XDR-Analyst Alert Lifecycle And Incident Correlation Practice Test 2 — 15 Questions

Question 1

A Cortex XDR incident is automatically created when multiple alerts are stitched together. The analyst wants to see the exact sequence of events that led to the incident, including the first alert and subsequent related alerts. Which section of the Incident view provides this chronological ordering?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident Timeline. The Incident Timeline is the dedicated view that orders all alerts and events chronologically, making it the correct choice for understanding the sequence of events that led to the incident. It helps analysts reconstruct the attack timeline and identify the initial vector.

Answer

Alert Grid

Answer

Incident Summary

Answer

Causality Chain

Question 2

An analyst is reviewing a Cortex XDR incident that contains several alerts. They want to add a note to one specific alert within the incident, indicating that it has been reviewed and deemed benign. Where can the analyst add this note so that it is associated with that alert rather than the entire incident?

Accepted Answer

By opening the alert's details from the incident's Alerts tab and using the 'Add Note' option in the alert's context menu.. Cortex XDR allows analysts to add notes directly to individual alerts within an incident. This is done by accessing the alert's context menu from the Alerts tab of the incident. Notes added this way are stored with the alert and are visible in the alert's details, ensuring that the annotation is tied to the specific alert rather than the incident as a whole.

Answer

By editing the alert's raw data in the Alert View and adding a comment field.

Answer

In the incident's Notes tab, by creating a new note and linking it to the alert ID.

Answer

By using the 'Add Tag' function on the incident and creating a tag with the alert ID and note text.

Question 3

An analyst is reviewing a Cortex XDR incident that was created by stitching together multiple alerts. The analyst wants to manually add a related alert from a different endpoint to the existing incident to keep all related activity together. Which two actions are possible in Cortex XDR to achieve this? (Choose two.)

Accepted Answer

Use the 'Add to Incident' action from the Alerts page.. The 'Add to Incident' action on the Alerts page allows direct manual association of alerts with an existing incident. Additionally, if the alert resides in another incident, merging incidents consolidates them. Both methods enable analysts to manually group related alerts, ensuring comprehensive incident context.

Answer

Modify the incident's stitching rules to include the alert.

Answer

Create a custom BIOC rule to trigger the alert into the incident.

Answer

Drag and drop the alert from the Alerts page onto the incident in the Incidents page.

Question 4

A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?

Accepted Answer

Incident starring. Incident starring in Cortex XDR is a manual flag that analysts apply to specific incidents to mark them as noteworthy — for example, for executive visibility or follow-up. Starred incidents can be filtered and surfaced in dashboards, making them easy to track. This is the intended feature for flagging individual incidents without altering their severity or correlation logic.

Answer

Incident scoring threshold override

Answer

Data stitching rule assignment

Answer

Featured fields configuration

Question 5

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Accepted Answer

The time delta between the endpoint and network events exceeds the stitching correlation window. Cortex XDR stitches alerts into incidents by correlating on shared featured fields (such as IP, user, hostname) within a defined time window. If the endpoint event and the network event occur too far apart in time, the correlation engine will not merge them, so they appear as separate incidents even though the IP and user match. The most likely cause is therefore that the time delta exceeds the stitching window.

Answer

The incident score was manually overridden to low

Answer

Alert starring was disabled on the network data source

Answer

Featured fields were not configured for the network logs

Question 6

During the raw-alert-to-incident lifecycle, an alert is generated by a custom BIOC (Behavioral Indicator of Compromise). At what point does this raw alert transition into an actionable incident?

Accepted Answer

Immediately upon correlation and grouping by the Incident Engine. When a raw alert triggers, Cortex XDR evaluates it against existing open incidents or creates a new incident based on correlation and stitching logic, moving it into the Incident View.

Answer

Only after an analyst manually assigns a severity score

Answer

Once featured fields are populated for the data source

Answer

When the alert is starred by a tier-2 analyst

Question 7

An analyst wants to quickly identify all alerts related to a specific external IP address across multiple incidents without opening each incident individually. Which feature in the Cortex XDR console should the analyst use?

Accepted Answer

Alerts View filter and search capabilities. The Alerts View in Cortex XDR provides a centralized, filterable list of all raw alerts across every incident, with search capabilities that let analysts query by indicator values such as an external IP address. This allows the analyst to pivot on the IP without opening each incident individually, since alerts from multiple incidents are aggregated in a single searchable table. Filtering and searching at the Alerts View level is the intended workflow for cross-incident indicator hunting.

