XDR-Analyst Practice Test 12 — 15 Questions

Question 1

An administrator is planning a large Cortex XDR agent rollout across 5,000 endpoints in a distributed network. Before starting, the administrator must confirm the network prerequisites that allow agents to register with the Cortex XDR management console and receive content updates. Which TWO network requirements must be satisfied? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Endpoints must be able to reach the Cortex XDR management console over TCP 443. Cortex XDR agents register and check in by initiating outbound TLS sessions to the management console on TCP 443, and they must resolve the console hostname via DNS to do so. These two outbound requirements are the essential network prerequisites for a successful rollout. Inbound SSH, SMB, and ICMP from the console are not used by the agent communication model and should not be opened.

Answer

Endpoints must have inbound TCP 445 open to allow the console to push agent updates

Answer

Endpoints must allow inbound ICMP echo requests from the management console for health checks

Answer

Endpoints must allow inbound connections from the management console on TCP 22 for remote management

Question 2

When configuring Cortex XDR agent permissions on macOS, what step is necessary due to macOS security restrictions (Transparency, Consent, and Control - TCC)?

Accepted Answer

Approving System Extensions, Full Disk Access, and Network Filter permissions via MDM or user prompt. macOS requires users or MDM profiles to grant Full Disk Access and network filter permissions to the Cortex XDR agent.

Answer

Configuring an Apple Developer ID certificate in Keychain Access

Answer

Installing a custom kernel extension compiled locally using Xcode

Answer

Disabling System Integrity Protection (SIP) entirely on every Mac

Question 3

An administrator is planning a Cortex XDR deployment in an environment where endpoints reside behind a web proxy that performs SSL inspection. During a pilot, agents fail to register with the management console even though outbound TCP 443 is permitted. The administrator must adjust the plan so agents can communicate through the proxy. Which action should the administrator take?

Accepted Answer

Disable SSL inspection for the Cortex XDR management console traffic or add the console to the proxy bypass list. SSL inspection causes the proxy to present its own certificate in place of the Cortex XDR management console certificate, so the agent's certificate validation fails and registration does not complete. The correct planning adjustment is to exclude console traffic from inspection or add the console to the proxy bypass list. Changing ports, installing duplicate agents, or disabling certificate validation do not address the interception and are not supported solutions.

Answer

Install a second Cortex XDR agent on each endpoint and configure it to bypass the proxy

Answer

Change the agent to use TCP 80 instead of TCP 443 so the proxy does not inspect the traffic

Answer

Configure the endpoints to ignore certificate errors so the inspected connection is accepted

Question 4

An analyst is investigating a Cortex XDR incident involving a suspicious process on a Windows endpoint. The analyst wants to gather volatile evidence from the endpoint before taking containment actions. Which TWO response actions can be used to collect volatile evidence? (Choose two.)

Accepted Answer

Get Network Connections. Get Process List and Get Network Connections are response actions that collect volatile evidence by capturing the current state of running processes and active network connections, respectively. These are time-sensitive data that can be lost if containment actions are taken first. Other actions like quarantine, isolation, or file retrieval do not collect volatile system state information.

Answer

Isolate Endpoint

Answer

Quarantine File

Answer

Retrieve File

Question 5

An analyst is reviewing a Cortex XDR incident involving a compromised Linux server. The analyst needs to retrieve the contents of a suspicious file located at /tmp/malware.bin from the endpoint for further analysis. Which response action should the analyst use?

Accepted Answer

Retrieve File. Retrieve File is the correct response action because it directly collects a specified file from an endpoint and makes it available in the Cortex XDR console for analysis. This allows the analyst to examine the suspicious binary without altering the endpoint's state or requiring custom scripting. Other actions like quarantine or isolation do not provide the file contents, and Run Script is an indirect and less reliable method.

Answer

Quarantine File

Answer

Isolate Endpoint

Answer

Run Script

Question 6

An analyst is investigating a series of alerts related to a suspicious scheduled task created on a Windows endpoint. They want to determine the user account that created the task and the exact command that was scheduled. Which Cortex XDR data source should the analyst review to find this information?

Accepted Answer

Scheduled task events. Scheduled task events in Cortex XDR are specifically designed to capture the creation, modification, and deletion of scheduled tasks, including the responsible user account and the command line. This data source directly answers the analyst's questions about who created the task and what command was scheduled.

