XDR-Analyst Practice Test 15 — 15 Questions

Question 1

What is the primary benefit of using Cortex XDR's identity correlation engine when triaging incidents?

Accepted Answer

It correlates alerts across endpoints, network, and identity to provide a complete picture of an attack campaign targeting a user. Cortex XDR's identity correlation engine links alerts from endpoints, network sensors, and identity sources (like AD and cloud IdPs) to a single user identity, revealing the full scope of an attack campaign targeting that user. This unified view helps analysts see lateral movement, credential abuse, and privilege escalation across disparate telemetry sources in one incident timeline.

Answer

It generates recurring compliance PDF reports for PCI-DSS audit filing

Answer

It replaces the need for Active Directory Group Policies

Answer

It automatically formats hard drives of compromised endpoints

Question 2

An organization is setting up a Broker VM instance to support Active Directory User-ID integration and log forwarding. Which authentication mechanism must the administrator configure to pair the newly deployed Broker VM with the Cortex XDR management console?

Accepted Answer

A unique registration token generated within the Cortex XDR console under Settings > Configurations > Broker VM. To pair a newly deployed Broker VM with the Cortex XDR management console, the administrator must configure a unique registration token generated in the console under Settings > Configurations > Broker VM. This token authenticates the Broker VM to the management plane during initial registration, establishing the trusted channel for configuration and log forwarding.

Answer

A pre-shared IPSec tunnel key configured on the perimeter firewall

Answer

An imported enterprise PKI root certificate bundle

Answer

An OAuth 2.0 client secret generated from the Palo Alto Networks Customer Support Portal

Question 3

An administrator needs to configure automated incident response actions in Cortex XDR. Which THREE components are critical for building a successful automated response workflow? (Choose three)

Accepted Answer

Playbook actions and logic steps (such as quarantine or enrichment). Option C is correct because playbook actions and logic steps are the executable core of an automated response workflow in Cortex XDR, defining what happens (e.g., isolate endpoint, quarantine file, enrich indicators) and in what order. Option D is correct because integration configurations are required to connect Cortex XDR with external tools such as Cortex XSOAR, threat intelligence providers, or ticketing systems so the playbook can invoke those services during response. Option E is correct because trigger conditions determine when the automation fires, using criteria such as incident severity, alert type, or specific detection rules to scope the workflow appropriately. Options A and B are incorrect because cafeteria menu pricing and server room coolant levels are unrelated to incident response automation and have no role in Cortex XDR playbook design or execution.

Answer

Corporate cafeteria catering menu pricing sheets

Answer

Physical server room air conditioning coolant levels

Question 4

An analyst needs to verify whether Active Directory audit policies are correctly configured to supply Cortex XDR with the necessary event logs for Identity Threat Detection and Response. Which Windows Event ID range contains the core authentication and credential validation events required by Cortex XDR ITDR?

Accepted Answer

Event IDs 4600 through 4799 (Windows Security Audit logs). Windows Security Event IDs in the 4600-4799 range cover critical authentication events such as logon successes/failures, Kerberos ticket requests, and account modifications.

Answer

Event IDs 1100 through 1108 (Event Log Service operational logs)

Answer

Event IDs 1000 through 1005 (Application Error logs)

Answer

Event IDs 7000 through 7045 (Service Control Manager logs)

Question 5

What is the primary benefit of the raw-alert-to-incident lifecycle consolidation in Cortex XDR?

Accepted Answer

It reduces alert fatigue by grouping related alerts into a single cohesive incident. Cortex XDR's raw-alert-to-incident lifecycle consolidation groups related raw alerts (from endpoints, network, identity, and cloud sources) into a single cohesive incident, dramatically reducing the number of items an analyst must triage. This directly addresses alert fatigue by presenting one correlated case with unified timeline, causality chain, and root-cause view instead of dozens of disconnected alerts. The consolidation is the core value proposition of an XDR platform versus standalone EDR or SIEM tools.

