XDR-Analyst Practice Test 20 — 15 Questions

Question 1

Which TWO factors directly influence how Cortex XDR calculates the overall severity score of an incident? (Choose two)

Accepted Answer

The severity levels of the constituent raw alerts. Cortex XDR derives an incident's overall severity from the severity of the individual alerts that are grouped into it, so option A is correct because the constituent raw alerts' severity levels are a direct input to the incident severity calculation. Option C is also correct because Cortex XDR factors in the criticality weighting of the affected assets (for example, asset criticality values configured in the asset inventory) when computing the incident severity. Option B is incorrect because enabling featured fields only changes which columns are displayed in the UI and has no effect on severity scoring. Option D is incorrect because manually starring alerts is an analyst triage action, not a scoring input. Option E is incorrect because syslog forwarding port configuration relates only to external log export and does not influence incident severity.

Answer

The number of featured fields enabled in the UI

Answer

The frequency of manual alert starring by analysts

Answer

The syslog forwarding port configuration

Question 2

An analyst is investigating a potential data exfiltration incident. They have identified a suspicious external IP address that the endpoint communicated with. To gather more context, they want to see all historical network connections involving that IP address across the organization. Which Cortex XDR capability should the analyst use?

Accepted Answer

XQL Search with network connection events. XQL Search is Cortex XDR's query language that enables analysts to search across all collected telemetry, including network connection events. By querying for the suspicious IP address, the analyst can retrieve historical connections from any endpoint, providing the organization-wide visibility needed to assess the extent of the incident.

Answer

Endpoint Management console for the affected endpoint

Answer

Threat Intelligence module for the IP address

Answer

Alert Details page for the specific alert

Question 3

A Cortex XDR analyst receives a critical incident for an endpoint that was quarantined by the organization months ago but is still generating new alerts. The analyst wants to quickly verify whether the endpoint has had any recent network activity that could indicate the alerts are from a live but unmanaged device. Which Cortex XDR feature should the analyst use to view the latest network connections associated with that endpoint?

Accepted Answer

Cortex XDR Network Connections view. The Network Connections view is designed to show recent network activity for an endpoint, including remote addresses and processes. For a quarantined endpoint that continues to trigger alerts, this view helps determine if the device is still active on the network. Other consoles and logs focus on management, automation, or auditing rather than live connection data.

Answer

Cortex XDR Endpoint Administration console

Answer

Cortex XDR Audit Log

Answer

Cortex XDR Incident Response playbook

Question 4

An incident in Cortex XDR contains dozens of low-priority alerts that were grouped together. The analyst determines that one specific alert within the incident is a false positive while the rest are legitimate threats. What is the best practice for handling this specific raw alert?

Accepted Answer

Mark the specific raw alert as a false positive or dismiss it within the incident view. Cortex XDR allows analysts to act on individual raw alerts inside a grouped incident. Marking the specific alert as a false positive or dismissing it removes it from the incident's active alert set without affecting the other legitimate alerts, preserving the incident's integrity and the analyst's triage record. This is the documented best practice for handling a single false positive within a multi-alert incident.

Answer

Change the incident score to zero to hide all alerts

Answer

Delete the entire incident and recreate it manually

Answer

Apply an alert starring filter to exclude the false positive

Question 5

An analyst is investigating a Cortex XDR incident involving a Windows endpoint. The analyst needs to retrieve a copy of a suspicious executable from the endpoint's disk to submit to WildFire for further analysis, without executing the file locally. Which response action should the analyst use?

Accepted Answer

Retrieve File. Retrieve File is the correct response action because it allows the analyst to pull a copy of a suspicious executable from the endpoint to the Cortex XDR console or another location, enabling submission to WildFire without executing the file locally. Other actions like quarantine, isolation, or process termination do not transfer the file for external analysis.

Answer

Terminate Process

Answer

Quarantine File

Answer

Isolate Endpoint

Question 6

An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?

Accepted Answer

Windows Security Event logs (specifically Event ID 4769) collected via Broker VM. Kerberoasting is detected by analyzing Windows Security Event log ID 4769 (A Kerberos service ticket was requested), specifically looking for high encryption downgrade requests (e.g., RC4).

Answer

Antivirus scan reports

Answer

DNS query logs showing external root hints

Answer

DHCP lease allocation tables

Question 7

An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?

Accepted Answer

Settings > Configurations > Endpoint Settings > Install Packages. In the Cortex XDR management console, agent installation packages (.msi for Windows, .pkg for macOS) are downloaded from Settings > Configurations > Endpoint Settings > Install Packages. This is the designated location for obtaining the packages needed for enterprise software deployment tools like SCCM or Intune.

Answer

Data Collector > Broker VM > Agent Packages

Answer

Incidents > Actions > Export Agent

Answer

Monitoring > System Health > Agent Distribution

Question 8

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

Accepted Answer

Retrieve File and Forensic File Collection. Cortex XDR allows analysts to trigger forensic data collection, including file retrieval and process information, directly from the incident response tools.

Answer

Global Protect Tunnel Inspection

Answer

Agent Upgrade Schedule

Answer

WildFire Submission Policy

Question 9

During an ITDR investigation, an analyst sees a Cortex XDR identity alert: a privileged user authenticated successfully to three different SaaS applications from two countries within 12 minutes. MFA was satisfied via push notification on each attempt. The analyst needs to determine whether this is a legitimate VPN egress or a session-token replay. Which Cortex XDR identity data point best distinguishes session-token theft from legitimate travel?

