XDR-Analyst Practice Test 6 — 10 Questions

Question 1

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cortex XDR Management Console under Exceptions. Global exclusions and exceptions in Cortex XDR are managed centrally under Response -> Exceptions or Agent Settings, ensuring organization-wide application.

Answer

Syslog forwarding rules

Answer

User Identity mapping rules

Answer

Local Windows Registry on each endpoint

Question 2

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

Accepted Answer

File Details / WildFire Analysis tab. The WildFire analysis report and verdict are accessible directly from the file details or alert inspection panel within Cortex XDR.

Answer

DHCP Server status log

Answer

DNS query statistics panel

Answer

Printer queue management interface

Question 3

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

Accepted Answer

Cloud audit and API activity logs. Cloud infrastructure logs (like AWS CloudTrail or Azure Activity logs) ingested into Cortex XDR provide the audit trail for cloud resource changes.

Answer

Active Directory SYSVOL share

Answer

Local printer driver cache

Answer

Local endpoint SAM registry hive

Question 4

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

Accepted Answer

Kill Process Tree. The 'Kill Process Tree' action terminates the targeted process along with all descendant processes spawned by it, ensuring complete neutralization of the threat tree.

Answer

Retrieve File

Answer

Block File Hash

Answer

Isolate Endpoint

Question 5

An analyst wants to ensure that any file evaluated with a specific SHA-256 hash is immediately blocked from execution across all endpoints managed by Cortex XDR, regardless of its WildFire verdict. Where should this hash be added?

Accepted Answer

Hash Blocklist in Cortex XDR. Blocking specific file hashes across all endpoints is accomplished by adding the hash to the Hash Blocklist under Response or Malware Protection settings.

Answer

Network interface promiscuous mode toggle

Answer

Agent debug log level selector

Answer

Cortex XSOAR integration ticket template

Question 6

An analyst is investigating a suspected phishing attack and needs to review the command line arguments passed to a suspicious email attachment execution. Where can the analyst find this evidence in Cortex XDR?

Accepted Answer

Process Execution details within the Causality Chain. The Process Execution view and Causality Chain record the exact command line arguments passed when a process is spawned.

Answer

Hardware asset inventory list

Answer

Agent network proxy configuration file

Answer

DNS server cache table

Question 7

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

Accepted Answer

Review command-line arguments for utility tools utilized during the attack. Credential dumping investigations involve analyzing process access telemetry and examining associated endpoint logs.

Answer

Verify employee cafeteria badge swipe access times

Answer

Check the office HVAC temperature logs

Answer

Analyze cafeteria point-of-sale receipt records

Question 8

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

Accepted Answer

Quarantine File. Playbooks support automated containment and investigative tasks such as endpoint isolation, file quarantine, and artifact gathering.

Answer

Physically replace damaged endpoint motherboard hardware

Answer

Update the corporate website DNS homepage banner

Question 9

An administrator needs to configure automated incident response actions in Cortex XDR. Which THREE components are critical for building a successful automated response workflow? (Choose three)

Accepted Answer

Playbook actions and logic steps (such as quarantine or enrichment). Automated response workflows require triggers (alerts/incidents), playbook logic/steps, and integration targets or response actions.

Answer

Corporate cafeteria catering menu pricing sheets

Answer

Physical server room air conditioning coolant levels

Question 10

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

Accepted Answer

IP Connection (Source/Destination IP and Port). Cortex XDR incident and alert views capture various telemetry artifacts, notably file hashes and network connection details.

Answer

Physical RAM stick serial number

Answer

Office printer cartridge ink level

Answer

BIOS manufacturer date