Answer

Process execution events

Answer

File creation events

Answer

Registry modification events

Question 7

An analyst is reviewing a Cortex XDR incident where an endpoint has been compromised by malware that established persistence via a scheduled task. The analyst wants to remove the scheduled task remotely. Which response action should the analyst use?

Accepted Answer

Run Script. Run Script is the correct response action because it enables the analyst to execute a custom script that can delete the scheduled task. Cortex XDR does not have a dedicated 'Remove Scheduled Task' action, so Run Script provides the necessary flexibility. Quarantine File, Terminate Process, and Isolate Endpoint do not remove the scheduled task and thus do not fully remediate the persistence.

Answer

Quarantine File

Answer

Terminate Process

Answer

Isolate Endpoint

Question 8

A Cortex XDR analyst is investigating repeated failed authentications against a domain controller from a single workstation. The failures are followed by one success from the same workstation, after which the account begins accessing file shares it has never touched before. The analyst needs to preserve the identity context while correlating the authentication events with subsequent file activity. Which Cortex XDR capability should the analyst use to pivot from the authentication events to the related endpoint activity?

Accepted Answer

The Causality View, which groups related alerts and events by their shared causality chain. The Causality View is designed to group related alerts, events, and processes into a single investigation thread so analysts can follow an attack from initial authentication anomalies through subsequent endpoint behavior. Because the failed logons, the successful logon, and the file share access all share a causal relationship, this view lets the analyst preserve identity context and see the full sequence without manually stitching together separate event tables.

Answer

The Endpoint Isolation action, which quarantines the workstation from the network

Answer

The Threat Intelligence module, which enriches indicators with external reputation data

Answer

The Policy Audit report, which lists all endpoint security policy changes

Question 9

Which THREE features of Cortex XDR assist an analyst in conducting a deep-dive forensic investigation into an identity-based alert?

Accepted Answer

User View providing identity risk scores and associated device history. Option B is correct because the User View in Cortex XDR aggregates identity-centric context, including user risk scores and the history of devices associated with that identity, which is essential when pivoting from an identity-based alert into a forensic investigation. Option C is correct because XQL (Extended Query Language) Search lets analysts run granular, ad-hoc queries across both raw and normalized datasets (such as the xdr_data and endpoints tables), enabling deep-dive hunting and timeline reconstruction beyond the pre-built alert view. Option D is correct because Cortex XDR Storyline visualizes causal relationships between processes, files, network connections, and other events, allowing an analyst to trace the full chain of activity tied to the identity-based alert. Option A does not belong because disk defragmentation is an OS maintenance function with no forensic or investigative value in Cortex XDR. Option E does not belong because printer queue monitoring is unrelated to identity analytics, endpoint telemetry, or forensic investigation workflows in Cortex XDR.

Answer

Automated disk defragmentation utility

Answer

Printer queue status monitor

Question 10

A Cortex XDR analyst is building an ITDR detection strategy for a hybrid environment where attackers frequently abuse legitimate credentials rather than malware. The analyst needs to select identity behaviors that should generate high-fidelity alerts because they strongly indicate credential misuse rather than normal user activity. (Choose two.)

Accepted Answer

A user account obtaining a Kerberos ticket-granting ticket with an encryption type downgraded from AES to RC4. Interactive logons by service accounts from multiple workstations and Kerberos ticket requests downgraded to RC4 both deviate sharply from normal identity baselines and map directly to known credential abuse techniques. Service accounts should remain non-interactive and host-bound, while modern Kerberos negotiation should use AES; violations of either expectation provide high-fidelity evidence that credentials have been stolen or manipulated.

Answer

A user changing their password through the self-service portal after a password expiration prompt

Answer

A user logging out of their workstation at the end of the business day

Answer

A standard user authenticating successfully to a single workstation at the start of their normal shift

Question 11

A Cortex XDR analyst is investigating a suspected pass-the-hash attack. The attacker has captured an NTLM hash and is using it to authenticate to multiple servers without knowing the plaintext password. Which Cortex XDR data source would most directly reveal the anomalous NTLM authentication events indicating this attack?

