XDR-Analyst Practice Test 4 — 25 Questions

Question 1

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

Accepted Answer

Global Indicator Search / Threat Hunting. Enterprise scoping is accomplished using XQL search and global threat hunting tools.

Answer

Mouse pointer speed settings

Answer

Audio speaker volume mixer

Answer

Physical keyboard backlight color adjuster

Question 2

Which TWO actions can an analyst take when closing an incident in Cortex XDR? (Choose two)

Accepted Answer

Add resolution notes detailing remediation steps taken. Incidents can be closed with specific resolution statuses and closing notes to document the outcome.

Answer

Conduct an employee annual performance review meeting

Answer

Order replacement laptops for all company employees

Answer

Initiate a physical factory reset of the datacenter cooling system

Question 3

An analyst wants to create a robust incident response workflow in Cortex XDR that incorporates both manual analyst review and automated remediation. Which THREE capabilities support this integrated approach? (Choose three)

Accepted Answer

Incident Queue and manual triage tools for analyst review. Integrated workflows utilize incident management queues, automated response playbooks, and granular exception tuning.

Answer

Automated physical destruction of endpoint motherboard circuits

Answer

Manual replacement of physical office windows

Question 4

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

Accepted Answer

Comprehensive profile information including recent alerts, associated devices, and identity attributes. The User View in Cortex XDR aggregates user-centric data, including associated endpoints, active directory attributes, risk scores, and correlated alerts.

Answer

Real-time packet captures of the user's active browsing session

Answer

The hardware warranty status of endpoints assigned to the user

Answer

Group Policy Object (GPO) editing capabilities

Question 5

Which TWO actions are available to an analyst when managing an incident's assignment in Cortex XDR? (Choose two)

Accepted Answer

Assign the incident to a specific analyst user account. Incidents can be assigned to specific analysts or SOC user groups for investigation and accountability.

Answer

Update corporate stock market ticker symbols

Answer

Re-route office mail delivery to a new address

Answer

Change corporate office building security guard shifts

Question 6

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Accepted Answer

Windows Scheduled Tasks. Common endpoint persistence mechanisms include Run keys, scheduled tasks, and Windows services.

Answer

Office desk relocation requests

Answer

Breakroom coffee machine maintenance schedules

Question 7

An analyst discovers that a malicious payload communicated with an external Command and Control (C2) server. Which TWO evidence sources should the analyst review to identify the C2 communication details? (Choose two)

Accepted Answer

Network connection event logs (Destination IP, port, and connection duration). C2 communications are investigated using network connection telemetry and DNS request history logs.

Answer

Local office printer toner cartridge status

Answer

Employee parking permit registration forms

Answer

Corporate conference room booking calendars

Question 8

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

Accepted Answer

Incident Response > Alerts, filtering by Analytics category related to Identity. Cortex XDR consolidates identity-based threats and user behavior analytics within the Incident Response and Alerts views, specifically filtered by analytics categories such as compromised credentials.

Answer

Cloud > Posture > Identity

Answer

XQL Search > Identity_Raw schema

Answer

Endpoints > Agent Configurations > Identity

Question 9

An analyst is investigating a suspicious user account that accessed sensitive internal shares outside of normal business hours. Which Cortex XDR feature enables the analyst to review all actions taken by this user across endpoints and cloud services in a chronological timeline?

Accepted Answer

The Incident Storyline and User Timeline view. The Cortex XDR Incident View and User Timeline provide a chronological sequence of events and alerts associated with a specific user entity.

Answer

The Static File Analysis Report

Answer

The Network Packet Capture Utility

Answer

The Host Isolation Status page

Question 10

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

Accepted Answer

Incident Timeline / Causality view. Forensic data and file details are accessible via the File Details view and forensic collection reports.

Answer

Corporate gym membership roster

Answer

Cloud printer ink supply level gauge

Answer

Cafeteria food inventory management sheet

Question 11

Which TWO actions can be performed directly from the Cortex XDR Incident Details page when reviewing evidence? (Choose two)

Accepted Answer

Update incident status and assignment. The Incident Details page allows analysts to view alert timelines, examine artifacts, and change incident status.

