XDR-Analyst Practice Test 1 — 25 Questions

Question 1

An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TCP port 443 for HTTPS API and tenant communication. Broker VM requires outbound HTTPS access on port 443 to communicate with the Cortex XDR tenant cloud backend.

Answer

TCP port 22 for SSH tunnel maintenance

Answer

TCP port 389 and 636 for directory synchronization

Answer

TCP port 6514 for secure syslog ingestion

Question 2

An XDR analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst notices that the network alerts lack associated endpoint process information, even though the same host is involved. What is the most likely cause for this missing correlation?

Accepted Answer

The endpoint telemetry for that host was not ingested or was delayed beyond the stitching window.. Cortex XDR correlates network and endpoint alerts by matching host identifiers and timestamps. If endpoint telemetry is not available or arrives after the stitching window, the network alerts cannot be enriched with process information. This often occurs when endpoints are offline, the agent is not installed, or log forwarding is delayed. Ensuring timely telemetry ingestion is key to maintaining correlation.

Answer

The incident was manually created and does not include automatic stitching.

Answer

The network alerts were generated from a different sensor that does not share endpoint telemetry.

Answer

The network alerts were triggered by a different IP address than the endpoint's IP due to NAT.

Question 3

An analyst needs to change the status of an incident from 'Under Investigation' to 'Resolved' after completing remediation. Which section of the Incident View allows updating the incident status?

Accepted Answer

Incident Header / Status field. Incident metadata such as status, assignment, and severity can be updated directly from the Incident header or details pane.

Answer

BIOC rule creation dialog

Answer

WildFire file submission form

Answer

Agent upgrade wizard

Question 4

A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three regional offices. The company wants to minimize the number of open inbound firewall ports on their network while still allowing agents to receive policy updates and send telemetry. Which deployment consideration should the architect prioritize?

Accepted Answer

Configure the Cortex XDR agents to initiate outbound connections over TCP 443 to the Cortex XDR cloud tenant.. Cortex XDR agents communicate with the cloud tenant by initiating outbound TCP 443 sessions, so no inbound firewall rules are required on the endpoint network. This outbound-only model is the standard deployment pattern and directly fulfills the architect's goal of reducing inbound port exposure while maintaining telemetry and policy delivery.

Answer

Configure agents to communicate with the Cortex XDR server component hosted on-premises over inbound TCP 443.

Answer

Enable inbound TCP 4443 on the perimeter firewall so agents can receive push notifications from the cloud.

Answer

Deploy a Broker VM in each regional office and open inbound TCP 443 from agents to the Broker VM.

Question 5

An analyst is investigating a Cortex XDR incident that contains an alert for a suspicious PowerShell script execution on a Windows endpoint. The analyst wants to see the exact command line and parent process that triggered the alert without leaving the incident view. Which action should the analyst take?

Accepted Answer

Open the alert details pane and review the 'Causality' chain.. The alert details pane in Cortex XDR provides a causality chain that displays the process tree, including command lines and parent-child relationships, for the specific alert. This allows analysts to quickly understand the exact sequence of events that triggered the alert without leaving the incident view. Other methods either require additional steps or do not provide the same level of integrated context.

Answer

Run a query in the Query Builder using the 'process' dataset and filter by the endpoint name.

Answer

Export the incident to a CSV file and search for the PowerShell command line.

Answer

Navigate to the Endpoint Security console and look up the endpoint's recent process history.

Question 6

An XDR Analyst is investigating a newly generated incident in Palo Alto Networks Cortex XDR and notices that multiple disparate alerts from different endpoints and network sensors have been automatically grouped together. Which core mechanism of Cortex XDR is primarily responsible for intelligently grouping these related alerts into a single incident?

Accepted Answer

Incident scoring and analytics correlation engine. Cortex XDR uses a specialized analytics engine and data stitching algorithms to correlate and group related alerts across endpoints, network, and cloud sources into a single incident based on shared indicators of compromise or causality chains.

Answer

Alert starring

Answer

Local Analysis agent configuration

Answer

BIOC rule generation wizard

Question 7

A security team is deploying Cortex XDR agents to 8,000 endpoints across three geographic regions. The network team requires that all agent-to-cloud communication be routed through a controlled, on-premises egress point rather than allowing direct internet access from each endpoint. Which Cortex XDR component should the administrator deploy to satisfy this requirement?

