XDR-Analyst Practice Test 13 — 15 Questions

Question 1

A Cortex XDR administrator wants to review which user accounts have the highest identity risk based on recent authentication anomalies and privilege changes. The administrator needs a consolidated view that ranks users by their accumulated risk indicators across the environment. Which Cortex XDR feature should the administrator open to obtain this ranked list of at-risk identities?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Identity Analytics dashboard, which aggregates user risk scores and identity-related findings. Identity Analytics is the dedicated dashboard that collects identity-related telemetry, applies risk scoring, and ranks users by accumulated indicators such as anomalous authentications and privilege changes. It gives the administrator a single, user-centric view of identity risk posture, which incident, endpoint, or raw query views are not designed to provide.

Answer

The Endpoints page, sorted by the number of alerts per endpoint

Answer

The Cortex XDR Query Builder, executed against the alerts table with a severity filter

Answer

The Incidents page, filtered by severity to show only high-severity incidents

Question 2

During an investigation, a Cortex XDR analyst observes that a user account successfully authenticated to a server and then, within seconds, accessed a credential store file on that server. The analyst wants to determine whether the account's credentials were subsequently used from a different host. Which Cortex XDR data should the analyst examine to trace whether the stolen credentials were reused elsewhere?

Accepted Answer

Authentication events correlated by account across all ingested identity data sources. Credential reuse after theft appears as authentication events for the same account originating from new hosts or locations. By correlating authentication records across every ingested identity source, the analyst can detect those later logons and confirm whether the credentials taken from the server were used elsewhere, which single-host process or software views cannot show.

Answer

The endpoint's installed software inventory, compared against a known-good baseline

Answer

The process execution history on the original server, filtered by the accessing user

Answer

The firewall rule base, reviewed for recently modified rules affecting the server

Question 3

An analyst is reviewing a Cortex XDR identity alert where a user authenticated with a valid password but from a device that has never been associated with that user. The analyst wants to assess whether the account's privileges make this a high-risk event. Which Cortex XDR data source provides the user's group memberships and role assignments to support this assessment?

Accepted Answer

The identity provider integration data, which includes directory attributes such as group membership and roles.. Assessing whether an unfamiliar device login is high risk depends on knowing the privileges of the account involved. Identity provider integration data supplies group memberships and role assignments directly to Cortex XDR, enabling the analyst to determine if the user is privileged. Endpoint inventory, network logs, and vulnerability results provide supporting context but do not answer the privilege question.

Answer

The endpoint device inventory, which lists installed software and hardware details.

Answer

The network connection logs, which show which services the user's device contacted.

Answer

The vulnerability scan results, which identify missing patches on the authenticating device.

Question 4

An analyst identifies a custom, benign internal tool that is continuously flagged by a BIOC rule in Cortex XDR. To prevent future alerts without disabling the entire rule globally, what is the best practice method to create an exception?

Accepted Answer

Create a local exception using the specific file hash or path within the Exceptions management page.. Creating an exception using file hash or digital signature parameters directly from the alert context ensures targeted suppression without weakening the broader BIOC rule effectiveness.

Answer

Modify the Agent Settings profile to stop reporting all file execution events.

Answer

Disable the BIOC rule globally in the Profiles page.

Answer

Delete the alert from the Incident View to prevent re-triggering.

Question 5

A Cortex XDR analyst is building an ITDR detection strategy for a hybrid environment where attackers frequently abuse valid credentials. Which TWO identity risk signals should the analyst prioritize to detect credential misuse rather than credential theft? (Choose two.)

Accepted Answer

Impossible travel, where the same account authenticates from geographically distant locations within an implausibly short interval.. Detecting credential misuse requires signals that reveal valid credentials being used in anomalous ways. Impossible travel and anomalous token issuance both depend on successful authentication patterns and contextual deviations, which indicate an attacker is actively using working credentials. LSASS access, Kerberoasting, and DCSync replication are theft techniques that occur before credentials are usable, so they address a different phase of the attack lifecycle.

Answer

LSASS memory access by a non-standard process, indicating attempted credential dumping.

Answer

Kerberoasting service ticket requests using weak encryption, indicating offline password cracking attempts.

Answer

DCSync replication requests from a non-domain-controller host, indicating directory database extraction.

Question 6

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint spawned a child process with a suspicious command line. The analyst wants to see the exact parent-child process relationship and the full command line of the parent process to determine if this is a true positive. Which pane in the Cortex XDR Alert view provides this information?

Accepted Answer

The Causality Chain pane. The Causality Chain pane in Cortex XDR is specifically designed to visualize process execution flow, including parent-child relationships and command-line arguments. It allows analysts to quickly trace the root cause of an alert by showing the sequence of processes that led to the suspicious activity. This is essential for determining whether a child process was spawned by a legitimate application or by malicious code.

Answer

The Timeline pane

Answer

The WildFire analysis report

Answer

The Incident Details page

Question 7

During an investigation, an analyst examines the Causality Chain and Incident Graph. What THREE key insights do these visualization tools provide into the incident lifecycle? (Choose three)

Accepted Answer

The chronological sequence of events spanning the entire incident. Option A is correct because the Causality Chain and Incident Graph present events in chronological order, letting the analyst trace the full timeline of the incident from first activity to resolution. Option B is correct because these visualizations map parent-child process relationships, exposing the process lineage that led to the initial alert and revealing how malicious code was spawned. Option D is correct because the graph links activity across hosts and network segments, making lateral movement pathways between endpoints and networks visible. Option C is not correct because custom featured fields are grid configuration metadata, not insights derived from the causality or incident graph. Option E is not correct because the manual star status is an analyst-assigned triage marker, not a lifecycle insight produced by these visualization tools.

