XDR-Analyst Practice Test 2 — 25 Questions

Question 1

You are configuring integration between Cortex XDR and an external Identity Provider (IdP) to ingest user authentication logs for ITDR. Which component is primarily responsible for securely forwarding these IdP telemetry logs to the Cortex XDR data lake?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Cortex XDR Broker VM configured with the appropriate log forwarding profile. The Cortex XDR Collector or Broker VM is used to ingest syslog, HTTP event collector streams, or API-based logs from external IdPs into the Cortex data lake.

Answer

The Traps management service daemon

Answer

The WildFire cloud analysis cluster

Answer

The Cortex XDR Agent installed on domain controllers

Question 2

When responding to a malware alert, an analyst decides to quarantine the offending file. Which TWO outcomes occur when Cortex XDR performs a file quarantine? (Choose two)

Accepted Answer

Running processes associated with the file are terminated.. Quarantine terminates the running process instance (if applicable) and moves the file binary from its original path to a secure, encrypted quarantine location on the endpoint.

Answer

All network routers in the enterprise data center are reset.

Answer

The computer's power supply unit is permanently disabled.

Answer

The endpoint operating system hard drive is physically wiped clean.

Question 3

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

Accepted Answer

Incident Timeline / Causality view. Option A, the Incident Timeline / Causality view, is correct because in Cortex XDR this view reconstructs the sequence of events (process execution, network connections, file writes, registry changes) around an alert, letting analysts trace the root cause and forensic artifacts collected from the endpoint. Option C, the File Details / Forensic File Collection view, is correct because it exposes the actual collected forensic artifacts such as quarantined files, hashes, and file metadata retrieved from the endpoint during an investigation. The remaining options (B, D, and E) are unrelated administrative or facilities records and have no role in Cortex XDR forensic artifact analysis.

Answer

Corporate gym membership roster

Answer

Cloud printer ink supply level gauge

Answer

Cafeteria food inventory management sheet

Question 4

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

Accepted Answer

Isolate Endpoint. Isolate Endpoint allows an administrator to sever the network connection of a compromised host while retaining Cortex XDR agent communication and administrative troubleshooting access.

Answer

Disable User

Answer

Kill Process Tree

Answer

Quarantine File

Question 5

A Cortex XDR analyst is examining an alert where a user account successfully authenticated from two different countries within a 10-minute window. The analyst suspects impossible travel. Which Cortex XDR feature would provide a visual representation of the user's login locations and times to confirm this?

Accepted Answer

User View timeline. User View in Cortex XDR provides a consolidated timeline of user activities, including authentication events with geographic locations and timestamps. This feature enables analysts to visualize login patterns and quickly identify impossible travel by showing the sequence of logins from disparate locations within a short timeframe, confirming the anomaly.

Answer

Endpoint device control audit

Answer

Network traffic flow analysis

Answer

Incident Response Playbook execution log

Question 6

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

Accepted Answer

Cross-data-source data stitching. Cross-data-source data stitching is the Cortex XDR mechanism that correlates alerts and events from different telemetry sources (XDR agents, third-party firewalls, cloud logs) into a single unified incident. It links entities like IPs, hostnames, and users across sources so that a firewall alert and an endpoint alert about the same attack are presented as one incident rather than separate alerts.

Answer

Automated alert starring

Answer

Incident score weighting tables

Answer

Featured fields column mapping

Question 7

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Accepted Answer

New. Option A, New, is correct because a newly generated incident in Cortex XDR begins in the New state, which is the initial stage of the standard incident lifecycle before any analyst action is taken. Option D, Under Investigation, is correct because once an analyst begins working an incident, it moves to the Under Investigation state, which is a defined stage in the standard lifecycle. The remaining options do not belong: Featured and Starred are not lifecycle states but rather UI flags or filters used to mark or prioritize incidents for quick access, and Stitched refers to the stitching of related alerts/causality events into an incident, not a lifecycle state.

