XDR-Analyst Practice Test 3 — 30 Questions

Question 1

An organization requires that specific custom threat intelligence tags appear as primary columns in the Incident View. How can an administrator achieve this?

Accepted Answer

Configure featured fields to include the custom threat intelligence tags. Featured fields in Cortex XDR let administrators choose which fields appear as primary columns in the Incident View, including custom threat intelligence tags. By adding the custom TI tag field to the featured fields configuration, those tags render as top-level columns for every incident, giving analysts immediate visibility without drilling into details.

Answer

Create a data stitching rule for threat intelligence

Answer

Set up an alert exclusion exception

Answer

Adjust the incident scoring profile weights

Question 2

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

Accepted Answer

User Investigation view. The User Investigation view in Cortex XDR aggregates user activity, authentication events, and associated alerts across endpoints and cloud environments.

Answer

Disk Encryption status panel

Answer

Agent Health dashboard

Answer

BIOC Policy editor

Question 3

What role does the Cortex XDR Broker VM play regarding Active Directory and ITDR log collection?

Accepted Answer

It acts as a collector appliance to ingest and forward syslog, WMI, and Active Directory logs to Cortex XDR. The Cortex XDR Broker VM functions as a collector appliance that ingests and forwards syslog, WMI, and Active Directory logs to Cortex XDR. It acts as an on-premises intermediary that receives telemetry from various sources and securely transmits it to the Cortex XDR management console for analysis and correlation. This is its primary role in AD and ITDR log collection.

Answer

It stores long-term forensic disk images of all enterprise workstations

Answer

It replaces the domain controller operating system

Answer

It functions as an external Next-Generation Firewall

Question 4

During an investigation, an analyst discovers that a raw alert was generated by a legitimate software update tool. To prevent this specific alert from triggering future incidents across all endpoints, how should the analyst proceed within the lifecycle management framework?

Accepted Answer

Create an alert exclusion based on the tool's file hash or digital signature. Creating an alert exception or exclusion based on file hash, path, or digital signature prevents future raw alerts and subsequent incident creation.

Answer

Modify the data stitching window to ignore update hours

Answer

Decrease the global incident scoring threshold

Answer

Star the alert and change its status to resolved

Question 5

When deploying and troubleshooting the integration between Cortex XDR and Active Directory for ITDR, which TWO steps or configurations are critical to ensure successful telemetry collection? (Choose two)

Accepted Answer

Configuring the Cortex XDR Broker VM to receive and parse syslog or Windows event streams from domain controllers. Option B is correct because the Cortex XDR Broker VM acts as the collection and parsing point for ITDR telemetry, ingesting syslog or Windows Event Forwarding streams from domain controllers so identity events reach Cortex XDR. Option C is correct because advanced audit policies (e.g., Audit Logon/Logoff, Audit Account Management, and Directory Service Access) must be enabled on Domain Controllers to generate the authentication and account-change events ITDR relies on. Option A is wrong because BIOS boot order has no bearing on AD telemetry collection. Option D is wrong because DNS root servers do not host AD identity telemetry and installing a kernel driver there is neither required nor appropriate. Option E is wrong because disabling firewall rules to SYSVOL is unnecessary and would weaken security without improving ITDR telemetry.

Answer

Modifying the local BIOS boot order on every user workstation

Answer

Installing the full Cortex XDR Agent kernel driver directly on all DNS root servers

Answer

Disabling all firewall rules between endpoints and the Active Directory SYSVOL share

Question 6

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

Accepted Answer

The endpoint agent must be online and connected to receive the command.. Cortex XDR response playbooks issue remediation commands (isolate endpoint, kill process, quarantine file) through the agent's management channel, so the agent must be online and connected to the Cortex XDR management server for the command to be delivered and acknowledged. If the endpoint is offline, the action is queued but cannot execute until the agent reconnects.

Answer

The user must manually approve every automated step in the playbook.

Answer

The endpoint must have local administrative privileges disabled.

Answer

The endpoint must be running a legacy operating system without secure boot.

Question 7

An analyst wants to filter the Incident View to show only incidents that have been bookmarked by members of the SOC team. Which filter criterion should be applied?

Accepted Answer

Starred incidents filter. Cortex XDR's Incident View includes a 'Starred' filter that shows only incidents bookmarked by analysts. Applying this filter narrows the grid to starred incidents, which is exactly what the SOC team needs to see bookmarked cases. It is a first-class filter criterion in the incident grid's filter panel.

Answer

Incident score range filter

Answer

Featured fields filter

Answer

Data stitching status filter

Question 8

What is the primary function of Cortex XDR Agent prevention modules (such as Anti-Malware and Exploit Protection)?

