XDR-Analyst Practice Test 6 — 10 Questions

Question 1

Which TWO features in Cortex XDR assist analysts in communicating identity threat findings to stakeholders or compliance auditors?

Accepted Answer

Scheduled and on-demand reporting templates for incident summaries and user risk. Option A is correct because Cortex XDR provides scheduled and on-demand reporting templates that summarize incidents and user risk, giving analysts a repeatable way to present identity threat findings to stakeholders and auditors. Option D is correct because Cortex XDR allows incidents and related data to be exported or shared in formats such as PDF or CSV, which supports evidence handoff and compliance review. Options B, C, and E are incorrect because BIOS flashing, live packet generation, and hard drive partitioning are not Cortex XDR features for communicating identity threat findings; they are unrelated to reporting or audit workflows.

Answer

Automated BIOS flashing utility

Answer

Live packet generator

Answer

Hard drive partition editor

Question 2

An analyst is investigating a Cortex XDR incident where the automatic correlation engine grouped alerts based on a shared causality ID. The analyst discovers that one alert in the incident actually belongs to a different attack on the same endpoint. What should the analyst do to correct the incident grouping?

Accepted Answer

Remove the alert from the incident and create a new incident for it.. To correct an incorrect grouping, the analyst should remove the mis-grouped alert from the incident. Cortex XDR provides this manual action, allowing the analyst to then handle the alert separately, such as creating a new incident. Other actions like editing causality IDs or merging incidents do not achieve the desired separation.

Answer

Change the alert's causality ID to a different value.

Answer

Close the incident and reopen it with a filter that excludes the alert.

Answer

Merge the incident with another incident that contains the correct alerts.

Question 3

When sizing a Broker VM instance for an environment collecting high-volume syslog and Active Directory logs, which hardware resource is most critical to scale appropriately?

Accepted Answer

Sufficient vCPU and RAM allocation per published system requirements. Log collection and parsing require adequate RAM and CPU to process high throughput before forwarding to the Cortex Data Lake.

Answer

Fibre Channel HBA connected to an enterprise SAN storage array

Answer

Dedicated high-end NVIDIA GPU for deep learning processing

Answer

Dual 10Gbps SFP+ physical network interface cards passed through directly

Question 4

Cortex XDR stitches together data from multiple telemetry sources to form a cohesive incident. An analyst notices that network logs from a third-party firewall are generating alerts, but they are not stitching correctly with the endpoint alerts for the same compromised host. What is the most likely cause of this stitching failure in the raw-alert-to-incident lifecycle?

Accepted Answer

The third-party firewall logs lack proper field mapping for endpoint IP or hostname identifiers required by the stitching engine.. Data stitching relies on consistent identifiers such as internal IP addresses, MAC addresses, or hostnames. Mismatched or missing identifiers in parsed logs prevent the Cortex XDR causality engine from linking network and endpoint events.

Answer

The incident scoring threshold is set too high for network alerts to be included in endpoint-triggered incidents.

Answer

The alerts are in an 'Unassigned' status, which disables the causality engine.

Answer

Alert starring has not been applied to the network alerts, preventing automated correlation.

Question 5

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

Accepted Answer

New. When the Cortex XDR correlation engine automatically generates an incident from correlated alerts, it is assigned the status 'New' by default. This indicates the incident has been created but not yet triaged, assigned, or acted upon by an analyst. Status transitions (e.g., Under Investigation, Resolved, Closed) occur only after human or automated workflow actions.

Answer

Closed

Answer

Under Investigation

Answer

Resolved

Question 6

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Accepted Answer

Windows Scheduled Tasks. Option C is correct because Windows Scheduled Tasks are a common APT persistence mechanism, allowing malware to execute on a schedule or at logon/boot, and Cortex XDR telemetry captures task creation and modification events (e.g., schtasks.exe, Task Scheduler operational logs). Option D is correct because creating or modifying Windows Services (e.g., via sc.exe, New-Service, or service DLL hijacking) enables persistence by launching malicious code at system startup, and Cortex XDR records service installation and configuration changes. Option E is correct because Registry Run and RunOnce keys (HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce) are classic autostart locations that Cortex XDR monitors for registry modifications tied to persistence. Options A and B are incorrect because office desk relocation requests and breakroom coffee machine maintenance schedules are physical facilities matters with no relation to host-based persistence or endpoint telemetry.

