XDR-Analyst Practice Test 9 — 10 Questions

Question 1

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Windows Scheduled Tasks. Common endpoint persistence mechanisms include Run keys, scheduled tasks, and Windows services.

Answer

Office desk relocation requests

Answer

Breakroom coffee machine maintenance schedules

Question 2

An analyst discovers that a malicious payload communicated with an external Command and Control (C2) server. Which TWO evidence sources should the analyst review to identify the C2 communication details? (Choose two)

Accepted Answer

Network connection event logs (Destination IP, port, and connection duration). C2 communications are investigated using network connection telemetry and DNS request history logs.

Answer

Local office printer toner cartridge status

Answer

Employee parking permit registration forms

Answer

Corporate conference room booking calendars

Question 3

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

Accepted Answer

Incident Response > Alerts, filtering by Analytics category related to Identity. Cortex XDR consolidates identity-based threats and user behavior analytics within the Incident Response and Alerts views, specifically filtered by analytics categories such as compromised credentials.

Answer

Cloud > Posture > Identity

Answer

XQL Search > Identity_Raw schema

Answer

Endpoints > Agent Configurations > Identity

Question 4

An analyst is investigating a suspicious user account that accessed sensitive internal shares outside of normal business hours. Which Cortex XDR feature enables the analyst to review all actions taken by this user across endpoints and cloud services in a chronological timeline?

Accepted Answer

The Incident Storyline and User Timeline view. The Cortex XDR Incident View and User Timeline provide a chronological sequence of events and alerts associated with a specific user entity.

Answer

The Static File Analysis Report

Answer

The Network Packet Capture Utility

Answer

The Host Isolation Status page

Question 5

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

Accepted Answer

Incident Timeline / Causality view. Forensic data and file details are accessible via the File Details view and forensic collection reports.

Answer

Corporate gym membership roster

Answer

Cloud printer ink supply level gauge

Answer

Cafeteria food inventory management sheet

Question 6

Which TWO actions can be performed directly from the Cortex XDR Incident Details page when reviewing evidence? (Choose two)

Accepted Answer

Update incident status and assignment. The Incident Details page allows analysts to view alert timelines, examine artifacts, and change incident status.

Answer

Order office catering supplies for the team meeting

Answer

Schedule routine commercial window washing

Answer

Calibrate the office thermostat temperature

Question 7

Which TWO views in Cortex XDR are primarily used to monitor overall alert and incident status across the SOC? (Choose two)

Accepted Answer

Dashboards (providing high-level metrics and widget summaries). SOC monitoring dashboards and incident queues provide visibility into enterprise security status.

Answer

Commercial shipping logistics tracking application

Answer

Local operating system task manager

Answer

Office water cooler maintenance portal

Question 8

An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?

Accepted Answer

Target process name matching 'lsass.exe' with suspicious access rights from an unauthorized source process. LSASS credential dumping typically involves specific process open requests (e.g., OpenProcess with PROCESS_VM_READ or PROCESS_QUERY_LIMITED_INFORMATION) targeting lsass.exe.

Answer

Registry modifications affecting the Windows Firewall state

Answer

DNS query logs for newly registered domains

Answer

Outbound HTTPS connections to unknown external IP addresses on port 443

Question 9

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

Accepted Answer

The Cortex XDR Broker VM configured with the User-ID integration. The Cortex XDR Collector (or BIOC/agent mapping combined with Active Directory integration) requires the User-ID agent or Cortex XDR Agent visibility to sync identity metadata.

Answer

The Cortex XDR Network Traffic Analyzer

Answer

WildFire cloud analysis engine

Answer

The Cortex XSOAR Content Pack for Active Directory

Question 10

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Accepted Answer

Directory Service Access and LDAP query event logs from Domain Controllers (such as Event ID 4662). Active Directory enumeration involves LDAP queries (e.g., querying group memberships, ACLs) which are logged in Domain Controller Security Event logs or Directory Service event logs (Event ID 4662).

Answer

Network interface duplex settings

Answer

USB device connection history

Answer

Browser extension inventory reports