XDR-Analyst Practice Test 18 — 15 Questions

Question 1

An analyst is investigating an ITDR incident in Cortex XDR where an attacker used a compromised service account to create a new domain admin account. The analyst needs to review the sequence of authentication and directory-change events leading to the new account creation. Which Cortex XDR feature provides a chronological, identity-centric timeline for this investigation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The User View for the compromised service account, which aggregates that identity's authentication and related activity into a timeline.. The User View presents an identity-centric chronological timeline, aggregating authentication events and related directory activity for a specific account. For a service account that authenticated and then created a domain admin, this view lets the analyst reconstruct the exact sequence. Endpoint-centric, containment, and tuning views do not provide that identity-focused chronology.

Answer

The Causality Chain view for the involved endpoint, which links processes to their parent and child activity.

Answer

The Alert Exceptions configuration, which lists detection rules that have been tuned to reduce noise.

Answer

The Endpoint Isolation status page, which shows which hosts have been isolated during the incident response.

Question 2

An analyst is reviewing a Cortex XDR incident that was created by the correlation engine. The analyst wants to understand why certain alerts were grouped together. Which two factors does the Cortex XDR correlation engine primarily use to stitch alerts into a single incident? (Choose two.)

Accepted Answer

Shared indicators such as file hashes, IP addresses, or domain names across alerts.. The Cortex XDR correlation engine primarily stitches alerts based on shared indicators (like hashes, IPs, domains) and common entities (user accounts or endpoints). These factors provide strong evidence that alerts are part of the same attack, enabling the engine to group them into a single incident for efficient investigation.

Answer

Alerts with identical severity levels as assigned by the analytics engine.

Answer

The order in which alerts are ingested into the Cortex XDR console.

Answer

Alerts generated within a specific time window, regardless of other similarities.

Question 3

An administrator is setting up User Risk Scoring within Cortex XDR. They notice that certain service accounts with high volumes of automated authentications are skewing the risk calculations. How should the administrator handle these service accounts in Cortex XDR to prevent false-positive risk elevations?

Accepted Answer

Configure Identity Analytics exclusions or entity classifications for known service accounts. The correct approach is to configure Identity Analytics exclusions or entity classifications for known service accounts (A). This allows Cortex XDR to treat these accounts specially, preventing their high-volume automated authentications from skewing risk scores. Exclusions or classifications can be based on account name, group membership, or other attributes, ensuring that legitimate service activity does not trigger false-positive risk elevations.

Answer

Delete all authentication logs associated with service accounts from the Cortex XDR data lake

Answer

Disable Cortex XDR Agent protection on all Domain Controllers

Answer

Convert the service accounts into standard local administrator accounts

Question 4

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

Accepted Answer

Cloud audit and API activity logs. Cloud audit and API activity logs (e.g., AWS CloudTrail, Azure Activity Log) record every API call and resource modification in the cloud environment, making them the primary forensic source for cloud incidents. Cortex XDR ingests these to correlate cloud activity with endpoint telemetry.

Answer

Active Directory SYSVOL share

Answer

Local printer driver cache

Answer

Local endpoint SAM registry hive

Question 5

A Cortex XDR analyst is investigating an incident where a user's endpoint was compromised. The analyst needs to determine if the attacker moved laterally to other endpoints by leveraging stolen credentials. Which Cortex XDR data source should the analyst query to identify successful and failed authentication attempts across the environment?

Accepted Answer

Authentication logs from the identity provider. Authentication logs from the identity provider contain records of logon attempts, including success or failure, and often include source and destination information. This makes them the most appropriate data source for detecting lateral movement via stolen credentials. Other sources like process execution or network traffic logs lack the necessary authentication context to confirm such activity.

Answer

Network traffic analysis (NTA) logs

Answer

File system audit logs

Answer

Endpoint process execution logs

Question 6

An analyst wants to flag a particular high-priority incident so that other shift analysts immediately notice it when they log in. What is the most direct feature to use?

Accepted Answer

Incident starring. Incident starring is the built-in Cortex XDR feature that lets an analyst bookmark an incident so it stands out for other team members. Starred incidents are visually flagged in the Incident View and can be filtered, making it the most direct way to draw a shift's attention to a specific case. It requires no rule changes or forwarding configuration.

Answer

Alert exclusion rule

Answer

Syslog forwarding profile

Answer

Data stitching configuration

Question 7

An administrator is planning the initial installation of Cortex XDR agents on 500 Windows endpoints. The security policy requires that endpoints authenticate to the Cortex XDR tenant during installation using a shared secret that can be rotated if compromised. Which item must the administrator generate in the Cortex XDR management console before installing the agents?

Accepted Answer

An agent installation token. The agent installation token is the shared secret that endpoints present during Cortex XDR agent installation to authenticate with the tenant. Administrators generate it in the management console and can rotate it if compromised. It is distinct from API keys and Broker VM tokens, which serve different authentication purposes in the Cortex XDR architecture.

Answer

A Broker VM registration token

Answer

A content update signing certificate

Answer

A Cortex XDR API key

Question 8

When reviewing an incident, an analyst wants to assign ownership to themselves. Which action should the analyst take?

Accepted Answer

Assign the incident to their user account in the Incident View. Assigning an incident to an analyst updates the incident ownership field in the Cortex XDR console.

Answer

Star the incident and export it to syslog

Answer

Change the data stitching profile name

Answer

Add a featured field with their username

Question 9

An organization has strict egress filtering rules. Which destination URLs or IP ranges must be whitelisted in the corporate firewall to allow the Cortex XDR agent to communicate with the Cortex XDR cloud service?

