XDR-Analyst Practice Test 2 — 10 Questions

Question 1

An organization's security operations center (SOC) wants to adjust how Cortex XDR calculates incident severity scores based on specific asset criticality tags. Where should the administrator configure this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident View scoring configuration and severity weights. Incident scoring can be customized using scoring rules or profiles that factor in asset criticality to ensure high-value assets elevate incident severity appropriately.

Answer

Featured fields display mapper

Answer

Data stitching engine properties

Answer

Raw alert priority override settings

Question 2

What is the primary purpose of starring an alert within an incident details pane?

Accepted Answer

To bookmark and highlight important alerts for tracking and collaboration. Starring alerts helps analysts highlight key findings or indicators of compromise for collaboration and quick reference during or after an investigation.

Answer

To permanently exclude the alert from future incident generation

Answer

To increase the incident severity score to critical

Answer

To automatically trigger containment actions on the endpoint

Question 3

Where in the Cortex XDR console can an analyst review the complete lifecycle timeline of an incident, from initial raw alert generation to final resolution?

Accepted Answer

The Incident Details page and Incident Timeline view. The Incident View provides a detailed breakdown of an incident, including its timeline, associated alerts, affected assets, and lifecycle status.

Answer

The Syslog forwarding configuration panel

Answer

The Global Dashboard widget builder

Answer

The Agent installation status log

Question 4

Which TWO mechanisms are used by Cortex XDR to prevent alert fatigue during the raw-alert-to-incident lifecycle? (Choose two)

Accepted Answer

Alert exclusion and exception rules. Alert fatigue is mitigated by grouping related raw alerts into single incidents and utilizing exception rules to filter out benign activity.

Answer

Featured fields column configuration

Answer

Manual incident starring

Answer

Syslog log export scheduling

Question 5

An analyst wants to quickly identify all alerts related to a specific external IP address across multiple incidents without opening each incident individually. Which feature in the Cortex XDR console should the analyst use?

Accepted Answer

Alerts View filter and search capabilities. Global search or filtering within the Alerts View allows analysts to query specific IOCs, IPs, or hashes across all incidents and alerts.

Answer

Incident scoring threshold filter

Answer

Featured fields sorting

Answer

Data stitching status toggle

Question 6

A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?

Accepted Answer

Incident starring. Alert starring and incident starring allow analysts to bookmark or star specific items to highlight them for immediate attention and follow-up.

Answer

Incident scoring threshold override

Answer

Data stitching rule assignment

Answer

Featured fields configuration

Question 7

Which TWO factors directly influence how Cortex XDR calculates the overall severity score of an incident? (Choose two)

Accepted Answer

The severity levels of the constituent raw alerts. Incident scores are calculated based on the severity of the constituent raw alerts and the criticality of the affected assets.

Answer

The number of featured fields enabled in the UI

Answer

The frequency of manual alert starring by analysts

Answer

The syslog forwarding port configuration

Question 8

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

Accepted Answer

Suppress or disable the noisy alert rule if it lacks operational value. To prevent false positives from polluting future incidents, analysts can create alert exclusions, tune detector thresholds, or suppress specific behavioral rules.

Answer

Star all future instances of the alert in the incident view

Answer

Add a featured field column to hide the false positive alerts

Question 9

During an investigation, an analyst examines the Causality Chain and Incident Graph. What THREE key insights do these visualization tools provide into the incident lifecycle? (Choose three)

Accepted Answer

The chronological sequence of events spanning the entire incident. The Causality Chain and Incident Graph show process parent-child relationships, lateral movement across assets, and the chronological origin of the attack.

Answer

The custom featured fields assigned to the incident grid

Answer

The manual star status assigned by the shift supervisor

Question 10

A security analyst wants to adjust how Cortex XDR calculates incident severity to ensure that incidents involving domain controllers receive higher priority scores. Where should the analyst configure custom weights or scoring logic for incidents?

Accepted Answer

Under Settings > Configurations > Incident View > Incident Scoring. Incident severity and scoring rules can be customized in Cortex XDR under Incident View and Scoring settings to align with organizational risk appetite and asset criticality.

Answer

Under Endpoint Security > Settings > Profiles > Malware > Severity Adjustment

Answer

Under Response > Action Center > Scoring Policy

Answer

Under Correlation Rules > Custom BIOC > Severity Tab