XDR-Analyst Practice Test 4 — 10 Questions

Question 1

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cross-data-source data stitching. Cross-data-source data stitching is the Cortex XDR mechanism that correlates alerts and events from different telemetry sources (XDR agents, third-party firewalls, cloud logs) into a single unified incident. It links entities like IPs, hostnames, and users across sources so that a firewall alert and an endpoint alert about the same attack are presented as one incident rather than separate alerts.

Answer

Automated alert starring

Answer

Incident score weighting tables

Answer

Featured fields column mapping

Question 2

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Accepted Answer

New. Option A, New, is correct because a newly generated incident in Cortex XDR begins in the New state, which is the initial stage of the standard incident lifecycle before any analyst action is taken. Option D, Under Investigation, is correct because once an analyst begins working an incident, it moves to the Under Investigation state, which is a defined stage in the standard lifecycle. The remaining options do not belong: Featured and Starred are not lifecycle states but rather UI flags or filters used to mark or prioritize incidents for quick access, and Stitched refers to the stitching of related alerts/causality events into an incident, not a lifecycle state.

Answer

Featured

Answer

Starred

Answer

Stitched

Question 3

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

Accepted Answer

Under the Incident Details page by selecting the Alerts tab. By drilling down into an incident in Cortex XDR, the analyst can access the Alert tab to inspect the individual raw alerts that make up the incident lineage.

Answer

Under Analytics > BIOC > Alert Log

Answer

Under Response > Action Center > History

Answer

Under Settings > Data Stitching > Raw Logs

Question 4

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

Accepted Answer

Configure exclusions for the vulnerability scanner's IP addresses or signature patterns. Creating exclusion rules for scanner IP addresses or signatures ensures vulnerability assessment traffic does not trigger security incidents.

Answer

Enable featured fields to hide scanner columns

Answer

Turn off data stitching across all internal subnets

Answer

Star all alerts generated during scanning windows

Question 5

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Accepted Answer

Verify the digital signature and publisher of the application. Safe exception implementation involves validating binary integrity, verifying legitimate paths, and testing prior to global deployment.

Answer

Disable all Cortex XDR agent security modules across the entire enterprise

Answer

Remove all file access permissions from the operating system kernel

Question 6

An analyst is investigating a security incident and needs to review the timeline of events that occurred on a compromised endpoint. The analyst wants to see a chronological list of all alerts, process executions, and network connections related to the incident. Which Cortex XDR view should the analyst use?

Accepted Answer

Incident Details page. The Incident Details page is specifically designed to present all relevant information for an incident in one place, including a chronological timeline of alerts, process executions, and network connections. This allows the analyst to quickly understand the sequence of events without manual querying. Other options serve different purposes such as endpoint management, threat intelligence, or custom querying.

Answer

Endpoint Management console

Answer

Threat Intelligence module

Answer

XQL Query Center

Question 7

An administrator is planning a Cortex XDR deployment across multiple sites, including a remote office with limited internet bandwidth. The administrator wants to minimize WAN traffic for agent updates and threat intelligence lookups. Which Cortex XDR component should be deployed at the remote office to achieve this?

Accepted Answer

Broker VM. A Broker VM deployed at the remote office can cache content updates and threat intelligence, serving them to local endpoints. This reduces WAN traffic because endpoints retrieve updates from the Broker VM instead of the cloud. The management console and Cortex Data Lake are cloud-based and do not provide local caching. Agent local caching does not exist as a feature for sharing updates.

Answer

Cortex XDR agent with local caching enabled

Answer

Cortex Data Lake

Answer

Cortex XDR management console

Question 8

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Accepted Answer

Directory Service Access and LDAP query event logs from Domain Controllers (such as Event ID 4662). BloodHound enumerates Active Directory by issuing LDAP queries and accessing directory service objects, which generates Directory Service Access events on domain controllers, including Event ID 4662. Cortex XDR can ingest these Domain Controller event logs to detect the enumeration patterns characteristic of BloodHound reconnaissance.

Answer

Network interface duplex settings

Answer

USB device connection history

Answer

Browser extension inventory reports

Question 9

A Cortex XDR analyst is building an identity threat detection strategy for a hybrid environment with on-premises Active Directory and cloud identity. Which TWO telemetry sources should the analyst prioritize ingesting to detect credential abuse and anomalous authentication across both environments? (Choose two.)

Accepted Answer

Windows Security event logs from domain controllers, including authentication and Kerberos events.. Effective hybrid identity threat detection requires visibility into both authentication authorities. Domain controller security logs expose on-premises Kerberos and logon behavior, while cloud identity provider sign-in and audit logs expose cloud authentication and directory changes. Together they let Cortex XDR baseline and correlate identity behavior across environments. Network, DHCP, and print logs lack the credential and authentication context needed for identity-focused detection.

Answer

Endpoint firewall connection logs recording outbound TCP and UDP flows from user workstations.

Answer

Print server spooler logs capturing document names and submitting user accounts.

Answer

DHCP lease logs from the internal network recording IP address assignments to endpoints.

Question 10

An administrator is planning to install Cortex XDR agents on a large fleet of Windows endpoints and wants to ensure the installation can proceed without manual intervention on each host. Which approach best supports a silent, unattended installation?

Accepted Answer

Deploy the agent MSI package with the installation token supplied as a command-line parameter through a software distribution tool.. Silent, unattended installation on Windows is achieved by distributing the agent MSI through a software deployment tool and passing the installation token as a command-line parameter. This lets each host register automatically with the tenant without interactive input, which is essential for large-scale rollouts.

Answer

Run the agent installer interactively on each endpoint and paste the installation token when prompted.

Answer

Install the agent without a token and rely on the cloud tenant to auto-assign the endpoint to a default policy.

Answer

Copy the agent installer to a network share and instruct users to double-click it from their desktops.