Accepted Answer

The device fingerprint and session identifier for each authentication, because a replayed token reuses the original device and session context rather than creating a new one.. The decisive signal is whether the authenticated session context, including device fingerprint and session identifier, is reused across geographically distant authentications. A replayed session token preserves the original device and session context while the source IP changes, which Cortex XDR identity analytics flags. Legitimate travel creates fresh device and session context at each new location.

Answer

The user's department and manager fields in the identity profile, since HR attributes determine whether international travel is expected.

Answer

The number of SaaS applications accessed, because accessing three applications in 12 minutes exceeds the threshold that Cortex XDR uses to flag credential stuffing.

Answer

The MFA push notification delivery status, because a successful push proves the legitimate user approved the login from each location.

Question 10

An administrator is planning a Cortex XDR deployment for a network that uses a forward proxy requiring authentication for all outbound traffic. Endpoints run Windows and must communicate with the Cortex XDR cloud tenant. Which planning configuration will allow agents to reach the cloud through the proxy without per-user credentials?

Accepted Answer

Configure the agent to use the proxy with credentials embedded in the agent installation package or agent settings so the service can authenticate.. Agents run as services and need their own proxy configuration to authenticate to a forward proxy. Specifying proxy settings and credentials in the agent installation or agent configuration ensures the service can reach the cloud tenant consistently, including when no user is logged in, which is essential for reliable management and content updates.

Answer

Enable transparent proxy mode on the endpoints so the agent's traffic is redirected without authentication.

Answer

Rely on the logged-in user's browser proxy settings, since the agent inherits the user's proxy configuration automatically.

Answer

Disable the proxy requirement for the Cortex XDR cloud URLs by adding them to the proxy's authentication bypass list.

Question 11

An analyst is reviewing a Cortex XDR incident and wants to identify which endpoints are affected and what user accounts were involved. Which TWO pieces of information can be directly obtained from the Incident Details page to help with this assessment? (Choose two.)

Accepted Answer

The list of user accounts involved. The Incident Details page in Cortex XDR provides a summary of the incident, including the affected endpoints and the user accounts involved. These two pieces of information are essential for understanding the scope of the incident and for planning containment and remediation actions. They are directly visible without needing to drill into individual alerts or use advanced queries.

Answer

The full packet capture of the malicious traffic

Answer

The registry keys modified by the malware

Answer

The MITRE ATT&CK techniques mapped to the incident

Question 12

An organization experiences a Golden Ticket attack. How does Cortex XDR's identity analytics engine typically detect this type of Kerberos ticket manipulation?

Accepted Answer

By detecting anomalies in Kerberos authentication attributes such as unusual ticket lifetimes or mismatched SID history from domain controller telemetry. Golden Ticket attacks forge Kerberos TGTs with arbitrary lifespans and SIDs. Cortex XDR detects this by correlating anomalous ticket attributes, such as invalid SID history or ticket lifetimes exceeding domain policy, captured from domain controller logs.

Answer

By monitoring USB mass storage insertion events

Answer

By blocking outbound TCP port 80 traffic at the perimeter firewall

Answer

By scanning the master boot record (MBR) of the endpoint for rootkit signatures

Question 13

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

Accepted Answer

Comprehensive profile information including recent alerts, associated devices, and identity attributes. The User View in Cortex XDR aggregates identity-centric context: a comprehensive profile showing recent alerts, associated devices, and identity attributes (department, role, risk score). This helps analysts quickly assess whether an identity-based alert is part of a broader pattern or an isolated event.

Answer

Real-time packet captures of the user's active browsing session

Answer

The hardware warranty status of endpoints assigned to the user

Answer

Group Policy Object (GPO) editing capabilities

Question 14

An administrator is preparing to install Cortex XDR agents on 500 Windows servers. The security policy requires that the endpoint be automatically associated with the correct tenant and that agents report to the management console without manual per-endpoint registration. What must the administrator obtain from the Cortex XDR management console before starting the installation?

Accepted Answer

An agent installation token. The agent installation token is the credential that authorizes an endpoint to enroll with a specific Cortex XDR tenant. When embedded in the installer, it lets each Windows server register automatically without manual intervention. This is the standard mechanism for large-scale, policy-compliant deployments where every endpoint must land in the correct tenant.

Answer

A Broker VM registration code

Answer

A content update license key

Answer

An XDR analytics API key

Question 15

An administrator is reviewing the Cortex XDR system requirements and architecture. Which TWO statements accurately describe the Broker VM architecture?

Accepted Answer

The Broker VM runs as a virtual appliance on supported hypervisors such as VMware ESXi, KVM, AWS, or Azure. Option B is correct because the Broker VM is deployed as a virtual appliance on supported hypervisors and cloud platforms, including VMware ESXi, KVM, AWS, and Azure, rather than on endpoints. Option C is correct because the Broker VM hosts modular apps that provide capabilities such as Syslog Collector, Active Directory integration, and agent proxying for Cortex XDR. Option A is incorrect because the Broker VM is not installed as a macOS kernel extension on individual endpoints. Option D is incorrect because the Broker VM does not replace Cortex Data Lake as the enterprise's primary long-term log storage repository. Option E is incorrect because the Broker VM does not require a physical server with 128 cores and 1TB of RAM; it is a virtual appliance with far more modest resource requirements.

Answer

The Broker VM is installed directly on individual macOS endpoints as a kernel extension

Answer

The Broker VM replaces the Cortex Data Lake as the primary long-term log storage repository for the entire enterprise

Answer

The Broker VM requires a physical server with at least 128 cores and 1TB of RAM