XDR-Analyst Practice Test 3 — 30 Questions

Question 1

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

Accepted Answer

It reduces alert fatigue by grouping related alerts into a single attack storyline.. Incident grouping correlates related alerts into a single incident based on causality and shared artifacts, reducing alert fatigue and providing a cohesive attack narrative.

Answer

It automatically upgrades endpoint operating system licenses.

Answer

It deletes duplicate log files to save storage space.

Answer

It provisions new virtual machines for containment.

Question 2

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

Accepted Answer

XQL Search querying registry event tables. XQL Search allows analysts to query registry modification events across the entire fleet of endpoints to hunt for persistence mechanisms.

Answer

Syslog server forwarding destination list

Answer

Cortex XDR Agent installation log

Answer

GlobalProtect client configuration wizard

Question 3

Which TWO automated or manual response actions can be executed directly on an endpoint from the Cortex XDR Incident Response toolbox? (Choose two)

Accepted Answer

Isolate Endpoint. Cortex XDR provides direct endpoint response capabilities such as endpoint isolation and file quarantine.

Answer

Upgrade BIOS firmware

Answer

Calibrate display resolution

Answer

Reimage Operating System kernel

Question 4

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

Accepted Answer

Network connection details including source, destination, port, and protocol. An IP connection artifact details network communication telemetry, including source IP, destination IP, port, and protocol used during the event.

Answer

Software license expiration dates

Answer

Hardware temperature and fan speed metrics

Answer

Local user account password complexity settings

Question 5

An analyst notices suspicious network connections originating from an unknown process on an endpoint. To block outbound communication for this process without isolating the entire host, what action can be taken?

Accepted Answer

Terminate the process and block its file hash or path. Network rules or process blocking actions in Cortex XDR can restrict malicious processes from communicating over the network while allowing normal OS operations.

Answer

Unplug the physical power cable from the workstation

Answer

Change the local monitor refresh rate

Answer

Reset the enterprise DNS root servers

Question 6

When reviewing identity alerts in Cortex XDR, which TWO anomalous behaviors might indicate compromised credentials? (Choose two)

Accepted Answer

Accessing sensitive resources outside normal working hours and baseline behavior. Identity analytics look for unusual access patterns such as impossible travel or abnormal login times.

Answer

Connecting a standard corporate wired Ethernet cable

Answer

Printing a standard business document to the local office printer

Answer

Routine login from the user's assigned office desktop during regular business hours

Question 7

An analyst is investigating an alert involving suspicious PowerShell execution. To thoroughly review the evidence, which THREE investigative steps should the analyst take within Cortex XDR? (Choose three)

Accepted Answer

Examine the exact command-line arguments passed to powershell.exe. PowerShell investigations require reviewing command-line arguments, parent process lineage, and spawned child processes or network connections.

Answer

Check the physical desk phone extension number of the user

Answer

Verify the physical building entry badge reader logs

Question 8

An analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?

Accepted Answer

Process execution telemetry from endpoint agents. BIOC rules for process execution evaluate endpoint telemetry data, specifically process creation events.

Answer

Cloud storage audit logs

Answer

Firewall URL filtering logs

Answer

DHCP lease tables

Question 9

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

Accepted Answer

The endpoint agent must be online and connected to receive the command.. Automated response playbooks require the Cortex XDR agent to be actively connected and online to receive and execute commands such as isolation or file quarantine.

Answer

The user must manually approve every automated step in the playbook.

Answer

The endpoint must have local administrative privileges disabled.

Answer

The endpoint must be running a legacy operating system without secure boot.

Question 10

When an endpoint is isolated during an incident response action in Cortex XDR, which TWO types of network traffic are generally permitted to ensure continued management and minimal disruption? (Choose two)

Accepted Answer

Communication channel between the Cortex XDR agent and the management server. Endpoint isolation blocks general network traffic while permitting communication with the Cortex XDR server and essential domain services if configured.

