XDR-Analyst Practice Test 12 — 15 Questions

Question 1

Which THREE features of Cortex XDR assist an analyst in conducting a deep-dive forensic investigation into an identity-based alert?

Accepted Answer

User View providing identity risk scores and associated device history. Storyline, XQL search, and the User View are essential tools for deep-dive forensic investigations in Cortex XDR.

Answer

Automated disk defragmentation utility

Answer

Printer queue status monitor

Question 2

An enterprise is facing credential stuffing attacks targeting its cloud and on-premises applications. Which TWO detection or mitigation strategies within Cortex XDR and integrated tools help address this threat?

Accepted Answer

Analytics rules detecting high-frequency failed login attempts across multiple accounts from distributed source IPs. Credential stuffing can be detected via analytics identifying high volumes of failed logins from distinct external IPs, and mitigated via identity provider conditional access or automated account locking.

Answer

Modifying screen saver timeout intervals via Group Policy

Answer

Configuring printer sharing permissions on all Windows 10 endpoints

Answer

Enabling USB mass storage device blocking

Question 3

Which THREE key identity-based threat behaviors are typically detected and flagged by Cortex XDR Identity Analytics? (Choose three)

Accepted Answer

Abnormal privilege escalation or group membership changes. Cortex XDR Identity Analytics detects anomalies such as impossible travel, brute-force or password spray attacks, and unusual privilege escalations.

Answer

Corrupted sector errors on mechanical hard drives

Answer

Standard browser bookmark synchronization

Question 4

When planning a Cortex XDR deployment, what is the primary function of the Cortex XDR server component within the cloud architecture?

Accepted Answer

To act as the centralized management console, analytics engine, and data lake for security events. The Cortex XDR cloud backend hosts the analysis engine, data lake, and management console for threat investigation and policy configuration.

Answer

To replace the Panorama management server for firewall policy enforcement

Answer

To locally store raw endpoint memory dumps indefinitely without cloud transmission

Answer

To execute automated sandbox detonation for all enterprise email traffic

Question 5

Which TWO types of user accounts are critical to monitor closely for privilege abuse and anomalous behavior within an ITDR program?

Accepted Answer

Domain Administrator accounts. Domain Administrators and Service Accounts are high-value targets for attackers and require rigorous monitoring.

Answer

Guest user accounts with zero permissions

Answer

Unassigned printer test accounts

Answer

Deactivated former employee accounts

Question 6

An enterprise security architect is designing a multi-tenant Cortex XDR architecture where different business units must have isolated visibility. Which feature in Cortex XDR allows the administrator to logically segment endpoints, logs, and alerts by business unit?

Accepted Answer

Tenant Management and Endpoint Groups with RBAC scoping. Multi-tenancy and role-based access control (RBAC) along with Endpoint Groups allow administrative segregation within a single tenant or via multi-tenant architecture.

Answer

Broker VM App Domains

Answer

Global Protect Gateway Zones

Answer

Virtual Router Contexts within the Agent Core

Question 7

An administrator is troubleshooting a Broker VM that has lost connectivity to the Cortex XDR cloud tenant. After logging into the Broker VM CLI, which command should the administrator use to test connectivity and troubleshoot DNS/HTTPS communication to the cloud backend?

Accepted Answer

show broker status and test connection. The Broker VM CLI provides specific troubleshooting commands, including network diagnostics and connectivity tests to verify cloud reachability.

Answer

traceroute -m 64 gateway

Answer

ping -t customer.paloaltonetworks.com

Answer

tail -f /var/log/pan_broker_vm.log

Question 8

What is the primary function of the Cortex XDR Agent Support File collection tool?

Accepted Answer

To collect diagnostic logs, configuration details, and troubleshooting data for Palo Alto Networks Support. The Support File collection tool gathers diagnostic logs and system states from the endpoint agent to assist Palo Alto Networks support in troubleshooting.

