XDR-Analyst Practice Test 2 — 25 Questions

Question 1

An organization notices that Cortex XDR incidents are being assigned high severity scores primarily due to a noisy network alert rule that triggers frequently on internal port scans. What is the correct administrative workflow to resolve this scoring inflation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Tune or disable the noisy detector rule, or adjust scoring weight profiles. To fix scoring inflation caused by noisy rules, administrators should tune or disable the specific detector rule or adjust scoring weights rather than ignoring incidents.

Answer

Star all alerts generated by the port scan rule

Answer

Hide the port scan column using featured fields

Answer

Enable data stitching overrides for internal ports

Question 2

A security engineer notices that raw alerts from a third-party firewall are successfully ingested into Cortex XDR but fail to correlate into existing endpoint incidents. Upon inspection, it is discovered that the firewall logs lack internal NAT translation details. How does this impact the raw-alert-to-incident lifecycle?

Accepted Answer

It breaks data stitching because internal and external IP mappings cannot be reconciled. Data stitching relies heavily on accurate IP addresses, ports, and timestamps. Missing NAT information breaks the link between internal endpoints and external network traffic, preventing correlation.

Answer

It forces the incident score to default to maximum

Answer

It causes all firewall alerts to be automatically starred

Answer

It triggers featured fields to hide the firewall data source

Question 3

An administrator configures a custom data stitching rule to correlate custom application logs with endpoint events. After deployment, no new incidents are formed from these logs. What is the most critical factor to verify when troubleshooting custom stitching rules?

Accepted Answer

That the custom log fields correctly map to shared schema identifiers like user or IP. Custom data stitching rules require exact field matching (such as matching keys, timestamps, and identifiers) between the custom log schema and the XDR schema.

Answer

That featured fields are enabled for the custom schema

Answer

That the incident score is locked at maximum

Answer

That all incoming custom logs are starred by default

Question 4

An analyst observes that an incident's score dynamically increases over time as new related alerts are added. Which component of Cortex XDR drives this behavior?

Accepted Answer

The dynamic incident scoring engine. The Cortex XDR incident scoring engine recalculates the overall incident score dynamically as new telemetry and raw alerts are stitched and added to the incident context.

Answer

The manual analyst assignment workflow

Answer

The log collector retention policy

Answer

The featured fields rendering engine

Question 5

An administrator wants to ensure that incidents generated by alerts involving domain controllers are always assigned a 'Critical' score. Which setting should be modified?

Accepted Answer

Asset criticality groups and incident scoring rules. Scoring profiles or asset criticality rules allow administrators to assign specific score modifiers based on asset groups like domain controllers.

Answer

Alert starring default policy

Answer

Data stitching time window

Answer

Featured fields display mapper

Question 6

An analyst is reviewing the Incidents page in Cortex XDR and wants to quickly highlight a critical ransomware incident so that the shift supervisor can review it immediately without changing its status. Which feature should the analyst use?

Accepted Answer

Alert starring. Analysts use alert or incident starring to flag items of interest for review, handover, or collaboration during triage.

Answer

Severity override

Answer

Incident assignment

Answer

Featured fields configuration

Question 7

An analyst wants to prevent Cortex XDR from generating alerts on a specific signature-based detection (such as a known vulnerability scanner tool) across a specific endpoint group. Where should this exclusion be created?

Accepted Answer

Exceptions settings page, scoping the rule to the target endpoint group. Exceptions in Cortex XDR can be scoped to specific agent groups and detection types via the Exceptions management interface.

Answer

In the individual user's operating system environment variables

Answer

By modifying the BIOS firmware on the endpoint group

Answer

Through the global firewall packet filter configuration

Question 8

An enterprise wants to ensure that all incidents with a score above 80 are automatically escalated and assigned to a Tier-3 incident response queue. Where should an administrator configure this routing logic?

Accepted Answer

Incident assignment and automation rules. Automation and response rules in Cortex XDR (such as BIOC/XQL-based automation or incident assignment rules) allow routing based on score thresholds.

Answer

Data stitching parameter settings

Answer

Featured fields display configuration

Answer

Alert starring policies

Question 9

An analyst is investigating an incident and needs to determine whether lateral movement occurred between two endpoints. Which Cortex XDR feature provides the visual connection between these assets within the incident?

Accepted Answer

The Incident Graph and Causality Chain. The Causality Chain and Incident Graph provide visual representations of how threats move between processes, hosts, and networks during an attack.