Answer

Order office catering supplies for the team meeting

Answer

Schedule routine commercial window washing

Answer

Calibrate the office thermostat temperature

Question 12

Which TWO views in Cortex XDR are primarily used to monitor overall alert and incident status across the SOC? (Choose two)

Accepted Answer

Dashboards (providing high-level metrics and widget summaries). SOC monitoring dashboards and incident queues provide visibility into enterprise security status.

Answer

Commercial shipping logistics tracking application

Answer

Local operating system task manager

Answer

Office water cooler maintenance portal

Question 13

An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?

Accepted Answer

Target process name matching 'lsass.exe' with suspicious access rights from an unauthorized source process. LSASS credential dumping typically involves specific process open requests (e.g., OpenProcess with PROCESS_VM_READ or PROCESS_QUERY_LIMITED_INFORMATION) targeting lsass.exe.

Answer

Registry modifications affecting the Windows Firewall state

Answer

DNS query logs for newly registered domains

Answer

Outbound HTTPS connections to unknown external IP addresses on port 443

Question 14

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

Accepted Answer

The Cortex XDR Broker VM configured with the User-ID integration. The Cortex XDR Collector (or BIOC/agent mapping combined with Active Directory integration) requires the User-ID agent or Cortex XDR Agent visibility to sync identity metadata.

Answer

The Cortex XDR Network Traffic Analyzer

Answer

WildFire cloud analysis engine

Answer

The Cortex XSOAR Content Pack for Active Directory

Question 15

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Accepted Answer

Directory Service Access and LDAP query event logs from Domain Controllers (such as Event ID 4662). Active Directory enumeration involves LDAP queries (e.g., querying group memberships, ACLs) which are logged in Domain Controller Security Event logs or Directory Service event logs (Event ID 4662).

Answer

Network interface duplex settings

Answer

USB device connection history

Answer

Browser extension inventory reports

Question 16

Which TWO methods can an administrator use to ingest Active Directory logs into Cortex XDR?

Accepted Answer

Configuring forwarding of Windows Security Event logs via agent or syslog to Cortex XDR. Cortex XDR ingests AD logs primarily through the Cortex XDR Broker VM collecting Syslog/WMI or via direct integrations/agent log forwarding.

Answer

Printing logs to paper and scanning them via OCR

Answer

Connecting a USB flash drive directly to the Cortex XDR cloud tenant

Answer

Sending logs via consumer email attachments to support@paloaltonetworks.com

Question 17

Which TWO data sources can Cortex XDR leverage to build comprehensive user identity behavior profiles for ITDR? (Choose two)

Accepted Answer

Cloud Identity Provider authentication logs (e.g., Azure AD, Okta). Cortex XDR ITDR ingests telemetry from both on-premises Active Directory event logs and cloud Identity Providers (such as Azure AD/Entra ID or Okta) to establish complete user baselines.

Answer

Local printer configuration files

Answer

DHCP lease allocation tables

Answer

BIOS firmware version logs

Question 18

An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?

Accepted Answer

Settings > Configurations > Endpoint Settings > Install Packages. Installation packages and transform files are accessed via Settings > Configurations > Endpoint Settings > Install Packages in the Cortex XDR console.

Answer

Data Collector > Broker VM > Agent Packages

Answer

Incidents > Actions > Export Agent

Answer

Monitoring > System Health > Agent Distribution

Question 19

What is the primary purpose of the Cortex XDR agent installation token (or installation password)?

Accepted Answer

To authenticate the agent installation and prevent unauthorized uninstallation or tampering. Installation tokens/passwords protect the agent from unauthorized removal, tampering, or uninstallation by local end-users.

Answer

To license the endpoint for Palo Alto Networks Next-Generation Firewall features

Answer

To authenticate the agent against the local Active Directory domain controller

Answer

To encrypt all local agent SQLite databases at rest

Question 20

What is the primary purpose of integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR?

Accepted Answer

To provide visibility into cloud authentication events, sign-in anomalies, and identity risks in hybrid environments. Integrating cloud identity provider logs provides visibility into cloud-based authentications, conditional access failures, and SaaS app logins for comprehensive ITDR.

Answer

To replace the Cortex XDR Agent on Linux servers

Answer

To enforce local BIOS password policies

Answer

To automate the deployment of Windows security patches to endpoints