XDR-Analyst Practice Exam 3 — 20 Questions

Question 1

Which TWO actions can an administrator take to tune incident scoring for high-value assets? (Choose two)

Accepted Answer

Assign assets to high criticality groups. Administrators can adjust asset criticality groups and configure scoring profiles to ensure high-value assets receive appropriate severity weights.

Answer

Enable automatic starring for all alerts on those assets

Answer

Adjust the global data stitching window

Answer

Create featured fields to display asset scores

Question 2

When managing the alert lifecycle in Cortex XDR, analysts can perform various triage and prioritization tasks. Which THREE features or options are available to analysts when managing active incidents and alerts? (Choose three)

Accepted Answer

Updating the incident status (e.g., New, Under Investigation, Resolved).. Analysts can manage active incidents through assignment, starring, status updates, and severity adjustments.

Answer

Directly modifying the core machine learning algorithm weights of the Global Protect cloud service.

Answer

Writing raw kernel-level driver code to replace the endpoint prevention engine.

Question 3

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

Accepted Answer

Update the incident status (e.g., New to Under Investigation). Analysts can change incident statuses and assign ownership directly from the Incident View.

Answer

Build global dashboard metric widgets

Answer

Install Cortex XDR agents on remote endpoints

Answer

Configure custom data stitching parser scripts

Question 4

During an investigation of an advanced persistent threat, an analyst wants to customize the Incident View layout to ensure that custom fields populated via parsed log ingestion are prominently displayed at the top of every incident summary. How should the analyst achieve this?

Accepted Answer

By modifying the Incident Layout via Settings > Configurations > Incident View > Featured Fields. Cortex XDR allows administrators to configure featured fields to determine which data points appear prominently in the incident summary and table columns.

Answer

By creating a custom BIOC rule with output variables mapped to incident tags

Answer

By exporting the incident JSON schema and modifying the UI template mapping

Answer

By editing the Incident Scoring configuration file via the CLI

Question 5

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

Accepted Answer

Causality Chain. The Causality Chain in Cortex XDR provides a graphical representation of the process tree, showing the chronological sequence of events, parent-child process relationships, and associated artifacts that led to an execution.

Answer

Action Center

Answer

Audit Log

Answer

BIOC Rules Manager

Question 6

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Accepted Answer

It maps the behaviors observed in the incident to known attacker tactics and techniques.. The MITRE ATT&CK tab maps detected tactics and techniques to the standard framework, helping analysts understand attacker behavior and TTPs.

Answer

It provides network routing tables for the compromised subnet.

Answer

It automatically downloads security patches from vendor repositories.

Answer

It lists the hardware warranty status of the affected device.

Question 7

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

Accepted Answer

The agent maintains a dedicated management communication channel to the Cortex XDR server while blocking other network traffic.. Endpoint isolation blocks all general network traffic while maintaining a secure, dedicated management channel between the Cortex XDR agent and the backend server.

Answer

The host switches to a backup dial-up modem connection.

Answer

All network traffic is routed through an open public proxy server.

Answer

The host disables its TCP/IP stack entirely.

Question 8

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

Accepted Answer

Process execution telemetry showing WmiPrvSE.exe spawning child processes. WMI activity generates specific process execution and WMI event consumer telemetry logs.

Answer

Bluetooth peripheral pairing histories

Answer

Local monitor color calibration profiles

Answer

Desktop wallpaper image file paths

Question 9

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

Accepted Answer

Remediate Action (Cleanup). Remediation in Cortex XDR can automatically clean up artifacts such as created files, registry modifications, and processes associated with a malicious execution.

Answer

DNS Flushing

Answer

DHCP Lease Renewal

Answer

Static Route Addition

Question 10

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

Accepted Answer

Run an XQL Search querying the dataset for the specific file_sha256 value.. XQL Search allows analysts to query dataset tables such as xdr_data using the file_sha256 field to hunt for presence across all onboarded endpoints.

Answer

Review the Global Protect gateway traffic logs for file downloads.

Answer

Create a new BIOC rule and wait for the file to be executed again.

Answer

Export the Windows Event logs from a single machine and compare manually.

Question 11

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

Accepted Answer

Cortex XDR Management Console under Exceptions. Global exclusions and exceptions in Cortex XDR are managed centrally under Response -> Exceptions or Agent Settings, ensuring organization-wide application.

Answer

Syslog forwarding rules

Answer

User Identity mapping rules

Answer

Local Windows Registry on each endpoint

Question 12

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

Accepted Answer

File Details / WildFire Analysis tab. The WildFire analysis report and verdict are accessible directly from the file details or alert inspection panel within Cortex XDR.

Answer

DHCP Server status log

Answer

DNS query statistics panel

Answer

Printer queue management interface

Question 13

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

Accepted Answer

Cloud audit and API activity logs. Cloud infrastructure logs (like AWS CloudTrail or Azure Activity logs) ingested into Cortex XDR provide the audit trail for cloud resource changes.

Answer

Active Directory SYSVOL share

Answer

Local printer driver cache

Answer

Local endpoint SAM registry hive

Question 14

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

Accepted Answer

Kill Process Tree. The 'Kill Process Tree' action terminates the targeted process along with all descendant processes spawned by it, ensuring complete neutralization of the threat tree.

Answer

Retrieve File

Answer

Block File Hash

Answer

Isolate Endpoint

Question 15

An analyst wants to ensure that any file evaluated with a specific SHA-256 hash is immediately blocked from execution across all endpoints managed by Cortex XDR, regardless of its WildFire verdict. Where should this hash be added?

Accepted Answer

Hash Blocklist in Cortex XDR. Blocking specific file hashes across all endpoints is accomplished by adding the hash to the Hash Blocklist under Response or Malware Protection settings.

Answer

Network interface promiscuous mode toggle

Answer

Agent debug log level selector

Answer

Cortex XSOAR integration ticket template

Question 16

An analyst is investigating a suspected phishing attack and needs to review the command line arguments passed to a suspicious email attachment execution. Where can the analyst find this evidence in Cortex XDR?

Accepted Answer

Process Execution details within the Causality Chain. The Process Execution view and Causality Chain record the exact command line arguments passed when a process is spawned.

Answer

Hardware asset inventory list

Answer

Agent network proxy configuration file

Answer

DNS server cache table

Question 17

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

Accepted Answer

Review command-line arguments for utility tools utilized during the attack. Credential dumping investigations involve analyzing process access telemetry and examining associated endpoint logs.

Answer

Verify employee cafeteria badge swipe access times

Answer

Check the office HVAC temperature logs

Answer

Analyze cafeteria point-of-sale receipt records

Question 18

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

Accepted Answer

Quarantine File. Playbooks support automated containment and investigative tasks such as endpoint isolation, file quarantine, and artifact gathering.

Answer

Physically replace damaged endpoint motherboard hardware

Answer

Update the corporate website DNS homepage banner

Question 19

An administrator needs to configure automated incident response actions in Cortex XDR. Which THREE components are critical for building a successful automated response workflow? (Choose three)

Accepted Answer

Playbook actions and logic steps (such as quarantine or enrichment). Automated response workflows require triggers (alerts/incidents), playbook logic/steps, and integration targets or response actions.

Answer

Corporate cafeteria catering menu pricing sheets

Answer

Physical server room air conditioning coolant levels

Question 20

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

Accepted Answer

IP Connection (Source/Destination IP and Port). Cortex XDR incident and alert views capture various telemetry artifacts, notably file hashes and network connection details.

Answer

Physical RAM stick serial number

Answer

Office printer cartridge ink level

Answer

BIOS manufacturer date