XDR-Analyst Practice Test 2 — 30 Questions

Question 1

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cross-data-source data stitching. Cross-data-source data stitching is the Cortex XDR mechanism that correlates alerts and events from different telemetry sources (XDR agents, third-party firewalls, cloud logs) into a single unified incident. It links entities like IPs, hostnames, and users across sources so that a firewall alert and an endpoint alert about the same attack are presented as one incident rather than separate alerts.

Answer

Automated alert starring

Answer

Incident score weighting tables

Answer

Featured fields column mapping

Question 2

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Accepted Answer

New. Option A, New, is correct because a newly generated incident in Cortex XDR begins in the New state, which is the initial stage of the standard incident lifecycle before any analyst action is taken. Option D, Under Investigation, is correct because once an analyst begins working an incident, it moves to the Under Investigation state, which is a defined stage in the standard lifecycle. The remaining options do not belong: Featured and Starred are not lifecycle states but rather UI flags or filters used to mark or prioritize incidents for quick access, and Stitched refers to the stitching of related alerts/causality events into an incident, not a lifecycle state.

Answer

Featured

Answer

Starred

Answer

Stitched

Question 3

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

Accepted Answer

Under the Incident Details page by selecting the Alerts tab. By drilling down into an incident in Cortex XDR, the analyst can access the Alert tab to inspect the individual raw alerts that make up the incident lineage.

Answer

Under Analytics > BIOC > Alert Log

Answer

Under Response > Action Center > History

Answer

Under Settings > Data Stitching > Raw Logs

Question 4

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

Accepted Answer

Configure exclusions for the vulnerability scanner's IP addresses or signature patterns. Creating exclusion rules for scanner IP addresses or signatures ensures vulnerability assessment traffic does not trigger security incidents.

Answer

Enable featured fields to hide scanner columns

Answer

Turn off data stitching across all internal subnets

Answer

Star all alerts generated during scanning windows

Question 5

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Accepted Answer

Verify the digital signature and publisher of the application. Safe exception implementation involves validating binary integrity, verifying legitimate paths, and testing prior to global deployment.

Answer

Disable all Cortex XDR agent security modules across the entire enterprise

Answer

Remove all file access permissions from the operating system kernel

Question 6

An analyst is investigating a security incident and needs to review the timeline of events that occurred on a compromised endpoint. The analyst wants to see a chronological list of all alerts, process executions, and network connections related to the incident. Which Cortex XDR view should the analyst use?

Accepted Answer

Incident Details page. The Incident Details page is specifically designed to present all relevant information for an incident in one place, including a chronological timeline of alerts, process executions, and network connections. This allows the analyst to quickly understand the sequence of events without manual querying. Other options serve different purposes such as endpoint management, threat intelligence, or custom querying.

Answer

Endpoint Management console

Answer

Threat Intelligence module

Answer

XQL Query Center

Question 7

An administrator is planning a Cortex XDR deployment across multiple sites, including a remote office with limited internet bandwidth. The administrator wants to minimize WAN traffic for agent updates and threat intelligence lookups. Which Cortex XDR component should be deployed at the remote office to achieve this?

Accepted Answer

Broker VM. A Broker VM deployed at the remote office can cache content updates and threat intelligence, serving them to local endpoints. This reduces WAN traffic because endpoints retrieve updates from the Broker VM instead of the cloud. The management console and Cortex Data Lake are cloud-based and do not provide local caching. Agent local caching does not exist as a feature for sharing updates.

Answer

Cortex XDR agent with local caching enabled

Answer

Cortex Data Lake

Answer

Cortex XDR management console

Question 8

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Accepted Answer

Directory Service Access and LDAP query event logs from Domain Controllers (such as Event ID 4662). BloodHound enumerates Active Directory by issuing LDAP queries and accessing directory service objects, which generates Directory Service Access events on domain controllers, including Event ID 4662. Cortex XDR can ingest these Domain Controller event logs to detect the enumeration patterns characteristic of BloodHound reconnaissance.

Answer

Network interface duplex settings

Answer

USB device connection history

Answer

Browser extension inventory reports

Question 9

A Cortex XDR analyst is building an identity threat detection strategy for a hybrid environment with on-premises Active Directory and cloud identity. Which TWO telemetry sources should the analyst prioritize ingesting to detect credential abuse and anomalous authentication across both environments? (Choose two.)

