XDR-Analyst Practice Exam 3 — 20 Questions

Question 1

When analyzing a complex multi-stage attack in Cortex XDR, an analyst examines the Causality Chain. How does the Causality Chain assist in understanding the raw-alert-to-incident lifecycle?

Accepted Answer

It traces the parent-child process relationship and telemetry leading to the alert. The Causality Chain visualizes the chronological sequence of processes, network connections, and file modifications that led to an alert, helping trace the origin of the incident.

Answer

It automatically recalculates the incident score based on user activity

Answer

It stitches network logs with endpoint logs using IP subnet masks

Answer

It filters featured fields to highlight malicious hashes

Question 2

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Accepted Answer

It maps the behaviors observed in the incident to known attacker tactics and techniques.. The MITRE ATT&CK tab in Cortex XDR incident details maps observed behaviors to the MITRE ATT&CK framework, which is a curated knowledge base of adversary tactics, techniques, and procedures (TTPs). This mapping helps analysts understand the attacker's intent, identify the stage of the attack lifecycle, and prioritize response actions. It provides context beyond raw alerts by categorizing activities like 'Credential Dumping' (T1003) or 'Spearphishing Attachment' (T1566), enabling faster triage and correlation with threat intelligence.

Answer

It provides network routing tables for the compromised subnet.

Answer

It automatically downloads security patches from vendor repositories.

Answer

It lists the hardware warranty status of the affected device.

Question 3

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

Accepted Answer

Network connection details including source, destination, port, and protocol. Network connection details including source, destination, port, and protocol is correct because an 'IP Connection' artifact in Cortex XDR represents a network connection event, capturing the source IP, destination IP, destination port, and protocol (e.g., TCP, UDP). This information is crucial for understanding command-and-control (C2) traffic, data exfiltration, or lateral movement. The artifact is generated from endpoint telemetry and provides context for the connection, such as the responsible process.

Answer

Software license expiration dates

Answer

Hardware temperature and fan speed metrics

Answer

Local user account password complexity settings

Question 4

What is the primary purpose of the Cortex XDR agent installation token (or installation password)?

Accepted Answer

To authenticate the agent installation and prevent unauthorized uninstallation or tampering. The Cortex XDR agent installation token authenticates the agent during installation and registration with the Cortex XDR tenant, and it also prevents unauthorized uninstallation or tampering by requiring the token for agent removal. This ensures only authorized endpoints join the tenant and that the agent cannot be easily disabled by malware or unauthorized users.

Answer

To license the endpoint for Palo Alto Networks Next-Generation Firewall features

Answer

To authenticate the agent against the local Active Directory domain controller

Answer

To encrypt all local agent SQLite databases at rest

Question 5

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Accepted Answer

The time delta between the endpoint and network events exceeds the stitching correlation window. Cortex XDR stitches alerts into incidents by correlating on shared featured fields (such as IP, user, hostname) within a defined time window. If the endpoint event and the network event occur too far apart in time, the correlation engine will not merge them, so they appear as separate incidents even though the IP and user match. The most likely cause is therefore that the time delta exceeds the stitching window.

Answer

The incident score was manually overridden to low

Answer

Alert starring was disabled on the network data source

Answer

Featured fields were not configured for the network logs

Question 6

An analyst is reviewing a Cortex XDR incident involving a suspicious PowerShell script that was executed on multiple endpoints. The analyst needs to gather evidence to determine the script's origin and impact. Which TWO actions should the analyst take to collect relevant evidence from the endpoints? (Choose two.)

Accepted Answer

Retrieve the PowerShell script file from the endpoints using the 'Retrieve File' action.. Retrieving the PowerShell script file provides direct evidence of its contents, while querying process execution events via XQL gives context about how and where it ran. Together, these actions allow the analyst to understand the script's origin, execution parameters, and impact across endpoints. The other options are either containment or detection measures that do not directly collect the needed evidence.

