XDR-Analyst Practice Test 2 — 10 Questions

Question 1

A Cortex XDR analyst sees an alert for a user account that authenticated successfully from an unfamiliar ASN, then immediately triggered a privileged role assignment in Azure AD. Which Cortex XDR capability should the analyst use FIRST to correlate the identity activity with endpoint and network telemetry in a single timeline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Incident View, which stitches identity, endpoint, and network events into one causal chain.. The Incident View is designed to unify identity, endpoint, and network telemetry into one causal timeline, which is exactly what is needed when a suspicious authentication is followed by a privileged role assignment. It surfaces the relationships between alerts and events so the analyst can determine scope and impact before taking response actions. Other console areas either provide raw data, administrative records, or response controls rather than correlated incident context.

Answer

The Audit Log, which records administrative changes made inside the Cortex XDR console.

Answer

The Endpoint Isolation action, which contains the device tied to the identity alert.

Answer

The Query Builder, which runs XQL against raw datasets to reconstruct the chain manually.

Question 2

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

Accepted Answer

File Path and Command-Line arguments. Option A (File Path and Command-Line arguments) is correct because Cortex XDR exceptions can be scoped by the process image path and the exact command-line string, allowing an analyst to suppress a false positive only for a specific executable invocation rather than all activity. Option C (Digital Signature / Certificate information) is correct because exceptions can be tied to the signer or certificate details, so only binaries signed by a trusted publisher are excluded, which is useful for legitimate vendor tools that trigger behavioral alerts. Option E (File Hash (SHA-256)) is correct because hash-based exceptions match a specific known-good file by its SHA-256 value, providing the tightest scope and preventing a different file with the same name or path from being suppressed. Option B (Local user keyboard layout language) is not a security-relevant attribute in Cortex XDR exception criteria, and Option D (Endpoint CPU temperature threshold) is a hardware/health metric that has no role in defining detection exception scope.

Answer

Local user keyboard layout language

Answer

Endpoint CPU temperature threshold

Question 3

A security team is planning a Cortex XDR deployment for a small business with 250 endpoints and no existing on-premises security infrastructure. The administrator must decide how to retrieve and distribute the endpoint agent installer. Which Cortex XDR capability should be used to obtain the installer package directly from the management console?

Accepted Answer

Download the agent installer from the Cortex XDR management console and distribute it using existing software deployment tools.. For a small deployment without existing infrastructure, the most straightforward method is to download the agent installer from the Cortex XDR management console. This console provides the correct installer version for the tenant and allows distribution through existing software deployment tools. Broker VMs, API automation, and support portal downloads are either unnecessary or less direct for this scenario.

Answer

Use the Cortex XDR API to generate a unique installer for each endpoint dynamically.

Answer

Deploy a Broker VM and configure it to push agent installers to endpoints automatically.

Answer

Download the installer from the Palo Alto Networks Customer Support Portal and install it manually on each endpoint.

Question 4

Which TWO log sources are commonly ingested into Cortex XDR to support Identity Threat Detection and Response (ITDR)?

Accepted Answer

Cloud Identity Provider Sign-in Logs (e.g., Microsoft Entra ID). Option B is correct because Cortex XDR's ITDR capabilities ingest authentication and sign-in telemetry from cloud identity providers such as Microsoft Entra ID (Azure AD), including events like successful and failed sign-ins, MFA challenges, and risky sign-in detections, which are essential for correlating identity-based attacks across the environment. Option D is correct because Windows Security Event Logs supply the core on-premises identity telemetry Cortex XDR uses for ITDR, including Kerberos authentication events (e.g., 4768, 4769, 4771), logon/logoff events (4624, 4625, 4634), and privilege/account changes (4720, 4728, 4672) that reveal credential theft, pass-the-hash, and lateral movement. Options A, C, and E are not relevant: BIOS firmware update logs, display resolution configuration logs, and printer spooler error logs contain hardware or peripheral configuration data with no authentication or identity context, so they do not feed ITDR analytics.

Answer

BIOS Firmware Update Logs

Answer

Display Resolution Configuration Logs

Answer

Printer Spooler Error Logs

Question 5

A Cortex XDR incident contains 15 alerts that were automatically stitched together. The analyst determines that 3 of these alerts are false positives caused by a legitimate administrative script. The analyst wants to remove these 3 alerts from the incident without affecting the other 12 alerts. What is the correct action?

Accepted Answer

Select the 3 alerts in the incident and choose 'Remove from Incident' to unlink them, leaving the incident with the remaining 12 alerts.. The correct action is to select the false-positive alerts and use the 'Remove from Incident' function. This unlinks them from the incident, leaving the remaining alerts intact. It is the precise method for refining incident contents without altering the incident's status or creating new incidents.

