within a bounded time period, so A is correct because significant time skew or clock desynchronization between data sources prevents events from aligning on the timeline and breaks the correlation. C is correct because unmapped or inconsistent user identity formats across systems mean the identity field cannot be normalized and matched between network and endpoint records, so the stitch key fails. D is correct because events occurring outside the predefined data stitching time window fall outside the correlation interval and are never paired, even if all other fields match. B is not a stitching condition—starring endpoint alerts is a triage/UI action that does not alter the underlying correlation logic. E is not a cause of failure—enabling featured fields for the network log source supports parsing and field extraction rather than preventing stitching.

Answer

Starring the endpoint alerts during triage

Answer

Enabling featured fields for the network log source