XDR-Analyst Practice Test 23 — 15 Questions

Question 1

Which THREE key components or features in Cortex XDR contribute directly to identifying and investigating compromised user credentials?

Accepted Answer

Alert Grouping and Correlation engine. The Alert Grouping and Correlation engine (A) is correct because it aggregates and links disparate alerts—such as suspicious logons, credential dumping, and lateral movement—into a single correlated incident, which is essential for recognizing credential-compromise patterns across endpoints and identities. The User Behavior Analytics (UBA) engine (B) is correct because it baselines normal user activity and applies behavioral analytics to detect anomalies like impossible travel, atypical login times, or unusual access, which are direct indicators of compromised credentials. The User Timeline and Incident View (C) is correct because it presents a chronological, unified timeline of user and endpoint activity within an incident, letting investigators reconstruct how credentials were abused and trace the attack path. The Hardware Asset Warranty Tracker (D) is not relevant, as it manages device warranty and asset lifecycle information rather than credential threat detection or investigation. The Network QoS Bandwidth Profiler (E) is also not relevant, since it deals with network traffic prioritization and bandwidth management, not identity compromise analysis.

Answer

Hardware Asset Warranty Tracker

Answer

Network QoS Bandwidth Profiler

Question 2

An ITDR rule in Cortex XDR triggers due to impossible travel detected for a user account. Upon investigation, the analyst discovers the source IP belongs to a corporate VPN egress node. How should the analyst prevent future false positives for this known infrastructure?

Accepted Answer

Add the corporate VPN egress IP ranges to the known corporate network or location exclusions list in Cortex XDR settings. False positives caused by known corporate VPN exit nodes or proxy servers can be mitigated by configuring IP exclusions or tuning threat intelligence/behavioral analytics settings within Cortex XDR.

Answer

Modify the Windows Registry on the user's workstation to disable IPv6

Answer

Disable all behavioral analytics globally

Answer

Uninstall the Cortex XDR agent from all Domain Controllers

Question 3

A security engineer notices that raw alerts from a third-party firewall are successfully ingested into Cortex XDR but fail to correlate into existing endpoint incidents. Upon inspection, it is discovered that the firewall logs lack internal NAT translation details. How does this impact the raw-alert-to-incident lifecycle?

Accepted Answer

It breaks data stitching because internal and external IP mappings cannot be reconciled. Cortex XDR's stitching engine correlates alerts into incidents by matching shared identifiers such as internal IP, external IP, username, hostname, and NAT translation pairs. When firewall logs omit internal NAT details, the engine cannot map the external-facing IP in the firewall alert back to the internal endpoint IP seen in endpoint alerts, so the alerts remain orphaned and never join the existing incident. This is a data-stitching failure, not a scoring or UI issue.

Answer

It forces the incident score to default to maximum

Answer

It causes all firewall alerts to be automatically starred

Answer

It triggers featured fields to hide the firewall data source

Question 4

When an endpoint is isolated during an incident response action in Cortex XDR, which TWO types of network traffic are generally permitted to ensure continued management and minimal disruption? (Choose two)

Accepted Answer

Communication channel between the Cortex XDR agent and the management server. Option B is correct because when Cortex XDR isolates an endpoint, the agent must retain its communication channel to the Cortex XDR management server so the analyst can continue issuing commands, collect telemetry, and later release the endpoint from isolation. Option D is correct because isolation policies typically allow traffic to explicitly defined exceptions or management infrastructure, such as DNS and Active Directory, so the host can still resolve names and authenticate while remaining contained. Options A, C, and E are incorrect because peer-to-peer torrent sharing, social media video streaming, and public online gaming are unrelated to incident response management and would undermine the purpose of network isolation.

Answer

Unrestricted peer-to-peer torrent file sharing traffic

Answer

Personal social media video streaming broadcasts

Answer

Public online gaming multiplayer connections

Question 5

A Cortex XDR administrator wants to ensure that when an identity-based attack is detected, the platform can automatically disable the compromised user account in the identity provider. Which integration must be configured to enable this automated response?

Accepted Answer

A Cortex XDR identity provider integration that supports user account actions.. Automated identity response actions such as disabling a user account depend on an integration between Cortex XDR and the identity provider that exposes user management APIs. This integration gives the platform the authority and mechanism to revoke access when an identity-based attack is detected. Log forwarding, endpoint prevention, and network segmentation operate at different layers and cannot disable an account in the directory.

Answer

An endpoint prevention policy that blocks credential theft techniques on domain controllers.