Answer

Featured

Answer

Starred

Answer

Stitched

Question 8

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

Accepted Answer

Under the Incident Details page by selecting the Alerts tab. By drilling down into an incident in Cortex XDR, the analyst can access the Alert tab to inspect the individual raw alerts that make up the incident lineage.

Answer

Under Analytics > BIOC > Alert Log

Answer

Under Response > Action Center > History

Answer

Under Settings > Data Stitching > Raw Logs

Question 9

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

Accepted Answer

Configure exclusions for the vulnerability scanner's IP addresses or signature patterns. Creating exclusion rules for scanner IP addresses or signatures ensures vulnerability assessment traffic does not trigger security incidents.

Answer

Enable featured fields to hide scanner columns

Answer

Turn off data stitching across all internal subnets

Answer

Star all alerts generated during scanning windows

Question 10

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Accepted Answer

Verify the digital signature and publisher of the application. Safe exception implementation involves validating binary integrity, verifying legitimate paths, and testing prior to global deployment.

Answer

Disable all Cortex XDR agent security modules across the entire enterprise

Answer

Remove all file access permissions from the operating system kernel

Question 11

An analyst is investigating a security incident and needs to review the timeline of events that occurred on a compromised endpoint. The analyst wants to see a chronological list of all alerts, process executions, and network connections related to the incident. Which Cortex XDR view should the analyst use?

Accepted Answer

Incident Details page. The Incident Details page is specifically designed to present all relevant information for an incident in one place, including a chronological timeline of alerts, process executions, and network connections. This allows the analyst to quickly understand the sequence of events without manual querying. Other options serve different purposes such as endpoint management, threat intelligence, or custom querying.

Answer

Endpoint Management console

Answer

Threat Intelligence module

Answer

XQL Query Center

Question 12

An administrator is planning a Cortex XDR deployment across multiple sites, including a remote office with limited internet bandwidth. The administrator wants to minimize WAN traffic for agent updates and threat intelligence lookups. Which Cortex XDR component should be deployed at the remote office to achieve this?

Accepted Answer

Broker VM. A Broker VM deployed at the remote office can cache content updates and threat intelligence, serving them to local endpoints. This reduces WAN traffic because endpoints retrieve updates from the Broker VM instead of the cloud. The management console and Cortex Data Lake are cloud-based and do not provide local caching. Agent local caching does not exist as a feature for sharing updates.

Answer

Cortex XDR agent with local caching enabled

Answer

Cortex Data Lake

Answer

Cortex XDR management console

Question 13

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Accepted Answer

Directory Service Access and LDAP query event logs from Domain Controllers (such as Event ID 4662). BloodHound enumerates Active Directory by issuing LDAP queries and accessing directory service objects, which generates Directory Service Access events on domain controllers, including Event ID 4662. Cortex XDR can ingest these Domain Controller event logs to detect the enumeration patterns characteristic of BloodHound reconnaissance.

Answer

Network interface duplex settings

Answer

USB device connection history

Answer

Browser extension inventory reports

Question 14

A Cortex XDR analyst is building an identity threat detection strategy for a hybrid environment with on-premises Active Directory and cloud identity. Which TWO telemetry sources should the analyst prioritize ingesting to detect credential abuse and anomalous authentication across both environments? (Choose two.)

Accepted Answer

Windows Security event logs from domain controllers, including authentication and Kerberos events.. Effective hybrid identity threat detection requires visibility into both authentication authorities. Domain controller security logs expose on-premises Kerberos and logon behavior, while cloud identity provider sign-in and audit logs expose cloud authentication and directory changes. Together they let Cortex XDR baseline and correlate identity behavior across environments. Network, DHCP, and print logs lack the credential and authentication context needed for identity-focused detection.

Answer

Endpoint firewall connection logs recording outbound TCP and UDP flows from user workstations.

Answer

Print server spooler logs capturing document names and submitting user accounts.

Answer

DHCP lease logs from the internal network recording IP address assignments to endpoints.

