XDR-Analyst Practice Test 3 — 25 Questions

Question 1

Which TWO features in Cortex XDR assist analysts in communicating identity threat findings to stakeholders or compliance auditors?

Accepted Answer

Scheduled and on-demand reporting templates for incident summaries and user risk. Option A is correct because Cortex XDR provides scheduled and on-demand reporting templates that summarize incidents and user risk, giving analysts a repeatable way to present identity threat findings to stakeholders and auditors. Option D is correct because Cortex XDR allows incidents and related data to be exported or shared in formats such as PDF or CSV, which supports evidence handoff and compliance review. Options B, C, and E are incorrect because BIOS flashing, live packet generation, and hard drive partitioning are not Cortex XDR features for communicating identity threat findings; they are unrelated to reporting or audit workflows.

Answer

Automated BIOS flashing utility

Answer

Live packet generator

Answer

Hard drive partition editor

Question 2

An analyst is investigating a Cortex XDR incident where the automatic correlation engine grouped alerts based on a shared causality ID. The analyst discovers that one alert in the incident actually belongs to a different attack on the same endpoint. What should the analyst do to correct the incident grouping?

Accepted Answer

Remove the alert from the incident and create a new incident for it.. To correct an incorrect grouping, the analyst should remove the mis-grouped alert from the incident. Cortex XDR provides this manual action, allowing the analyst to then handle the alert separately, such as creating a new incident. Other actions like editing causality IDs or merging incidents do not achieve the desired separation.

Answer

Change the alert's causality ID to a different value.

Answer

Close the incident and reopen it with a filter that excludes the alert.

Answer

Merge the incident with another incident that contains the correct alerts.

Question 3

When sizing a Broker VM instance for an environment collecting high-volume syslog and Active Directory logs, which hardware resource is most critical to scale appropriately?

Accepted Answer

Sufficient vCPU and RAM allocation per published system requirements. Log collection and parsing require adequate RAM and CPU to process high throughput before forwarding to the Cortex Data Lake.

Answer

Fibre Channel HBA connected to an enterprise SAN storage array

Answer

Dedicated high-end NVIDIA GPU for deep learning processing

Answer

Dual 10Gbps SFP+ physical network interface cards passed through directly

Question 4

Cortex XDR stitches together data from multiple telemetry sources to form a cohesive incident. An analyst notices that network logs from a third-party firewall are generating alerts, but they are not stitching correctly with the endpoint alerts for the same compromised host. What is the most likely cause of this stitching failure in the raw-alert-to-incident lifecycle?

Accepted Answer

The third-party firewall logs lack proper field mapping for endpoint IP or hostname identifiers required by the stitching engine.. Data stitching relies on consistent identifiers such as internal IP addresses, MAC addresses, or hostnames. Mismatched or missing identifiers in parsed logs prevent the Cortex XDR causality engine from linking network and endpoint events.

Answer

The incident scoring threshold is set too high for network alerts to be included in endpoint-triggered incidents.

Answer

The alerts are in an 'Unassigned' status, which disables the causality engine.

Answer

Alert starring has not been applied to the network alerts, preventing automated correlation.

Question 5

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

Accepted Answer

New. When the Cortex XDR correlation engine automatically generates an incident from correlated alerts, it is assigned the status 'New' by default. This indicates the incident has been created but not yet triaged, assigned, or acted upon by an analyst. Status transitions (e.g., Under Investigation, Resolved, Closed) occur only after human or automated workflow actions.

Answer

Closed

Answer

Under Investigation

Answer

Resolved

Question 6

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Accepted Answer

Windows Scheduled Tasks. Option C is correct because Windows Scheduled Tasks are a common APT persistence mechanism, allowing malware to execute on a schedule or at logon/boot, and Cortex XDR telemetry captures task creation and modification events (e.g., schtasks.exe, Task Scheduler operational logs). Option D is correct because creating or modifying Windows Services (e.g., via sc.exe, New-Service, or service DLL hijacking) enables persistence by launching malicious code at system startup, and Cortex XDR records service installation and configuration changes. Option E is correct because Registry Run and RunOnce keys (HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce) are classic autostart locations that Cortex XDR monitors for registry modifications tied to persistence. Options A and B are incorrect because office desk relocation requests and breakroom coffee machine maintenance schedules are physical facilities matters with no relation to host-based persistence or endpoint telemetry.

Answer

Office desk relocation requests

Answer

Breakroom coffee machine maintenance schedules

Question 7

An administrator is setting up a new Cortex XDR tenant and preparing for initial onboarding. Which TWO administrative tasks must be completed during the initial planning and setup phase?

Accepted Answer

Configure administrator user accounts and assign appropriate Role-Based Access Control (RBAC) roles. Option D is correct because during initial Cortex XDR tenant onboarding, the administrator must create administrator user accounts and assign the appropriate RBAC roles so that different teams (e.g., SOC analysts, responders, admins) get only the permissions they need. Option E is correct because onboarding requires generating Agent Installation Packages (with the tenant/registration token) and defining Settings profiles so endpoints can be enrolled and managed consistently. Option A is incorrect because Cortex XDR agents are prebuilt binaries; no custom assembly code per CPU architecture is written by the administrator. Option B is incorrect because Cortex XDR is an endpoint detection and response platform and does not require physically replacing core switches with Palo Alto Networks firewalls. Option C is incorrect because disabling cloud logging would defeat Cortex XDR's telemetry ingestion and analytics rather than being a required setup task.