Answer

Initiate a full antivirus scan on the endpoints.

Answer

Isolate the endpoints from the network immediately.

Answer

Review the endpoints' Windows Event Logs for PowerShell operational events.

Question 7

An analyst is investigating a Cortex XDR incident and wants to correlate alerts from different endpoints that share the same file hash. The analyst needs to quickly find all other incidents that contain this hash to assess the scope of the campaign. Which Cortex XDR feature should the analyst use?

Accepted Answer

Incident Search with a filter on the file hash. Incident Search is the only feature that allows querying across all incidents using fields like file hash. By filtering on the hash, the analyst can identify every incident that includes that hash, thereby mapping the campaign's reach. Endpoint Search, Threat Intelligence Lookup, and Causality Chain do not provide cross-incident correlation by hash.

Answer

Endpoint Search for the file hash

Answer

Causality Chain view for the file hash

Answer

Threat Intelligence Lookup for the file hash

Question 8

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

Accepted Answer

Kill Process Tree. Kill Process Tree terminates the specified process and all of its child processes on the targeted endpoint, which is exactly what's needed to stop a malicious parent and its spawned children in one action. It's available directly from the Cortex XDR incident/endpoint view.

Answer

Retrieve File

Answer

Block File Hash

Answer

Isolate Endpoint

Question 9

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

Accepted Answer

Utilize asset criticality scoring profiles to elevate key asset visibility. Option D is correct because Cortex XDR lets administrators configure featured fields, which add custom columns to the Incident View so that specific metadata relevant to their environment is displayed directly in the incident grid. Option C is correct because asset criticality scoring profiles assign criticality values to assets, and this criticality metadata is surfaced in the Incident View to elevate the visibility of incidents involving key or high-value assets. Option A is incorrect because deleting inactive data collectors only removes unused collector entries and does not customize or enhance incident metadata visibility. Option B is incorrect because automatically starring every raw alert would simply flag all alerts indiscriminately and does not add or customize metadata columns in the Incident View. Option E is incorrect because data stitching rules determine how alerts are correlated into incidents, not how the incident grid is sorted or which metadata columns are shown.

Answer

Delete inactive data collectors to clear queue clutter

Answer

Enable automatic alert starring for every raw alert

Answer

Change data stitching rules to alter incident grid sorting

Question 10

An administrator is planning a Cortex XDR deployment and must choose the appropriate agent installation methods for a mix of Windows and macOS endpoints. The administrator wants to minimize manual effort and support remote users who are not on the corporate network. Which TWO installation methods should the administrator select? (Choose two.)

Accepted Answer

Distribute the agent installer via a software deployment tool such as Microsoft Endpoint Configuration Manager. Automated deployment through software deployment tools for Windows and MDM for macOS allows the administrator to install Cortex XDR agents at scale, including for remote users, without manual intervention. These methods ensure consistent configuration and central tracking, while manual or email-based approaches increase effort and risk.

Answer

Require users to download the agent from the Cortex XDR management console and install it themselves

Answer

Deploy the agent only to endpoints that are on the corporate network and postpone remote users

Answer

Send each user an email with the agent installer and installation token, asking them to run it manually

Question 11

Which TWO features in Cortex XDR assist analysts in communicating identity threat findings to stakeholders or compliance auditors?

Accepted Answer

Scheduled and on-demand reporting templates for incident summaries and user risk. Option A is correct because Cortex XDR provides scheduled and on-demand reporting templates that summarize incidents and user risk, giving analysts a repeatable way to present identity threat findings to stakeholders and auditors. Option D is correct because Cortex XDR allows incidents and related data to be exported or shared in formats such as PDF or CSV, which supports evidence handoff and compliance review. Options B, C, and E are incorrect because BIOS flashing, live packet generation, and hard drive partitioning are not Cortex XDR features for communicating identity threat findings; they are unrelated to reporting or audit workflows.