Accepted Answer

Broker VM. The Broker VM is the Cortex XDR component designed to sit inside the customer network and mediate communication between agents and the cloud. When network policy forbids direct internet access from endpoints, routing agent traffic through a Broker VM provides the controlled egress the team requires while preserving telemetry, policy enforcement, and management connectivity.

Answer

Cortex XDR agent installation token

Answer

Cortex XDR Content Update package

Answer

Cortex XDR management console

Question 8

An analyst is investigating a Cortex XDR incident where the alert source is listed as 'XDR Analytics' and the alert contains a MITRE ATT&CK technique mapping. The analyst wants to understand how the alert was generated and what data contributed to it. Which two actions should the analyst take to gain this understanding? (Choose two.)

Accepted Answer

Review the alert's 'Alert Details' pane for the analytics description and contributing events. To understand an XDR Analytics alert, the analyst should review the Alert Details pane for the analytics description and contributing events, and examine the Causality Chain to see the event sequence. These provide the 'why' and 'how' of the alert. Other actions like exporting raw logs, modifying BIOC rules, or counting similar alerts do not directly explain the alert's generation.

Answer

Run a query in the Query Builder to count similar alerts

Answer

Modify the BIOC rule that triggered the alert

Answer

Export the raw endpoint logs from the Cortex XDR agent

Question 9

An analyst is reviewing a Cortex XDR incident that includes alerts from multiple sources. The analyst wants to correlate related alerts to identify a coordinated attack. Which two actions can the analyst take to manually correlate alerts into the incident? (Choose two.)

Accepted Answer

Create a new incident from the alert and then merge it with the existing incident.. Manual correlation in Cortex XDR can be achieved by either adding an alert directly to an incident or by creating a new incident from the alert and merging it. Both methods result in the alert being included in the incident's context, enabling unified analysis. Other actions like changing severity or editing descriptions do not establish the necessary link.

Answer

Modify the alert's severity to match the incident's severity.

Answer

Edit the alert's description to include the incident ID.

Answer

Assign the alert to the same analyst who owns the incident.

Question 10

Which THREE actions can be taken directly or via orchestration within Cortex XDR when responding to an active identity-based attack?

Accepted Answer

Isolating the compromised endpoint from the network. Option B is correct because Cortex XDR can isolate a compromised endpoint from the network, cutting off the attacker's command-and-control and lateral-movement paths while preserving the agent for investigation. Option C is correct because Cortex XDR response actions integrate with identity providers (e.g., Active Directory) to disable the compromised account or force a password reset, terminating the attacker's valid-credential access. Option D is correct because Cortex XDR can quarantine malicious credential-dumping tools (e.g., Mimikatz) found on endpoints, removing the attacker's ability to harvest further credentials. Option A is not a Cortex XDR action since rebuilding a data center's electrical grid is a physical facilities task outside the product's scope. Option E is not a Cortex XDR action because upgrading BIOS firmware on enterprise routers is a hardware/firmware maintenance task unrelated to identity-attack response.

Answer

Rebuilding the physical data center facility electrical grid

Answer

Upgrading the BIOS firmware on enterprise routers

Question 11

A Cortex XDR analyst sees an alert for a user account that authenticated successfully from an unfamiliar ASN, then immediately triggered a privileged role assignment in Azure AD. Which Cortex XDR capability should the analyst use FIRST to correlate the identity activity with endpoint and network telemetry in a single timeline?

Accepted Answer

The Incident View, which stitches identity, endpoint, and network events into one causal chain.. The Incident View is designed to unify identity, endpoint, and network telemetry into one causal timeline, which is exactly what is needed when a suspicious authentication is followed by a privileged role assignment. It surfaces the relationships between alerts and events so the analyst can determine scope and impact before taking response actions. Other console areas either provide raw data, administrative records, or response controls rather than correlated incident context.

Answer

The Audit Log, which records administrative changes made inside the Cortex XDR console.

Answer

The Endpoint Isolation action, which contains the device tied to the identity alert.

Answer

The Query Builder, which runs XQL against raw datasets to reconstruct the chain manually.