Answer

Manually write custom assembly code for every endpoint CPU architecture

Answer

Physically replace all enterprise core switches with Palo Alto Networks firewalls

Answer

Disable all cloud logging features to prevent data ingestion

Question 8

When reviewing identity analytics alerts in Cortex XDR, which THREE behavioral anomalies are typically flagged by the UBA engine as potential indicators of a compromised account?

Accepted Answer

Abnormal volume of data access or file downloads compared to peer group baselines. The UBA (User and Entity Behavior Analytics) engine in Cortex XDR baselines each user's normal activity and flags deviations, so option B is correct because a spike in data access or file downloads relative to the peer group baseline is a classic exfiltration/compromised-account indicator. Option C is correct because accessing sensitive internal applications or file shares outside the user's normal working hours is an anomalous access pattern the engine scores as risky. Option D is correct because impossible travel — geographically distant logins within an unrealistically short timeframe — is a hallmark UBA detection for credential compromise or session hijacking. Option A is not anomalous since a standard QWERTY keyboard layout is a ubiquitous, benign configuration with no security relevance. Option E is not a user-behavior anomaly at all; plugging an Ethernet cable into switch port 1 is a physical network action, not identity analytics telemetry.

Answer

Using a standard QWERTY keyboard layout

Answer

Connecting an Ethernet cable into port 1 of a switch

Question 9

After containing a malware outbreak, a Cortex XDR analyst needs to verify that the malicious file was removed from all affected endpoints. The analyst wants to confirm the current state of the endpoints without waiting for the next scheduled scan. Which Cortex XDR action allows the analyst to query endpoint file system state on demand and return results to the console?

Accepted Answer

Run a script or command through the Cortex XDR Live Terminal or action center to check for the file's presence and capture the output.. To verify current endpoint state on demand, Cortex XDR provides Live Terminal and script-based response actions that execute directly on endpoints and return output to the console. These actions query the live file system, so the analyst can confirm whether the malicious file persists and immediately remediate if it does, rather than waiting for scheduled scans or relying on historical detection records.

Answer

Modify the endpoint protection policy to enable real-time file monitoring and rely on future alerts to confirm removal.

Answer

Initiate a WildFire submission of the file hash to obtain a fresh verdict and infer that the file was removed.

Answer

Review the Incident Details page timeline for the original detection and confirm that the file was quarantined at that time.

Question 10

During incident triage, an analyst notices that two completely separate attacks on different endpoints were merged into a single incident by Cortex XDR. What is the underlying reason for this over-correlation?

Accepted Answer

Shared common identifiers such as a NAT gateway IP address within the correlation window. Cortex XDR's correlation engine stitches alerts into incidents by matching shared identifiers — IP addresses, hostnames, usernames, file hashes, and similar artifacts — within a configurable correlation window. When two unrelated attacks both traverse the same NAT gateway, the public IP is identical in both alert sets, so the engine merges them into one incident. This is a classic over-correlation caused by shared infrastructure identifiers rather than true attack linkage.

Answer

All alerts were manually starred by an analyst

Answer

The incident scoring threshold was set too low

Answer

Featured fields were configured to group by IP subnet

Question 11

An organization requires that specific custom threat intelligence tags appear as primary columns in the Incident View. How can an administrator achieve this?

Accepted Answer

Configure featured fields to include the custom threat intelligence tags. Featured fields in Cortex XDR let administrators choose which fields appear as primary columns in the Incident View, including custom threat intelligence tags. By adding the custom TI tag field to the featured fields configuration, those tags render as top-level columns for every incident, giving analysts immediate visibility without drilling into details.

Answer

Create a data stitching rule for threat intelligence

Answer

Set up an alert exclusion exception

Answer

Adjust the incident scoring profile weights

Question 12

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

Accepted Answer

User Investigation view. The User Investigation view in Cortex XDR aggregates user activity, authentication events, and associated alerts across endpoints and cloud environments.

Answer

Disk Encryption status panel

Answer

Agent Health dashboard

Answer

BIOC Policy editor

Question 13

What role does the Cortex XDR Broker VM play regarding Active Directory and ITDR log collection?

Accepted Answer

It acts as a collector appliance to ingest and forward syslog, WMI, and Active Directory logs to Cortex XDR. The Cortex XDR Broker VM functions as a collector appliance that ingests and forwards syslog, WMI, and Active Directory logs to Cortex XDR. It acts as an on-premises intermediary that receives telemetry from various sources and securely transmits it to the Cortex XDR management console for analysis and correlation. This is its primary role in AD and ITDR log collection.

