XDR-Analyst Alert Lifecycle And Incident Correlation Practice Test 2 — 15 Questions

Question 1

An analyst observes that an incident's score dynamically increases over time as new related alerts are added. Which component of Cortex XDR drives this behavior?

Accepted Answer

The dynamic incident scoring engine. The Cortex XDR incident scoring engine recalculates the overall incident score dynamically as new telemetry and raw alerts are stitched and added to the incident context.

Answer

The manual analyst assignment workflow

Answer

The log collector retention policy

Answer

The featured fields rendering engine

Question 2

What is the primary purpose of starring an alert within an incident details pane?

Accepted Answer

To bookmark and highlight important alerts for tracking and collaboration. Starring alerts helps analysts highlight key findings or indicators of compromise for collaboration and quick reference during or after an investigation.

Answer

To permanently exclude the alert from future incident generation

Answer

To increase the incident severity score to critical

Answer

To automatically trigger containment actions on the endpoint

Question 3

An analyst is investigating an incident and needs to quickly view customized columns containing threat actor attribution tags in the incident grid. Which feature must be configured to show these columns?

Accepted Answer

Featured fields configuration. Featured fields allow security teams to customize grid views with specific metadata fields relevant to their operational needs.

Answer

Data stitching parameters

Answer

Raw alert priority rules

Answer

Incident scoring weights

Question 4

A security engineer notices that raw alerts from a third-party firewall are successfully ingested into Cortex XDR but fail to correlate into existing endpoint incidents. Upon inspection, it is discovered that the firewall logs lack internal NAT translation details. How does this impact the raw-alert-to-incident lifecycle?

Accepted Answer

It breaks data stitching because internal and external IP mappings cannot be reconciled. Data stitching relies heavily on accurate IP addresses, ports, and timestamps. Missing NAT information breaks the link between internal endpoints and external network traffic, preventing correlation.

Answer

It forces the incident score to default to maximum

Answer

It causes all firewall alerts to be automatically starred

Answer

It triggers featured fields to hide the firewall data source

Question 5

Where in the Cortex XDR console can an analyst review the complete lifecycle timeline of an incident, from initial raw alert generation to final resolution?

Accepted Answer

The Incident Details page and Incident Timeline view. The Incident View provides a detailed breakdown of an incident, including its timeline, associated alerts, affected assets, and lifecycle status.

Answer

The Syslog forwarding configuration panel

Answer

The Global Dashboard widget builder

Answer

The Agent installation status log

Question 6

An administrator wants to ensure that incidents generated by alerts involving domain controllers are always assigned a 'Critical' score. Which setting should be modified?

Accepted Answer

Asset criticality groups and incident scoring rules. Scoring profiles or asset criticality rules allow administrators to assign specific score modifiers based on asset groups like domain controllers.

Answer

Alert starring default policy

Answer

Data stitching time window

Answer

Featured fields display mapper

Question 7

During incident triage, an analyst notices that two completely separate attacks on different endpoints were merged into a single incident by Cortex XDR. What is the underlying reason for this over-correlation?

Accepted Answer

Shared common identifiers such as a NAT gateway IP address within the correlation window. Over-correlation typically occurs when disparate alerts share a common indicator (such as a shared NAT gateway IP address or a generic proxy server) within the same time window, tricking the stitching engine.

Answer

All alerts were manually starred by an analyst

Answer

The incident scoring threshold was set too low

Answer

Featured fields were configured to group by IP subnet

Question 8

What action should an analyst take in Cortex XDR when an incident investigation is fully complete and all remediation steps have been verified?

Accepted Answer

Update the incident status to 'Resolved' or 'Closed'. Once an investigation and remediation are complete, the analyst should update the incident status to 'Resolved' or 'Closed'.

Answer

Apply a featured field to hide the incident

Answer

Star every alert in the incident queue

Answer

Delete all raw alerts associated with the incident

Question 9

An organization requires that specific custom threat intelligence tags appear as primary columns in the Incident View. How can an administrator achieve this?

Accepted Answer

Configure featured fields to include the custom threat intelligence tags. Featured fields allow administrators to select custom fields and tags to be displayed as columns in the Incident View.

Answer

Create a data stitching rule for threat intelligence

Answer

Set up an alert exclusion exception

Answer

Adjust the incident scoring profile weights

Question 10

An analyst is reviewing a raw alert that was generated by Cortex XDR analytics. The alert indicates suspicious behavior, but no incident was created. What is the most likely explanation?

Accepted Answer

The raw alert did not meet the threshold for incident creation or was grouped into an existing incident. Analytics generate raw alerts, but an alert must meet specific correlation thresholds or aggregation criteria before an incident is spawned, or it may have been grouped into an existing incident.

Answer

Featured fields were disabled for the analytic detector

Answer

The alert was automatically starred, preventing incident promotion

Answer

Data stitching was turned off globally

Question 11

When sorting incidents in the Cortex XDR console to find the most severe threats first, which attribute is most commonly used?

Accepted Answer

Incident Score / Severity. The Incident Score (or severity) is the primary metric used to sort and prioritize incidents in the incident queue.

Answer

Data stitching identifier

Answer

Featured field display order

Answer

Agent version number

Question 12

An analyst wants to flag a particular high-priority incident so that other shift analysts immediately notice it when they log in. What is the most direct feature to use?

Accepted Answer

Incident starring. Starring an incident marks it for visibility and easy filtering across the SOC team.

Answer

Alert exclusion rule

Answer

Syslog forwarding profile

Answer

Data stitching configuration

Question 13

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

Accepted Answer

New. Newly created incidents default to the 'New' status until an analyst takes ownership and updates the status.

Answer

Closed

Answer

Under Investigation

Answer

Resolved

Question 14

An administrator needs to customize the incident queue to show the 'OS Version' column for all displayed incidents. Which configuration interface should be accessed?

Accepted Answer

Featured fields settings. Featured fields configuration allows administrators to add standard or custom attributes like OS Version as columns in the incident table.

Answer

Incident scoring weight profiles

Answer

Alert exclusion rule manager

Answer

Data stitching correlation parameters

Question 15

An enterprise ingests proxy logs and endpoint telemetry into Cortex XDR. An analyst notices that web traffic alerts for a specific user are not correlating with the user's endpoint malware alerts. What is a common prerequisite for successful identity-based data stitching across network and endpoint sources?

Accepted Answer

Consistent user naming conventions and identity mapping across log sources. Identity stitching requires consistent username formatting and mapping (such as Active Directory user principal names or NetBIOS names) across all ingested log sources.

Answer

Incident scoring must be set to manual mode

Answer

All alerts must be manually starred by an analyst

Answer

Featured fields must be enabled for proxy logs