Question 12

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

Accepted Answer

File Path and Command-Line arguments. Option A (File Path and Command-Line arguments) is correct because Cortex XDR exceptions can be scoped by the process image path and the exact command-line string, allowing an analyst to suppress a false positive only for a specific executable invocation rather than all activity. Option C (Digital Signature / Certificate information) is correct because exceptions can be tied to the signer or certificate details, so only binaries signed by a trusted publisher are excluded, which is useful for legitimate vendor tools that trigger behavioral alerts. Option E (File Hash (SHA-256)) is correct because hash-based exceptions match a specific known-good file by its SHA-256 value, providing the tightest scope and preventing a different file with the same name or path from being suppressed. Option B (Local user keyboard layout language) is not a security-relevant attribute in Cortex XDR exception criteria, and Option D (Endpoint CPU temperature threshold) is a hardware/health metric that has no role in defining detection exception scope.

Answer

Local user keyboard layout language

Answer

Endpoint CPU temperature threshold

Question 13

A security team is planning a Cortex XDR deployment for a small business with 250 endpoints and no existing on-premises security infrastructure. The administrator must decide how to retrieve and distribute the endpoint agent installer. Which Cortex XDR capability should be used to obtain the installer package directly from the management console?

Accepted Answer

Download the agent installer from the Cortex XDR management console and distribute it using existing software deployment tools.. For a small deployment without existing infrastructure, the most straightforward method is to download the agent installer from the Cortex XDR management console. This console provides the correct installer version for the tenant and allows distribution through existing software deployment tools. Broker VMs, API automation, and support portal downloads are either unnecessary or less direct for this scenario.

Answer

Use the Cortex XDR API to generate a unique installer for each endpoint dynamically.

Answer

Deploy a Broker VM and configure it to push agent installers to endpoints automatically.

Answer

Download the installer from the Palo Alto Networks Customer Support Portal and install it manually on each endpoint.

Question 14

Which TWO log sources are commonly ingested into Cortex XDR to support Identity Threat Detection and Response (ITDR)?

Accepted Answer

Cloud Identity Provider Sign-in Logs (e.g., Microsoft Entra ID). Option B is correct because Cortex XDR's ITDR capabilities ingest authentication and sign-in telemetry from cloud identity providers such as Microsoft Entra ID (Azure AD), including events like successful and failed sign-ins, MFA challenges, and risky sign-in detections, which are essential for correlating identity-based attacks across the environment. Option D is correct because Windows Security Event Logs supply the core on-premises identity telemetry Cortex XDR uses for ITDR, including Kerberos authentication events (e.g., 4768, 4769, 4771), logon/logoff events (4624, 4625, 4634), and privilege/account changes (4720, 4728, 4672) that reveal credential theft, pass-the-hash, and lateral movement. Options A, C, and E are not relevant: BIOS firmware update logs, display resolution configuration logs, and printer spooler error logs contain hardware or peripheral configuration data with no authentication or identity context, so they do not feed ITDR analytics.

Answer

BIOS Firmware Update Logs

Answer

Display Resolution Configuration Logs

Answer

Printer Spooler Error Logs

Question 15

A Cortex XDR incident contains 15 alerts that were automatically stitched together. The analyst determines that 3 of these alerts are false positives caused by a legitimate administrative script. The analyst wants to remove these 3 alerts from the incident without affecting the other 12 alerts. What is the correct action?

Accepted Answer

Select the 3 alerts in the incident and choose 'Remove from Incident' to unlink them, leaving the incident with the remaining 12 alerts.. The correct action is to select the false-positive alerts and use the 'Remove from Incident' function. This unlinks them from the incident, leaving the remaining alerts intact. It is the precise method for refining incident contents without altering the incident's status or creating new incidents.

Answer

Add a note to the incident indicating that the 3 alerts are false positives, and then resolve the incident.

Answer

Change the severity of the 3 alerts to 'Informational' so they no longer contribute to the incident's risk score.

Answer

Close the incident and create a new incident manually with only the 12 relevant alerts.

Question 16

An administrator is designing a disaster recovery and high availability strategy for Broker VM deployments in a large enterprise. Which THREE practices ensure high availability and resilience for Broker VM services?

