XDR-Analyst Practice Test 4 — 25 Questions

Question 1

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

Accepted Answer

Suppress or disable the noisy alert rule if it lacks operational value. Option B is correct because suppressing or disabling an alert rule that has no operational value stops the recurring false positive from generating new incidents, directly reducing incident pollution at the rule level. Option C is correct because tuning the specific detector or BIOC rule parameters (for example, adjusting thresholds, logic, or conditions) refines detection so the benign activity no longer triggers the rule while preserving its legitimate detections. Option E is correct because creating an alert exclusion rule scoped to unique file hashes or paths precisely filters out the known-benign artifacts, preventing those specific false positives from re-entering the incident queue without broadly weakening detection. Option A does not belong because starring alerts only flags them for visibility and does not prevent them from being generated or polluting incidents. Option D does not belong because adding a featured field column merely changes how alerts are displayed and hides nothing from the incident pipeline, so the false positives still occur.

Answer

Star all future instances of the alert in the incident view

Answer

Add a featured field column to hide the false positive alerts

Question 2

An administrator is deploying Cortex XDR agents in a Linux environment and needs to ensure that the agent does not interfere with a critical custom database application. Which feature should the administrator configure to exclude specific directories or processes from agent inspection?

Accepted Answer

Global Agent Profile Exclusions (Path, Process, and File Hash exclusions). The correct feature is Global Agent Profile Exclusions (Path, Process, and File Hash exclusions) (A). These exclusions allow administrators to specify directories, processes, or file hashes that the agent should ignore during inspection, preventing interference with critical applications. This is configured in the agent profile and applied to endpoints.

Answer

Broker VM Firewall Rules

Answer

Kernel Module Blacklisting via /etc/modprobe.d

Answer

Linux iptables PREROUTING chains

Question 3

Where in the Cortex XDR console can an analyst review the complete lifecycle timeline of an incident, from initial raw alert generation to final resolution?

Accepted Answer

The Incident Details page and Incident Timeline view. The Incident Details page and Incident Timeline view in Cortex XDR provide a unified, chronological record of an incident's entire lifecycle. This includes the initial raw alert generation, subsequent alert grouping into an incident, all investigative actions taken, and the final resolution or closure. Analysts use this view to understand the full scope and progression of a security event without needing to correlate data from multiple separate tools.

Answer

The Syslog forwarding configuration panel

Answer

The Global Dashboard widget builder

Answer

The Agent installation status log

Question 4

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

Accepted Answer

Signed binary exception with path and certificate verification. Signed binary exceptions combined with valid certificate verification and file path checks allow legitimate administrative or updater tools to operate without generating alerts.

Answer

Configuring a network port forwarding rule

Answer

Deleting the software updater from all endpoints

Answer

Disabling all behavioral monitoring on the subnet

Question 5

An administrator needs to customize the incident queue to show the 'OS Version' column for all displayed incidents. Which configuration interface should be accessed?

Accepted Answer

Featured fields settings. Featured fields configuration allows administrators to add standard or custom attributes like OS Version as columns in the incident table.

Answer

Incident scoring weight profiles

Answer

Alert exclusion rule manager

Answer

Data stitching correlation parameters

Question 6

An administrator is planning a Cortex XDR agent rollout and needs to decide how to distribute the agent installer to 2,000 Windows endpoints without manually touching each machine. The organization already uses Microsoft Configuration Manager (SCCM) and Microsoft Intune for software deployment. Which approach best fits the planning requirement?

Accepted Answer

Use SCCM and Intune to package and push the Cortex XDR agent installer to the managed endpoints. The organization already uses SCCM and Intune, which are designed for large-scale, auditable software deployment. Packaging the Cortex XDR agent installer with those tools lets the administrator push it to all managed Windows endpoints, track installation status, and retry failures. Manual or user-driven methods are unreliable and cannot scale to 2,000 endpoints, and the agent has no self-install capability.