Accepted Answer

The specific regional Cortex XDR tenant FQDNs and update distribution domains. The correct answer is to whitelist the specific regional Cortex XDR tenant FQDNs and update distribution domains (D). Cortex XDR agents communicate with region-specific cloud endpoints, and these must be allowed through egress firewalls. The FQDNs are provided by Palo Alto Networks and vary by region (e.g., Americas, Europe, Asia). Update distribution domains are also required for agent updates.

Answer

A static list of Palo Alto Networks global headquarters IP addresses

Answer

Only local internal DNS servers

Answer

Public NTP servers only

Question 10

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

Accepted Answer

Incident Response > Alerts, filtering by Analytics category related to Identity. Identity analytics alerts generated by User Behavior Analytics (UBA) in Cortex XDR appear under Incident Response > Alerts, where analysts can filter by the Analytics category and specifically the Identity-related subcategory. This is the centralized alert triage interface where UBA-generated detections (e.g., impossible travel, anomalous login) surface alongside other analytics alerts.

Answer

Cloud > Posture > Identity

Answer

XQL Search > Identity_Raw schema

Answer

Endpoints > Agent Configurations > Identity

Question 11

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

Accepted Answer

The agent maintains a dedicated management communication channel to the Cortex XDR server while blocking other network traffic.. When Cortex XDR isolates a host, the agent maintains a dedicated management communication channel to the Cortex XDR server while blocking other network traffic. This allows the analyst to retain visibility and control (e.g., run scripts, collect forensics) even though the endpoint cannot reach internal file shares or the internet. The isolation is selective, not a full network shutdown.

Answer

The host switches to a backup dial-up modem connection.

Answer

All network traffic is routed through an open public proxy server.

Answer

The host disables its TCP/IP stack entirely.

Question 12

What THREE outcomes typically occur when data stitching successfully links a network alert and an endpoint alert? (Choose three)

Accepted Answer

The timeline reflects a complete attack path across network and endpoint. Option B is correct because successful data stitching correlates the network and endpoint telemetry into one coherent narrative, so the incident timeline shows the full attack path spanning both the network and endpoint sides. Option C is correct because stitching merges the related network and endpoint alerts into a single unified incident rather than leaving them as separate detections. Option E is correct because once the combined evidence from both alerts is linked, the incident's overall score is recalculated to reflect the aggregated severity and confidence. Option A is incorrect because stitching does not wipe or reset featured fields to defaults; featured fields are preserved and enriched. Option D is incorrect because stitching does not automatically star all constituent raw alerts; starring is a manual analyst action, not a stitching outcome.

Answer

Featured fields are wiped out and reset to default

Answer

All constituent raw alerts are automatically starred

Question 13

A security administrator is preparing to install Cortex XDR agents on a large number of Windows endpoints. The administrator wants to ensure that the agents automatically register with the correct Cortex XDR tenant and receive the appropriate policy settings. Which item must be included in the agent installation package or command line to achieve this?

Accepted Answer

The installation token generated in the Cortex XDR console. The installation token is the required credential for Cortex XDR agents to authenticate and register with the correct tenant during installation. It is generated in the management console and can be included in the installation package or command line for bulk deployments. Without it, agents cannot join the tenant or receive policies. The other options are not used for initial agent registration.

Answer

The Broker VM IP address

Answer

The Cortex XDR tenant API key

Answer

The Cortex XDR agent license key

Question 14

Which TWO actions are available to an analyst when managing an incident's assignment in Cortex XDR? (Choose two)

Accepted Answer

Assign the incident to a specific analyst user account. Option A is correct because Cortex XDR incident management allows an analyst to assign an incident to a specific analyst user account, which sets that named user as the owner responsible for triaging and resolving the incident. Option E is correct because incidents can also be assigned to a specific SOC analyst group or tier, enabling team-based ownership and routing to the appropriate skill level rather than a single individual. Both actions are core assignment operations in the Cortex XDR incident response workflow, letting analysts direct ownership either to a person or to a group/tier. Options B, C, and D are incorrect because stock ticker symbols, office mail delivery, and security guard shifts are unrelated to Cortex XDR incident assignment and have no place in the platform's incident management features.

Answer

Update corporate stock market ticker symbols

Answer

Re-route office mail delivery to a new address

Answer

Change corporate office building security guard shifts

Question 15

An administrator is configuring Active Directory integration with Cortex XDR using the Broker VM. Which TWO prerequisites or components are required to successfully establish User-ID mapping and synchronization?

Accepted Answer

A dedicated service account in Active Directory with read permissions to query user and group objects. Option A is correct because Cortex XDR's Active Directory integration via the Broker VM requires a dedicated AD service account with read permissions to query user and group objects, which is used to perform LDAP bind and enumerate directory data for User-ID mapping. Option E is correct because the Broker VM must reach the Domain Controllers over TCP 389 for LDAP or TCP 636 for LDAPS to perform those queries and synchronize user and group information. Option B is incorrect because no physical USB hardware token is involved in AD User-ID synchronization. Option C is incorrect because the integration uses LDAP/LDAPS queries with the service account, not direct SSH root access to each Domain Controller. Option D is incorrect because installing the Cortex XDR Agent on Domain Controllers is not a mandatory prerequisite for Broker VM-based AD integration.

Answer

A physical hardware token connected to the Broker VM USB port

Answer

Direct SSH root access to every Active Directory Domain Controller

Answer

Installation of the Cortex XDR Agent on all Domain Controllers as a mandatory prerequisite