XDR-Analyst Practice Test 11 — 15 Questions

Question 1

An analyst is investigating an incident and needs to determine whether lateral movement occurred between two endpoints. Which Cortex XDR feature provides the visual connection between these assets within the incident?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Incident Graph and Causality Chain. The Incident Graph and Causality Chain in Cortex XDR visually maps how processes, alerts, and endpoints relate within an incident, making lateral movement between two endpoints visible as a connected chain of causality. It shows the parent-child process relationships and network connections that link the assets. This is the feature purpose-built for visualizing asset-to-asset relationships in an incident.

Answer

The Data Stitching status indicator

Answer

The Alert Starring bookmark manager

Answer

The Featured Fields configuration panel

Question 2

A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three geographic regions. The security team wants to minimize the number of external firewall rules required for agent-to-cloud communication while still allowing the agents to receive policy updates and upload telemetry. Which component should the architect deploy in each region to aggregate and forward agent traffic to the Cortex XDR cloud tenant?

Accepted Answer

A Cortex XDR Broker VM. The Broker VM is designed to aggregate and forward agent traffic to the Cortex XDR cloud tenant, reducing the need for many direct outbound connections. In multi-region deployments, placing a Broker VM in each region concentrates agent communication and simplifies firewall rules. It also supports local apps such as syslog collection, but its core planning benefit here is traffic concentration.

Answer

A Cortex XDR management console

Answer

A Cortex XDR Content Update server

Answer

A Cortex XDR agent installation token

Question 3

During incident triage, an analyst notices that a Cortex XDR incident contains alerts from both a Windows endpoint and a Linux server. The analyst wants to see the specific MITRE ATT&CK techniques associated with each alert to understand the adversary's tactics. Where can the analyst find this information?

Accepted Answer

In the Alert details pane, under the 'MITRE ATT&CK' tab.. The alert details pane in Cortex XDR includes a 'MITRE ATT&CK' tab that maps the alert to specific tactics and techniques. This is the most direct and comprehensive place to view technique information for each alert, regardless of the endpoint's operating system.

Answer

In the Causality Chain, each process is annotated with its MITRE technique.

Answer

In the Incident Timeline, each alert displays its MITRE technique.

Answer

In the Incident Summary, a list of all MITRE techniques is provided.

Question 4

An administrator is planning agent deployment in an air-gapped environment (no direct internet access to the public cloud). How do Cortex XDR agents receive content updates and policy changes in this scenario?

Accepted Answer

Through a Broker VM configured to download and distribute content updates locally within the air-gapped network. In air-gapped environments, agents receive updates through a local Broker VM configured as a content proxy/gateway that syncs from an internal source or offline bundle.

Answer

Via dial-up modem backup lines connected directly to Palo Alto Networks support

Answer

Air-gapped environments are not supported by Cortex XDR under any circumstances

Answer

Updates are physically loaded via USB thumb drive into every endpoint agent daily

Question 5

An analyst is examining a Cortex XDR incident that includes a high-severity alert for a suspicious process execution. The analyst wants to determine the parent process that spawned the suspicious process and the command line arguments used. Which Cortex XDR feature should the analyst use to obtain this information?

Accepted Answer

Incident View > Causality Chain. The Causality Chain is designed to visualize the process execution flow that triggered an alert. It shows the parent process, the suspicious process, and any child processes, along with command line arguments. This allows the analyst to quickly understand how the suspicious process was launched and what it did, which is critical for determining the scope and nature of the threat.

Answer

Endpoint Investigation > Search, using a process name filter

Answer

Incident View > Timeline, filtered by process name

Answer

Incident View > Alerts tab, then click the alert to view its details

Question 6

An analyst is investigating a Cortex XDR incident that includes both endpoint and network alerts. They notice that the incident's timeline shows a gap between a network alert indicating a suspicious outbound connection and a subsequent endpoint alert for process execution. The analyst suspects that the two alerts are related but were not stitched into the same incident. What is the most likely reason for the failure to correlate these alerts into a single incident?

