XDR-Analyst Practice Test 2 — 30 Questions

Question 1

An analyst is reviewing the Incidents page in Cortex XDR and wants to quickly highlight a critical ransomware incident so that the shift supervisor can review it immediately without changing its status. Which feature should the analyst use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Alert starring. Analysts use alert or incident starring to flag items of interest for review, handover, or collaboration during triage.

Answer

Severity override

Answer

Incident assignment

Answer

Featured fields configuration

Question 2

An analyst wants to prevent Cortex XDR from generating alerts on a specific signature-based detection (such as a known vulnerability scanner tool) across a specific endpoint group. Where should this exclusion be created?

Accepted Answer

Exceptions settings page, scoping the rule to the target endpoint group. Exceptions in Cortex XDR can be scoped to specific agent groups and detection types via the Exceptions management interface.

Answer

In the individual user's operating system environment variables

Answer

By modifying the BIOS firmware on the endpoint group

Answer

Through the global firewall packet filter configuration

Question 3

An enterprise wants to ensure that all incidents with a score above 80 are automatically escalated and assigned to a Tier-3 incident response queue. Where should an administrator configure this routing logic?

Accepted Answer

Incident assignment and automation rules. Automation and response rules in Cortex XDR (such as BIOC/XQL-based automation or incident assignment rules) allow routing based on score thresholds.

Answer

Data stitching parameter settings

Answer

Featured fields display configuration

Answer

Alert starring policies

Question 4

An analyst is investigating an incident and needs to determine whether lateral movement occurred between two endpoints. Which Cortex XDR feature provides the visual connection between these assets within the incident?

Accepted Answer

The Incident Graph and Causality Chain. The Causality Chain and Incident Graph provide visual representations of how threats move between processes, hosts, and networks during an attack.

Answer

The Data Stitching status indicator

Answer

The Alert Starring bookmark manager

Answer

The Featured Fields configuration panel

Question 5

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

Accepted Answer

Utilize asset criticality scoring profiles to elevate key asset visibility. Administrators can configure featured fields to display custom columns and apply scoring profiles to highlight high-priority assets.

Answer

Delete inactive data collectors to clear queue clutter

Answer

Enable automatic alert starring for every raw alert

Answer

Change data stitching rules to alter incident grid sorting

Question 6

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

Accepted Answer

Identity and authentication logs. Log data containing IP addresses, user agent strings, and geo-location metadata provides the source of truth for identity analytics and impossible travel alerts.

Answer

Network packet capture (PCAP)

Answer

Master Boot Record (MBR) analysis

Answer

Endpoint memory dump

Question 7

Which TWO actions can an analyst perform to manage and highlight specific findings during an incident investigation in Cortex XDR? (Choose two)

Accepted Answer

Star individual alerts within the incident details pane. Analysts can star individual alerts within an incident and star the overall incident to highlight and track them effectively.

Answer

Modify the data stitching window for the alert

Answer

Create a new featured field column for every raw alert

Answer

Delete raw alerts to recalculate the incident score

Question 8

What THREE conditions can cause data stitching failures between network logs and endpoint telemetry in Cortex XDR? (Choose three)

Accepted Answer

Significant time skew or clock desynchronization between data sources. Data stitching can fail due to clock desynchronization, missing or unmapped user/IP identifiers, or events falling outside the correlation time window.

Answer

Starring the endpoint alerts during triage

Answer

Enabling featured fields for the network log source

Question 9

What THREE criteria are evaluated by Cortex XDR when determining whether incoming raw alerts should be grouped into an existing incident or spawn a new one? (Choose three)

Accepted Answer

Common affected entities such as hostnames or user accounts. Alert grouping is determined by shared indicators of compromise (IOCs), common affected entities (hosts/users), and temporal proximity.

Answer

Whether the previous alerts were starred by an analyst

Answer

The presence of custom featured fields in the table view

Question 10

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Accepted Answer

New. Standard incident lifecycle statuses in Cortex XDR include 'New', 'Under Investigation', 'Resolved', and 'Closed'.