Answer

It automatically patches vulnerable operating systems on endpoints

Answer

It encrypts raw log data before sending it to syslog servers

Answer

It replaces the need for data collectors and endpoint agents

Question 6

An analyst is investigating an incident where an attacker leveraged compromised credentials to establish persistence via Active Directory object manipulation. Which TWO Active Directory event logs or actions captured by ITDR monitoring should the analyst examine?

Accepted Answer

Windows Security Event IDs related to security group membership changes (e.g., adding a user to Domain Admins). Option B is correct because adding a user to a privileged group such as Domain Admins generates Windows Security events like 4728 (member added to a global group) or 4732 (member added to a local group), which are key ITDR indicators of persistence through privilege escalation. Option C is correct because Event ID 5136 is logged when a directory service object is modified, capturing changes to AD object attributes (e.g., userAccountControl, servicePrincipalName, or ACLs) that attackers abuse for persistence. Option A is wrong because DHCP lease renewals are network configuration events unrelated to Active Directory object manipulation. Option D is wrong because switch port duplex status is a Layer 1/2 physical link condition with no bearing on AD persistence. Option E is wrong because antivirus signature update timestamps reflect endpoint protection maintenance, not directory service changes.

Answer

DHCP IP lease renewal event logs

Answer

Network switch port duplex status logs

Answer

Antivirus signature version update timestamps

Question 7

Which TWO views in Cortex XDR are primarily used to monitor overall alert and incident status across the SOC? (Choose two)

Accepted Answer

Dashboards (providing high-level metrics and widget summaries). Option C, Dashboards, is correct because Cortex XDR dashboards aggregate high-level metrics, widget summaries, and trend visualizations that give the SOC a consolidated, at-a-glance picture of overall alert and incident status across the environment. Option D, Incident View / Incident Queue, is correct because it is the primary operational workspace where analysts monitor, triage, and track the status of incidents and their associated alerts from a centralized queue. Options A, B, and E are incorrect because a shipping logistics tracker, a local OS task manager, and a water cooler maintenance portal are unrelated to Cortex XDR and provide no visibility into SOC alert or incident monitoring.

Answer

Commercial shipping logistics tracking application

Answer

Local operating system task manager

Answer

Office water cooler maintenance portal

Question 8

An analyst wants to ensure that any file evaluated with a specific SHA-256 hash is immediately blocked from execution across all endpoints managed by Cortex XDR, regardless of its WildFire verdict. Where should this hash be added?

Accepted Answer

Hash Blocklist in Cortex XDR. The Hash Blocklist in Cortex XDR lets analysts add a specific SHA-256 (or MD5) hash that is blocked from execution across all managed endpoints, regardless of WildFire verdict. This is the centralized, immediate enforcement mechanism for known-bad files.

Answer

Network interface promiscuous mode toggle

Answer

Agent debug log level selector

Answer

Cortex XSOAR integration ticket template

Question 9

An administrator is configuring a Proxy setting for Cortex XDR agents deployed in a segmented network zone that requires all HTTP/HTTPS traffic to traverse an explicit web proxy. Where is the proxy configuration defined for the Cortex XDR agent?

Accepted Answer

In the Agent Settings profile within the Cortex XDR management console. Proxy settings for Cortex XDR agents are configured within the Agent Settings profile in the Cortex XDR management console.

Answer

On the local Broker VM CLI configuration menu

Answer

Via the Palo Alto Networks Firewall URL Filtering profile

Answer

Directly inside the Windows registry under HKLM\Software\Cyvera\Proxy

Question 10

An administrator needs to deploy Cortex XDR agents to a fleet of Linux servers running Ubuntu 20.04. Before executing the installation script, which prerequisite package must be verified as installed on the Linux endpoints to ensure kernel module or Extended Berkeley Packet Filter (eBPF) support functions correctly?