Answer

To generate a forensic disk image of the entire hard drive

Answer

To back up the user's personal documents to the cloud data lake

Answer

To export endpoint cryptographic keys to an external vault

Question 9

An analyst is investigating a compromised user account in Cortex XDR and wants to review identity-based alerts generated by Active Directory monitoring. Which specific view in the Cortex XDR management console provides a consolidated timeline of identity events and authentication anomalies for a specific user?

Accepted Answer

The User View in the Incident or Audit logs. The User View in Cortex XDR consolidates identity-related telemetry, user risk scoring, and activity timelines across connected identity sources like Active Directory and Okta.

Answer

The Device Management inventory tab

Answer

The Correlation Rules editor

Answer

The Host Details page under Endpoint Protection

Question 10

An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?

Accepted Answer

Cortex XDR Broker VM. The Broker VM serves as a local aggregator and proxy for Cortex XDR agents that are off-network, enabling secure communication with the Cortex XDR management console.

Answer

Panther Agent Gateway

Answer

Cortex XDR Agent Collector Service

Answer

Panorama Log Forwarding App

Question 11

An administrator wants to ensure that Cortex XDR agents automatically update their software version whenever a new version is released by Palo Alto Networks. Where is this automated agent upgrade setting configured?

Accepted Answer

Settings > Configurations > Agent Settings > Upgrades. Agent upgrade settings are managed within the Agent Settings profiles in the Cortex XDR console.

Answer

Help > About > Check for Updates

Answer

Response > Actions > Push Update

Answer

Data Collector > Broker VM > Software Distribution

Question 12

An administrator is troubleshooting a Broker VM that fails to connect to the Cortex XDR cloud management console after deployment. Which THREE potential causes should be investigated?

Accepted Answer

An expired or incorrect registration token used during the initial setup wizard. Broker VM connection failures are commonly caused by DNS resolution issues, firewall blocks on TCP 443, or incorrect/expired registration tokens.

Answer

Incorrect fiber channel zoning on the enterprise SAN switch

Answer

Insufficient physical RAM installed on the host laptop running Windows 11

Question 13

An administrator is setting up User Risk Scoring within Cortex XDR. They notice that certain service accounts with high volumes of automated authentications are skewing the risk calculations. How should the administrator handle these service accounts in Cortex XDR to prevent false-positive risk elevations?

Accepted Answer

Configure Identity Analytics exclusions or entity classifications for known service accounts. Administrators can configure exclusions or adjustments in Identity Analytics for specific service accounts or known non-human entity patterns to prevent skewed risk scores.

Answer

Delete all authentication logs associated with service accounts from the Cortex XDR data lake

Answer

Disable Cortex XDR Agent protection on all Domain Controllers

Answer

Convert the service accounts into standard local administrator accounts

Question 14

An organization has strict egress filtering rules. Which destination URLs or IP ranges must be whitelisted in the corporate firewall to allow the Cortex XDR agent to communicate with the Cortex XDR cloud service?

Accepted Answer

The specific regional Cortex XDR tenant FQDNs and update distribution domains. Cortex XDR agents require outbound HTTPS access to the specific regional Cortex XDR cloud tenant URLs provided by Palo Alto Networks.

Answer

A static list of Palo Alto Networks global headquarters IP addresses

Answer

Only local internal DNS servers

Answer

Public NTP servers only

Question 15

An administrator needs to deploy Cortex XDR agents to a fleet of Linux servers running Ubuntu 20.04. Before executing the installation script, which prerequisite package must be verified as installed on the Linux endpoints to ensure kernel module or Extended Berkeley Packet Filter (eBPF) support functions correctly?

Accepted Answer

Kernel headers and dependent build tools matching the running kernel version. Linux agents rely on standard kernel headers, build essentials, or specific utilities depending on whether kernel modules or eBPF are utilized.

Answer

Microsoft .NET Framework 4.8 Runtime

Answer

IIS Web Server Role and ASP.NET

Answer

Active Directory Domain Services Client tools