Accepted Answer

Windows Security event logs from domain controllers, including authentication and Kerberos events.. Effective hybrid identity threat detection requires visibility into both authentication authorities. Domain controller security logs expose on-premises Kerberos and logon behavior, while cloud identity provider sign-in and audit logs expose cloud authentication and directory changes. Together they let Cortex XDR baseline and correlate identity behavior across environments. Network, DHCP, and print logs lack the credential and authentication context needed for identity-focused detection.

Answer

Endpoint firewall connection logs recording outbound TCP and UDP flows from user workstations.

Answer

Print server spooler logs capturing document names and submitting user accounts.

Answer

DHCP lease logs from the internal network recording IP address assignments to endpoints.

Question 10

An administrator is planning to install Cortex XDR agents on a large fleet of Windows endpoints and wants to ensure the installation can proceed without manual intervention on each host. Which approach best supports a silent, unattended installation?

Accepted Answer

Deploy the agent MSI package with the installation token supplied as a command-line parameter through a software distribution tool.. Silent, unattended installation on Windows is achieved by distributing the agent MSI through a software deployment tool and passing the installation token as a command-line parameter. This lets each host register automatically with the tenant without interactive input, which is essential for large-scale rollouts.

Answer

Run the agent installer interactively on each endpoint and paste the installation token when prompted.

Answer

Install the agent without a token and rely on the cloud tenant to auto-assign the endpoint to a default policy.

Answer

Copy the agent installer to a network share and instruct users to double-click it from their desktops.

Question 11

When analyzing a complex multi-stage attack in Cortex XDR, an analyst examines the Causality Chain. How does the Causality Chain assist in understanding the raw-alert-to-incident lifecycle?

Accepted Answer

It traces the parent-child process relationship and telemetry leading to the alert. The Causality Chain visualizes the chronological sequence of processes, network connections, and file modifications that led to an alert, helping trace the origin of the incident.

Answer

It automatically recalculates the incident score based on user activity

Answer

It stitches network logs with endpoint logs using IP subnet masks

Answer

It filters featured fields to highlight malicious hashes

Question 12

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Accepted Answer

It maps the behaviors observed in the incident to known attacker tactics and techniques.. The MITRE ATT&CK tab in Cortex XDR incident details maps observed behaviors to the MITRE ATT&CK framework, which is a curated knowledge base of adversary tactics, techniques, and procedures (TTPs). This mapping helps analysts understand the attacker's intent, identify the stage of the attack lifecycle, and prioritize response actions. It provides context beyond raw alerts by categorizing activities like 'Credential Dumping' (T1003) or 'Spearphishing Attachment' (T1566), enabling faster triage and correlation with threat intelligence.

Answer

It provides network routing tables for the compromised subnet.

Answer

It automatically downloads security patches from vendor repositories.

Answer

It lists the hardware warranty status of the affected device.

Question 13

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

Accepted Answer

Network connection details including source, destination, port, and protocol. Network connection details including source, destination, port, and protocol is correct because an 'IP Connection' artifact in Cortex XDR represents a network connection event, capturing the source IP, destination IP, destination port, and protocol (e.g., TCP, UDP). This information is crucial for understanding command-and-control (C2) traffic, data exfiltration, or lateral movement. The artifact is generated from endpoint telemetry and provides context for the connection, such as the responsible process.

Answer

Software license expiration dates

Answer

Hardware temperature and fan speed metrics

Answer

Local user account password complexity settings

Question 14

What is the primary purpose of the Cortex XDR agent installation token (or installation password)?

Accepted Answer

To authenticate the agent installation and prevent unauthorized uninstallation or tampering. The Cortex XDR agent installation token authenticates the agent during installation and registration with the Cortex XDR tenant, and it also prevents unauthorized uninstallation or tampering by requiring the token for agent removal. This ensures only authorized endpoints join the tenant and that the agent cannot be easily disabled by malware or unauthorized users.

