XDR-Analyst Practice Test 16 — 15 Questions

Question 1

An organization wants to ensure that all administrative logon sessions are closely monitored for anomalous behaviors in Cortex XDR. Where should the administrator configure custom behavioral alert thresholds for privileged users?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Settings > Analytics > Analytics Rules / Thresholds. Custom behavioral alert thresholds for privileged users in Cortex XDR are configured under Settings > Analytics > Analytics Rules / Thresholds. This section allows administrators to define and tune detection rules, including behavioral analytics thresholds that govern when alerts fire for anomalous activity such as unusual administrative logons. It is the centralized location for managing detection logic and sensitivity.

Answer

Response > Playbooks > Designer

Answer

Cloud > Settings > CSPM

Answer

Endpoints > Agent Configurations > Profile

Question 2

Which TWO actions can an analyst take when closing an incident in Cortex XDR? (Choose two)

Accepted Answer

Add resolution notes detailing remediation steps taken. Option C is correct because when an analyst closes an incident in Cortex XDR, they can add resolution notes that document the remediation steps taken, providing an audit trail and context for the closure. Option D is correct because Cortex XDR requires the analyst to assign a resolution status such as 'Resolved - True Positive' or 'Resolved - False Positive' to categorize the outcome of the investigation. These two fields are part of the standard incident resolution workflow in the Cortex XDR incident response interface. Option A is incorrect because employee performance reviews are an HR function unrelated to incident closure. Option B is incorrect because ordering replacement laptops is a procurement task, not an incident-closing action. Option E is incorrect because resetting datacenter cooling equipment is a facilities operation with no role in Cortex XDR incident resolution.

Answer

Conduct an employee annual performance review meeting

Answer

Order replacement laptops for all company employees

Answer

Initiate a physical factory reset of the datacenter cooling system

Question 3

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Group Policy Objects (GPO). Which file format is required for GPO-based installations on Windows endpoints?

Accepted Answer

.msi Windows Installer package. Group Policy Software Installation (MSI) requires an .msi installation package.

Answer

.rpm Red Hat Package Manager file

Answer

.exe self-extracting archive with embedded arguments

Answer

.dmg disk image format

Question 4

Which TWO details does the Cortex XDR Incident Graph display during evidence review? (Choose two)

Accepted Answer

Key attack entities such as suspicious files, IP addresses, and user accounts. The Cortex XDR Incident Graph is designed to visualize an incident's scope and progression by mapping the key attack entities involved, such as suspicious files, IP addresses, and user accounts, which is exactly what option A describes and why it is correct. It also depicts the causal and relational links between alerts, endpoints, and malicious artifacts, showing how they connect across the incident timeline, which is what option C correctly identifies. Options B, D, and E are all irrelevant non-security details (parking lot lighting, chair ergonomics, and microwave wattage) that have nothing to do with incident evidence review or the Incident Graph's visualization of threat data.

Answer

Corporate parking lot lighting schedules

Answer

Office desk chair ergonomic adjustment instructions

Answer

Breakroom microwave operational wattage ratings

Question 5

Which dashboard widget type in Cortex XDR is best suited for tracking the volume of open incidents over time across different severity levels?

Accepted Answer

Incident trend and severity breakdown widgets. Incident trend and severity widgets in Cortex XDR dashboards display historical and real-time metrics categorized by severity levels.

Answer

Syslog export status meter

Answer

Data stitching performance monitor

Answer

Agent health and connectivity graph

Question 6

Which TWO automated or manual response actions can be executed directly on an endpoint from the Cortex XDR Incident Response toolbox? (Choose two)

Accepted Answer

Isolate Endpoint. Option D (Isolate Endpoint) is correct because the Cortex XDR Incident Response toolbox includes a network isolation action that cuts the endpoint off from the network (except for the Cortex XDR management channel) to contain a threat during an active incident. Option E (Quarantine File) is correct because the toolbox provides a file quarantine action that moves a malicious file to a protected quarantine location on the endpoint so it can no longer execute. These are standard built-in response actions available directly from the incident response interface. Options A (Upgrade BIOS firmware), B (Calibrate display resolution), and C (Reimage Operating System kernel) are not response actions offered by the Cortex XDR toolbox; they are hardware, display, or OS-level maintenance tasks unrelated to threat containment or remediation.

Answer

Upgrade BIOS firmware

Answer

Calibrate display resolution

Answer

Reimage Operating System kernel

Question 7

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

Accepted Answer

Global Indicator Search / Threat Hunting. Option C, Global Indicator Search / Threat Hunting, is correct because it lets an analyst pivot on indicators such as file hashes, IP addresses, domains, and process names across all endpoints and telemetry in the Cortex XDR tenant, revealing every host or artifact tied to the incident enterprise-wide. Option E, XQL Search (Query Builder), is correct because XQL (XDR Query Language) queries the Cortex Data Lake and endpoint datasets, enabling broad, customizable hunting and correlation of events across the entire environment to scope an incident's blast radius. The remaining options do not belong: A (mouse pointer speed settings), B (audio speaker volume mixer), and D (physical keyboard backlight color adjuster) are unrelated OS or hardware cosmetic settings with no security, search, or incident-scoping capability in Cortex XDR.