Accepted Answer

To actively block and remediate threats such as malware, exploits, and ransomware execution on the endpoint. Prevention modules block known and unknown malware, exploits, and ransomware execution in real-time on the endpoint.

Answer

To generate weekly compliance PDF reports for external auditors

Answer

To monitor bandwidth usage across enterprise switch ports

Answer

To automatically patch third-party software vulnerabilities like Adobe Reader

Question 9

An enterprise ingests proxy logs and endpoint telemetry into Cortex XDR. An analyst notices that web traffic alerts for a specific user are not correlating with the user's endpoint malware alerts. What is a common prerequisite for successful identity-based data stitching across network and endpoint sources?

Accepted Answer

Consistent user naming conventions and identity mapping across log sources. Identity stitching requires consistent username formatting and mapping (such as Active Directory user principal names or NetBIOS names) across all ingested log sources.

Answer

Incident scoring must be set to manual mode

Answer

All alerts must be manually starred by an analyst

Answer

Featured fields must be enabled for proxy logs

Question 10

Which TWO types of user accounts are critical to monitor closely for privilege abuse and anomalous behavior within an ITDR program?

Accepted Answer

Domain Administrator accounts. Domain Administrator accounts (B) are the highest-value targets in any environment, since they hold near-unrestricted rights over Active Directory (e.g., DCSync, Golden Ticket, and domain-wide policy changes), so any anomalous logon, privilege escalation, or lateral movement tied to them is a top ITDR detection priority. Service accounts with elevated permissions (D) are equally critical because they typically run with non-interactive, often non-expiring credentials and broad rights, making them prime targets for Kerberoasting, credential dumping, and abuse that blends into normal automated activity. The remaining options are not the focus of privilege-abuse monitoring: guest accounts with zero permissions (A) and unassigned printer test accounts (C) lack meaningful privileges, and deactivated former employee accounts (E) should be disabled or removed, so they represent an account-lifecycle/hygiene issue rather than active privileged-account monitoring.

Answer

Guest user accounts with zero permissions

Answer

Unassigned printer test accounts

Answer

Deactivated former employee accounts

Question 11

An administrator is configuring a Broker VM to act as a Syslog collector for third-party network devices. Which configuration step must be performed within the Cortex XDR console after deploying the Broker VM to enable the Syslog Collector app?

Accepted Answer

Enable the Syslog Collector app instance on the specific Broker VM via Settings > Configurations > Broker VM. After deploying the Broker VM, administrators must install and configure the Syslog Collector content app from the Cortex XDR Marketplace or Broker VM configuration menu.

Answer

Push an XML configuration update using Panorama

Answer

Reboot the Broker VM hypervisor with the Syslog ISO attached

Answer

Manually compile the rsyslog.conf file via SSH on the Broker VM CLI

Question 12

An administrator is configuring Broker VM network settings and firewall rules in a secure data center zone. Which THREE traffic flows must be permitted through internal firewalls for the Broker VM to function correctly?

Accepted Answer

Inbound Syslog (TCP/UDP 514 or custom ports) from network devices to the Broker VM Syslog collector. Option C is correct because the Broker VM hosts a Syslog collector that receives log and event data from network devices, so inbound Syslog on TCP/UDP 514 or configured custom ports must be allowed through internal firewalls. Option D is correct because the Broker VM must communicate with Active Directory Domain Controllers over LDAP/LDAPS on TCP 389/636 in both directions to perform directory lookups, user/group resolution, and related identity functions. Option E is correct because the Broker VM requires outbound HTTPS on TCP 443 to reach the Cortex XDR cloud tenant and associated content delivery networks for registration, management, telemetry, and content updates. Option A is not correct because BitTorrent peer-to-peer traffic is not a supported or required Broker VM communication flow. Option B is not correct because exposing RDP from all internet IP addresses directly to the Broker VM is an insecure management practice and is not a required internal firewall flow for Broker VM functionality.

Answer

Outbound BitTorrent peer-to-peer traffic for software distribution

Answer

Inbound Remote Desktop Protocol (RDP) from all internet IP addresses directly to the Broker VM

Question 13

A security administrator is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints. Before installation, the administrator must ensure that the endpoints meet the minimum operating system requirements for the Cortex XDR agent. Which of the following is a valid supported Windows operating system for the Cortex XDR agent?

Accepted Answer

Windows 10 (64-bit). The Cortex XDR agent requires a currently supported Windows platform. Windows 10 64-bit is a supported operating system and is a realistic target for enterprise deployment, so it satisfies the minimum OS requirement. Legacy platforms such as Windows 7 SP1, Windows Server 2008 R2, and Windows XP are no longer supported by current agent releases and cannot be used for a new deployment.