Answer

Unrestricted peer-to-peer torrent file sharing traffic

Answer

Personal social media video streaming broadcasts

Answer

Public online gaming multiplayer connections

Question 11

Which TWO forensic logs or artifacts are most valuable when investigating a suspected ransomware attack on an endpoint? (Choose two)

Accepted Answer

File system activity logs showing rapid mass file modifications or extensions. Ransomware investigations rely heavily on file activity logs (mass modifications/renaming) and volume shadow copy deletion logs.

Answer

Visitor badge sign-in sheets

Answer

Cafeteria menu rotation schedules

Answer

Office desk assignment floor plans

Question 12

Which TWO details are typically reviewed when inspecting an alert in the Cortex XDR Incident Viewer? (Choose two)

Accepted Answer

Timestamp of when the event occurred. Alert inspection involves reviewing detection descriptions, timestamps, affected hosts, and associated MITRE mappings.

Answer

Local cafeteria lunch receipt totals

Answer

Corporate travel booking itineraries

Answer

Office building parking garage gate codes

Question 13

Which THREE key components or features in Cortex XDR contribute directly to identifying and investigating compromised user credentials?

Accepted Answer

Alert Grouping and Correlation engine. User Behavior Analytics (UBA), Incident View/User Timeline, and BIOC/Analytics alert correlation are core components for investigating compromised credentials.

Answer

Hardware Asset Warranty Tracker

Answer

Network QoS Bandwidth Profiler

Question 14

When reviewing identity analytics alerts in Cortex XDR, which THREE behavioral anomalies are typically flagged by the UBA engine as potential indicators of a compromised account?

Accepted Answer

Abnormal volume of data access or file downloads compared to peer group baselines. UBA flags impossible travel, abnormal access times (after hours), and unusual access to sensitive resources or file shares outside a user's normal peer group baseline.

Answer

Using a standard QWERTY keyboard layout

Answer

Connecting an Ethernet cable into port 1 of a switch

Question 15

Which TWO details does the Cortex XDR Incident Graph display during evidence review? (Choose two)

Accepted Answer

Key attack entities such as suspicious files, IP addresses, and user accounts. The Incident Graph visually maps relationships between alerts, endpoints, users, and files involved in an incident.

Answer

Corporate parking lot lighting schedules

Answer

Office desk chair ergonomic adjustment instructions

Answer

Breakroom microwave operational wattage ratings

Question 16

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

Accepted Answer

Global Indicator Search / Threat Hunting. Enterprise scoping is accomplished using XQL search and global threat hunting tools.

Answer

Mouse pointer speed settings

Answer

Audio speaker volume mixer

Answer

Physical keyboard backlight color adjuster

Question 17

Which TWO actions can an analyst take when closing an incident in Cortex XDR? (Choose two)

Accepted Answer

Add resolution notes detailing remediation steps taken. Incidents can be closed with specific resolution statuses and closing notes to document the outcome.

Answer

Conduct an employee annual performance review meeting

Answer

Order replacement laptops for all company employees

Answer

Initiate a physical factory reset of the datacenter cooling system

Question 18

An analyst wants to create a robust incident response workflow in Cortex XDR that incorporates both manual analyst review and automated remediation. Which THREE capabilities support this integrated approach? (Choose three)

Accepted Answer

Incident Queue and manual triage tools for analyst review. Integrated workflows utilize incident management queues, automated response playbooks, and granular exception tuning.

Answer

Automated physical destruction of endpoint motherboard circuits

Answer

Manual replacement of physical office windows

Question 19

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

Accepted Answer

Comprehensive profile information including recent alerts, associated devices, and identity attributes. The User View in Cortex XDR aggregates user-centric data, including associated endpoints, active directory attributes, risk scores, and correlated alerts.

Answer

Real-time packet captures of the user's active browsing session

Answer

The hardware warranty status of endpoints assigned to the user

Answer

Group Policy Object (GPO) editing capabilities

Question 20

Which TWO actions are available to an analyst when managing an incident's assignment in Cortex XDR? (Choose two)

Accepted Answer

Assign the incident to a specific analyst user account. Incidents can be assigned to specific analysts or SOC user groups for investigation and accountability.

Answer

Update corporate stock market ticker symbols

Answer

Re-route office mail delivery to a new address

Answer

Change corporate office building security guard shifts