XDR-Analyst Practice Test 19 — 15 Questions

Question 1

An administrator is planning an agent rollout and needs to configure agent profiles in the Cortex XDR management console. Which THREE configuration elements can be defined within an Agent Settings profile?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Proxy server configuration for agent communication traversal. Option A is correct because an Agent Settings profile in Cortex XDR includes proxy settings that determine how the agent reaches the management console and Cortex XDR services, including proxy server address, port, and authentication for communication traversal. Option C is correct because Agent Settings profiles define exclusions by path, process, or file hash so that specified files or behaviors are not scanned or blocked by the agent. Option E is correct because the profile controls the agent's operational mode, such as Normal, Detect-only, or Disabled, which governs whether protections are enforced or only reported. Option B is not part of agent profiles because GlobalProtect VPN gateway tunnel encryption algorithms are configured in the GlobalProtect gateway configuration, not in Cortex XDR agent settings. Option D is not part of agent profiles because physical firewall interface IP addresses and routing tables are configured on the firewall itself, not within an endpoint agent settings profile.

Answer

GlobalProtect VPN gateway tunnel encryption algorithms

Answer

Physical firewall interface IP addresses and routing tables

Question 2

An administrator is planning a Cortex XDR agent rollout for 2,500 Windows servers that reside in a data center with no direct internet access. All outbound traffic must traverse an explicit forward proxy. The administrator wants agents to register successfully with the Cortex XDR cloud tenant. What should the administrator do first?

Accepted Answer

Configure the agent installation package with the explicit proxy address and port so agents can reach the Cortex XDR cloud.. In a no-direct-internet data center, the Cortex XDR agent cannot reach the cloud unless it is configured to use the explicit forward proxy. Providing the proxy address and port during installation or via policy lets the agent establish its outbound session and register, which is the foundation for receiving policy and sending telemetry.

Answer

Deploy a Broker VM in the data center and point agents to it as their management server instead of the cloud tenant.

Answer

Disable SSL inspection on the proxy for all traffic so agents can register without certificate issues.

Answer

Open inbound TCP 443 from the Cortex XDR cloud to each server so registration traffic can reach the agents.

Question 3

An analyst wants to quickly identify all alerts related to a specific external IP address across multiple incidents without opening each incident individually. Which feature in the Cortex XDR console should the analyst use?

Accepted Answer

Alerts View filter and search capabilities. The Alerts View in Cortex XDR provides a centralized, filterable list of all raw alerts across every incident, with search capabilities that let analysts query by indicator values such as an external IP address. This allows the analyst to pivot on the IP without opening each incident individually, since alerts from multiple incidents are aggregated in a single searchable table. Filtering and searching at the Alerts View level is the intended workflow for cross-incident indicator hunting.

Answer

Incident scoring threshold filter

Answer

Featured fields sorting

Answer

Data stitching status toggle

Question 4

An analyst determines that a compromised endpoint is beaconing to a known malicious domain. The analyst wants to immediately stop the endpoint from reaching that domain while keeping the rest of the host's business traffic intact. Which Cortex XDR response action should the analyst choose?

Accepted Answer

Add the domain or its resolved IPs to the Block List in the Cortex XDR console.. The Block List in Cortex XDR is a targeted control that blocks specified domains, IP addresses, or hashes across managed endpoints. Adding the malicious domain stops the beaconing immediately and persistently while leaving all other host traffic operational, which is precisely what the scenario requires without resorting to full isolation.

Answer

Initiate Network Isolation on the endpoint.

Answer

Quarantine the endpoint using the agent's malware quarantine feature.

Answer

Terminate the process responsible for the beaconing.

Question 5

During an investigation, a Cortex XDR analyst notices that an endpoint generated a high volume of network connection events to a suspicious external IP address. The analyst wants to isolate the host from the network while still allowing the Cortex XDR agent to communicate with the console for continued investigation. Which Cortex XDR response action should the analyst use?

Accepted Answer

Isolate the endpoint using the Cortex XDR network isolation capability, which blocks external traffic while permitting agent-to-console communication.. Cortex XDR network isolation contains an endpoint by blocking its network traffic while preserving the agent's connection to the console. This stops command-and-control and lateral movement but keeps the host manageable for continued evidence collection and response. It directly satisfies the requirement to cut the suspicious external communication without losing investigative visibility.

Answer

Terminate the malicious process only, leaving the endpoint fully connected so that the analyst can observe further attacker behavior.

Answer

Add the external IP address to the block list in the endpoint policy and wait for the policy to synchronize to the endpoint.

Answer

Quarantine the endpoint, which disables all network interfaces including the agent's management channel.

Question 6

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

Accepted Answer

Remediate Action (Cleanup). The Remediate Action (Cleanup) capability in Cortex XDR supports automatic remediation of file drops and registry modifications by reverting changes made by malicious processes. It can remove dropped files, delete registry keys, and undo other system modifications based on the causality chain. This is the built-in remediation feature designed for cleanup after an incident.

Answer

DNS Flushing

Answer

DHCP Lease Renewal

Answer

Static Route Addition

Question 7

An analyst is reviewing a Cortex XDR incident where a suspicious PowerShell script was executed on an endpoint. The analyst wants to see the exact command-line arguments that were passed to PowerShell at the time of execution. Which Cortex XDR feature should the analyst use to find this information?

Accepted Answer

Process Execution History in the Causality Chain. The Causality Chain in Cortex XDR provides a detailed view of process execution, including the command-line arguments used when each process was started. By inspecting the Process Execution History within the Causality Chain, the analyst can see the exact PowerShell command line and its arguments. Other features like the Alerts Table, isolation logs, or policy audits do not offer this level of process detail.