Accepted Answer

Windows Security Event Logs. Pass-the-hash attacks involve using an NTLM hash to authenticate to remote systems, generating network logon events. Windows Security Event Logs capture these events with details such as logon type and authentication package, enabling Cortex XDR to detect anomalies like a single user authenticating to multiple servers in a short time. This data source is essential for identifying such credential misuse.

Answer

DNS query logs

Answer

Endpoint process execution logs

Answer

Firewall logs

Question 12

A Cortex XDR analyst is investigating an identity alert where a helpdesk technician account successfully authenticated to 14 different workstations within 3 minutes, each logon using explicit credentials rather than interactive console logon. The account has no associated change ticket. Which identity-based detection concept best explains why Cortex XDR raised this as a high-severity alert?

Accepted Answer

The account exhibited anomalous lateral movement behavior using explicit credentials across multiple endpoints in a short window.. Cortex XDR's identity analytics baseline normal account behavior and elevate alerts when an account deviates sharply. A helpdesk account authenticating with explicit credentials to many endpoints in a very short window, without a change ticket, matches lateral movement tradecraft. The severity derives from anomalous account behavior patterns, not from failed logons, geographic displacement, or decoy account usage.

Answer

The account was identified as a honeypot credential because it authenticated to decoy accounts configured in the identity store.

Answer

The account was flagged for impossible travel because its logons originated from geographically distant source IP addresses.

Answer

The account triggered a brute-force detection because multiple failed logons preceded each successful explicit credential logon.

Question 13

A Cortex XDR administrator wants the platform to automatically disable a user account in Active Directory when an identity alert indicates confirmed active credential compromise, without analyst intervention. Which Cortex XDR capability should the administrator configure to achieve this?

Accepted Answer

An automated response action in the alert configuration that invokes the identity provider integration to disable the account.. Automated remediation for identity compromise requires an orchestrated response action tied to alert criteria and integrated with the identity provider. Cortex XDR's automation can invoke the directory integration to disable the account the moment a confirmed compromise alert fires. Reports, detection rules, and endpoint isolation all fail to revoke the account's ability to authenticate, which is the core containment objective.

Answer

A BIOC rule that generates a new high-severity alert whenever a user account is disabled by an administrator.

Answer

A scheduled report that emails the identity team a list of compromised accounts every hour.

Answer

An endpoint isolation policy that quarantines every host the compromised user has ever logged on to.

Question 14

During an identity investigation in Cortex XDR, an analyst observes a service account performing a Kerberoasting-style request pattern: multiple TGS requests for accounts with Service Principal Names, followed by an anomalous LDAP query enumerating domain admins. The service account normally runs a backup job nightly. Which interpretation should guide the analyst's next action?

Accepted Answer

The service account is likely compromised and being used for Kerberoasting and reconnaissance, warranting immediate containment and credential rotation.. Mass TGS requests against multiple SPN-bearing accounts followed by privileged group enumeration is a textbook Kerberoasting and reconnaissance sequence. A backup service account has no legitimate reason to exhibit this behavior, so the analyst should treat the account as compromised, contain it, rotate credentials, and hunt for the host and tooling responsible rather than tuning detections or filing change requests.

Answer

The pattern is expected backup behavior and can be closed as benign because service accounts routinely request service tickets.

Answer

The LDAP query is the only suspicious element, so the analyst should tune the Kerberoasting detection to reduce noise and monitor further.

Answer

The activity indicates a misconfigured backup job, so the analyst should open a change request to correct the service account's SPN assignments.

Question 15

A Cortex XDR analyst is responding to an alert indicating a Golden Ticket attack. The attacker has compromised the KRBTGT account hash and is forging Kerberos ticket-granting tickets (TGTs) to maintain persistent access. Which TWO Cortex XDR capabilities are most effective for detecting and investigating this attack? (Choose two.)

Accepted Answer

Behavioral analytics on Kerberos ticket requests. Golden Ticket attacks involve forging Kerberos TGTs using the KRBTGT hash, leading to anomalies in Kerberos ticket requests and domain controller logs. Cortex XDR's behavioral analytics and integration with Active Directory Domain Controller security logs are essential for detecting such anomalies, as they can identify unusual ticket properties and missing corresponding events, enabling effective investigation.

Answer

File integrity monitoring on domain controllers

Answer

Endpoint process execution monitoring for LSASS access

Answer

Network traffic analysis for SMB signing bypass