XDR-Analyst Practice Test 14 — 15 Questions

Question 1

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

XQL Search querying registry event tables. XQL Search querying registry event tables is correct because Cortex XDR collects and stores registry modification events from all endpoints in its data lake. By writing an XQL query against the registry event table, the analyst can search across the entire fleet for the specific Run key and its value, identifying any other affected machines. This leverages the centralized telemetry that the XDR agent provides, enabling rapid scoping of the threat without manually inspecting each host.

Answer

Syslog server forwarding destination list

Answer

Cortex XDR Agent installation log

Answer

GlobalProtect client configuration wizard

Question 2

An attacker compromises a domain user account and attempts to enumerate domain admins using native Windows utilities (e.g., 'net group "Domain Admins" /domain'). Which Cortex XDR detection mechanism is specifically designed to catch such reconnaissance behaviors without relying solely on static signatures?

Accepted Answer

Behavioral Indicator of Compromise (BIOC) rules tuned for suspicious command-line execution and reconnaissance patterns. Behavioral Indicator of Compromise (BIOC) rules in Cortex XDR are specifically designed to detect suspicious behaviors such as reconnaissance commands, including native Windows utilities like 'net group "Domain Admins" /domain'. BIOCs focus on behavior patterns and command-line execution rather than static signatures, making them effective against living-off-the-land techniques that evade traditional signature-based detection.

Answer

WildFire file quarantine settings

Answer

DNS sinkholing profiles

Answer

Cloud Identity Provider Conditional Access policies

Question 3

What is the primary purpose of starring an alert within an incident details pane?

Accepted Answer

To bookmark and highlight important alerts for tracking and collaboration. Starring an alert in the incident details pane is a bookmarking and highlighting action that lets analysts mark important alerts for tracking and collaboration. It does not change severity, trigger containment, or exclude the alert from future incidents. The star is purely a workflow and communication aid within the incident.

Answer

To permanently exclude the alert from future incident generation

Answer

To increase the incident severity score to critical

Answer

To automatically trigger containment actions on the endpoint

Question 4

Which TWO details are typically reviewed when inspecting an alert in the Cortex XDR Incident Viewer? (Choose two)

Accepted Answer

Timestamp of when the event occurred. In the Cortex XDR Incident Viewer, the alert details pane surfaces the event's timestamp so analysts can establish when the activity occurred and correlate it with other telemetry — making option A correct. It also displays the alert description and the name of the detection rule (or BIOC/analytics signature) that fired, which tells the analyst what behavior was detected and why — making option C correct. Options B, D, and E are unrelated business records (cafeteria receipts, travel itineraries, parking gate codes) and have no place in the alert inspection workflow, so they are not reviewed details.

Answer

Local cafeteria lunch receipt totals

Answer

Corporate travel booking itineraries

Answer

Office building parking garage gate codes

Question 5

An enterprise wants to ensure that all incidents with a score above 80 are automatically escalated and assigned to a Tier-3 incident response queue. Where should an administrator configure this routing logic?

Accepted Answer

Incident assignment and automation rules. Incident assignment and automation rules in Cortex XDR let administrators define conditions (such as incident score thresholds) and the resulting actions (escalate, assign to a queue, change severity). Configuring a rule with a score > 80 condition and a Tier-3 queue target is exactly the intended use. This is the only option that provides routing logic tied to incident attributes.

Answer

Data stitching parameter settings

Answer

Featured fields display configuration

Answer

Alert starring policies

Question 6

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

Accepted Answer

Run an XQL Search querying the dataset for the specific file_sha256 value.. XQL Search in Cortex XDR queries the endpoint telemetry dataset (e.g., xdr_data / process events) which includes file_sha256 for every process execution. Searching by the specific file_sha256 value returns every endpoint where that exact binary executed, giving immediate organization-wide scope. This is the fastest, most precise way to hunt for other instances of the same file.

Answer

Review the Global Protect gateway traffic logs for file downloads.

Answer

Create a new BIOC rule and wait for the file to be executed again.

Answer

Export the Windows Event logs from a single machine and compare manually.

Question 7

An organization notices that Cortex XDR incidents are being assigned high severity scores primarily due to a noisy network alert rule that triggers frequently on internal port scans. What is the correct administrative workflow to resolve this scoring inflation?

Accepted Answer

Tune or disable the noisy detector rule, or adjust scoring weight profiles. Scoring inflation from a noisy detector is resolved at the source: tune or disable the offending rule so it stops generating high-severity alerts, and/or adjust the scoring weight profile so that category of alert contributes less to the incident score. Both actions address the root cause — the rule's volume and its weight in the scoring model — rather than masking the symptom.

Answer

Star all alerts generated by the port scan rule

Answer

Hide the port scan column using featured fields

Answer

Enable data stitching overrides for internal ports

Question 8

A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?