Answer

The custom featured fields assigned to the incident grid

Answer

The manual star status assigned by the shift supervisor

Question 8

Which TWO metrics or components are typically included in a user's risk score calculation within Cortex XDR's identity analytics?

Accepted Answer

Severity and count of triggered behavioral analytics alerts. User risk scores incorporate failed authentication attempts and alerts triggered by anomalous behavioral patterns.

Answer

Manufacturer of the user's computer monitor

Answer

Total number of desktop wallpaper images stored by the user

Answer

Average length of time the user spends on lunch breaks

Question 9

What is the primary purpose of integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR?

Accepted Answer

To provide visibility into cloud authentication events, sign-in anomalies, and identity risks in hybrid environments. Integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR feeds cloud identity telemetry — sign-in events, conditional access results, MFA challenges, and risky user detections — into the XDR console. This lets analysts correlate identity-based threats with endpoint and network activity, which is essential for detecting credential compromise and lateral movement in hybrid environments.

Answer

To replace the Cortex XDR Agent on Linux servers

Answer

To enforce local BIOS password policies

Answer

To automate the deployment of Windows security patches to endpoints

Question 10

An analyst notices that a service account is generating alerts for anomalous login locations. Upon review, the account is used by an automated batch script running from a newly provisioned server. How should the analyst resolve this alert while maintaining security best practices?

Accepted Answer

Create an exception or tune the analytics rule to account for the new authorized script execution source. If a service account is performing expected automated operations from a new source, the analyst can tune the analytics or add the source IP/service account combination to known exclusions.

Answer

Change the Cortex XDR agent operational mode to 'Disabled'

Answer

Upgrade the firewall firmware version

Answer

Delete the Active Directory domain entirely

Question 11

Which TWO pieces of information are displayed in the Incident summary dashboard of Cortex XDR? (Choose two)

Accepted Answer

Overall incident severity distribution. The Incident summary provides high-level metrics such as total incident count, severity distribution, and affected host counts.

Answer

Cellular phone network tower signal strengths

Answer

Local employee salary payroll database records

Answer

Commercial airline flight booking schedules

Question 12

When managing exclusions and exceptions in Cortex XDR, which THREE best practices should an analyst follow to maintain security posture? (Choose three)

Accepted Answer

Scope exceptions as narrowly as possible (e.g., specific hash and path). Effective exception management requires scoping rules tightly, documenting justifications, and reviewing exceptions periodically.

Answer

Share internal exception hashes publicly on open social media channels

Answer

Disable all default Cortex XDR BIOC rules globally upon deployment

Question 13

When conducting a comprehensive post-incident review and remediation verification in Cortex XDR, which THREE actions should an analyst perform? (Choose three)

Accepted Answer

Review and document lessons learned, updating detection rules or playbooks as needed. Option A is correct because a post-incident review must capture lessons learned and feed them back into detection rules, BIOCs, and response playbooks so the same TTPs are caught faster next time. Option B is correct because remediation verification requires confirming every affected endpoint shows a healthy Cortex XDR agent (heartbeat present, no 'Agent Uninstalled' or 'Disconnected' state) and that no malicious processes, injected modules, or persistence artifacts remain active. Option D is correct because containment such as endpoint isolation must be explicitly lifted after eradication and recovery are validated, otherwise the host stays cut off from the network and business operations cannot resume. Option C is wrong because permanently uninstalling Cortex XDR agents would remove the very telemetry and enforcement needed for ongoing monitoring and future incident response. Option E is wrong because deleting historical telemetry databases destroys forensic evidence, breaks audit and compliance retention requirements, and prevents retrospective threat hunting.

Answer

Permanently uninstall Cortex XDR agents from all enterprise endpoints

Answer

Delete all historical telemetry databases to save disk space permanently

Question 14

An analyst is investigating a Cortex XDR alert indicating a possible ransomware attack. The analyst wants to isolate the affected endpoint from the network while preserving the ability to remotely investigate and remediate. Which Cortex XDR response action should the analyst take?

Accepted Answer

Isolate the endpoint. Isolating the endpoint is the correct response because it immediately contains the threat by severing network connections, preventing ransomware from spreading or communicating externally. At the same time, it maintains a secure channel for the analyst to remotely investigate and remediate the endpoint through the Cortex XDR console. This balances containment with the need for further analysis.

Answer

Initiate a Live Terminal session

Answer

Terminate the malicious process

Answer

Block the malicious hash

Question 15

An administrator wants to ensure that Cortex XDR agents automatically update their software version whenever a new version is released by Palo Alto Networks. Where is this automated agent upgrade setting configured?

Accepted Answer

Settings > Configurations > Agent Settings > Upgrades. The automated agent upgrade setting is located under Settings > Configurations > Agent Settings > Upgrades. This is the central configuration point where administrators can enable automatic updates, set a schedule, and define the target agent version. Enabling this ensures agents check for and install new versions released by Palo Alto Networks without manual intervention.

Answer

Help > About > Check for Updates

Answer

Response > Actions > Push Update

Answer

Data Collector > Broker VM > Software Distribution