XDR-Analyst Practice Exam 2 — 20 Questions

Question 1

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

Accepted Answer

To determine how the attacker established persistence on the system. Attackers frequently use scheduled tasks for persistence, allowing malicious code or scripts to run automatically at specific times or system events.

Answer

To verify the hardware specifications of the endpoint

Answer

To analyze the local user group membership policies

Answer

To inspect the network throughput limits of the adapter

Question 2

An analyst investigating a ransomware incident on a Windows endpoint needs to determine which process originally created the malicious executable that was later detected. The analyst opens the Cortex XDR Causality Chain view for the alert. Which element of the Causality Chain directly identifies the parent process responsible for spawning the malicious file?

Accepted Answer

The immediate ancestor node connected directly above the malicious process node in the causality chain graph.. The Causality Chain in Cortex XDR is a process lineage graph in which every node links back to the process that spawned it. The node immediately above the malicious process is therefore its direct parent, the process that actually created and launched the executable. Examining that ancestor's image path, command line, and user gives the analyst the concrete origin of execution, which is the correct evidence to pursue.

Answer

The alert severity indicator attached to the malicious process node, which reflects how the parent process was classified.

Answer

The WildFire verdict shown alongside the file hash, which records the process that submitted the sample for analysis.

Answer

The root node at the top of the causality chain, which represents the earliest observed process in the chain of execution.

Question 3

An administrator is setting up syslog log collection on a Broker VM. By default, which UDP and TCP port does the Broker VM Syslog collector listen on for incoming syslog messages from network devices?

Accepted Answer

TCP/UDP port 514. By default, standard syslog collection listens on TCP/UDP port 514, though configurable in the Broker VM app settings.

Answer

TCP port 636 for secure LDAP syslog

Answer

UDP port 123 for Network Time Protocol

Answer

TCP port 8080 for HTTP forwarding

Question 4

An analyst is reviewing a Cortex XDR alert for a suspicious PowerShell script that was executed on a Windows endpoint. The analyst wants to gather additional context about the script's execution. Which TWO data sources are available directly in the Cortex XDR alert details to help understand the script's behavior? (Choose two.)

Accepted Answer

Network connections initiated by the process. The alert details in Cortex XDR provide process execution details and network connections associated with the process. These allow the analyst to see how the script was launched and whether it communicated externally. Memory dumps, registry modifications, and user login history are not standard data sources directly available in the alert details for a specific process, making them incorrect choices.

Answer

Full memory dump of the PowerShell process

Answer

Windows Registry modifications made by the script

Answer

User login history for the account that executed the script

Question 5

An administrator is designing a Cortex XDR deployment for a company with a main data center and a remote branch office connected by a low-bandwidth WAN link. The branch has 200 endpoints that must remain manageable even if the WAN link fails temporarily. Which deployment consideration best supports this requirement?

Accepted Answer

Deploy a Broker VM at the branch office to localize agent communication and buffer traffic during WAN outages.. Placing a Broker VM at the branch localizes agent communication and provides a local point of presence that keeps endpoints functional and manageable even when the WAN link is unavailable. This architecture reduces bandwidth pressure and adds resilience, which is precisely what a low-bandwidth, occasionally disconnected branch office requires.

Answer

Configure all branch agents to connect directly to the cloud over the WAN link without any local component.

Answer

Install agents only on data center servers and leave branch endpoints unprotected to conserve bandwidth.

Answer

Increase the WAN link capacity and rely on that alone to keep branch agents connected during outages.

Question 6

You are configuring integration between Cortex XDR and an external Identity Provider (IdP) to ingest user authentication logs for ITDR. Which component is primarily responsible for securely forwarding these IdP telemetry logs to the Cortex XDR data lake?

Accepted Answer

The Cortex XDR Broker VM configured with the appropriate log forwarding profile. The Cortex XDR Collector or Broker VM is used to ingest syslog, HTTP event collector streams, or API-based logs from external IdPs into the Cortex data lake.

