XDR-Analyst Practice Test 5 — 10 Questions

Question 1

When analyzing a complex multi-stage attack in Cortex XDR, an analyst examines the Causality Chain. How does the Causality Chain assist in understanding the raw-alert-to-incident lifecycle?

Accepted Answer

It traces the parent-child process relationship and telemetry leading to the alert. The Causality Chain visualizes the chronological sequence of processes, network connections, and file modifications that led to an alert, helping trace the origin of the incident.

Answer

It automatically recalculates the incident score based on user activity

Answer

It stitches network logs with endpoint logs using IP subnet masks

Answer

It filters featured fields to highlight malicious hashes

Question 2

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Accepted Answer

It maps the behaviors observed in the incident to known attacker tactics and techniques.. The MITRE ATT&CK tab in Cortex XDR incident details maps observed behaviors to the MITRE ATT&CK framework, which is a curated knowledge base of adversary tactics, techniques, and procedures (TTPs). This mapping helps analysts understand the attacker's intent, identify the stage of the attack lifecycle, and prioritize response actions. It provides context beyond raw alerts by categorizing activities like 'Credential Dumping' (T1003) or 'Spearphishing Attachment' (T1566), enabling faster triage and correlation with threat intelligence.

Answer

It provides network routing tables for the compromised subnet.

Answer

It automatically downloads security patches from vendor repositories.

Answer

It lists the hardware warranty status of the affected device.

Question 3

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

Accepted Answer

Network connection details including source, destination, port, and protocol. Network connection details including source, destination, port, and protocol is correct because an 'IP Connection' artifact in Cortex XDR represents a network connection event, capturing the source IP, destination IP, destination port, and protocol (e.g., TCP, UDP). This information is crucial for understanding command-and-control (C2) traffic, data exfiltration, or lateral movement. The artifact is generated from endpoint telemetry and provides context for the connection, such as the responsible process.

Answer

Software license expiration dates

Answer

Hardware temperature and fan speed metrics

Answer

Local user account password complexity settings

Question 4

What is the primary purpose of the Cortex XDR agent installation token (or installation password)?

Accepted Answer

To authenticate the agent installation and prevent unauthorized uninstallation or tampering. The Cortex XDR agent installation token authenticates the agent during installation and registration with the Cortex XDR tenant, and it also prevents unauthorized uninstallation or tampering by requiring the token for agent removal. This ensures only authorized endpoints join the tenant and that the agent cannot be easily disabled by malware or unauthorized users.

Answer

To license the endpoint for Palo Alto Networks Next-Generation Firewall features

Answer

To authenticate the agent against the local Active Directory domain controller

Answer

To encrypt all local agent SQLite databases at rest

Question 5

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Accepted Answer

The time delta between the endpoint and network events exceeds the stitching correlation window. Cortex XDR stitches alerts into incidents by correlating on shared featured fields (such as IP, user, hostname) within a defined time window. If the endpoint event and the network event occur too far apart in time, the correlation engine will not merge them, so they appear as separate incidents even though the IP and user match. The most likely cause is therefore that the time delta exceeds the stitching window.

Answer

The incident score was manually overridden to low

Answer

Alert starring was disabled on the network data source

Answer

Featured fields were not configured for the network logs

Question 6

An analyst is reviewing a Cortex XDR incident involving a suspicious PowerShell script that was executed on multiple endpoints. The analyst needs to gather evidence to determine the script's origin and impact. Which TWO actions should the analyst take to collect relevant evidence from the endpoints? (Choose two.)

Accepted Answer

Retrieve the PowerShell script file from the endpoints using the 'Retrieve File' action.. Retrieving the PowerShell script file provides direct evidence of its contents, while querying process execution events via XQL gives context about how and where it ran. Together, these actions allow the analyst to understand the script's origin, execution parameters, and impact across endpoints. The other options are either containment or detection measures that do not directly collect the needed evidence.

Answer

Initiate a full antivirus scan on the endpoints.

Answer

Isolate the endpoints from the network immediately.

Answer

Review the endpoints' Windows Event Logs for PowerShell operational events.

Question 7

An analyst is investigating a Cortex XDR incident and wants to correlate alerts from different endpoints that share the same file hash. The analyst needs to quickly find all other incidents that contain this hash to assess the scope of the campaign. Which Cortex XDR feature should the analyst use?

Accepted Answer

Incident Search with a filter on the file hash. Incident Search is the only feature that allows querying across all incidents using fields like file hash. By filtering on the hash, the analyst can identify every incident that includes that hash, thereby mapping the campaign's reach. Endpoint Search, Threat Intelligence Lookup, and Causality Chain do not provide cross-incident correlation by hash.

Answer

Endpoint Search for the file hash

Answer

Causality Chain view for the file hash

Answer

Threat Intelligence Lookup for the file hash

Question 8

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

Accepted Answer

Kill Process Tree. Kill Process Tree terminates the specified process and all of its child processes on the targeted endpoint, which is exactly what's needed to stop a malicious parent and its spawned children in one action. It's available directly from the Cortex XDR incident/endpoint view.

Answer

Retrieve File

Answer

Block File Hash

Answer

Isolate Endpoint

Question 9

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

Accepted Answer

Utilize asset criticality scoring profiles to elevate key asset visibility. Option D is correct because Cortex XDR lets administrators configure featured fields, which add custom columns to the Incident View so that specific metadata relevant to their environment is displayed directly in the incident grid. Option C is correct because asset criticality scoring profiles assign criticality values to assets, and this criticality metadata is surfaced in the Incident View to elevate the visibility of incidents involving key or high-value assets. Option A is incorrect because deleting inactive data collectors only removes unused collector entries and does not customize or enhance incident metadata visibility. Option B is incorrect because automatically starring every raw alert would simply flag all alerts indiscriminately and does not add or customize metadata columns in the Incident View. Option E is incorrect because data stitching rules determine how alerts are correlated into incidents, not how the incident grid is sorted or which metadata columns are shown.

Answer

Delete inactive data collectors to clear queue clutter

Answer

Enable automatic alert starring for every raw alert

Answer

Change data stitching rules to alter incident grid sorting

Question 10

An administrator is planning a Cortex XDR deployment and must choose the appropriate agent installation methods for a mix of Windows and macOS endpoints. The administrator wants to minimize manual effort and support remote users who are not on the corporate network. Which TWO installation methods should the administrator select? (Choose two.)

Accepted Answer

Distribute the agent installer via a software deployment tool such as Microsoft Endpoint Configuration Manager. Automated deployment through software deployment tools for Windows and MDM for macOS allows the administrator to install Cortex XDR agents at scale, including for remote users, without manual intervention. These methods ensure consistent configuration and central tracking, while manual or email-based approaches increase effort and risk.

Answer

Require users to download the agent from the Cortex XDR management console and install it themselves

Answer

Deploy the agent only to endpoints that are on the corporate network and postpone remote users

Answer

Send each user an email with the agent installer and installation token, asking them to run it manually