Answer

Mouse pointer speed settings

Answer

Audio speaker volume mixer

Answer

Physical keyboard backlight color adjuster

Question 8

An enterprise is facing credential stuffing attacks targeting its cloud and on-premises applications. Which TWO detection or mitigation strategies within Cortex XDR and integrated tools help address this threat?

Accepted Answer

Analytics rules detecting high-frequency failed login attempts across multiple accounts from distributed source IPs. Option A is correct because credential stuffing manifests as many failed authentication attempts spread across numerous accounts from many different source IPs, and Cortex XDR analytics rules (BIOC/correlation rules) can detect this high-frequency failed-login pattern to trigger alerts and response actions. Option E is correct because integrating cloud identity provider (IdP) logs — such as Microsoft Entra ID/Entra ID, Okta, or similar — into Cortex XDR lets you monitor sign-in risk policies, conditional access outcomes, and automated lockout thresholds, which are key controls against credential stuffing. Options B, C, and D do not belong: screen saver timeouts, printer sharing permissions, and USB mass storage blocking address physical endpoint hygiene or data-loss concerns, not credential-based authentication attacks, and none of them detect or mitigate distributed failed-login activity.

Answer

Modifying screen saver timeout intervals via Group Policy

Answer

Configuring printer sharing permissions on all Windows 10 endpoints

Answer

Enabling USB mass storage device blocking

Question 9

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which THREE log locations or troubleshooting methods should the administrator examine to determine the root cause of the installation failure?

Accepted Answer

The Windows System and Application Event Logs for MSIInstaller or service creation errors. Option A is correct because failed MSI installations and service-creation problems are recorded in the Windows System and Application Event Logs, where MSIInstaller events (e.g., Event ID 11708/1033/1040) reveal the failing action or service that could not be created. Option B is correct because the Cortex XDR agent writes its own installation logs to the Windows %TEMP% directory and Cyvera-branded log files, which contain agent-specific setup errors that the generic Windows logs may not capture. Option C is correct because running the MSI with verbose logging (msiexec /i installer.msi /l*v install.log) produces a detailed Windows Installer log showing each action, return value, and the exact point of failure. Option D is not relevant because BIOS boot order only affects which device the system boots from and has no bearing on an MSI-based agent installation inside Windows. Option E is not relevant because arp -a displays the local ARP cache (IP-to-MAC mappings), not router routing tables, and has no relationship to software installation failures.

Answer

The BIOS firmware boot order configuration screen

Answer

The local router routing table via the arp -a command

Question 10

Which THREE indicators collected by Cortex XDR endpoint agents are crucial for identifying post-exploitation credential harvesting activities on a host?

Accepted Answer

Unauthorized process memory access requests targeting lsass.exe. Option B is correct because post-exploitation credential harvesting frequently involves tools that read the memory of lsass.exe (e.g., Mimikatz, ProcDump, comsvcs.dll MiniDump), and Cortex XDR agents flag unauthorized cross-process memory access to LSASS as a high-fidelity indicator of credential theft. Option C is correct because the SAM hive stores local account password hashes and the SYSTEM hive contains the boot key needed to decrypt them, so unauthorized registry access to these hives (e.g., via reg save or esentutl) signals offline credential dumping. Option D is correct because Cortex XDR detects known credential-dumping command-lines and renamed binaries (e.g., procdump.exe -ma lsass.exe, sekurlsa::logonpasswords, lazagne.exe) through behavioral analytics and signature matching, which is a primary detection vector for credential harvesting. Option A is not relevant because changing the desktop wallpaper is a cosmetic/user-preference action with no relation to credential access. Option E is not relevant because clearing browser cache is a routine maintenance or privacy action and does not indicate credential harvesting from OS-level stores such as LSASS or the registry hives.

Answer

Changes to desktop background wallpaper settings

Answer

Default web browser cache clearing

Question 11

What THREE criteria are evaluated by Cortex XDR when determining whether incoming raw alerts should be grouped into an existing incident or spawn a new one? (Choose three)

Accepted Answer

Common affected entities such as hostnames or user accounts. Cortex XDR groups incoming raw alerts into an existing incident primarily based on shared affected entities (Option A), such as the same hostname, endpoint, or user account, since alerts touching the same asset or identity are treated as part of one attack story. It also evaluates shared indicators of compromise (Option C) — matching file hashes, IP addresses, or domains — because overlapping IOCs signal the same underlying activity. Finally, temporal proximity and correlation time windows (Option E) matter, as alerts falling within the configured correlation window are candidates for merging while older alerts fall outside and spawn a new incident. Options B and D are not grouping criteria: starring an alert is only an analyst triage/UI action, and custom featured fields merely control table-view display, neither of which influences incident correlation logic.