Answer

Windows XP Professional

Answer

Windows Server 2008 R2

Answer

Windows 7 SP1

Question 14

An analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?

Accepted Answer

Process execution telemetry from endpoint agents. Process execution telemetry from endpoint agents is correct because a BIOC rule detects behavioral patterns based on endpoint activity, such as process executions. To detect suspicious use of 'whoami' by an authenticated domain user, the rule must evaluate process execution events, which include the process name, command line, user context, and parent process. This telemetry is collected by the Cortex XDR agent and stored in the endpoint data lake, allowing BIOC rules to trigger on specific behaviors.

Answer

Cloud storage audit logs

Answer

Firewall URL filtering logs

Answer

DHCP lease tables

Question 15

An analyst is reviewing the Causality Chain for an alert. Which TWO key insights does this view provide? (Choose two)

Accepted Answer

The chronological sequence of events associated with the detection. Option C is correct because the Causality Chain view presents the chronological sequence of events associated with the detection, allowing the analyst to see how activity unfolded over time leading up to the alert. Option E is correct because the Causality Chain specifically maps the parent-child process relationships that led to the alert, showing which process spawned which and how the detection was ultimately triggered. Options A, B, and D are incorrect because physical server room location, email distribution list membership, and CPU power consumption wattage are unrelated to the process lineage and event timeline that the Causality Chain provides.

Answer

The physical location of the server room containing the host

Answer

The corporate email distribution list membership

Answer

The power consumption wattage of the CPU

Question 16

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

Accepted Answer

Suppress or disable the noisy alert rule if it lacks operational value. Option B is correct because suppressing or disabling an alert rule that has no operational value stops the recurring false positive from generating new incidents, directly reducing incident pollution at the rule level. Option C is correct because tuning the specific detector or BIOC rule parameters (for example, adjusting thresholds, logic, or conditions) refines detection so the benign activity no longer triggers the rule while preserving its legitimate detections. Option E is correct because creating an alert exclusion rule scoped to unique file hashes or paths precisely filters out the known-benign artifacts, preventing those specific false positives from re-entering the incident queue without broadly weakening detection. Option A does not belong because starring alerts only flags them for visibility and does not prevent them from being generated or polluting incidents. Option D does not belong because adding a featured field column merely changes how alerts are displayed and hides nothing from the incident pipeline, so the false positives still occur.

Answer

Star all future instances of the alert in the incident view

Answer

Add a featured field column to hide the false positive alerts

Question 17

An administrator is deploying Cortex XDR agents in a Linux environment and needs to ensure that the agent does not interfere with a critical custom database application. Which feature should the administrator configure to exclude specific directories or processes from agent inspection?

Accepted Answer

Global Agent Profile Exclusions (Path, Process, and File Hash exclusions). The correct feature is Global Agent Profile Exclusions (Path, Process, and File Hash exclusions) (A). These exclusions allow administrators to specify directories, processes, or file hashes that the agent should ignore during inspection, preventing interference with critical applications. This is configured in the agent profile and applied to endpoints.

Answer

Broker VM Firewall Rules

Answer

Kernel Module Blacklisting via /etc/modprobe.d

Answer

Linux iptables PREROUTING chains

Question 18

Where in the Cortex XDR console can an analyst review the complete lifecycle timeline of an incident, from initial raw alert generation to final resolution?

Accepted Answer

The Incident Details page and Incident Timeline view. The Incident Details page and Incident Timeline view in Cortex XDR provide a unified, chronological record of an incident's entire lifecycle. This includes the initial raw alert generation, subsequent alert grouping into an incident, all investigative actions taken, and the final resolution or closure. Analysts use this view to understand the full scope and progression of a security event without needing to correlate data from multiple separate tools.

Answer

The Syslog forwarding configuration panel

Answer

The Global Dashboard widget builder

Answer

The Agent installation status log

Question 19

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

Accepted Answer

Signed binary exception with path and certificate verification. Signed binary exceptions combined with valid certificate verification and file path checks allow legitimate administrative or updater tools to operate without generating alerts.

Answer

Configuring a network port forwarding rule

Answer

Deleting the software updater from all endpoints

Answer

Disabling all behavioral monitoring on the subnet

Question 20

An administrator needs to customize the incident queue to show the 'OS Version' column for all displayed incidents. Which configuration interface should be accessed?

Accepted Answer

Featured fields settings. Featured fields configuration allows administrators to add standard or custom attributes like OS Version as columns in the incident table.

Answer

Incident scoring weight profiles

Answer

Alert exclusion rule manager

Answer

Data stitching correlation parameters