Accepted Answer

The network alert lacks a valid host identifier that matches the endpoint's hostname or IP address in the endpoint alert.. Correlation in Cortex XDR relies on shared entities such as hostnames, IP addresses, or usernames. If a network alert does not contain a host identifier that matches the endpoint alert's hostname or IP, the system cannot stitch them together. This often happens when network logs lack endpoint context or when NAT obscures the internal IP. Thus, the missing or mismatched host identifier is the most likely cause.

Answer

The network alert and endpoint alert have different severity levels, so Cortex XDR does not correlate them.

Answer

The two alerts occurred more than 5 minutes apart, exceeding the correlation time window.

Answer

The endpoint alert was generated by a different Cortex XDR agent version than the network alert's sensor.

Question 7

An analyst notices that a Cortex XDR incident contains alerts from two different endpoints that appear to be part of the same attack campaign. The analyst wants to confirm that the incidents are linked by a common threat actor. Which Cortex XDR feature provides a graphical representation of the relationships between alerts, endpoints, and indicators of compromise (IOCs) to help identify such connections?

Accepted Answer

Incident View > Graph. The Graph view is specifically designed to visualize the relationships between entities within an incident, such as alerts, endpoints, and IOCs. It allows analysts to quickly spot shared indicators or communication paths that suggest a coordinated attack. This graphical correlation is essential for linking seemingly separate alerts to a single threat actor.

Answer

Incident View > Alert Timeline

Answer

Incident View > Timeline

Answer

Incident View > Causality Chain

Question 8

A security team is planning its first Cortex XDR deployment and must decide how to group endpoints so that different prevention policies apply to servers versus user workstations. Which planning action should the administrator take first?

Accepted Answer

Create endpoint groups and assign each group a tailored agent policy, then target the groups during installation.. Endpoint groups let administrators apply different agent policies to different endpoint categories, so servers and workstations can each receive appropriate prevention settings. Planning groups before installation ensures endpoints land in the correct policy from the start, avoiding manual reconfiguration and keeping the deployment organized and auditable.

Answer

Disable prevention modules on servers and rely solely on the workstations' policy to protect the environment.

Answer

Purchase separate Cortex XDR tenants for servers and workstations to keep their policies isolated.

Answer

Install all agents with the default policy, then manually edit each endpoint's local configuration after installation.

Question 9

An analyst is reviewing a Cortex XDR alert for a suspicious process on a Windows endpoint. They need to determine the parent process that spawned the suspicious executable to understand the attack chain. Which Cortex XDR feature or view should the analyst use to see the process lineage and related causality information?

Accepted Answer

Causality View. Causality View is the built-in Cortex XDR visualization that links related events and shows the process tree, including parent-child relationships. For an analyst trying to identify the parent process of a suspicious executable, this view provides the necessary context and attack chain visualization, making it the correct tool.

Answer

Threat Intelligence module

Answer

Alert Details page

Answer

Endpoint Management console

Question 10

A company is planning its first Cortex XDR deployment and wants to confirm which component is responsible for centrally storing endpoint telemetry, running analytics, and delivering policy to agents. Which component fulfills this role?

Accepted Answer

The Cortex XDR management console hosted in the cloud tenant.. The cloud-hosted Cortex XDR management console is the central management plane that stores telemetry, performs analytics, and distributes policy to agents. Agents enforce and report, while Broker VMs extend reach to isolated networks, but neither replaces the cloud tenant as the authoritative analytics and policy source.

Answer

The Cortex XDR agent installed on each endpoint.

Answer

The on-premises Cortex XDR server component installed by the customer.

Answer

The Broker VM deployed in the local network.

Question 11

An analyst needs to quickly identify all incidents in Cortex XDR that are related to a specific MITRE ATT&CK technique, such as T1059 (Command and Scripting Interpreter). What is the most efficient way to find these incidents?

