XDR-Analyst Practice Test 9 — 10 Questions

Question 1

An administrator is planning a Cortex XDR agent rollout and needs to decide how to distribute the agent installer to 2,000 Windows endpoints without manually touching each machine. The organization already uses Microsoft Configuration Manager (SCCM) and Microsoft Intune for software deployment. Which approach best fits the planning requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use SCCM and Intune to package and push the Cortex XDR agent installer to the managed endpoints. The organization already uses SCCM and Intune, which are designed for large-scale, auditable software deployment. Packaging the Cortex XDR agent installer with those tools lets the administrator push it to all managed Windows endpoints, track installation status, and retry failures. Manual or user-driven methods are unreliable and cannot scale to 2,000 endpoints, and the agent has no self-install capability.

Answer

Wait for the Cortex XDR agent to self-install automatically on endpoints that check in to the console

Answer

Deploy the Cortex XDR agent by emailing the installer to each end user and asking them to run it manually

Answer

Ask each department to download the installer from the Cortex XDR console and install it on their own machines

Question 2

An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?

Accepted Answer

Cortex XDR Broker VM. The Cortex XDR Broker VM is the component that serves as a local communication proxy and log collector for remote agents deployed outside the corporate network. It acts as an intermediary between endpoints and the Cortex XDR cloud, buffering logs and forwarding them securely. This is essential when endpoints cannot directly reach the cloud due to network restrictions or when you want to reduce egress traffic.

Answer

Panther Agent Gateway

Answer

Cortex XDR Agent Collector Service

Answer

Panorama Log Forwarding App

Question 3

During the raw-alert-to-incident lifecycle, an alert is generated by a custom BIOC (Behavioral Indicator of Compromise). At what point does this raw alert transition into an actionable incident?

Accepted Answer

Immediately upon correlation and grouping by the Incident Engine. When a raw alert triggers, Cortex XDR evaluates it against existing open incidents or creates a new incident based on correlation and stitching logic, moving it into the Incident View.

Answer

Only after an analyst manually assigns a severity score

Answer

Once featured fields are populated for the data source

Answer

When the alert is starred by a tier-2 analyst

Question 4

Which THREE key identity-based threat behaviors are typically detected and flagged by Cortex XDR Identity Analytics? (Choose three)

Accepted Answer

Abnormal privilege escalation or group membership changes. Cortex XDR Identity Analytics baselines identity activity and flags deviations such as Option A, abnormal privilege escalation or group membership changes, because adding accounts to privileged groups or elevating rights is a classic attacker persistence and lateral-movement technique that the analytics engine correlates against normal role behavior. Option B, password spray and brute-force attempts, is detected because Identity Analytics ingests authentication telemetry and identifies repeated failed logons across many accounts or high-volume credential guessing patterns indicative of credential attacks. Option E, impossible travel sign-ins, is flagged because the engine correlates sign-in geolocation and timestamps to detect physically impossible authentication sequences that suggest compromised credentials or session hijacking. Option C does not belong because corrupted sector errors on mechanical hard drives are a hardware/storage reliability issue, not an identity behavior, and Option D does not belong because standard browser bookmark synchronization is benign user activity with no identity threat relevance.

Answer

Corrupted sector errors on mechanical hard drives

Answer

Standard browser bookmark synchronization

Question 5

An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?

Accepted Answer

Create an alert exclusion or exception rule. When legitimate administrative scripts repeatedly trigger low-level behavioral alerts, the correct lifecycle action is to create an alert exclusion or exception rule that suppresses those specific alerts based on defined criteria. This prevents the noise from cluttering the incident queue while preserving detection for genuinely malicious script behavior. Exclusions are the standard mechanism for tuning out known-benign activity without disabling the underlying detection logic entirely.

Answer

Manually star all related alerts

Answer

Increase the data stitching window

Answer

Modify featured fields to hide script alerts

Question 6

During an ITDR investigation, an analyst observes that a service account authenticated to a domain controller and then created a new computer object. The analyst wants to determine whether this is a known attack technique involving directory object manipulation. Which Cortex XDR analytic or rule category is MOST relevant to this behavior?

