XDR-Analyst Practice Test 3 — 10 Questions

Question 1

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

Accepted Answer

To determine how the attacker established persistence on the system. Attackers frequently use scheduled tasks for persistence, allowing malicious code or scripts to run automatically at specific times or system events.

Answer

To verify the hardware specifications of the endpoint

Answer

To analyze the local user group membership policies

Answer

To inspect the network throughput limits of the adapter

Question 2

An analyst investigating a ransomware incident on a Windows endpoint needs to determine which process originally created the malicious executable that was later detected. The analyst opens the Cortex XDR Causality Chain view for the alert. Which element of the Causality Chain directly identifies the parent process responsible for spawning the malicious file?

Accepted Answer

The immediate ancestor node connected directly above the malicious process node in the causality chain graph.. The Causality Chain in Cortex XDR is a process lineage graph in which every node links back to the process that spawned it. The node immediately above the malicious process is therefore its direct parent, the process that actually created and launched the executable. Examining that ancestor's image path, command line, and user gives the analyst the concrete origin of execution, which is the correct evidence to pursue.

Answer

The alert severity indicator attached to the malicious process node, which reflects how the parent process was classified.

Answer

The WildFire verdict shown alongside the file hash, which records the process that submitted the sample for analysis.

Answer

The root node at the top of the causality chain, which represents the earliest observed process in the chain of execution.

Question 3

An administrator is setting up syslog log collection on a Broker VM. By default, which UDP and TCP port does the Broker VM Syslog collector listen on for incoming syslog messages from network devices?

Accepted Answer

TCP/UDP port 514. By default, standard syslog collection listens on TCP/UDP port 514, though configurable in the Broker VM app settings.

Answer

TCP port 636 for secure LDAP syslog

Answer

UDP port 123 for Network Time Protocol

Answer

TCP port 8080 for HTTP forwarding

Question 4

An analyst is reviewing a Cortex XDR alert for a suspicious PowerShell script that was executed on a Windows endpoint. The analyst wants to gather additional context about the script's execution. Which TWO data sources are available directly in the Cortex XDR alert details to help understand the script's behavior? (Choose two.)

Accepted Answer

Network connections initiated by the process. The alert details in Cortex XDR provide process execution details and network connections associated with the process. These allow the analyst to see how the script was launched and whether it communicated externally. Memory dumps, registry modifications, and user login history are not standard data sources directly available in the alert details for a specific process, making them incorrect choices.

Answer

Full memory dump of the PowerShell process

Answer

Windows Registry modifications made by the script

Answer

User login history for the account that executed the script

Question 5

An administrator is designing a Cortex XDR deployment for a company with a main data center and a remote branch office connected by a low-bandwidth WAN link. The branch has 200 endpoints that must remain manageable even if the WAN link fails temporarily. Which deployment consideration best supports this requirement?

Accepted Answer

Deploy a Broker VM at the branch office to localize agent communication and buffer traffic during WAN outages.. Placing a Broker VM at the branch localizes agent communication and provides a local point of presence that keeps endpoints functional and manageable even when the WAN link is unavailable. This architecture reduces bandwidth pressure and adds resilience, which is precisely what a low-bandwidth, occasionally disconnected branch office requires.

Answer

Configure all branch agents to connect directly to the cloud over the WAN link without any local component.

Answer

Install agents only on data center servers and leave branch endpoints unprotected to conserve bandwidth.

Answer

Increase the WAN link capacity and rely on that alone to keep branch agents connected during outages.

Question 6

You are configuring integration between Cortex XDR and an external Identity Provider (IdP) to ingest user authentication logs for ITDR. Which component is primarily responsible for securely forwarding these IdP telemetry logs to the Cortex XDR data lake?

Accepted Answer

The Cortex XDR Broker VM configured with the appropriate log forwarding profile. The Cortex XDR Collector or Broker VM is used to ingest syslog, HTTP event collector streams, or API-based logs from external IdPs into the Cortex data lake.

Answer

The Traps management service daemon

Answer

The WildFire cloud analysis cluster

Answer

The Cortex XDR Agent installed on domain controllers

Question 7

When responding to a malware alert, an analyst decides to quarantine the offending file. Which TWO outcomes occur when Cortex XDR performs a file quarantine? (Choose two)

Accepted Answer

Running processes associated with the file are terminated.. Quarantine terminates the running process instance (if applicable) and moves the file binary from its original path to a secure, encrypted quarantine location on the endpoint.

Answer

All network routers in the enterprise data center are reset.

Answer

The computer's power supply unit is permanently disabled.

Answer

The endpoint operating system hard drive is physically wiped clean.

Question 8

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

Accepted Answer

Incident Timeline / Causality view. Option A, the Incident Timeline / Causality view, is correct because in Cortex XDR this view reconstructs the sequence of events (process execution, network connections, file writes, registry changes) around an alert, letting analysts trace the root cause and forensic artifacts collected from the endpoint. Option C, the File Details / Forensic File Collection view, is correct because it exposes the actual collected forensic artifacts such as quarantined files, hashes, and file metadata retrieved from the endpoint during an investigation. The remaining options (B, D, and E) are unrelated administrative or facilities records and have no role in Cortex XDR forensic artifact analysis.

Answer

Corporate gym membership roster

Answer

Cloud printer ink supply level gauge

Answer

Cafeteria food inventory management sheet

Question 9

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

Accepted Answer

Isolate Endpoint. Isolate Endpoint allows an administrator to sever the network connection of a compromised host while retaining Cortex XDR agent communication and administrative troubleshooting access.

Answer

Disable User

Answer

Kill Process Tree

Answer

Quarantine File

Question 10

A Cortex XDR analyst is examining an alert where a user account successfully authenticated from two different countries within a 10-minute window. The analyst suspects impossible travel. Which Cortex XDR feature would provide a visual representation of the user's login locations and times to confirm this?

Accepted Answer

User View timeline. User View in Cortex XDR provides a consolidated timeline of user activities, including authentication events with geographic locations and timestamps. This feature enables analysts to visualize login patterns and quickly identify impossible travel by showing the sequence of logins from disparate locations within a short timeframe, confirming the anomaly.

Answer

Endpoint device control audit

Answer

Network traffic flow analysis

Answer

Incident Response Playbook execution log