XDR-Analyst Practice Test 17 — 15 Questions

Question 1

An analyst is investigating an alert involving suspicious PowerShell execution. To thoroughly review the evidence, which THREE investigative steps should the analyst take within Cortex XDR? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Examine the exact command-line arguments passed to powershell.exe. Option A is correct because examining the exact command-line arguments passed to powershell.exe reveals the actual script, encoded commands (e.g., -EncodedCommand), or download-and-execute strings that define the malicious behavior, which is essential evidence in a PowerShell alert. Option C is correct because the Causality Chain in Cortex XDR shows the process lineage, letting the analyst identify the parent process that spawned PowerShell (e.g., winword.exe or wmiprvse.exe) and determine the initial infection vector. Option E is correct because inspecting network connections initiated by the PowerShell process exposes command-and-control traffic, exfiltration, or payload downloads, tying the execution to external infrastructure. Options B and D are incorrect because desk phone extensions and physical badge reader logs are physical-security artifacts unrelated to host-based PowerShell process telemetry and are not investigative data available within Cortex XDR for this alert.

Answer

Check the physical desk phone extension number of the user

Answer

Verify the physical building entry badge reader logs

Question 2

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

Accepted Answer

Review command-line arguments for utility tools utilized during the attack. Option D is correct because reviewing command-line arguments for utility tools (e.g., procdump, comsvcs.dll MiniDump, or Mimikatz invocations) reveals the exact syntax and target used to dump credentials, which is critical evidence in a credential dumping investigation. Option E is correct because LSASS.exe holds credential material in memory, so inspecting process access events (e.g., Sysmon Event ID 10, ProcessAccess with GrantedAccess like 0x1010 or 0x1410) targeting LSASS.exe directly identifies the credential dumping attempt. Options A and B are incorrect because badge swipe times and HVAC temperature logs are physical/environmental records unrelated to memory-based credential theft. Option C is incorrect because point-of-sale receipt records pertain to retail transactions and have no bearing on credential dumping activity on endpoints.

Answer

Verify employee cafeteria badge swipe access times

Answer

Check the office HVAC temperature logs

Answer

Analyze cafeteria point-of-sale receipt records

Question 3

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

Accepted Answer

IP Connection (Source/Destination IP and Port). Option A (IP Connection with Source/Destination IP and Port) is correct because Cortex XDR alert details include network artifacts such as the source and destination IP addresses and ports involved in the connection, which are essential for tracing command-and-control or lateral movement activity. Option D (File hash, SHA-256) is correct because Cortex XDR captures cryptographic file hashes (including SHA-256) as part of its file artifacts, enabling analysts to identify known-malicious files and pivot to threat intelligence lookups. The remaining options do not belong: physical RAM stick serial numbers (B), office printer cartridge ink levels (C), and BIOS manufacturer dates (E) are hardware or facilities attributes that Cortex XDR does not collect or surface as alert artifacts.

Answer

Physical RAM stick serial number

Answer

Office printer cartridge ink level

Answer

BIOS manufacturer date

Question 4

An incident responder is investigating a complex incident in Cortex XDR and needs to examine the raw alert-to-incident lifecycle and data stitching relationships. Which THREE components or views in the Cortex XDR console should the responder utilize to thoroughly analyze this data? (Choose three)

Accepted Answer

The Causality View to inspect process execution chains and stitched telemetry.. Responders use the Causality View, Alert Tab, and Incident Graph/Timeline to trace the raw-alert-to-incident lifecycle and data stitching.

Answer

The Agent Upgrade wizard to deploy new software versions.

Answer

The Firewall Rulebase Configuration page to modify packet filters.

Question 5

A security analyst suspects an account compromise after noticing multiple rapid logins from geographically distant IP addresses within minutes. Which Cortex XDR feature automatically aggregates these related anomalous authentication indicators into a single incident?

Accepted Answer

Analytics Alert Grouping engine. Analytics and Alert Grouping engines in Cortex XDR correlate disparate alerts associated with the same entity (such as a compromised user account) into a unified incident.