Answer

Office desk relocation requests

Answer

Breakroom coffee machine maintenance schedules

Question 7

An administrator is setting up a new Cortex XDR tenant and preparing for initial onboarding. Which TWO administrative tasks must be completed during the initial planning and setup phase?

Accepted Answer

Configure administrator user accounts and assign appropriate Role-Based Access Control (RBAC) roles. Option D is correct because during initial Cortex XDR tenant onboarding, the administrator must create administrator user accounts and assign the appropriate RBAC roles so that different teams (e.g., SOC analysts, responders, admins) get only the permissions they need. Option E is correct because onboarding requires generating Agent Installation Packages (with the tenant/registration token) and defining Settings profiles so endpoints can be enrolled and managed consistently. Option A is incorrect because Cortex XDR agents are prebuilt binaries; no custom assembly code per CPU architecture is written by the administrator. Option B is incorrect because Cortex XDR is an endpoint detection and response platform and does not require physically replacing core switches with Palo Alto Networks firewalls. Option C is incorrect because disabling cloud logging would defeat Cortex XDR's telemetry ingestion and analytics rather than being a required setup task.

Answer

Manually write custom assembly code for every endpoint CPU architecture

Answer

Physically replace all enterprise core switches with Palo Alto Networks firewalls

Answer

Disable all cloud logging features to prevent data ingestion

Question 8

When reviewing identity analytics alerts in Cortex XDR, which THREE behavioral anomalies are typically flagged by the UBA engine as potential indicators of a compromised account?

Accepted Answer

Abnormal volume of data access or file downloads compared to peer group baselines. The UBA (User and Entity Behavior Analytics) engine in Cortex XDR baselines each user's normal activity and flags deviations, so option B is correct because a spike in data access or file downloads relative to the peer group baseline is a classic exfiltration/compromised-account indicator. Option C is correct because accessing sensitive internal applications or file shares outside the user's normal working hours is an anomalous access pattern the engine scores as risky. Option D is correct because impossible travel — geographically distant logins within an unrealistically short timeframe — is a hallmark UBA detection for credential compromise or session hijacking. Option A is not anomalous since a standard QWERTY keyboard layout is a ubiquitous, benign configuration with no security relevance. Option E is not a user-behavior anomaly at all; plugging an Ethernet cable into switch port 1 is a physical network action, not identity analytics telemetry.

Answer

Using a standard QWERTY keyboard layout

Answer

Connecting an Ethernet cable into port 1 of a switch

Question 9

After containing a malware outbreak, a Cortex XDR analyst needs to verify that the malicious file was removed from all affected endpoints. The analyst wants to confirm the current state of the endpoints without waiting for the next scheduled scan. Which Cortex XDR action allows the analyst to query endpoint file system state on demand and return results to the console?

Accepted Answer

Run a script or command through the Cortex XDR Live Terminal or action center to check for the file's presence and capture the output.. To verify current endpoint state on demand, Cortex XDR provides Live Terminal and script-based response actions that execute directly on endpoints and return output to the console. These actions query the live file system, so the analyst can confirm whether the malicious file persists and immediately remediate if it does, rather than waiting for scheduled scans or relying on historical detection records.

Answer

Modify the endpoint protection policy to enable real-time file monitoring and rely on future alerts to confirm removal.

Answer

Initiate a WildFire submission of the file hash to obtain a fresh verdict and infer that the file was removed.

Answer

Review the Incident Details page timeline for the original detection and confirm that the file was quarantined at that time.

Question 10

During incident triage, an analyst notices that two completely separate attacks on different endpoints were merged into a single incident by Cortex XDR. What is the underlying reason for this over-correlation?

Accepted Answer

Shared common identifiers such as a NAT gateway IP address within the correlation window. Cortex XDR's correlation engine stitches alerts into incidents by matching shared identifiers — IP addresses, hostnames, usernames, file hashes, and similar artifacts — within a configurable correlation window. When two unrelated attacks both traverse the same NAT gateway, the public IP is identical in both alert sets, so the engine merges them into one incident. This is a classic over-correlation caused by shared infrastructure identifiers rather than true attack linkage.

Answer

All alerts were manually starred by an analyst

Answer

The incident scoring threshold was set too low

Answer

Featured fields were configured to group by IP subnet