Accepted Answer

Kernel headers and dependent build tools matching the running kernel version. The prerequisite package is kernel headers and dependent build tools matching the running kernel version (D). Cortex XDR on Linux uses either a kernel module or eBPF for deep visibility, and these require kernel headers to compile or load correctly. Without matching headers, the agent cannot install or function properly.

Answer

Microsoft .NET Framework 4.8 Runtime

Answer

IIS Web Server Role and ASP.NET

Answer

Active Directory Domain Services Client tools

Question 11

A security operations manager is planning to deploy Cortex XDR agents to 2,000 endpoints. The manager wants to ensure that the agents can receive the latest detection content and policy updates automatically without manual intervention. Which Cortex XDR feature should the manager verify is enabled to meet this requirement?

Accepted Answer

Automatic content updates. Automatic content updates are the mechanism that keeps Cortex XDR agents current with the latest detection content and policy updates from the cloud. Manual upgrade scheduling, Broker VM high availability, and endpoint isolation policies serve different purposes and do not provide automatic content delivery.

Answer

Broker VM high availability

Answer

Endpoint isolation policy

Answer

Manual agent upgrade scheduling

Question 12

An administrator is reviewing a newly generated incident in Cortex XDR and notices that multiple low-severity alerts from different endpoints have been grouped together. Which mechanism is primarily responsible for this automated grouping?

Accepted Answer

Cortex XDR correlation rules and analytics grouping. Cortex XDR uses Analytics and Analytics Profiling, along with correlation rules, to automatically group related alerts into a single incident based on indicators of compromise and shared telemetry.

Answer

Syslog forwarding profile filters

Answer

Manual aggregation by the assigned security analyst

Answer

The endpoint agent local threshold configuration

Question 13

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

Accepted Answer

Update the incident status (e.g., New to Under Investigation). Option A is correct because the Incident View in Cortex XDR provides a status field where analysts can change an incident's state (for example, from New to Under Investigation) as part of the incident lifecycle workflow. Option C is correct because the same Incident View lets you assign the incident to a specific analyst (owner), enabling accountability and routing of the investigation. These are both core incident-management actions exposed directly in the Incident View UI. Option B is not correct because dashboard metric widgets are built in the Dashboards/Reports area, not from an incident record. Option D is not correct because agent installation is handled through endpoint management (e.g., Agent Installations/Endpoints), not the Incident View. Option E is not correct because custom data stitching parser scripts are configured in the data management/parsing settings, not within an incident.

Answer

Build global dashboard metric widgets

Answer

Install Cortex XDR agents on remote endpoints

Answer

Configure custom data stitching parser scripts

Question 14

An analyst notices suspicious network connections originating from an unknown process on an endpoint. To block outbound communication for this process without isolating the entire host, what action can be taken?

Accepted Answer

Terminate the process and block its file hash or path. Terminate the process and block its file hash or path is correct because this action stops the malicious process from running and prevents it from executing again by blocking its hash or path. In Cortex XDR, analysts can terminate a process directly from the incident view and add the file hash to a blocklist, which is enforced by the agent. This approach contains the threat without disrupting the entire host's network connectivity, unlike full isolation.

Answer

Unplug the physical power cable from the workstation

Answer

Change the local monitor refresh rate

Answer

Reset the enterprise DNS root servers

Question 15

An analyst is investigating a suspected phishing attack and needs to review the command line arguments passed to a suspicious email attachment execution. Where can the analyst find this evidence in Cortex XDR?

Accepted Answer

Process Execution details within the Causality Chain. Cortex XDR captures process execution telemetry as part of its endpoint data collection, and the Causality Chain view links each process to its parent, showing the full command line arguments used when the process was launched. When a suspicious email attachment executes, the spawned process (e.g., WINWORD.EXE launching a script or executable) appears in the Causality Chain with its exact command line, allowing the analyst to see what arguments were passed. This is the authoritative location for process-level execution evidence in Cortex XDR.

Answer

Hardware asset inventory list

Answer

Agent network proxy configuration file

Answer

DNS server cache table