Answer

The Traps management service daemon

Answer

The WildFire cloud analysis cluster

Answer

The Cortex XDR Agent installed on domain controllers

Question 7

When responding to a malware alert, an analyst decides to quarantine the offending file. Which TWO outcomes occur when Cortex XDR performs a file quarantine? (Choose two)

Accepted Answer

Running processes associated with the file are terminated.. Quarantine terminates the running process instance (if applicable) and moves the file binary from its original path to a secure, encrypted quarantine location on the endpoint.

Answer

All network routers in the enterprise data center are reset.

Answer

The computer's power supply unit is permanently disabled.

Answer

The endpoint operating system hard drive is physically wiped clean.

Question 8

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

Accepted Answer

Incident Timeline / Causality view. Option A, the Incident Timeline / Causality view, is correct because in Cortex XDR this view reconstructs the sequence of events (process execution, network connections, file writes, registry changes) around an alert, letting analysts trace the root cause and forensic artifacts collected from the endpoint. Option C, the File Details / Forensic File Collection view, is correct because it exposes the actual collected forensic artifacts such as quarantined files, hashes, and file metadata retrieved from the endpoint during an investigation. The remaining options (B, D, and E) are unrelated administrative or facilities records and have no role in Cortex XDR forensic artifact analysis.

Answer

Corporate gym membership roster

Answer

Cloud printer ink supply level gauge

Answer

Cafeteria food inventory management sheet

Question 9

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

Accepted Answer

Isolate Endpoint. Isolate Endpoint allows an administrator to sever the network connection of a compromised host while retaining Cortex XDR agent communication and administrative troubleshooting access.

Answer

Disable User

Answer

Kill Process Tree

Answer

Quarantine File

Question 10

A Cortex XDR analyst is examining an alert where a user account successfully authenticated from two different countries within a 10-minute window. The analyst suspects impossible travel. Which Cortex XDR feature would provide a visual representation of the user's login locations and times to confirm this?

Accepted Answer

User View timeline. User View in Cortex XDR provides a consolidated timeline of user activities, including authentication events with geographic locations and timestamps. This feature enables analysts to visualize login patterns and quickly identify impossible travel by showing the sequence of logins from disparate locations within a short timeframe, confirming the anomaly.

Answer

Endpoint device control audit

Answer

Network traffic flow analysis

Answer

Incident Response Playbook execution log

Question 11

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

Accepted Answer

Cross-data-source data stitching. Cross-data-source data stitching is the Cortex XDR mechanism that correlates alerts and events from different telemetry sources (XDR agents, third-party firewalls, cloud logs) into a single unified incident. It links entities like IPs, hostnames, and users across sources so that a firewall alert and an endpoint alert about the same attack are presented as one incident rather than separate alerts.

Answer

Automated alert starring

Answer

Incident score weighting tables

Answer

Featured fields column mapping

Question 12

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Accepted Answer

New. Option A, New, is correct because a newly generated incident in Cortex XDR begins in the New state, which is the initial stage of the standard incident lifecycle before any analyst action is taken. Option D, Under Investigation, is correct because once an analyst begins working an incident, it moves to the Under Investigation state, which is a defined stage in the standard lifecycle. The remaining options do not belong: Featured and Starred are not lifecycle states but rather UI flags or filters used to mark or prioritize incidents for quick access, and Stitched refers to the stitching of related alerts/causality events into an incident, not a lifecycle state.

Answer

Featured

Answer

Starred

Answer

Stitched

Question 13

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

Accepted Answer

Under the Incident Details page by selecting the Alerts tab. By drilling down into an incident in Cortex XDR, the analyst can access the Alert tab to inspect the individual raw alerts that make up the incident lineage.

Answer

Under Analytics > BIOC > Alert Log

Answer

Under Response > Action Center > History

Answer

Under Settings > Data Stitching > Raw Logs

Question 14

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

Accepted Answer

Configure exclusions for the vulnerability scanner's IP addresses or signature patterns. Creating exclusion rules for scanner IP addresses or signatures ensures vulnerability assessment traffic does not trigger security incidents.