Accepted Answer

Behavioral Indicators of Compromise (BIOCs) focused on Active Directory object creation and modification.. Behavioral Indicators of Compromise are the analytic category built to detect sequences of suspicious actions, including directory object creation and modification by accounts that should not perform them. Because the scenario involves an authenticated service account performing an unusual directory operation, a BIOC provides the technique-level visibility needed. Static IOCs, prevention profiles, and vulnerability scans address different layers and would not classify this behavior as an identity attack technique.

Answer

Indicators of Compromise (IOCs) based on known malicious file hashes and domains.

Answer

Vulnerability assessment scans that identify missing patches on domain controllers.

Answer

Custom prevention profiles that block specific executables from running on domain controllers.

Question 7

When sorting incidents in the Cortex XDR console to find the most severe threats first, which attribute is most commonly used?

Accepted Answer

Incident Score / Severity. The Incident Score (also surfaced as Severity) is the primary numeric attribute used to rank incidents by threat severity in Cortex XDR. Sorting the Incident View by Incident Score descending brings the highest-risk incidents to the top, which is the standard triage workflow. It aggregates alert severity, asset criticality, and other weighted factors into a single comparable value.

Answer

Data stitching identifier

Answer

Featured field display order

Answer

Agent version number

Question 8

An analyst reviewing a Cortex XDR identity incident sees that a user's account successfully authenticated from an unfamiliar ASN at 02:00, immediately followed by creation of a new mail forwarding rule and a password reset. The user confirms they were asleep and did not perform these actions. Which conclusion and immediate priority are most appropriate?

Accepted Answer

The account is compromised with confirmed attacker control, so the priority is to revoke sessions, reset credentials, and remove the malicious forwarding rule.. When a user denies activity that matches a coherent attack sequence, the account should be treated as compromised. The unfamiliar-ASN sign-in, malicious mail forwarding rule, and attacker-initiated password reset together indicate both persistent access and data exfiltration. Containment must revoke sessions, reset credentials, and remove the forwarding rule, because addressing only one element leaves the attacker a path back in or a channel to continue stealing mail.

Answer

The password reset indicates the user regained control, so the priority is to close the incident and monitor for recurrence.

Answer

The events are likely a synchronization error between the identity provider and Cortex XDR, so the priority is to reingest the logs and recheck.

Answer

The mail forwarding rule is the only malicious element, so the priority is to delete the rule and take no further containment action.

Question 9

While reviewing an incident involving suspicious lateral movement, an analyst notices that an adversary utilized compromised service account credentials. The analyst wants to use Cortex XDR response actions to immediately contain the threat without shutting down the entire domain controller. Which ITDR-related action can be executed directly from the Cortex XDR console for a compromised user account?

Accepted Answer

Disable User Account or Force Password Reset via Active Directory integration. Cortex XDR's Active Directory integration enables ITDR (Identity Threat Detection and Response) response actions directly from the console, including Disable User Account and Force Password Reset. These actions target the compromised identity itself, immediately neutralizing the adversary's ability to authenticate or use the stolen credentials without disrupting the domain controller or other users. This is the correct ITDR-aligned containment action for a compromised user account.

Answer

Revoke Kerberos TGT and purge DNS cache on the domain controller

Answer

Blacklist the user SID in the local Windows firewall

Answer

Isolate Endpoint via the XDR network containment feature

Question 10

An analyst is reviewing a raw alert that was generated by Cortex XDR analytics. The alert indicates suspicious behavior, but no incident was created. What is the most likely explanation?

Accepted Answer

The raw alert did not meet the threshold for incident creation or was grouped into an existing incident. Analytics generate raw alerts, but an alert must meet specific correlation thresholds or aggregation criteria before an incident is spawned, or it may have been grouped into an existing incident.

Answer

Featured fields were disabled for the analytic detector

Answer

The alert was automatically starred, preventing incident promotion

Answer

Data stitching was turned off globally