XDR-Analyst Practice Test 14 — 15 Questions

Question 1

An administrator needs to customize the incident queue to show the 'OS Version' column for all displayed incidents. Which configuration interface should be accessed?

Accepted Answer

Featured fields settings. Featured fields configuration allows administrators to add standard or custom attributes like OS Version as columns in the incident table.

Answer

Incident scoring weight profiles

Answer

Alert exclusion rule manager

Answer

Data stitching correlation parameters

Question 2

An enterprise ingests proxy logs and endpoint telemetry into Cortex XDR. An analyst notices that web traffic alerts for a specific user are not correlating with the user's endpoint malware alerts. What is a common prerequisite for successful identity-based data stitching across network and endpoint sources?

Accepted Answer

Consistent user naming conventions and identity mapping across log sources. Identity stitching requires consistent username formatting and mapping (such as Active Directory user principal names or NetBIOS names) across all ingested log sources.

Answer

Incident scoring must be set to manual mode

Answer

All alerts must be manually starred by an analyst

Answer

Featured fields must be enabled for proxy logs

Question 3

An administrator is configuring data stitching and alert correlation rules in Cortex XDR to improve incident prioritization. Which TWO actions are best practices to ensure high-fidelity alert grouping and accurate incident scoring? (Choose two)

Accepted Answer

Map critical assets with appropriate priority weights to influence incident scoring accurately.. Effective incident grouping and scoring rely on accurate asset criticality definitions and proper log parsing mappings to enable the causality engine.

Answer

Disable all default Cortex XDR analytics rules to prevent false correlation.

Answer

Set the incident close timeout to 1 minute to speed up alert processing.

Answer

Manually star every incoming alert to trigger the incident correlation engine.

Question 4

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

Accepted Answer

Signed binary exception with path and certificate verification. Signed binary exceptions combined with valid certificate verification and file path checks allow legitimate administrative or updater tools to operate without generating alerts.

Answer

Configuring a network port forwarding rule

Answer

Deleting the software updater from all endpoints

Answer

Disabling all behavioral monitoring on the subnet

Question 5

Which dashboard widget type in Cortex XDR is best suited for tracking the volume of open incidents over time across different severity levels?

Accepted Answer

Incident trend and severity breakdown widgets. Incident trend and severity widgets in Cortex XDR dashboards display historical and real-time metrics categorized by severity levels.

Answer

Syslog export status meter

Answer

Data stitching performance monitor

Answer

Agent health and connectivity graph

Question 6

During an investigation, an analyst discovers that a raw alert was generated by a legitimate software update tool. To prevent this specific alert from triggering future incidents across all endpoints, how should the analyst proceed within the lifecycle management framework?

Accepted Answer

Create an alert exclusion based on the tool's file hash or digital signature. Creating an alert exception or exclusion based on file hash, path, or digital signature prevents future raw alerts and subsequent incident creation.

Answer

Modify the data stitching window to ignore update hours

Answer

Decrease the global incident scoring threshold

Answer

Star the alert and change its status to resolved

Question 7

What THREE outcomes typically occur when data stitching successfully links a network alert and an endpoint alert? (Choose three)

Accepted Answer

The timeline reflects a complete attack path across network and endpoint. Successful data stitching results in a unified incident containing both alerts, an updated aggregate incident score, and enriched asset visibility in the timeline.

Answer

Featured fields are wiped out and reset to default

Answer

All constituent raw alerts are automatically starred

Question 8

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

Accepted Answer

Configure exclusions for the vulnerability scanner's IP addresses or signature patterns. Creating exclusion rules for scanner IP addresses or signatures ensures vulnerability assessment traffic does not trigger security incidents.

Answer

Enable featured fields to hide scanner columns

Answer

Turn off data stitching across all internal subnets

Answer

Star all alerts generated during scanning windows

Question 9

Which TWO features assist an analyst in prioritizing which incidents to investigate first within the Cortex XDR console? (Choose two)

Accepted Answer

Incident Starring indicators. Analysts prioritize incidents using the Incident Score (severity) and Incident Starring for bookmarked high-priority items.

Answer

Data stitching status logs

Answer

Agent version compliance meters

Answer

Featured fields display order

Question 10

During the alert-to-incident lifecycle in Cortex XDR, an alert is generated by an endpoint agent, evaluated by analytics, and subsequently combined into an existing incident. What status does the newly added alert assume upon joining the incident?

Accepted Answer

The alert automatically adopts the status of the parent incident (e.g., Under Investigation or Resolved).. When new alerts are added to an existing incident via correlation, they inherit the lifecycle context of the parent incident while retaining their individual alert states.

Answer

The alert status changes permanently to 'False Positive'.

Answer

The alert is dropped from the database due to duplicate correlation.

Answer

The alert is placed in 'Quarantine' status pending manual review.

Question 11

Which TWO metrics or components are typically included in a user's risk score calculation within Cortex XDR's identity analytics?

Accepted Answer

Severity and count of triggered behavioral analytics alerts. User risk scores incorporate failed authentication attempts and alerts triggered by anomalous behavioral patterns.

Answer

Manufacturer of the user's computer monitor

Answer

Total number of desktop wallpaper images stored by the user

Answer

Average length of time the user spends on lunch breaks

Question 12

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Group Policy Objects (GPO). Which file format is required for GPO-based installations on Windows endpoints?

Accepted Answer

.msi Windows Installer package. Group Policy Software Installation (MSI) requires an .msi installation package.

Answer

.rpm Red Hat Package Manager file

Answer

.exe self-extracting archive with embedded arguments

Answer

.dmg disk image format

Question 13

When sizing a Broker VM instance for an environment collecting high-volume syslog and Active Directory logs, which hardware resource is most critical to scale appropriately?

Accepted Answer

Sufficient vCPU and RAM allocation per published system requirements. Log collection and parsing require adequate RAM and CPU to process high throughput before forwarding to the Cortex Data Lake.

Answer

Fibre Channel HBA connected to an enterprise SAN storage array

Answer

Dedicated high-end NVIDIA GPU for deep learning processing

Answer

Dual 10Gbps SFP+ physical network interface cards passed through directly

Question 14

An XDR Analyst is investigating a newly generated incident in Palo Alto Networks Cortex XDR and notices that multiple disparate alerts from different endpoints and network sensors have been automatically grouped together. Which core mechanism of Cortex XDR is primarily responsible for intelligently grouping these related alerts into a single incident?

Accepted Answer

Incident scoring and analytics correlation engine. Cortex XDR uses a specialized analytics engine and data stitching algorithms to correlate and group related alerts across endpoints, network, and cloud sources into a single incident based on shared indicators of compromise or causality chains.

Answer

Alert starring

Answer

Local Analysis agent configuration

Answer

BIOC rule generation wizard

Question 15

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

Accepted Answer

Under the Incident Details page by selecting the Alerts tab. By drilling down into an incident in Cortex XDR, the analyst can access the Alert tab to inspect the individual raw alerts that make up the incident lineage.

Answer

Under Analytics > BIOC > Alert Log

Answer

Under Response > Action Center > History

Answer

Under Settings > Data Stitching > Raw Logs