Answer

Featured

Answer

Starred

Answer

Stitched

Question 11

Which TWO actions can an administrator take to tune incident scoring for high-value assets? (Choose two)

Accepted Answer

Assign assets to high criticality groups. Administrators can adjust asset criticality groups and configure scoring profiles to ensure high-value assets receive appropriate severity weights.

Answer

Enable automatic starring for all alerts on those assets

Answer

Adjust the global data stitching window

Answer

Create featured fields to display asset scores

Question 12

When managing the alert lifecycle in Cortex XDR, analysts can perform various triage and prioritization tasks. Which THREE features or options are available to analysts when managing active incidents and alerts? (Choose three)

Accepted Answer

Updating the incident status (e.g., New, Under Investigation, Resolved).. Analysts can manage active incidents through assignment, starring, status updates, and severity adjustments.

Answer

Directly modifying the core machine learning algorithm weights of the Global Protect cloud service.

Answer

Writing raw kernel-level driver code to replace the endpoint prevention engine.

Question 13

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

Accepted Answer

Update the incident status (e.g., New to Under Investigation). Analysts can change incident statuses and assign ownership directly from the Incident View.

Answer

Build global dashboard metric widgets

Answer

Install Cortex XDR agents on remote endpoints

Answer

Configure custom data stitching parser scripts

Question 14

During an investigation of an advanced persistent threat, an analyst wants to customize the Incident View layout to ensure that custom fields populated via parsed log ingestion are prominently displayed at the top of every incident summary. How should the analyst achieve this?

Accepted Answer

By modifying the Incident Layout via Settings > Configurations > Incident View > Featured Fields. Cortex XDR allows administrators to configure featured fields to determine which data points appear prominently in the incident summary and table columns.

Answer

By creating a custom BIOC rule with output variables mapped to incident tags

Answer

By exporting the incident JSON schema and modifying the UI template mapping

Answer

By editing the Incident Scoring configuration file via the CLI

Question 15

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

Accepted Answer

Causality Chain. The Causality Chain in Cortex XDR provides a graphical representation of the process tree, showing the chronological sequence of events, parent-child process relationships, and associated artifacts that led to an execution.

Answer

Action Center

Answer

Audit Log

Answer

BIOC Rules Manager

Question 16

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Accepted Answer

It maps the behaviors observed in the incident to known attacker tactics and techniques.. The MITRE ATT&CK tab maps detected tactics and techniques to the standard framework, helping analysts understand attacker behavior and TTPs.

Answer

It provides network routing tables for the compromised subnet.

Answer

It automatically downloads security patches from vendor repositories.

Answer

It lists the hardware warranty status of the affected device.

Question 17

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

Accepted Answer

The agent maintains a dedicated management communication channel to the Cortex XDR server while blocking other network traffic.. Endpoint isolation blocks all general network traffic while maintaining a secure, dedicated management channel between the Cortex XDR agent and the backend server.

Answer

The host switches to a backup dial-up modem connection.

Answer

All network traffic is routed through an open public proxy server.

Answer

The host disables its TCP/IP stack entirely.

Question 18

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

Accepted Answer

Process execution telemetry showing WmiPrvSE.exe spawning child processes. WMI activity generates specific process execution and WMI event consumer telemetry logs.

Answer

Bluetooth peripheral pairing histories

Answer

Local monitor color calibration profiles

Answer

Desktop wallpaper image file paths

Question 19

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

Accepted Answer

Remediate Action (Cleanup). Remediation in Cortex XDR can automatically clean up artifacts such as created files, registry modifications, and processes associated with a malicious execution.

Answer

DNS Flushing

Answer

DHCP Lease Renewal

Answer

Static Route Addition

Question 20

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

Accepted Answer

Run an XQL Search querying the dataset for the specific file_sha256 value.. XQL Search allows analysts to query dataset tables such as xdr_data using the file_sha256 field to hunt for presence across all onboarded endpoints.

Answer

Review the Global Protect gateway traffic logs for file downloads.

Answer

Create a new BIOC rule and wait for the file to be executed again.

Answer

Export the Windows Event logs from a single machine and compare manually.