Question 15

An administrator is planning to install Cortex XDR agents on a large fleet of Windows endpoints and wants to ensure the installation can proceed without manual intervention on each host. Which approach best supports a silent, unattended installation?

Accepted Answer

Deploy the agent MSI package with the installation token supplied as a command-line parameter through a software distribution tool.. Silent, unattended installation on Windows is achieved by distributing the agent MSI through a software deployment tool and passing the installation token as a command-line parameter. This lets each host register automatically with the tenant without interactive input, which is essential for large-scale rollouts.

Answer

Run the agent installer interactively on each endpoint and paste the installation token when prompted.

Answer

Install the agent without a token and rely on the cloud tenant to auto-assign the endpoint to a default policy.

Answer

Copy the agent installer to a network share and instruct users to double-click it from their desktops.

Question 16

When analyzing a complex multi-stage attack in Cortex XDR, an analyst examines the Causality Chain. How does the Causality Chain assist in understanding the raw-alert-to-incident lifecycle?

Accepted Answer

It traces the parent-child process relationship and telemetry leading to the alert. The Causality Chain visualizes the chronological sequence of processes, network connections, and file modifications that led to an alert, helping trace the origin of the incident.

Answer

It automatically recalculates the incident score based on user activity

Answer

It stitches network logs with endpoint logs using IP subnet masks

Answer

It filters featured fields to highlight malicious hashes

Question 17

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Accepted Answer

It maps the behaviors observed in the incident to known attacker tactics and techniques.. The MITRE ATT&CK tab in Cortex XDR incident details maps observed behaviors to the MITRE ATT&CK framework, which is a curated knowledge base of adversary tactics, techniques, and procedures (TTPs). This mapping helps analysts understand the attacker's intent, identify the stage of the attack lifecycle, and prioritize response actions. It provides context beyond raw alerts by categorizing activities like 'Credential Dumping' (T1003) or 'Spearphishing Attachment' (T1566), enabling faster triage and correlation with threat intelligence.

Answer

It provides network routing tables for the compromised subnet.

Answer

It automatically downloads security patches from vendor repositories.

Answer

It lists the hardware warranty status of the affected device.

Question 18

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

Accepted Answer

Network connection details including source, destination, port, and protocol. Network connection details including source, destination, port, and protocol is correct because an 'IP Connection' artifact in Cortex XDR represents a network connection event, capturing the source IP, destination IP, destination port, and protocol (e.g., TCP, UDP). This information is crucial for understanding command-and-control (C2) traffic, data exfiltration, or lateral movement. The artifact is generated from endpoint telemetry and provides context for the connection, such as the responsible process.

Answer

Software license expiration dates

Answer

Hardware temperature and fan speed metrics

Answer

Local user account password complexity settings

Question 19

What is the primary purpose of the Cortex XDR agent installation token (or installation password)?

Accepted Answer

To authenticate the agent installation and prevent unauthorized uninstallation or tampering. The Cortex XDR agent installation token authenticates the agent during installation and registration with the Cortex XDR tenant, and it also prevents unauthorized uninstallation or tampering by requiring the token for agent removal. This ensures only authorized endpoints join the tenant and that the agent cannot be easily disabled by malware or unauthorized users.

Answer

To license the endpoint for Palo Alto Networks Next-Generation Firewall features

Answer

To authenticate the agent against the local Active Directory domain controller

Answer

To encrypt all local agent SQLite databases at rest

Question 20

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Accepted Answer

The time delta between the endpoint and network events exceeds the stitching correlation window. Cortex XDR stitches alerts into incidents by correlating on shared featured fields (such as IP, user, hostname) within a defined time window. If the endpoint event and the network event occur too far apart in time, the correlation engine will not merge them, so they appear as separate incidents even though the IP and user match. The most likely cause is therefore that the time delta exceeds the stitching window.

Answer

The incident score was manually overridden to low

Answer

Alert starring was disabled on the network data source

Answer

Featured fields were not configured for the network logs