XDR-Analyst Practice Test 22 — 15 Questions

Question 1

Which TWO forensic logs or artifacts are most valuable when investigating a suspected ransomware attack on an endpoint? (Choose two)

Accepted Answer

File system activity logs showing rapid mass file modifications or extensions. Option A is correct because ransomware's defining behavior is rapid, high-volume file encryption, so file system activity logs that show mass file modifications or the appearance of new extensions (e.g., .locked, .encrypted) directly evidence the attack's scope and timeline. Option E is correct because a common ransomware precursor/impact step is destroying backups by deleting Volume Shadow Copies, and process execution logs capturing commands like 'vssadmin delete shadows /all /quiet' or 'wmic shadowcopy delete' reveal this anti-recovery activity. The remaining options are not technical forensic artifacts: visitor badge sign-in sheets (B), cafeteria menu rotations (C), and desk assignment floor plans (D) are physical/administrative records with no endpoint telemetry value for detecting encryption or shadow-copy deletion.

Answer

Visitor badge sign-in sheets

Answer

Cafeteria menu rotation schedules

Answer

Office desk assignment floor plans

Question 2

An organization experiences a false positive alert caused by a legitimate administrative script executed via PowerShell. The analyst wants to create an exception that applies specifically to this script's command-line arguments without whitelisting PowerShell entirely. What type of exception should be configured?

Accepted Answer

Command-line profile exception. Command-line argument exceptions allow administrators to filter out specific benign invocations of legitimate administrative tools like PowerShell while retaining full detection coverage.

Answer

Agent removal exception

Answer

Global file hash exception

Answer

Network connection exclusion

Question 3

An administrator configures a custom data stitching rule to correlate custom application logs with endpoint events. After deployment, no new incidents are formed from these logs. What is the most critical factor to verify when troubleshooting custom stitching rules?

Accepted Answer

That the custom log fields correctly map to shared schema identifiers like user or IP. Custom stitching rules only form incidents when the fields in the custom log schema map to the shared identifiers Cortex XDR uses for correlation — typically user, IP, hostname, or agent ID. If the custom log's fields are not mapped to these shared schema identifiers, the stitching engine has no join key and no incidents are created, even though logs are ingested. Verifying field mapping is the most critical troubleshooting step.

Answer

That featured fields are enabled for the custom schema

Answer

That the incident score is locked at maximum

Answer

That all incoming custom logs are starred by default

Question 4

An analyst is investigating a suspected pass-the-ticket attack where an attacker injects a stolen Kerberos ticket into memory. Which endpoint telemetry data collected by the Cortex XDR Agent helps identify abnormal process behavior related to ticket injection tools (such as Mimikatz 'kerberos::ptt')

Accepted Answer

Endpoint process behavior telemetry capturing handle creation and memory allocation anomalies targeting lsass.exe or LSA services. Process memory inspection and behavioral monitoring via BIOCs/Cortex XDR agent detect API calls and handle manipulations associated with ticket injection into LSASS or other processes.

Answer

SMTP mail delivery status reports

Answer

HTTP proxy CONNECT request headers

Answer

Cloud storage bucket access logs

Question 5

An analyst is investigating a suspicious user account that accessed sensitive internal shares outside of normal business hours. Which Cortex XDR feature enables the analyst to review all actions taken by this user across endpoints and cloud services in a chronological timeline?

Accepted Answer

The Incident Storyline and User Timeline view. The Incident Storyline and User Timeline view in Cortex XDR aggregates all telemetry—process executions, network connections, file operations, and cloud audit events—associated with a specific user or endpoint into a single chronological narrative. This allows the analyst to reconstruct the sequence of actions taken by the suspicious account across both endpoints and cloud services, which is exactly what the question requires. It is purpose-built for cross-domain, time-ordered investigation rather than static analysis or packet-level inspection.

Answer

The Static File Analysis Report

Answer

The Network Packet Capture Utility

Answer

The Host Isolation Status page

Question 6

An administrator is planning a Cortex XDR agent rollout to a large fleet of Windows endpoints whose users are frequently offline and connect through a restricted proxy. The administrator needs the agents to receive new content and policy updates without user intervention and without direct internet egress from each endpoint. Which deployment planning consideration best addresses this requirement?

Accepted Answer

Deploy a Broker VM and configure it as an update and content distribution point so endpoints retrieve updates from the internal Broker VM instead of the cloud.. A Broker VM can be positioned inside the network to cache and distribute content and policy updates to agents, which is the standard approach when endpoints cannot reach the cloud directly. This lets offline or proxied endpoints stay current without user action, while the Broker VM maintains the cloud connection and reduces external bandwidth consumption.

Answer

Configure the agent to use the management console's public API endpoint directly for updates, bypassing the proxy.

Answer

Rely on the Cortex XDR agent's built-in offline license file so agents can update themselves locally without contacting any server.

Answer

Enable WildFire forwarding on each endpoint so the agent forwards files to the cloud and receives content updates in return.

Question 7

Which log source is essential for Cortex XDR to track successful and failed interactive logon events on Windows workstations for ITDR analysis?

Accepted Answer

Windows Security Event logs (Event IDs 4624 and 4625). Windows Security Event logs, specifically Event IDs related to logon/logoff (such as 4624 and 4625), are fundamental for tracking Windows authentication.