Answer

Automated BIOS flashing utility

Answer

Live packet generator

Answer

Hard drive partition editor

Question 12

An analyst is investigating a Cortex XDR incident where the automatic correlation engine grouped alerts based on a shared causality ID. The analyst discovers that one alert in the incident actually belongs to a different attack on the same endpoint. What should the analyst do to correct the incident grouping?

Accepted Answer

Remove the alert from the incident and create a new incident for it.. To correct an incorrect grouping, the analyst should remove the mis-grouped alert from the incident. Cortex XDR provides this manual action, allowing the analyst to then handle the alert separately, such as creating a new incident. Other actions like editing causality IDs or merging incidents do not achieve the desired separation.

Answer

Change the alert's causality ID to a different value.

Answer

Close the incident and reopen it with a filter that excludes the alert.

Answer

Merge the incident with another incident that contains the correct alerts.

Question 13

When sizing a Broker VM instance for an environment collecting high-volume syslog and Active Directory logs, which hardware resource is most critical to scale appropriately?

Accepted Answer

Sufficient vCPU and RAM allocation per published system requirements. Log collection and parsing require adequate RAM and CPU to process high throughput before forwarding to the Cortex Data Lake.

Answer

Fibre Channel HBA connected to an enterprise SAN storage array

Answer

Dedicated high-end NVIDIA GPU for deep learning processing

Answer

Dual 10Gbps SFP+ physical network interface cards passed through directly

Question 14

Cortex XDR stitches together data from multiple telemetry sources to form a cohesive incident. An analyst notices that network logs from a third-party firewall are generating alerts, but they are not stitching correctly with the endpoint alerts for the same compromised host. What is the most likely cause of this stitching failure in the raw-alert-to-incident lifecycle?

Accepted Answer

The third-party firewall logs lack proper field mapping for endpoint IP or hostname identifiers required by the stitching engine.. Data stitching relies on consistent identifiers such as internal IP addresses, MAC addresses, or hostnames. Mismatched or missing identifiers in parsed logs prevent the Cortex XDR causality engine from linking network and endpoint events.

Answer

The incident scoring threshold is set too high for network alerts to be included in endpoint-triggered incidents.

Answer

The alerts are in an 'Unassigned' status, which disables the causality engine.

Answer

Alert starring has not been applied to the network alerts, preventing automated correlation.

Question 15

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

Accepted Answer

New. When the Cortex XDR correlation engine automatically generates an incident from correlated alerts, it is assigned the status 'New' by default. This indicates the incident has been created but not yet triaged, assigned, or acted upon by an analyst. Status transitions (e.g., Under Investigation, Resolved, Closed) occur only after human or automated workflow actions.

Answer

Closed

Answer

Under Investigation

Answer

Resolved

Question 16

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Accepted Answer

Windows Scheduled Tasks. Option C is correct because Windows Scheduled Tasks are a common APT persistence mechanism, allowing malware to execute on a schedule or at logon/boot, and Cortex XDR telemetry captures task creation and modification events (e.g., schtasks.exe, Task Scheduler operational logs). Option D is correct because creating or modifying Windows Services (e.g., via sc.exe, New-Service, or service DLL hijacking) enables persistence by launching malicious code at system startup, and Cortex XDR records service installation and configuration changes. Option E is correct because Registry Run and RunOnce keys (HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce) are classic autostart locations that Cortex XDR monitors for registry modifications tied to persistence. Options A and B are incorrect because office desk relocation requests and breakroom coffee machine maintenance schedules are physical facilities matters with no relation to host-based persistence or endpoint telemetry.

Answer

Office desk relocation requests

Answer

Breakroom coffee machine maintenance schedules

Question 17

An administrator is setting up a new Cortex XDR tenant and preparing for initial onboarding. Which TWO administrative tasks must be completed during the initial planning and setup phase?