Answer

Enable featured fields to hide scanner columns

Answer

Turn off data stitching across all internal subnets

Answer

Star all alerts generated during scanning windows

Question 15

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Accepted Answer

Verify the digital signature and publisher of the application. Safe exception implementation involves validating binary integrity, verifying legitimate paths, and testing prior to global deployment.

Answer

Disable all Cortex XDR agent security modules across the entire enterprise

Answer

Remove all file access permissions from the operating system kernel

Question 16

An analyst is investigating a security incident and needs to review the timeline of events that occurred on a compromised endpoint. The analyst wants to see a chronological list of all alerts, process executions, and network connections related to the incident. Which Cortex XDR view should the analyst use?

Accepted Answer

Incident Details page. The Incident Details page is specifically designed to present all relevant information for an incident in one place, including a chronological timeline of alerts, process executions, and network connections. This allows the analyst to quickly understand the sequence of events without manual querying. Other options serve different purposes such as endpoint management, threat intelligence, or custom querying.

Answer

Endpoint Management console

Answer

Threat Intelligence module

Answer

XQL Query Center

Question 17

An administrator is planning a Cortex XDR deployment across multiple sites, including a remote office with limited internet bandwidth. The administrator wants to minimize WAN traffic for agent updates and threat intelligence lookups. Which Cortex XDR component should be deployed at the remote office to achieve this?

Accepted Answer

Broker VM. A Broker VM deployed at the remote office can cache content updates and threat intelligence, serving them to local endpoints. This reduces WAN traffic because endpoints retrieve updates from the Broker VM instead of the cloud. The management console and Cortex Data Lake are cloud-based and do not provide local caching. Agent local caching does not exist as a feature for sharing updates.

Answer

Cortex XDR agent with local caching enabled

Answer

Cortex Data Lake

Answer

Cortex XDR management console

Question 18

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Accepted Answer

Directory Service Access and LDAP query event logs from Domain Controllers (such as Event ID 4662). BloodHound enumerates Active Directory by issuing LDAP queries and accessing directory service objects, which generates Directory Service Access events on domain controllers, including Event ID 4662. Cortex XDR can ingest these Domain Controller event logs to detect the enumeration patterns characteristic of BloodHound reconnaissance.

Answer

Network interface duplex settings

Answer

USB device connection history

Answer

Browser extension inventory reports

Question 19

A Cortex XDR analyst is building an identity threat detection strategy for a hybrid environment with on-premises Active Directory and cloud identity. Which TWO telemetry sources should the analyst prioritize ingesting to detect credential abuse and anomalous authentication across both environments? (Choose two.)

Accepted Answer

Windows Security event logs from domain controllers, including authentication and Kerberos events.. Effective hybrid identity threat detection requires visibility into both authentication authorities. Domain controller security logs expose on-premises Kerberos and logon behavior, while cloud identity provider sign-in and audit logs expose cloud authentication and directory changes. Together they let Cortex XDR baseline and correlate identity behavior across environments. Network, DHCP, and print logs lack the credential and authentication context needed for identity-focused detection.

Answer

Endpoint firewall connection logs recording outbound TCP and UDP flows from user workstations.

Answer

Print server spooler logs capturing document names and submitting user accounts.

Answer

DHCP lease logs from the internal network recording IP address assignments to endpoints.

Question 20

An administrator is planning to install Cortex XDR agents on a large fleet of Windows endpoints and wants to ensure the installation can proceed without manual intervention on each host. Which approach best supports a silent, unattended installation?

Accepted Answer

Deploy the agent MSI package with the installation token supplied as a command-line parameter through a software distribution tool.. Silent, unattended installation on Windows is achieved by distributing the agent MSI through a software deployment tool and passing the installation token as a command-line parameter. This lets each host register automatically with the tenant without interactive input, which is essential for large-scale rollouts.

Answer

Run the agent installer interactively on each endpoint and paste the installation token when prompted.

Answer

Install the agent without a token and rely on the cloud tenant to auto-assign the endpoint to a default policy.

Answer

Copy the agent installer to a network share and instruct users to double-click it from their desktops.