Answer

Device Control Policy

Answer

WildFire Verdict Engine

Answer

Cortex XSOAR Playbook Auto-Merge

Question 6

What action should an analyst take in Cortex XDR when an incident investigation is fully complete and all remediation steps have been verified?

Accepted Answer

Update the incident status to 'Resolved' or 'Closed'. Once an investigation and remediation are complete, the analyst should update the incident status to 'Resolved' or 'Closed'.

Answer

Apply a featured field to hide the incident

Answer

Star every alert in the incident queue

Answer

Delete all raw alerts associated with the incident

Question 7

An analyst wants to create a robust incident response workflow in Cortex XDR that incorporates both manual analyst review and automated remediation. Which THREE capabilities support this integrated approach? (Choose three)

Accepted Answer

Incident Queue and manual triage tools for analyst review. Option A is correct because the Cortex XDR Incident Queue provides a centralized view where analysts can manually triage, assign, and investigate incidents, which is the manual review half of the integrated workflow. Option D is correct because Exceptions management lets analysts tune detection rules and suppress verified false positives, keeping the automated pipeline accurate and reducing alert noise after human validation. Option E is correct because Response Playbooks deliver automated containment actions (such as isolating endpoints) and artifact collection, providing the automated remediation half that complements manual review. Option B is incorrect because physically destroying motherboard circuits is not a Cortex XDR capability and would be destructive, not a remediation workflow feature. Option C is incorrect because replacing office windows is a physical facilities task unrelated to endpoint security orchestration.

Answer

Automated physical destruction of endpoint motherboard circuits

Answer

Manual replacement of physical office windows

Question 8

Which TWO mechanisms are used by Cortex XDR to prevent alert fatigue during the raw-alert-to-incident lifecycle? (Choose two)

Accepted Answer

Alert exclusion and exception rules. Option A (Alert exclusion and exception rules) is correct because Cortex XDR lets analysts define exclusion and exception policies that suppress or filter known-benign raw alerts before they escalate, directly reducing the volume of noise that would otherwise contribute to alert fatigue. Option B (Automated alert grouping and incident correlation) is correct because Cortex XDR automatically groups related raw alerts and correlates them into a single incident, so multiple low-level alerts become one actionable case rather than many separate notifications, which is a core anti-fatigue mechanism in the raw-alert-to-incident lifecycle. Option C (Featured fields column configuration) is incorrect because it only customizes how columns are displayed in the alert table and does not reduce or consolidate alert volume. Option D (Manual incident starring) is incorrect because starring is a manual analyst convenience for flagging incidents and does not prevent fatigue through automated suppression or grouping. Option E (Syslog log export scheduling) is incorrect because scheduling syslog exports is a data-forwarding/reporting function and has no role in reducing alert fatigue within the incident lifecycle.

Answer

Featured fields column configuration

Answer

Manual incident starring

Answer

Syslog log export scheduling

Question 9

A security analyst receives a Cortex XDR incident that was automatically created from multiple alerts. The analyst wants to assign the incident to a specific team member for further investigation. Which action should the analyst take?

Accepted Answer

Assign the incident to a user.. Assigning the incident to a user is the direct method to designate ownership and responsibility in Cortex XDR. It notifies the assignee and allows them to manage the incident from their own queue. Other actions like changing severity, commenting, or tagging do not transfer ownership.

Answer

Change the incident's severity level.

Answer

Add a comment to the incident.

Answer

Tag the incident with a custom label.

Question 10

An analyst is investigating a Cortex XDR incident and wants to add a note to the incident timeline to document the steps taken so far. Where in the Cortex XDR console can the analyst add this note?

Accepted Answer

Incident Details page, under the Notes section. The Incident Details page has a dedicated Notes section where analysts can add documentation that is automatically included in the incident timeline. This is the correct place to record investigation steps. Other areas like Endpoint Management, Causality View, or XQL Query Builder do not provide a way to add notes to the incident timeline, making them incorrect.