Answer

System event logs for printer spooler errors

Answer

Antivirus definition update logs

Answer

IIS web server access logs

Question 8

During a live investigation, an analyst needs to isolate a Windows endpoint from the network while preserving the ability to run response actions and pull files for forensic review. Which Cortex XDR action best satisfies this requirement?

Accepted Answer

Initiate Network Isolation on the endpoint from the Response Action Center.. Network Isolation is designed to sever a compromised endpoint's external and lateral communications while keeping the Cortex XDR agent connected to the management server. That management channel is what allows follow-up response actions, file retrieval, and script execution, satisfying both containment and the need to continue investigating the live host.

Answer

Disable the endpoint's network adapter in Windows Device Manager.

Answer

Add the endpoint's IP address to a block list on the perimeter firewall.

Answer

Terminate the malicious process and block its hash on the endpoint.

Question 9

When planning Cortex XDR agent deployments across heterogeneous operating systems, which TWO operating systems are officially supported by Palo Alto Networks for agent installation?

Accepted Answer

Apple macOS (supported modern versions with System Extensions). Option A is correct because Palo Alto Networks officially supports Cortex XDR agent installation on Apple macOS, including modern versions that use System Extensions (rather than the deprecated Kernel Extensions) for endpoint security functionality. Option D is correct because Microsoft Windows is a core supported platform for the Cortex XDR agent, covering Windows 10, Windows 11, and supported Windows Server editions. Options B, C, and E are incorrect because Atari TOS v4.04, Commodore AmigaOS 3.1, and MS-DOS 6.22 are legacy/retro operating systems that are not supported platforms for Cortex XDR agent deployment.

Answer

Atari TOS v4.04

Answer

Commodore AmigaOS 3.1

Answer

MS-DOS 6.22 operating system

Question 10

An analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst wants to see a visual representation of how the alerts are related over time to better understand the attack progression. Which Cortex XDR feature should the analyst use?

Accepted Answer

Incident Timeline. The Incident Timeline is designed to visually map alerts and events chronologically, revealing causal and temporal relationships. This is ideal for understanding attack progression across multiple telemetry sources. The Alert Grid, isolation status, and threat intelligence match do not provide the required visual timeline of related alerts.

Answer

Threat Intelligence Match

Answer

Alert Grid

Answer

Endpoint Isolation Status

Question 11

An administrator wants to configure automated response actions for high-severity ITDR alerts indicating active credential compromise. Which Cortex XDR feature allows automated actions such as disabling the compromised user account in Active Directory?

Accepted Answer

Response Actions and Playbooks integrated via Cortex XSOAR or native Cortex XDR automation profiles. Cortex XDR supports automated response actions through native automation profiles and playbooks, and can integrate with Cortex XSOAR for more complex orchestration. For ITDR alerts indicating active credential compromise, these features can automatically disable the compromised AD account, force password reset, or revoke sessions, reducing dwell time.

Answer

Local Windows Group Policy Editor

Answer

Agent Content Update schedules

Answer

Firewall Zone Protection Profiles

Question 12

Which TWO actions can an analyst perform to manage and highlight specific findings during an incident investigation in Cortex XDR? (Choose two)

Accepted Answer

Star individual alerts within the incident details pane. Option B is correct because Cortex XDR lets analysts star individual alerts inside the incident details pane, which flags those specific findings for quick reference and prioritization during the investigation. Option D is correct because analysts can also star the overall incident in the Incident View, marking the entire case as important so it stands out in the incident list and can be filtered or tracked more easily. These starring actions are the intended mechanisms for managing and highlighting findings without altering the underlying data. Option A is incorrect because the data stitching window is a configuration setting that controls how alerts are correlated, not a way to highlight findings. Option C is incorrect because featured fields are configured in the Cortex XDR management settings, not created per raw alert by an analyst during an investigation. Option E is incorrect because deleting raw alerts is not a supported way to manage findings and would undermine the integrity of the incident rather than recalculate its score.

Answer

Modify the data stitching window for the alert

Answer

Create a new featured field column for every raw alert

Answer

Delete raw alerts to recalculate the incident score

Question 13

An analyst is investigating a Cortex XDR incident that contains several alerts from different endpoints. The analyst wants to quickly identify the root cause alert that initiated the incident and understand the sequence of events. Which feature in the incident details view provides a chronological timeline of all related alerts and activities?

Accepted Answer

Incident Timeline. The Incident Timeline is designed to present a chronological sequence of all alerts and activities within an incident, enabling analysts to quickly identify the initiating alert and understand the attack progression. Other features like the Alert Grid or Causality Chain provide related but narrower views that do not fulfill the need for an incident-wide timeline.

Answer

Incident Summary

Answer

Causality Chain

Answer

Alert Grid

Question 14

Where can an administrator view the overall identity risk posture score across all users within the Cortex XDR management console?

Accepted Answer

Dashboards and the User Risk view within the Cortex XDR console. The Cortex XDR dashboard and specific Identity/User risk widgets display the aggregated risk posture scores of monitored users.

Answer

License Management > Subscriptions

Answer

Reports > Audit Trail

Answer

Settings > Configurations > Agents

Question 15

An analyst is investigating an incident and wants to export the full incident report and associated artifact list for compliance reporting. Which option should the analyst select in Cortex XDR?

Accepted Answer

Export Incident report. The export incident functionality allows security analysts to download comprehensive reports containing alerts, artifacts, and investigation notes.

Answer

Format hard drive

Answer

Reboot endpoint agent

Answer

Purge telemetry database