Answer

Alerts Table

Answer

Endpoint Isolation Logs

Answer

Policy Audit Trail

Question 8

An administrator is planning a Cortex XDR rollout for a multinational company. Legal requires that endpoint telemetry from one region remain within that region's cloud tenant and never be visible to administrators in other regions. Which planning consideration is most critical to satisfy this data-residency requirement?

Accepted Answer

Deploy agents in each region with an installation token tied to that region's tenant so endpoints enroll only in the correct tenant.. Data residency is enforced at enrollment by binding endpoints to the correct regional tenant. Region-specific installation tokens ensure each agent registers only with the tenant approved for its location, so telemetry is stored and processed within that region. Other controls such as RBAC, content schedules, or Broker VM placement do not by themselves determine where data resides.

Answer

Use a single global tenant and rely on role-based access control to hide other regions' data from administrators.

Answer

Deploy a Broker VM in each region and assume that all telemetry stays local to that Broker VM.

Answer

Configure agent profiles with content update schedules that differ by region to keep data local.

Question 9

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

Accepted Answer

File Details / WildFire Analysis tab. In Cortex XDR, when a file is submitted to WildFire, the verdict and full sandbox report are accessible from the File Details view under the WildFire Analysis tab. This shows the verdict (malicious/benign/graymail), behavioral summary, and MITRE-mapped activity.

Answer

DHCP Server status log

Answer

DNS query statistics panel

Answer

Printer queue management interface

Question 10

An organization wants to configure Cortex XDR to automatically respond to high-severity ransomware alerts. Which THREE elements must be correctly configured to ensure successful automated mitigation? (Choose three)

Accepted Answer

Response Playbook configured with ransomware detection triggers. Option A is correct because a Response Playbook must be configured with ransomware detection triggers so that high-severity ransomware alerts automatically invoke the playbook's logic. Option D is correct because the playbook must contain appropriate response actions, such as Isolate Endpoint or Kill Process, to actually perform the automated mitigation. Option E is correct because active management connectivity between endpoints and the Cortex XDR backend is required for the platform to issue response commands and receive endpoint status. Option B is irrelevant because office lighting dimmer switches have no role in Cortex XDR automation. Option C is irrelevant because manual postal mail notification to regulatory bodies is not part of automated endpoint mitigation.

Answer

Manual adjustment of office lighting dimmer switches

Answer

Manual postal mail notification to external regulatory bodies

Question 11

An analyst is investigating an incident and needs to quickly view customized columns containing threat actor attribution tags in the incident grid. Which feature must be configured to show these columns?

Accepted Answer

Featured fields configuration. Featured fields in Cortex XDR let analysts define which alert and incident attributes are surfaced as columns in the incident and alert grids. To display threat actor attribution tags, the analyst must add those fields to the featured fields configuration so they render as columns. This is a display-layer configuration, not a detection or scoring change.

Answer

Data stitching parameters

Answer

Raw alert priority rules

Answer

Incident scoring weights

Question 12

Which role-based permission is typically required for an analyst to change the status of an incident from 'New' to 'Under Investigation' in Cortex XDR?

Accepted Answer

Cortex XDR Analyst role. Changing an incident's status from 'New' to 'Under Investigation' is a core triage action performed by an analyst, and the Cortex XDR Analyst role includes the permissions necessary to manage incident lifecycle states. This role is designed for day-to-day SOC operations, including incident review, status changes, and investigation workflows. Administrative or specialized roles are not required for this routine action.

Answer

Data stitching configuration role

Answer

Syslog forwarding administrator

Answer

Collector installation role

Question 13

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint wrote a suspicious executable to a network share. To determine whether the file was previously seen and analyzed by Palo Alto Networks WildFire, which action should the analyst take from the alert's causality view?

Accepted Answer

Open the WildFire analysis report for the file's SHA-256 hash from the alert's file details panel.. WildFire verdicts in Cortex XDR are associated with the file hash and are exposed in the file details panel of the alert's causality view, where the analyst can open the full analysis report. That report provides the verdict, observed behaviors, and technique mapping needed to decide whether to contain the endpoint or continue triage.

Answer

Export the alert to a CSV and search the description field for the word WildFire.

Answer

Check the Endpoint Management console for the host's last scan results.

Answer

Run an XQL query against the xdr_file_events dataset filtering by the file name.

Question 14

A Cortex XDR administrator is planning the installation of agents on endpoints that are behind a web proxy that requires authentication. The administrator needs to ensure that the agents can communicate with the Cortex XDR cloud through the proxy. What should the administrator configure in the agent installation settings?

Accepted Answer

The proxy server address, port, and authentication credentials. To allow Cortex XDR agents to communicate through an authenticated web proxy, the administrator must configure the agent with the proxy server address, port, and authentication credentials. This ensures the agent can authenticate and establish a connection to the Cortex XDR cloud. Simply providing the address and port, using a PAC file, or deploying a Broker VM does not directly fulfill the requirement in this scenario.

Answer

The Broker VM as a proxy for agent communication

Answer

The proxy server address and port only

Answer

A PAC file URL for automatic proxy configuration

Question 15

An analyst is reviewing an incident in Cortex XDR and wants to add a note explaining the steps taken during the investigation. Where should the analyst add this note?

Accepted Answer

In the Incident Notes section of the Incident Details page. The Incident Notes section is designed for analysts to record their investigation narrative, including actions taken, findings, and conclusions. This documentation becomes part of the incident record, facilitating collaboration and audit trails. It is the central place to add contextual information that applies to the entire incident, not just a single alert or endpoint.

Answer

In the Causality Chain pane as a comment

Answer

In the Endpoint Details page under the Notes tab

Answer

In the Alert Notes section of the Alert view