Answer

To license the endpoint for Palo Alto Networks Next-Generation Firewall features

Answer

To authenticate the agent against the local Active Directory domain controller

Answer

To encrypt all local agent SQLite databases at rest

Question 15

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Accepted Answer

The time delta between the endpoint and network events exceeds the stitching correlation window. Cortex XDR stitches alerts into incidents by correlating on shared featured fields (such as IP, user, hostname) within a defined time window. If the endpoint event and the network event occur too far apart in time, the correlation engine will not merge them, so they appear as separate incidents even though the IP and user match. The most likely cause is therefore that the time delta exceeds the stitching window.

Answer

The incident score was manually overridden to low

Answer

Alert starring was disabled on the network data source

Answer

Featured fields were not configured for the network logs

Question 16

An analyst is reviewing a Cortex XDR incident involving a suspicious PowerShell script that was executed on multiple endpoints. The analyst needs to gather evidence to determine the script's origin and impact. Which TWO actions should the analyst take to collect relevant evidence from the endpoints? (Choose two.)

Accepted Answer

Retrieve the PowerShell script file from the endpoints using the 'Retrieve File' action.. Retrieving the PowerShell script file provides direct evidence of its contents, while querying process execution events via XQL gives context about how and where it ran. Together, these actions allow the analyst to understand the script's origin, execution parameters, and impact across endpoints. The other options are either containment or detection measures that do not directly collect the needed evidence.

Answer

Initiate a full antivirus scan on the endpoints.

Answer

Isolate the endpoints from the network immediately.

Answer

Review the endpoints' Windows Event Logs for PowerShell operational events.

Question 17

An analyst is investigating a Cortex XDR incident and wants to correlate alerts from different endpoints that share the same file hash. The analyst needs to quickly find all other incidents that contain this hash to assess the scope of the campaign. Which Cortex XDR feature should the analyst use?

Accepted Answer

Incident Search with a filter on the file hash. Incident Search is the only feature that allows querying across all incidents using fields like file hash. By filtering on the hash, the analyst can identify every incident that includes that hash, thereby mapping the campaign's reach. Endpoint Search, Threat Intelligence Lookup, and Causality Chain do not provide cross-incident correlation by hash.

Answer

Endpoint Search for the file hash

Answer

Causality Chain view for the file hash

Answer

Threat Intelligence Lookup for the file hash

Question 18

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

Accepted Answer

Kill Process Tree. Kill Process Tree terminates the specified process and all of its child processes on the targeted endpoint, which is exactly what's needed to stop a malicious parent and its spawned children in one action. It's available directly from the Cortex XDR incident/endpoint view.

Answer

Retrieve File

Answer

Block File Hash

Answer

Isolate Endpoint

Question 19

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

Accepted Answer

Utilize asset criticality scoring profiles to elevate key asset visibility. Option D is correct because Cortex XDR lets administrators configure featured fields, which add custom columns to the Incident View so that specific metadata relevant to their environment is displayed directly in the incident grid. Option C is correct because asset criticality scoring profiles assign criticality values to assets, and this criticality metadata is surfaced in the Incident View to elevate the visibility of incidents involving key or high-value assets. Option A is incorrect because deleting inactive data collectors only removes unused collector entries and does not customize or enhance incident metadata visibility. Option B is incorrect because automatically starring every raw alert would simply flag all alerts indiscriminately and does not add or customize metadata columns in the Incident View. Option E is incorrect because data stitching rules determine how alerts are correlated into incidents, not how the incident grid is sorted or which metadata columns are shown.

Answer

Delete inactive data collectors to clear queue clutter

Answer

Enable automatic alert starring for every raw alert

Answer

Change data stitching rules to alter incident grid sorting

Question 20

An administrator is planning a Cortex XDR deployment and must choose the appropriate agent installation methods for a mix of Windows and macOS endpoints. The administrator wants to minimize manual effort and support remote users who are not on the corporate network. Which TWO installation methods should the administrator select? (Choose two.)

Accepted Answer

Distribute the agent installer via a software deployment tool such as Microsoft Endpoint Configuration Manager. Automated deployment through software deployment tools for Windows and MDM for macOS allows the administrator to install Cortex XDR agents at scale, including for remote users, without manual intervention. These methods ensure consistent configuration and central tracking, while manual or email-based approaches increase effort and risk.

Answer

Require users to download the agent from the Cortex XDR management console and install it themselves

Answer

Deploy the agent only to endpoints that are on the corporate network and postpone remote users

Answer

Send each user an email with the agent installer and installation token, asking them to run it manually