Accepted Answer

Continuously monitoring Broker VM health, connectivity status, and app status in the Cortex XDR console. Option A is correct because continuous monitoring of Broker VM health, connectivity status, and app status in the Cortex XDR console provides the visibility needed to detect failures or degraded services early and trigger remediation, which is essential for maintaining high availability. Option B is correct because hypervisor-level HA such as VMware vSphere HA automatically restarts Broker VM virtual machines on another host when a host failure occurs, reducing downtime without manual intervention. Option C is correct because deploying multiple Broker VM instances in active-active or active-passive configurations across different hypervisor hosts removes single points of failure and ensures service continuity if one instance or host becomes unavailable. Option D does not belong because connecting virtual disks to a local USB thumb drive is not a supported or reliable HA mechanism and introduces a single point of failure rather than resilience. Option E does not belong because Broker VM is a virtual appliance deployed on a hypervisor, not software that runs inside a web browser tab, so it cannot provide the required availability or performance.

Answer

Connecting the Broker VM virtual disks to a local USB thumb drive for manual failover

Answer

Running the Broker VM software directly inside a web browser tab

Question 17

An administrator is configuring data stitching and alert correlation rules in Cortex XDR to improve incident prioritization. Which TWO actions are best practices to ensure high-fidelity alert grouping and accurate incident scoring? (Choose two)

Accepted Answer

Map critical assets with appropriate priority weights to influence incident scoring accurately.. Option C is correct because Cortex XDR incident scoring factors in asset criticality, so mapping critical assets with appropriate priority weights ensures that alerts affecting high-value systems are scored and prioritized accurately. Option E is correct because data stitching and alert correlation depend on consistent, correctly parsed host and IP identification fields; if third-party log sources do not normalize these fields, Cortex XDR cannot reliably stitch related alerts into a single incident or correlate them across data sources. Option A is incorrect because disabling all default analytics rules removes valuable built-in detections and correlation logic rather than improving fidelity. Option B is incorrect because a 1-minute incident close timeout is far too aggressive and would prematurely close incidents before related alerts can be stitched together. Option D is incorrect because manually starring every alert does not trigger the correlation engine and would simply clutter the alert view without improving grouping or scoring.

Answer

Disable all default Cortex XDR analytics rules to prevent false correlation.

Answer

Set the incident close timeout to 1 minute to speed up alert processing.

Answer

Manually star every incoming alert to trigger the incident correlation engine.

Question 18

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

Accepted Answer

The Cortex XDR Broker VM configured with the User-ID integration. The Broker VM configured with the User-ID integration is the Cortex XDR component responsible for collecting user and group metadata from Active Directory and other identity sources. It forwards this identity context to Cortex XDR so alerts can be enriched and correlated for ITDR use cases. Without the Broker VM's User-ID integration, AD context would not be available for alert enrichment.

Answer

The Cortex XDR Network Traffic Analyzer

Answer

WildFire cloud analysis engine

Answer

The Cortex XSOAR Content Pack for Active Directory

Question 19

An organization notices an increase in credential dumping attacks against local Active Directory environments. They want to configure Cortex XDR Identity Analytics to trigger high-severity alerts when abnormal Kerberos ticket requests (such as potential Silver or Golden ticket activities) are detected. Where should the analyst enable or tune these specific identity behavior analytics rules?

Accepted Answer

Under Settings > Configurations > Analytics in the Cortex XDR console. Identity Analytics behavioral rules are managed within the Analytics configuration section of the Cortex XDR management console under Settings > Configurations > Analytics.

Answer

By modifying local Windows Group Policy Objects (GPOs) pushed to domain controllers

Answer

Within the BIOC (Behavioral Indicator of Compromise) rule builder under Incident Response

Answer

Under Settings > Configurations > Data Node Settings in the Cortex XDR console

Question 20

Which TWO evidence sources help an analyst investigate whether an unauthorized user accessed a compromised workstation locally? (Choose two)

Accepted Answer

Windows Security Event logs (Event IDs for logon successes and failures). Local workstation access investigations rely on Windows Security Event logs (Logon/Logoff events) and user session telemetry.

Answer

Corporate vehicle fleet GPS tracking logs

Answer

Office cafeteria refrigerator temperature charts

Answer

Office janitorial cleaning supply invoices