Answer

Add a note to the incident indicating that the 3 alerts are false positives, and then resolve the incident.

Answer

Change the severity of the 3 alerts to 'Informational' so they no longer contribute to the incident's risk score.

Answer

Close the incident and create a new incident manually with only the 12 relevant alerts.

Question 6

An administrator is designing a disaster recovery and high availability strategy for Broker VM deployments in a large enterprise. Which THREE practices ensure high availability and resilience for Broker VM services?

Accepted Answer

Continuously monitoring Broker VM health, connectivity status, and app status in the Cortex XDR console. Option A is correct because continuous monitoring of Broker VM health, connectivity status, and app status in the Cortex XDR console provides the visibility needed to detect failures or degraded services early and trigger remediation, which is essential for maintaining high availability. Option B is correct because hypervisor-level HA such as VMware vSphere HA automatically restarts Broker VM virtual machines on another host when a host failure occurs, reducing downtime without manual intervention. Option C is correct because deploying multiple Broker VM instances in active-active or active-passive configurations across different hypervisor hosts removes single points of failure and ensures service continuity if one instance or host becomes unavailable. Option D does not belong because connecting virtual disks to a local USB thumb drive is not a supported or reliable HA mechanism and introduces a single point of failure rather than resilience. Option E does not belong because Broker VM is a virtual appliance deployed on a hypervisor, not software that runs inside a web browser tab, so it cannot provide the required availability or performance.

Answer

Connecting the Broker VM virtual disks to a local USB thumb drive for manual failover

Answer

Running the Broker VM software directly inside a web browser tab

Question 7

An administrator is configuring data stitching and alert correlation rules in Cortex XDR to improve incident prioritization. Which TWO actions are best practices to ensure high-fidelity alert grouping and accurate incident scoring? (Choose two)

Accepted Answer

Map critical assets with appropriate priority weights to influence incident scoring accurately.. Option C is correct because Cortex XDR incident scoring factors in asset criticality, so mapping critical assets with appropriate priority weights ensures that alerts affecting high-value systems are scored and prioritized accurately. Option E is correct because data stitching and alert correlation depend on consistent, correctly parsed host and IP identification fields; if third-party log sources do not normalize these fields, Cortex XDR cannot reliably stitch related alerts into a single incident or correlate them across data sources. Option A is incorrect because disabling all default analytics rules removes valuable built-in detections and correlation logic rather than improving fidelity. Option B is incorrect because a 1-minute incident close timeout is far too aggressive and would prematurely close incidents before related alerts can be stitched together. Option D is incorrect because manually starring every alert does not trigger the correlation engine and would simply clutter the alert view without improving grouping or scoring.

Answer

Disable all default Cortex XDR analytics rules to prevent false correlation.

Answer

Set the incident close timeout to 1 minute to speed up alert processing.

Answer

Manually star every incoming alert to trigger the incident correlation engine.

Question 8

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

Accepted Answer

The Cortex XDR Broker VM configured with the User-ID integration. The Broker VM configured with the User-ID integration is the Cortex XDR component responsible for collecting user and group metadata from Active Directory and other identity sources. It forwards this identity context to Cortex XDR so alerts can be enriched and correlated for ITDR use cases. Without the Broker VM's User-ID integration, AD context would not be available for alert enrichment.

Answer

The Cortex XDR Network Traffic Analyzer

Answer

WildFire cloud analysis engine

Answer

The Cortex XSOAR Content Pack for Active Directory

Question 9

An organization notices an increase in credential dumping attacks against local Active Directory environments. They want to configure Cortex XDR Identity Analytics to trigger high-severity alerts when abnormal Kerberos ticket requests (such as potential Silver or Golden ticket activities) are detected. Where should the analyst enable or tune these specific identity behavior analytics rules?

Accepted Answer

Under Settings > Configurations > Analytics in the Cortex XDR console. Identity Analytics behavioral rules are managed within the Analytics configuration section of the Cortex XDR management console under Settings > Configurations > Analytics.

Answer

By modifying local Windows Group Policy Objects (GPOs) pushed to domain controllers

Answer

Within the BIOC (Behavioral Indicator of Compromise) rule builder under Incident Response

Answer

Under Settings > Configurations > Data Node Settings in the Cortex XDR console

Question 10

Which TWO evidence sources help an analyst investigate whether an unauthorized user accessed a compromised workstation locally? (Choose two)

Accepted Answer

Windows Security Event logs (Event IDs for logon successes and failures). Local workstation access investigations rely on Windows Security Event logs (Logon/Logoff events) and user session telemetry.

Answer

Corporate vehicle fleet GPS tracking logs

Answer

Office cafeteria refrigerator temperature charts

Answer

Office janitorial cleaning supply invoices