Answer

Wait for the Cortex XDR agent to self-install automatically on endpoints that check in to the console

Answer

Deploy the Cortex XDR agent by emailing the installer to each end user and asking them to run it manually

Answer

Ask each department to download the installer from the Cortex XDR console and install it on their own machines

Question 7

An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM is the component that serves as a local communication proxy and log collector for remote agents deployed outside the corporate network. It acts as an intermediary between endpoints and the Cortex XDR cloud, buffering logs and forwarding them securely. This is essential when endpoints cannot directly reach the cloud due to network restrictions or when you want to reduce egress traffic.

Answer

Panther Agent Gateway

Answer

Cortex XDR Agent Collector Service

Answer

Panorama Log Forwarding App

Question 8

During the raw-alert-to-incident lifecycle, an alert is generated by a custom BIOC (Behavioral Indicator of Compromise). At what point does this raw alert transition into an actionable incident?

Accepted Answer

Immediately upon correlation and grouping by the Incident Engine. When a raw alert triggers, Cortex XDR evaluates it against existing open incidents or creates a new incident based on correlation and stitching logic, moving it into the Incident View.

Answer

Only after an analyst manually assigns a severity score

Answer

Once featured fields are populated for the data source

Answer

When the alert is starred by a tier-2 analyst

Question 9

Which THREE key identity-based threat behaviors are typically detected and flagged by Cortex XDR Identity Analytics? (Choose three)

Accepted Answer

Abnormal privilege escalation or group membership changes. Cortex XDR Identity Analytics baselines identity activity and flags deviations such as Option A, abnormal privilege escalation or group membership changes, because adding accounts to privileged groups or elevating rights is a classic attacker persistence and lateral-movement technique that the analytics engine correlates against normal role behavior. Option B, password spray and brute-force attempts, is detected because Identity Analytics ingests authentication telemetry and identifies repeated failed logons across many accounts or high-volume credential guessing patterns indicative of credential attacks. Option E, impossible travel sign-ins, is flagged because the engine correlates sign-in geolocation and timestamps to detect physically impossible authentication sequences that suggest compromised credentials or session hijacking. Option C does not belong because corrupted sector errors on mechanical hard drives are a hardware/storage reliability issue, not an identity behavior, and Option D does not belong because standard browser bookmark synchronization is benign user activity with no identity threat relevance.

Answer

Corrupted sector errors on mechanical hard drives

Answer

Standard browser bookmark synchronization

Question 10

An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?

Accepted Answer

Create an alert exclusion or exception rule. When legitimate administrative scripts repeatedly trigger low-level behavioral alerts, the correct lifecycle action is to create an alert exclusion or exception rule that suppresses those specific alerts based on defined criteria. This prevents the noise from cluttering the incident queue while preserving detection for genuinely malicious script behavior. Exclusions are the standard mechanism for tuning out known-benign activity without disabling the underlying detection logic entirely.

Answer

Manually star all related alerts

Answer

Increase the data stitching window

Answer

Modify featured fields to hide script alerts

Question 11

During an ITDR investigation, an analyst observes that a service account authenticated to a domain controller and then created a new computer object. The analyst wants to determine whether this is a known attack technique involving directory object manipulation. Which Cortex XDR analytic or rule category is MOST relevant to this behavior?

Accepted Answer

Behavioral Indicators of Compromise (BIOCs) focused on Active Directory object creation and modification.. Behavioral Indicators of Compromise are the analytic category built to detect sequences of suspicious actions, including directory object creation and modification by accounts that should not perform them. Because the scenario involves an authenticated service account performing an unusual directory operation, a BIOC provides the technique-level visibility needed. Static IOCs, prevention profiles, and vulnerability scans address different layers and would not classify this behavior as an identity attack technique.

Answer

Indicators of Compromise (IOCs) based on known malicious file hashes and domains.

Answer

Vulnerability assessment scans that identify missing patches on domain controllers.

Answer

Custom prevention profiles that block specific executables from running on domain controllers.