Answer

It stores long-term forensic disk images of all enterprise workstations

Answer

It replaces the domain controller operating system

Answer

It functions as an external Next-Generation Firewall

Question 14

During an investigation, an analyst discovers that a raw alert was generated by a legitimate software update tool. To prevent this specific alert from triggering future incidents across all endpoints, how should the analyst proceed within the lifecycle management framework?

Accepted Answer

Create an alert exclusion based on the tool's file hash or digital signature. Creating an alert exception or exclusion based on file hash, path, or digital signature prevents future raw alerts and subsequent incident creation.

Answer

Modify the data stitching window to ignore update hours

Answer

Decrease the global incident scoring threshold

Answer

Star the alert and change its status to resolved

Question 15

When deploying and troubleshooting the integration between Cortex XDR and Active Directory for ITDR, which TWO steps or configurations are critical to ensure successful telemetry collection? (Choose two)

Accepted Answer

Configuring the Cortex XDR Broker VM to receive and parse syslog or Windows event streams from domain controllers. Option B is correct because the Cortex XDR Broker VM acts as the collection and parsing point for ITDR telemetry, ingesting syslog or Windows Event Forwarding streams from domain controllers so identity events reach Cortex XDR. Option C is correct because advanced audit policies (e.g., Audit Logon/Logoff, Audit Account Management, and Directory Service Access) must be enabled on Domain Controllers to generate the authentication and account-change events ITDR relies on. Option A is wrong because BIOS boot order has no bearing on AD telemetry collection. Option D is wrong because DNS root servers do not host AD identity telemetry and installing a kernel driver there is neither required nor appropriate. Option E is wrong because disabling firewall rules to SYSVOL is unnecessary and would weaken security without improving ITDR telemetry.

Answer

Modifying the local BIOS boot order on every user workstation

Answer

Installing the full Cortex XDR Agent kernel driver directly on all DNS root servers

Answer

Disabling all firewall rules between endpoints and the Active Directory SYSVOL share

Question 16

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

Accepted Answer

The endpoint agent must be online and connected to receive the command.. Cortex XDR response playbooks issue remediation commands (isolate endpoint, kill process, quarantine file) through the agent's management channel, so the agent must be online and connected to the Cortex XDR management server for the command to be delivered and acknowledged. If the endpoint is offline, the action is queued but cannot execute until the agent reconnects.

Answer

The user must manually approve every automated step in the playbook.

Answer

The endpoint must have local administrative privileges disabled.

Answer

The endpoint must be running a legacy operating system without secure boot.

Question 17

An analyst wants to filter the Incident View to show only incidents that have been bookmarked by members of the SOC team. Which filter criterion should be applied?

Accepted Answer

Starred incidents filter. Cortex XDR's Incident View includes a 'Starred' filter that shows only incidents bookmarked by analysts. Applying this filter narrows the grid to starred incidents, which is exactly what the SOC team needs to see bookmarked cases. It is a first-class filter criterion in the incident grid's filter panel.

Answer

Incident score range filter

Answer

Featured fields filter

Answer

Data stitching status filter

Question 18

What is the primary function of Cortex XDR Agent prevention modules (such as Anti-Malware and Exploit Protection)?

Accepted Answer

To actively block and remediate threats such as malware, exploits, and ransomware execution on the endpoint. Prevention modules block known and unknown malware, exploits, and ransomware execution in real-time on the endpoint.

Answer

To generate weekly compliance PDF reports for external auditors

Answer

To monitor bandwidth usage across enterprise switch ports

Answer

To automatically patch third-party software vulnerabilities like Adobe Reader

Question 19

An enterprise ingests proxy logs and endpoint telemetry into Cortex XDR. An analyst notices that web traffic alerts for a specific user are not correlating with the user's endpoint malware alerts. What is a common prerequisite for successful identity-based data stitching across network and endpoint sources?

Accepted Answer

Consistent user naming conventions and identity mapping across log sources. Identity stitching requires consistent username formatting and mapping (such as Active Directory user principal names or NetBIOS names) across all ingested log sources.

Answer

Incident scoring must be set to manual mode

Answer

All alerts must be manually starred by an analyst

Answer

Featured fields must be enabled for proxy logs

Question 20

Which TWO types of user accounts are critical to monitor closely for privilege abuse and anomalous behavior within an ITDR program?

Accepted Answer

Domain Administrator accounts. Domain Administrator accounts (B) are the highest-value targets in any environment, since they hold near-unrestricted rights over Active Directory (e.g., DCSync, Golden Ticket, and domain-wide policy changes), so any anomalous logon, privilege escalation, or lateral movement tied to them is a top ITDR detection priority. Service accounts with elevated permissions (D) are equally critical because they typically run with non-interactive, often non-expiring credentials and broad rights, making them prime targets for Kerberoasting, credential dumping, and abuse that blends into normal automated activity. The remaining options are not the focus of privilege-abuse monitoring: guest accounts with zero permissions (A) and unassigned printer test accounts (C) lack meaningful privileges, and deactivated former employee accounts (E) should be disabled or removed, so they represent an account-lifecycle/hygiene issue rather than active privileged-account monitoring.

Answer

Guest user accounts with zero permissions

Answer

Unassigned printer test accounts

Answer

Deactivated former employee accounts