XDR-Analyst Practice Test 16 — 15 Questions

Question 1

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

Accepted Answer

File Path and Command-Line arguments. Cortex XDR supports granular exception configuration using file hashes, digital signatures, and file paths or command-line arguments.

Answer

Local user keyboard layout language

Answer

Endpoint CPU temperature threshold

Question 2

Which TWO pieces of information are displayed in the Incident summary dashboard of Cortex XDR? (Choose two)

Accepted Answer

Overall incident severity distribution. The Incident summary provides high-level metrics such as total incident count, severity distribution, and affected host counts.

Answer

Cellular phone network tower signal strengths

Answer

Local employee salary payroll database records

Answer

Commercial airline flight booking schedules

Question 3

An organization wants to configure Cortex XDR to automatically respond to high-severity ransomware alerts. Which THREE elements must be correctly configured to ensure successful automated mitigation? (Choose three)

Accepted Answer

Response Playbook configured with ransomware detection triggers. Automated ransomware mitigation requires active agent connectivity, properly configured response playbooks, and appropriate containment actions such as isolation or process termination.

Answer

Manual adjustment of office lighting dimmer switches

Answer

Manual postal mail notification to external regulatory bodies

Question 4

When managing exclusions and exceptions in Cortex XDR, which THREE best practices should an analyst follow to maintain security posture? (Choose three)

Accepted Answer

Scope exceptions as narrowly as possible (e.g., specific hash and path). Effective exception management requires scoping rules tightly, documenting justifications, and reviewing exceptions periodically.

Answer

Share internal exception hashes publicly on open social media channels

Answer

Disable all default Cortex XDR BIOC rules globally upon deployment

Question 5

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Accepted Answer

Verify the digital signature and publisher of the application. Safe exception implementation involves validating binary integrity, verifying legitimate paths, and testing prior to global deployment.

Answer

Disable all Cortex XDR agent security modules across the entire enterprise

Answer

Remove all file access permissions from the operating system kernel

Question 6

An ITDR rule in Cortex XDR triggers due to impossible travel detected for a user account. Upon investigation, the analyst discovers the source IP belongs to a corporate VPN egress node. How should the analyst prevent future false positives for this known infrastructure?

Accepted Answer

Add the corporate VPN egress IP ranges to the known corporate network or location exclusions list in Cortex XDR settings. False positives caused by known corporate VPN exit nodes or proxy servers can be mitigated by configuring IP exclusions or tuning threat intelligence/behavioral analytics settings within Cortex XDR.

Answer

Modify the Windows Registry on the user's workstation to disable IPv6

Answer

Disable all behavioral analytics globally

Answer

Uninstall the Cortex XDR agent from all Domain Controllers

Question 7

An analyst is performing advanced threat hunting in Cortex XDR using XQL. Which THREE clauses or functions are commonly used when constructing analytical queries for evidence review? (Choose three)

Accepted Answer

fields command to select and display specific attributes or columns. XQL queries utilize clauses like dataset filtering, field projection (fields), and aggregation (alt / dedup / count) to analyze telemetry.

Answer

reboot operating system kernel function

Answer

format hard drive command to wipe the query storage engine

Question 8

When investigating an endpoint compromise, an analyst suspects DLL sideloading was used to execute malicious code. Which TWO telemetry indicators should the analyst examine? (Choose two)

Accepted Answer

File path analysis verifying whether the DLL resides in the application directory rather than System32. DLL sideloading investigations involve reviewing DLL load events and checking file paths and digital signatures of loaded binaries.

Answer

Company cafeteria seating arrangement charts

Answer

Corporate gym equipment maintenance logs

Answer

Office parking garage barrier arm position logs

Question 9

Which TWO evidence sources help an analyst investigate whether an unauthorized user accessed a compromised workstation locally? (Choose two)

Accepted Answer

Windows Security Event logs (Event IDs for logon successes and failures). Local workstation access investigations rely on Windows Security Event logs (Logon/Logoff events) and user session telemetry.

Answer

Corporate vehicle fleet GPS tracking logs

Answer

Office cafeteria refrigerator temperature charts

Answer

Office janitorial cleaning supply invoices

Question 10

An analyst is investigating an incident where a malicious file was dropped via email. Which TWO evidence artifacts should the analyst inspect to correlate the email vector with the endpoint execution? (Choose two)

Accepted Answer

Email gateway logs (sender, recipient, subject, and attachment name/hash). Correlating email vectors with endpoint execution involves analyzing email gateway logs and endpoint file drop events.

Answer

Employee dental insurance benefit claim forms

Answer

Office building elevator maintenance inspection reports

Answer

Corporate cafeteria recipe preparation guidelines

Question 11

An organization notices an increase in credential dumping attacks against local Active Directory environments. They want to configure Cortex XDR Identity Analytics to trigger high-severity alerts when abnormal Kerberos ticket requests (such as potential Silver or Golden ticket activities) are detected. Where should the analyst enable or tune these specific identity behavior analytics rules?

Accepted Answer

Under Settings > Configurations > Analytics in the Cortex XDR console. Identity Analytics behavioral rules are managed within the Analytics configuration section of the Cortex XDR management console under Settings > Configurations > Analytics.

Answer

By modifying local Windows Group Policy Objects (GPOs) pushed to domain controllers

Answer

Within the BIOC (Behavioral Indicator of Compromise) rule builder under Incident Response

Answer

Under Settings > Configurations > Data Node Settings in the Cortex XDR console

Question 12

When conducting a comprehensive post-incident review and remediation verification in Cortex XDR, which THREE actions should an analyst perform? (Choose three)

Accepted Answer

Review and document lessons learned, updating detection rules or playbooks as needed. Post-incident review includes verifying threat eradication, ensuring agent health, and updating detection rules or exceptions.

Answer

Permanently uninstall Cortex XDR agents from all enterprise endpoints

Answer

Delete all historical telemetry databases to save disk space permanently

Question 13

Where can an administrator view the overall identity risk posture score across all users within the Cortex XDR management console?

Accepted Answer

Dashboards and the User Risk view within the Cortex XDR console. The Cortex XDR dashboard and specific Identity/User risk widgets display the aggregated risk posture scores of monitored users.

Answer

License Management > Subscriptions

Answer

Reports > Audit Trail

Answer

Settings > Configurations > Agents

Question 14

An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?

Accepted Answer

Windows Security Event logs (specifically Event ID 4769) collected via Broker VM. Kerberoasting is detected by analyzing Windows Security Event log ID 4769 (A Kerberos service ticket was requested), specifically looking for high encryption downgrade requests (e.g., RC4).

Answer

Antivirus scan reports

Answer

DNS query logs showing external root hints

Answer

DHCP lease allocation tables

Question 15

An organization experiences a Golden Ticket attack. How does Cortex XDR's identity analytics engine typically detect this type of Kerberos ticket manipulation?

Accepted Answer

By detecting anomalies in Kerberos authentication attributes such as unusual ticket lifetimes or mismatched SID history from domain controller telemetry. Golden Ticket attacks forge Kerberos TGTs with arbitrary lifespans and SIDs. Cortex XDR detects this by correlating anomalous ticket attributes, such as invalid SID history or ticket lifetimes exceeding domain policy, captured from domain controller logs.

Answer

By monitoring USB mass storage insertion events

Answer

By blocking outbound TCP port 80 traffic at the perimeter firewall

Answer

By scanning the master boot record (MBR) of the endpoint for rootkit signatures