Question 12

When sorting incidents in the Cortex XDR console to find the most severe threats first, which attribute is most commonly used?

Accepted Answer

Incident Score / Severity. The Incident Score (also surfaced as Severity) is the primary numeric attribute used to rank incidents by threat severity in Cortex XDR. Sorting the Incident View by Incident Score descending brings the highest-risk incidents to the top, which is the standard triage workflow. It aggregates alert severity, asset criticality, and other weighted factors into a single comparable value.

Answer

Data stitching identifier

Answer

Featured field display order

Answer

Agent version number

Question 13

An analyst reviewing a Cortex XDR identity incident sees that a user's account successfully authenticated from an unfamiliar ASN at 02:00, immediately followed by creation of a new mail forwarding rule and a password reset. The user confirms they were asleep and did not perform these actions. Which conclusion and immediate priority are most appropriate?

Accepted Answer

The account is compromised with confirmed attacker control, so the priority is to revoke sessions, reset credentials, and remove the malicious forwarding rule.. When a user denies activity that matches a coherent attack sequence, the account should be treated as compromised. The unfamiliar-ASN sign-in, malicious mail forwarding rule, and attacker-initiated password reset together indicate both persistent access and data exfiltration. Containment must revoke sessions, reset credentials, and remove the forwarding rule, because addressing only one element leaves the attacker a path back in or a channel to continue stealing mail.

Answer

The password reset indicates the user regained control, so the priority is to close the incident and monitor for recurrence.

Answer

The events are likely a synchronization error between the identity provider and Cortex XDR, so the priority is to reingest the logs and recheck.

Answer

The mail forwarding rule is the only malicious element, so the priority is to delete the rule and take no further containment action.

Question 14

While reviewing an incident involving suspicious lateral movement, an analyst notices that an adversary utilized compromised service account credentials. The analyst wants to use Cortex XDR response actions to immediately contain the threat without shutting down the entire domain controller. Which ITDR-related action can be executed directly from the Cortex XDR console for a compromised user account?

Accepted Answer

Disable User Account or Force Password Reset via Active Directory integration. Cortex XDR's Active Directory integration enables ITDR (Identity Threat Detection and Response) response actions directly from the console, including Disable User Account and Force Password Reset. These actions target the compromised identity itself, immediately neutralizing the adversary's ability to authenticate or use the stolen credentials without disrupting the domain controller or other users. This is the correct ITDR-aligned containment action for a compromised user account.

Answer

Revoke Kerberos TGT and purge DNS cache on the domain controller

Answer

Blacklist the user SID in the local Windows firewall

Answer

Isolate Endpoint via the XDR network containment feature

Question 15

An analyst is reviewing a raw alert that was generated by Cortex XDR analytics. The alert indicates suspicious behavior, but no incident was created. What is the most likely explanation?

Accepted Answer

The raw alert did not meet the threshold for incident creation or was grouped into an existing incident. Analytics generate raw alerts, but an alert must meet specific correlation thresholds or aggregation criteria before an incident is spawned, or it may have been grouped into an existing incident.

Answer

Featured fields were disabled for the analytic detector

Answer

The alert was automatically starred, preventing incident promotion

Answer

Data stitching was turned off globally

Question 16

When reviewing the Incident View, an analyst notices an incident with an orange severity badge. What does this severity level typically indicate in Cortex XDR?

Accepted Answer

High severity incident. Cortex XDR uses standard severity levels (Low, Medium, High, Critical) represented by color-coded badges, where orange typically denotes High severity.

Answer

Critical severity incident requiring immediate containment

Answer

Low priority false positive

Answer

Informational event requiring no action

Question 17

An administrator is planning the deployment of Broker VM instances across a multi-site enterprise network. Which TWO best practices should be followed when planning Broker VM deployments?