Accepted Answer

Incident starring. Incident starring in Cortex XDR is a manual flag that analysts apply to specific incidents to mark them as noteworthy — for example, for executive visibility or follow-up. Starred incidents can be filtered and surfaced in dashboards, making them easy to track. This is the intended feature for flagging individual incidents without altering their severity or correlation logic.

Answer

Incident scoring threshold override

Answer

Data stitching rule assignment

Answer

Featured fields configuration

Question 9

An administrator wants to ensure that incidents generated by alerts involving domain controllers are always assigned a 'Critical' score. Which setting should be modified?

Accepted Answer

Asset criticality groups and incident scoring rules. To force incidents involving domain controllers to always score 'Critical,' the administrator must configure asset criticality groups (tagging domain controllers as high-value assets) and the incident scoring rules that map asset criticality to incident severity. This is the only setting that ties asset identity to score escalation.

Answer

Alert starring default policy

Answer

Data stitching time window

Answer

Featured fields display mapper

Question 10

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

Accepted Answer

Identity and authentication logs. Impossible travel alerts are generated by comparing login locations and timestamps for a user account, so the authoritative evidence is the identity and authentication logs. These logs contain the source IP, geolocation, timestamp, and authentication result needed to validate whether the two logins are physically impossible. Inspecting them confirms or refutes the alert.

Answer

Network packet capture (PCAP)

Answer

Master Boot Record (MBR) analysis

Answer

Endpoint memory dump

Question 11

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

Accepted Answer

Causality Chain. The Causality Chain view in Cortex XDR visualizes the process tree and root-cause relationships that led to an alert, showing parent-child process lineage. To trace how a suspicious PowerShell command was spawned, the analyst examines the Causality Chain to see the originating process, its parent, and the full execution path. This is the core forensic view for process-level investigation.

Answer

Action Center

Answer

Audit Log

Answer

BIOC Rules Manager

Question 12

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

Accepted Answer

Cortex XDR Management Console under Exceptions. Cortex XDR Exceptions defined in the management console are pushed as policy to all agents, allowing a known tool (e.g., an internal pen-test binary) to be excluded from prevention and/or alerting globally. This is the centralized, supported mechanism for organization-wide exclusions.

Answer

Syslog forwarding rules

Answer

User Identity mapping rules

Answer

Local Windows Registry on each endpoint

Question 13

Which architectural component acts as the central repository for all Cortex XDR telemetry, logs, and behavioral data?

Accepted Answer

Cortex Data Lake. Cortex Data Lake is the cloud-hosted, multi-tenant data repository that ingests and stores all telemetry from Cortex XDR agents, network sensors, and third-party log sources. It provides the centralized storage and correlation layer that powers Cortex XDR's detection, investigation, and threat-hunting capabilities across the entire environment.

Answer

Local Agent SQLite Cache

Answer

Panorama Log Collector Appliance

Answer

Broker VM Internal Hard Disk

Question 14

When managing the alert lifecycle in Cortex XDR, analysts can perform various triage and prioritization tasks. Which THREE features or options are available to analysts when managing active incidents and alerts? (Choose three)

Accepted Answer

Updating the incident status (e.g., New, Under Investigation, Resolved).. Option B is correct because Cortex XDR lets analysts move incidents through the standard lifecycle states such as New, Under Investigation, and Resolved, which is a core triage action for tracking and closing cases. Option C is correct because incidents can be assigned to individual analysts or user groups, enabling ownership and workload distribution during investigations. Option D is correct because analysts can star alerts or incidents to mark them for priority attention or shift handover, a built-in flagging mechanism in the alert and incident views. Option A is not correct because analysts cannot modify the weights of the GlobalProtect cloud service's machine learning algorithm; that is a vendor-controlled backend, not an analyst triage feature. Option E is not correct because writing raw kernel-level driver code to replace the endpoint prevention engine is not an available analyst action in Cortex XDR and would undermine the product's protected agent architecture.

Answer

Directly modifying the core machine learning algorithm weights of the Global Protect cloud service.

Answer

Writing raw kernel-level driver code to replace the endpoint prevention engine.

Question 15

What is the primary function of the Cortex XDR Agent Support File collection tool?

Accepted Answer

To collect diagnostic logs, configuration details, and troubleshooting data for Palo Alto Networks Support. The Cortex XDR Agent Support File collection tool is designed to gather diagnostic logs, configuration details, and system information from the endpoint to assist Palo Alto Networks Support in troubleshooting agent issues. It packages this data into a support file that can be uploaded to a case. It does not create forensic disk images, back up personal documents, or export cryptographic keys.

Answer

To generate a forensic disk image of the entire hard drive

Answer

To back up the user's personal documents to the cloud data lake

Answer

To export endpoint cryptographic keys to an external vault