Answer

A network segmentation rule isolating the VLAN used by the affected user.

Answer

A syslog forwarding rule from the domain controller to the Cortex XDR console.

Question 6

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

Accepted Answer

Process execution telemetry showing WmiPrvSE.exe spawning child processes. Option B is correct because WMI script execution is carried out by the WMI Provider Host process (WmiPrvSE.exe), so process execution telemetry (e.g., Sysmon Event ID 1 or Security 4688) that shows WmiPrvSE.exe spawning child processes such as cmd.exe, powershell.exe, or wscript.exe directly reveals the unauthorized script being launched. Option E is correct because attackers often achieve persistence through WMI by creating permanent event subscriptions, and examining WMI event subscription and consumer logs (e.g., Sysmon Event IDs 19, 20, and 21, or the WMI-Activity operational log) exposes the __EventFilter, __EventConsumer, and __FilterToConsumerBinding objects used to trigger the malicious script. Option A is not relevant because Bluetooth pairing histories relate to wireless peripheral connections, not WMI execution. Option C is not relevant because monitor color calibration profiles are display settings unrelated to process or script activity. Option D is not relevant because desktop wallpaper file paths are cosmetic user configuration data with no bearing on tracing WMI-based script execution.

Answer

Bluetooth peripheral pairing histories

Answer

Local monitor color calibration profiles

Answer

Desktop wallpaper image file paths

Question 7

When investigating an endpoint compromise, an analyst suspects DLL sideloading was used to execute malicious code. Which TWO telemetry indicators should the analyst examine? (Choose two)

Accepted Answer

File path analysis verifying whether the DLL resides in the application directory rather than System32. Option A is correct because DLL sideloading typically places a malicious DLL in the same directory as a legitimate executable, so the loader resolves it from the application directory instead of the trusted System32 path; verifying the DLL's location against the expected system path is a key indicator. Option C is correct because DLL load events (e.g., Sysmon Event ID 7, ImageLoad) reveal unsigned or unexpected DLLs loaded into legitimate processes, which is the core behavioral signature of sideloading. Options B, D, and E are irrelevant physical/logistics data with no bearing on endpoint process or module telemetry.

Answer

Company cafeteria seating arrangement charts

Answer

Corporate gym equipment maintenance logs

Answer

Office parking garage barrier arm position logs

Question 8

During data stitching across endpoints and networks, what THREE core attributes does Cortex XDR typically leverage to correlate disparate logs into a single incident? (Choose three)

Accepted Answer

Timestamps and time correlation windows. Cortex XDR correlates disparate logs into a single incident by leveraging core attributes that are common across data sources. Option A is correct because timestamps and time correlation windows allow the platform to align events that occurred within a defined temporal proximity, which is essential for stitching activity across endpoints and networks. Option C is correct because user identity and account names (e.g., usernames, SIDs, or UPNs) provide a consistent actor reference that links activity observed on different sensors to the same person or account. Option D is correct because source and destination IP addresses are key network-level indicators that tie endpoint telemetry to network logs and help establish communication paths between hosts. Option B is not correct because analyst star bookmarks are an investigation convenience for marking events, not a correlation attribute used to stitch logs. Option E is not correct because featured field column configurations are UI display settings in the Cortex XDR console and do not drive incident correlation.

Answer

Analyst star bookmarks

Answer

Featured field column configurations

Question 9

A Cortex XDR administrator is preparing to deploy agents to 200 Linux servers in a demilitarized zone (DMZ). The administrator needs to select a deployment method that supports automated, scalable installation without manual intervention on each server. Which deployment method should the administrator use?

Accepted Answer

Automated deployment using a configuration management tool such as Ansible, Puppet, or Chef. For automated, scalable deployment of Cortex XDR agents to Linux servers, configuration management tools such as Ansible, Puppet, or Chef are the appropriate choice. They enable centralized, scripted installation across many servers without manual intervention, ensuring consistency and efficiency. This method is particularly useful in DMZ environments where direct access may be restricted and automation reduces operational overhead.

Answer

Deployment using a preconfigured golden image with the agent preinstalled

Answer

Manual installation using the standalone agent installer package

Answer

Deployment via Microsoft Group Policy Objects (GPO)

Question 10

An analyst is investigating a Cortex XDR incident that was automatically created from a high-severity alert. The analyst determines that the alert is a false positive and wants to ensure that future identical alerts do not create new incidents. What is the most appropriate action?