Accepted Answer

Deploy Broker VM instances locally at remote sites or data centers to aggregate logs and reduce WAN bandwidth consumption. Option B is correct because deploying Broker VM instances locally at remote sites or data centers lets them aggregate and buffer logs close to the source, which reduces WAN bandwidth consumption and avoids sending raw telemetry across high-latency links. Option D is correct because Broker VM capacity is driven by throughput, so vCPU and RAM must be sized to the expected events-per-second (EPS) load to prevent dropped or delayed log forwarding. Option A is wrong because Broker VM is a server-side virtual appliance, not software installed on Windows 10 Pro workstations. Option C is wrong because the Broker VM is not designed as a permanent seven-year log archive; long-term retention belongs in the management console or a dedicated storage/SIEM repository. Option E is wrong because a single Broker VM cannot adequately serve 50,000 global endpoints over high-latency WAN links; multiple distributed instances are required for scale and locality.

Answer

Install the Broker VM directly on user workstations running Windows 10 Pro

Answer

Configure the Broker VM to store all enterprise log data locally on its virtual disk permanently for 7 years

Answer

Share a single Broker VM instance across 50,000 global endpoints separated by high-latency WAN links

Question 18

When planning a Cortex XDR deployment, an administrator must select the appropriate deployment method for endpoints. Which TWO methods are officially supported for mass-deploying the Cortex XDR agent across a Windows enterprise domain?

Accepted Answer

Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune using the .msi package. Option D is correct because Cortex XDR officially supports mass deployment on Windows domains through Microsoft Endpoint Configuration Manager (SCCM) or Microsoft Intune, distributing the provided .msi package via standard software-deployment mechanisms. Option E is correct because Active Directory Group Policy Object (GPO) Software Installation is a documented, supported method for pushing the Cortex XDR agent .msi to domain-joined Windows endpoints at scale. Option A is not a supported mass-deployment method, since email self-installation is unreliable, unmanaged, and not an official enterprise deployment channel. Option B is not viable for mass deployment because manually visiting each workstation with a USB drive is unscalable and not an officially supported automated method. Option C is not acceptable because broadcasting binaries over unauthenticated public FTP servers is insecure and not a supported Cortex XDR deployment method.

Answer

Sending the installer executable as an email attachment to all employees with instructions to self-install

Answer

Manually walking to every workstation with a USB flash drive to execute the GUI installer interactively

Answer

Broadcasting the installer binary over unauthenticated public FTP servers

Question 19

An analyst is triaging a Cortex XDR incident that contains a mix of high and low severity alerts. The analyst wants to quickly identify which alerts are most critical to address first. Which column in the Incident View's Alerts tab should the analyst sort by to prioritize alerts based on their potential impact?

Accepted Answer

Severity. The Severity column provides a quick, at-a-glance indication of how critical each alert is. By sorting descending on Severity, the analyst can immediately see and address the most severe alerts first, ensuring that high-impact threats are handled promptly. This aligns with standard triage practices of focusing on the highest risk items.

Answer

Timestamp

Answer

Alert Name

Answer

Endpoint Name

Question 20

A Cortex XDR analyst is building an ITDR detection strategy for an environment using Microsoft Entra ID and on-premises Active Directory. The analyst wants to identify identity-based attacks that span both cloud and on-premises authentication. Which TWO Cortex XDR data sources provide the authentication telemetry needed to correlate cloud sign-ins with on-premises logons? (Choose two.)

Accepted Answer

Microsoft Entra ID sign-in and audit logs ingested via the Cortex XDR cloud identity connector.. Correlating cloud and on-premises identity attacks requires authentication telemetry from both planes. Entra ID sign-in and audit logs provide cloud authentication context, while domain controller Windows Security logs provide Kerberos, NTLM, and logon events. Together they let Cortex XDR link a cloud sign-in to an on-premises logon and expose hybrid attacks such as password spray or token theft spanning both environments.

Answer

DNS query logs from internal resolvers, including queries for external domains.

Answer

Endpoint process execution logs from user workstations, including command-line arguments.

Answer

Firewall traffic logs showing outbound connections to known malicious IP addresses.