Accepted Answer

Configure administrator user accounts and assign appropriate Role-Based Access Control (RBAC) roles. Option D is correct because during initial Cortex XDR tenant onboarding, the administrator must create administrator user accounts and assign the appropriate RBAC roles so that different teams (e.g., SOC analysts, responders, admins) get only the permissions they need. Option E is correct because onboarding requires generating Agent Installation Packages (with the tenant/registration token) and defining Settings profiles so endpoints can be enrolled and managed consistently. Option A is incorrect because Cortex XDR agents are prebuilt binaries; no custom assembly code per CPU architecture is written by the administrator. Option B is incorrect because Cortex XDR is an endpoint detection and response platform and does not require physically replacing core switches with Palo Alto Networks firewalls. Option C is incorrect because disabling cloud logging would defeat Cortex XDR's telemetry ingestion and analytics rather than being a required setup task.

Answer

Manually write custom assembly code for every endpoint CPU architecture

Answer

Physically replace all enterprise core switches with Palo Alto Networks firewalls

Answer

Disable all cloud logging features to prevent data ingestion

Question 18

When reviewing identity analytics alerts in Cortex XDR, which THREE behavioral anomalies are typically flagged by the UBA engine as potential indicators of a compromised account?

Accepted Answer

Abnormal volume of data access or file downloads compared to peer group baselines. The UBA (User and Entity Behavior Analytics) engine in Cortex XDR baselines each user's normal activity and flags deviations, so option B is correct because a spike in data access or file downloads relative to the peer group baseline is a classic exfiltration/compromised-account indicator. Option C is correct because accessing sensitive internal applications or file shares outside the user's normal working hours is an anomalous access pattern the engine scores as risky. Option D is correct because impossible travel — geographically distant logins within an unrealistically short timeframe — is a hallmark UBA detection for credential compromise or session hijacking. Option A is not anomalous since a standard QWERTY keyboard layout is a ubiquitous, benign configuration with no security relevance. Option E is not a user-behavior anomaly at all; plugging an Ethernet cable into switch port 1 is a physical network action, not identity analytics telemetry.

Answer

Using a standard QWERTY keyboard layout

Answer

Connecting an Ethernet cable into port 1 of a switch

Question 19

After containing a malware outbreak, a Cortex XDR analyst needs to verify that the malicious file was removed from all affected endpoints. The analyst wants to confirm the current state of the endpoints without waiting for the next scheduled scan. Which Cortex XDR action allows the analyst to query endpoint file system state on demand and return results to the console?

Accepted Answer

Run a script or command through the Cortex XDR Live Terminal or action center to check for the file's presence and capture the output.. To verify current endpoint state on demand, Cortex XDR provides Live Terminal and script-based response actions that execute directly on endpoints and return output to the console. These actions query the live file system, so the analyst can confirm whether the malicious file persists and immediately remediate if it does, rather than waiting for scheduled scans or relying on historical detection records.

Answer

Modify the endpoint protection policy to enable real-time file monitoring and rely on future alerts to confirm removal.

Answer

Initiate a WildFire submission of the file hash to obtain a fresh verdict and infer that the file was removed.

Answer

Review the Incident Details page timeline for the original detection and confirm that the file was quarantined at that time.

Question 20

During incident triage, an analyst notices that two completely separate attacks on different endpoints were merged into a single incident by Cortex XDR. What is the underlying reason for this over-correlation?

Accepted Answer

Shared common identifiers such as a NAT gateway IP address within the correlation window. Cortex XDR's correlation engine stitches alerts into incidents by matching shared identifiers — IP addresses, hostnames, usernames, file hashes, and similar artifacts — within a configurable correlation window. When two unrelated attacks both traverse the same NAT gateway, the public IP is identical in both alert sets, so the engine merges them into one incident. This is a classic over-correlation caused by shared infrastructure identifiers rather than true attack linkage.

Answer

All alerts were manually starred by an analyst

Answer

The incident scoring threshold was set too low

Answer

Featured fields were configured to group by IP subnet