Accepted Answer

Apply a filter on the Incidents page for the 'MITRE ATT&CK' field and select the desired technique.. The Incidents page in Cortex XDR includes a filter for MITRE ATT&CK tactics and techniques. Applying this filter allows the analyst to view only incidents that contain alerts mapped to the selected technique. This is the most direct and efficient way to find all relevant incidents without manual searching or querying.

Answer

Run a query in the Query Builder using the 'mitre_technique_id' field.

Answer

Create a custom dashboard widget that counts incidents by MITRE technique.

Answer

Use the search bar on the Incidents page and type the technique ID.

Question 12

An administrator is planning a Cortex XDR deployment for a hospital network with strict change-control and limited maintenance windows. Before rolling agents out to clinical workstations, the administrator must validate that the deployment will not disrupt critical medical applications. Which TWO planning activities best reduce the risk of application conflicts during the rollout? (Choose two.)

Accepted Answer

Identify critical applications and plan for agent profile exclusions or exceptions where legitimate conflicts are found.. A staged pilot on representative endpoints surfaces conflicts safely, and preparing scoped exclusions for known critical applications resolves genuine issues without weakening protection network-wide. Together these activities let the administrator validate compatibility under change control before committing to a broad clinical rollout, minimizing the chance of disrupting patient-care systems.

Answer

Disable all agent prevention modules globally during the initial rollout to guarantee no application is affected.

Answer

Skip documentation of the deployment plan so the team can adapt quickly to unexpected issues.

Answer

Install agents on all clinical workstations simultaneously during peak operating hours to complete the project quickly.

Question 13

An analyst is investigating a Cortex XDR incident where the same alert appears multiple times with different timestamps. The analyst wants to understand why the alert was duplicated. Which factor is most likely responsible for the duplicate alerts within the incident?

Accepted Answer

The same detection rule triggered repeatedly on the same endpoint due to recurring activity, and each trigger created a new alert.. Duplicate alerts within an incident typically occur when the same detection rule triggers multiple times on the same endpoint due to recurring activity. Each trigger generates a separate alert with its own timestamp. Cortex XDR stitches these alerts into the same incident because they share common entities like hostname and rule ID. This is expected behavior and not a correlation failure.

Answer

The alert was triggered by multiple independent detection rules that share the same name.

Answer

The incident was created from a BIOC that was updated, causing historical alerts to be re-evaluated and duplicated.

Answer

The Cortex XDR correlation engine failed to deduplicate alerts that have identical raw data but different alert IDs.

Question 14

An administrator is planning a Cortex XDR deployment where agents will be installed on endpoints that have no direct internet access and will rely on a Broker VM for connectivity. Which TWO planning tasks are required to ensure the agents can register and communicate through the Broker VM? (Choose two.)

Accepted Answer

Configure the Broker VM with the correct tenant registration and ensure it has outbound access to the Cortex XDR cloud.. Agents without internet access need a reachable Broker VM that is registered to the tenant and has outbound cloud connectivity, and the agents must be configured to use that Broker VM as their communication path. Together these ensure registration and ongoing communication function in a restricted network.

Answer

Install a second Broker VM on every endpoint to provide redundancy for agent communication.

Answer

Disable TLS inspection on the Broker VM so agent traffic is encrypted end to end without interference.

Answer

Assign each agent a static public IP address so the Broker VM can identify and authenticate it.

Question 15

An analyst is reviewing a Cortex XDR incident where an attacker used a legitimate remote monitoring and management (RMM) tool to maintain persistence. The analyst wants to identify all endpoints where the same RMM tool has been installed and running over the past 30 days. Which Cortex XDR capability should the analyst use?

Accepted Answer

XQL Query. XQL Query is the correct choice because it enables ad-hoc searching of endpoint telemetry, including process and application data, across a defined time period. The analyst can craft a query to filter for the RMM tool's indicators and return all affected endpoints. Other options are either response actions or configuration reviews that do not provide the needed historical search capability.

Answer

Incident Response Playbook

Answer

Policy Audit

Answer

Endpoint Isolation