Answer

Whether the previous alerts were starred by an analyst

Answer

The presence of custom featured fields in the table view

Question 12

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

Accepted Answer

Quarantine File. Option A (Quarantine File) is correct because Cortex XDR playbooks can invoke the quarantine action to move a malicious file into the local quarantine vault and prevent its execution on the endpoint. Option B (Isolate Endpoint) is correct because endpoint isolation is a core automated containment action that restricts network communication to only the Cortex XDR management channel, blocking lateral movement during an incident. Option D (Collect forensic investigation package from the host) is correct because Cortex XDR supports triggering a forensic data collection (e.g., triage package with running processes, autoruns, and logs) directly from a playbook for offline analysis. Option C is not valid because physically replacing motherboard hardware is a manual, hands-on task that no software playbook can perform. Option E is not valid because modifying a corporate website's DNS homepage banner is unrelated to endpoint containment and outside the scope of Cortex XDR response actions.

Answer

Physically replace damaged endpoint motherboard hardware

Answer

Update the corporate website DNS homepage banner

Question 13

When reviewing identity alerts in Cortex XDR, which TWO anomalous behaviors might indicate compromised credentials? (Choose two)

Accepted Answer

Accessing sensitive resources outside normal working hours and baseline behavior. Option A is correct because accessing sensitive resources outside normal working hours and outside the user's established baseline behavior is a classic indicator of compromised credentials — an attacker using stolen credentials often operates at unusual times and targets data the legitimate user does not normally touch, which Cortex XDR surfaces as an identity analytics anomaly. Option C is correct because impossible travel logins from geographically distant locations within minutes are physically impossible for a single human to perform, indicating the credentials are being used by multiple parties or an attacker from a remote location, a well-known credential-compromise signal in Cortex XDR identity alerts. Option B does not belong because connecting a standard corporate wired Ethernet cable is a normal, expected network activity with no identity or credential anomaly. Option D does not belong because printing a standard business document to the local office printer is routine user behavior unrelated to credential misuse. Option E does not belong because a routine login from the user's assigned office desktop during regular business hours matches the expected baseline and shows no anomaly.

Answer

Connecting a standard corporate wired Ethernet cable

Answer

Printing a standard business document to the local office printer

Answer

Routine login from the user's assigned office desktop during regular business hours

Question 14

Which TWO data sources can Cortex XDR leverage to build comprehensive user identity behavior profiles for ITDR? (Choose two)

Accepted Answer

Cloud Identity Provider authentication logs (e.g., Azure AD, Okta). Option A is correct because Cortex XDR ingests authentication telemetry from cloud identity providers such as Microsoft Entra ID and Okta (via the identity analytics/ITDR integration), which supplies sign-in events, MFA results, and risk detections needed to baseline user identity behavior. Option D is correct because Active Directory security event logs (e.g., 4624, 4625, 4768, 4769, 4720) provide on-premises authentication, Kerberos, and account-change activity that Cortex XDR correlates to profile user behavior and detect identity threats. Option B is not relevant since printer configuration files contain device settings, not user identity or authentication activity. Option C is not relevant because DHCP lease tables only map IP addresses to MAC addresses and do not describe user identity behavior. Option E is not relevant because BIOS firmware version logs are hardware inventory data with no bearing on user identity behavior profiling.

Answer

Local printer configuration files

Answer

DHCP lease allocation tables

Answer

BIOS firmware version logs

Question 15

Which THREE configuration steps are required to ensure Cortex XDR successfully correlates endpoint events with Active Directory user identities?

Accepted Answer

Enabling behavioral analytics and ITDR modules within the Cortex XDR management console. Option C is correct because enabling behavioral analytics and ITDR (Identity Threat Detection and Response) modules in the Cortex XDR management console activates the identity-correlation and analytics engines that map endpoint activity to AD user identities. Option D is correct because Cortex XDR agents must be deployed on enterprise endpoints to collect the process, network, and user telemetry that is later correlated with Active Directory identities. Option E is correct because the Broker VM ingests Active Directory and User-ID mapping data (e.g., via WinRM/AD queries and User-ID agents), providing the identity context needed to associate endpoint events with AD users. Option A is not required and would be counterproductive, since removing local accounts does not enable AD correlation and can break legitimate access. Option B is not required and would weaken security, as disabling domain controller firewall rules is unrelated to identity correlation and exposes critical services.

Answer

Removing all local user accounts from workstations

Answer

Disabling all firewall rules on domain controllers