Accepted Answer

Create an exception rule for the alert's specific behavior or indicator.. The correct action is to create an exception rule. In Cortex XDR, exceptions allow analysts to suppress alerts based on specific criteria, such as process name, hash, or command line, for known benign activity. This prevents future false positive incidents from being generated, directly addressing the analyst's goal. Other actions like changing severity, merging, or resolving do not prevent new incidents from being created for the same behavior.

Answer

Change the incident's severity to Low and add a comment explaining the false positive.

Answer

Merge the incident with another similar incident to reduce the incident count.

Answer

Assign the incident to another analyst and mark it as Resolved.

Question 11

A Cortex XDR administrator is planning agent deployment for 5,000 Windows endpoints in a data center with restricted internet access. The security team requires that endpoints receive policy updates and upload telemetry without direct outbound internet connectivity. The administrator decides to deploy a Broker VM. Which Cortex XDR component must the Broker VM communicate with to receive policy updates and forward telemetry from agents?

Accepted Answer

Cortex XDR management console over HTTPS (TCP 443). The Broker VM serves as a communication relay for endpoints that cannot directly reach the Cortex XDR management console. It connects to the console over HTTPS (TCP 443) to retrieve policies and upload telemetry, enabling secure and efficient data flow in restricted network environments. This design ensures that agents receive updates and send data without requiring direct internet access.

Answer

External DNS server over UDP 53

Answer

Cortex XDR agent over TCP 4443

Answer

Local syslog server over TCP 514

Question 12

An analyst is reviewing a Cortex XDR incident that contains multiple alerts from different endpoints. The analyst wants to identify the root cause and determine the scope of the attack. Which TWO actions should the analyst take to achieve this? (Choose two.)

Accepted Answer

Run a Cortex XDR Query Builder query to search for the involved process or hash across all endpoints.. To identify root cause and scope, the analyst should use the Timeline tab to understand the sequence of events and Query Builder to search for indicators across all endpoints. These tools provide the necessary visibility into how the attack started and which systems are affected. Administrative actions like changing severity or exporting reports do not contribute to technical analysis, and closing as false positive is inappropriate for a multi-endpoint incident.

Answer

Change the incident's severity to Critical and assign it to the security manager.

Answer

Export the incident to a PDF report and share it with the incident response team.

Answer

Close the incident as a false positive to reduce noise.

Question 13

An analyst is reviewing a Cortex XDR incident involving a Windows endpoint that exhibited suspicious registry modifications. The analyst needs to determine whether a persistence mechanism was established by a specific process. Which Cortex XDR evidence source should the analyst review to see the registry key path, the value data written, and the process that performed the modification?

Accepted Answer

The endpoint's registry modification events filtered by the process name. Registry modification events are the only evidence source that records the registry key path, value data, and the process that performed the write. Reviewing these events for the suspicious process directly shows whether a persistence mechanism, such as a Run key or service entry, was created and which executable was responsible. This allows the analyst to confirm persistence and scope the response.

Answer

The endpoint's authentication log for interactive logons

Answer

The endpoint's file inventory for newly created files

Answer

The endpoint's network connections table filtered by remote port 443

Question 14

After containing a ransomware incident on a Windows endpoint, an analyst needs to preserve volatile evidence for later forensic analysis before the endpoint is reimaged. Which Cortex XDR response action should the analyst use to capture a snapshot of the endpoint's memory and running processes?

Accepted Answer

Use the endpoint's memory dump response action. The memory dump response action in Cortex XDR is designed to capture volatile memory from an endpoint. It preserves running processes, loaded modules, and other in-memory artifacts that would be lost when the endpoint is reimaged. Using this built-in action ensures the evidence is collected in a consistent, forensically useful format and can be retrieved for later analysis.

Answer

Retrieve the endpoint's file quarantine list

Answer

Export the endpoint's event timeline as a CSV file

Answer

Initiate a live terminal session and run a memory capture utility

Question 15

An analyst is reviewing a Cortex XDR incident and wants to quickly see which alerts are associated with the incident and their current status. Where should the analyst look?

Accepted Answer

The Incidents page, selecting the incident to view its details, including the Alerts tab.. To quickly see which alerts are associated with an incident and their statuses, the analyst should navigate to the Incidents page and open the incident's details, where the Alerts tab lists all related alerts and their current status. Other locations like the Alerts page, Causality View, or Dashboard do not provide this specific incident-centric alert list with statuses in a straightforward manner.

Answer

The Alerts page, filtering by the incident ID.

Answer

The Causality View, which shows the process tree and related alerts.

Answer

The Dashboard, which displays incident metrics and alert counts.