Answer

The Data Stitching status indicator

Answer

The Alert Starring bookmark manager

Answer

The Featured Fields configuration panel

Question 10

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

Accepted Answer

Utilize asset criticality scoring profiles to elevate key asset visibility. Administrators can configure featured fields to display custom columns and apply scoring profiles to highlight high-priority assets.

Answer

Delete inactive data collectors to clear queue clutter

Answer

Enable automatic alert starring for every raw alert

Answer

Change data stitching rules to alter incident grid sorting

Question 11

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

Accepted Answer

Identity and authentication logs. Log data containing IP addresses, user agent strings, and geo-location metadata provides the source of truth for identity analytics and impossible travel alerts.

Answer

Network packet capture (PCAP)

Answer

Master Boot Record (MBR) analysis

Answer

Endpoint memory dump

Question 12

Which TWO actions can an analyst perform to manage and highlight specific findings during an incident investigation in Cortex XDR? (Choose two)

Accepted Answer

Star individual alerts within the incident details pane. Analysts can star individual alerts within an incident and star the overall incident to highlight and track them effectively.

Answer

Modify the data stitching window for the alert

Answer

Create a new featured field column for every raw alert

Answer

Delete raw alerts to recalculate the incident score

Question 13

What THREE conditions can cause data stitching failures between network logs and endpoint telemetry in Cortex XDR? (Choose three)

Accepted Answer

Significant time skew or clock desynchronization between data sources. Data stitching can fail due to clock desynchronization, missing or unmapped user/IP identifiers, or events falling outside the correlation time window.

Answer

Starring the endpoint alerts during triage

Answer

Enabling featured fields for the network log source

Question 14

What THREE criteria are evaluated by Cortex XDR when determining whether incoming raw alerts should be grouped into an existing incident or spawn a new one? (Choose three)

Accepted Answer

Common affected entities such as hostnames or user accounts. Alert grouping is determined by shared indicators of compromise (IOCs), common affected entities (hosts/users), and temporal proximity.

Answer

Whether the previous alerts were starred by an analyst

Answer

The presence of custom featured fields in the table view

Question 15

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Accepted Answer

New. Standard incident lifecycle statuses in Cortex XDR include 'New', 'Under Investigation', 'Resolved', and 'Closed'.

Answer

Featured

Answer

Starred

Answer

Stitched

Question 16

Which TWO actions can an administrator take to tune incident scoring for high-value assets? (Choose two)

Accepted Answer

Assign assets to high criticality groups. Administrators can adjust asset criticality groups and configure scoring profiles to ensure high-value assets receive appropriate severity weights.

Answer

Enable automatic starring for all alerts on those assets

Answer

Adjust the global data stitching window

Answer

Create featured fields to display asset scores

Question 17

When managing the alert lifecycle in Cortex XDR, analysts can perform various triage and prioritization tasks. Which THREE features or options are available to analysts when managing active incidents and alerts? (Choose three)

Accepted Answer

Updating the incident status (e.g., New, Under Investigation, Resolved).. Analysts can manage active incidents through assignment, starring, status updates, and severity adjustments.

Answer

Directly modifying the core machine learning algorithm weights of the Global Protect cloud service.

Answer

Writing raw kernel-level driver code to replace the endpoint prevention engine.

Question 18

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

Accepted Answer

Update the incident status (e.g., New to Under Investigation). Analysts can change incident statuses and assign ownership directly from the Incident View.

Answer

Build global dashboard metric widgets

Answer

Install Cortex XDR agents on remote endpoints

Answer

Configure custom data stitching parser scripts

Question 19

During an investigation of an advanced persistent threat, an analyst wants to customize the Incident View layout to ensure that custom fields populated via parsed log ingestion are prominently displayed at the top of every incident summary. How should the analyst achieve this?

Accepted Answer

By modifying the Incident Layout via Settings > Configurations > Incident View > Featured Fields. Cortex XDR allows administrators to configure featured fields to determine which data points appear prominently in the incident summary and table columns.

Answer

By creating a custom BIOC rule with output variables mapped to incident tags

Answer

By exporting the incident JSON schema and modifying the UI template mapping

Answer

By editing the Incident Scoring configuration file via the CLI

Question 20

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

Accepted Answer

Causality Chain. The Causality Chain in Cortex XDR provides a graphical representation of the process tree, showing the chronological sequence of events, parent-child process relationships, and associated artifacts that led to an execution.

Answer

Action Center

Answer

Audit Log

Answer

BIOC Rules Manager