Answer

Causality View, by right-clicking an event

Answer

XQL Query Builder, by saving a query with a comment

Answer

Endpoint Management console, under the endpoint's details

Question 11

A Cortex XDR analyst receives an alert for 'Suspicious LDAP Query' from a workstation. The query targeted the 'adminCount' attribute on multiple user objects. The analyst suspects an attacker is using AD reconnaissance to find privileged accounts. Which Cortex XDR feature should the analyst use to quickly visualize the scope of this reconnaissance and identify other affected hosts?

Accepted Answer

The Cortex XDR Query Builder (XQL) to search for similar LDAP query events across all endpoints and create a timeline.. To assess the scope of LDAP reconnaissance across multiple hosts, the analyst needs to search event data centrally. Cortex XDR's Query Builder (XQL) enables ad-hoc queries across all endpoint telemetry, including LDAP query events. By searching for the specific attribute (e.g., adminCount) or query patterns, the analyst can identify all hosts that performed similar queries, aggregate results, and visualize trends. This provides a comprehensive view of the reconnaissance campaign, which is not achievable through single-endpoint views or inventory consoles.

Answer

The Alert Management console, which groups similar alerts into incidents for triage.

Answer

The Causality Chain view, which shows the sequence of processes and network connections related to the alert.

Answer

The Endpoint Management console, which lists all endpoints and their last seen status.

Question 12

An analyst is reviewing a Cortex XDR incident that contains a 'Behavioral Threat' alert for a process that spawned a child process with suspicious command-line arguments. The analyst wants to see the full process lineage, including the parent process, command line, and the user account that initiated it, to determine if this is a false positive. Which Cortex XDR feature should the analyst use to obtain this information?

Accepted Answer

Causality Chain view. The Causality Chain view provides a graphical representation of process ancestry, including parent-child relationships, command lines, and user context. This is the most direct and efficient way to understand the full lineage of a suspicious process and determine whether the behavior is malicious or benign. Other options either lack the necessary visual context or are intended for different purposes such as response or custom querying.

Answer

Incident Response Playbook

Answer

Alert Timeline view

Answer

XQL Query Builder

Question 13

An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?

Accepted Answer

Target process name matching 'lsass.exe' with suspicious access rights from an unauthorized source process. Credential dumping via LSASS memory access is detected by monitoring for suspicious access rights (e.g., PROCESS_VM_READ) requested against the lsass.exe process by an unauthorized or unexpected source process. This behavior is characteristic of tools like Mimikatz and is the core telemetry condition a BIOC rule must evaluate. The other options describe unrelated event types.

Answer

Registry modifications affecting the Windows Firewall state

Answer

DNS query logs for newly registered domains

Answer

Outbound HTTPS connections to unknown external IP addresses on port 443

Question 14

An analyst observes that an incident's score dynamically increases over time as new related alerts are added. Which component of Cortex XDR drives this behavior?

Accepted Answer

The dynamic incident scoring engine. Cortex XDR's dynamic incident scoring engine continuously recalculates an incident's score as new related alerts are stitched into it, factoring in alert severity, asset criticality, and alert volume. This is why the score rises over time as more correlated alerts arrive — it is the scoring engine, not any UI or retention component, that drives the dynamic behavior.

Answer

The manual analyst assignment workflow

Answer

The log collector retention policy

Answer

The featured fields rendering engine

Question 15

An analyst is investigating a Cortex XDR incident that contains alerts from an endpoint infected with malware. The analyst wants to determine which specific process on that endpoint initiated the malicious network connection. Which Cortex XDR feature should the analyst use to view the parent-child process relationships associated with the alert?

Accepted Answer

Causality Chain view. The Causality Chain view is specifically designed to visualize the process execution flow that led to an alert, including parent-child relationships. This allows the analyst to pinpoint the exact process that initiated the malicious network connection, which is critical for understanding the attack vector and scope.

Answer

Alert Details pane

Answer

BIOC Rules

Answer

Incident Timeline