Answer

Incident scoring threshold filter

Answer

Featured fields sorting

Answer

Data stitching status toggle

Question 8

An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?

Accepted Answer

Create an alert exclusion or exception rule. When legitimate administrative scripts repeatedly trigger low-level behavioral alerts, the correct lifecycle action is to create an alert exclusion or exception rule that suppresses those specific alerts based on defined criteria. This prevents the noise from cluttering the incident queue while preserving detection for genuinely malicious script behavior. Exclusions are the standard mechanism for tuning out known-benign activity without disabling the underlying detection logic entirely.

Answer

Manually star all related alerts

Answer

Increase the data stitching window

Answer

Modify featured fields to hide script alerts

Question 9

An administrator is reviewing a newly generated incident in Cortex XDR and notices that multiple low-severity alerts from different endpoints have been grouped together. Which mechanism is primarily responsible for this automated grouping?

Accepted Answer

Cortex XDR correlation rules and analytics grouping. Cortex XDR uses Analytics and Analytics Profiling, along with correlation rules, to automatically group related alerts into a single incident based on indicators of compromise and shared telemetry.

Answer

Syslog forwarding profile filters

Answer

Manual aggregation by the assigned security analyst

Answer

The endpoint agent local threshold configuration

Question 10

Which role-based permission is typically required for an analyst to change the status of an incident from 'New' to 'Under Investigation' in Cortex XDR?

Accepted Answer

Cortex XDR Analyst role. Changing an incident's status from 'New' to 'Under Investigation' is a core triage action performed by an analyst, and the Cortex XDR Analyst role includes the permissions necessary to manage incident lifecycle states. This role is designed for day-to-day SOC operations, including incident review, status changes, and investigation workflows. Administrative or specialized roles are not required for this routine action.

Answer

Data stitching configuration role

Answer

Syslog forwarding administrator

Answer

Collector installation role

Question 11

When reviewing the Incident View, an analyst notices an incident with an orange severity badge. What does this severity level typically indicate in Cortex XDR?

Accepted Answer

High severity incident. Cortex XDR uses standard severity levels (Low, Medium, High, Critical) represented by color-coded badges, where orange typically denotes High severity.

Answer

Critical severity incident requiring immediate containment

Answer

Low priority false positive

Answer

Informational event requiring no action

Question 12

When analyzing a complex multi-stage attack in Cortex XDR, an analyst examines the Causality Chain. How does the Causality Chain assist in understanding the raw-alert-to-incident lifecycle?

Accepted Answer

It traces the parent-child process relationship and telemetry leading to the alert. The Causality Chain visualizes the chronological sequence of processes, network connections, and file modifications that led to an alert, helping trace the origin of the incident.

Answer

It automatically recalculates the incident score based on user activity

Answer

It stitches network logs with endpoint logs using IP subnet masks

Answer

It filters featured fields to highlight malicious hashes

Question 13

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

Accepted Answer

Cross-data-source data stitching. Cross-data-source data stitching is the Cortex XDR mechanism that correlates alerts and events from different telemetry sources (XDR agents, third-party firewalls, cloud logs) into a single unified incident. It links entities like IPs, hostnames, and users across sources so that a firewall alert and an endpoint alert about the same attack are presented as one incident rather than separate alerts.

Answer

Automated alert starring

Answer

Incident score weighting tables

Answer

Featured fields column mapping

Question 14

An incident in Cortex XDR contains dozens of low-priority alerts that were grouped together. The analyst determines that one specific alert within the incident is a false positive while the rest are legitimate threats. What is the best practice for handling this specific raw alert?

Accepted Answer

Mark the specific raw alert as a false positive or dismiss it within the incident view. Cortex XDR allows analysts to act on individual raw alerts inside a grouped incident. Marking the specific alert as a false positive or dismissing it removes it from the incident's active alert set without affecting the other legitimate alerts, preserving the incident's integrity and the analyst's triage record. This is the documented best practice for handling a single false positive within a multi-alert incident.

Answer

Change the incident score to zero to hide all alerts

Answer

Delete the entire incident and recreate it manually

Answer

Apply an alert starring filter to exclude the false positive

Question 15

An analyst observes that an incident's score dynamically increases over time as new related alerts are added. Which component of Cortex XDR drives this behavior?

Accepted Answer

The dynamic incident scoring engine. Cortex XDR's dynamic incident scoring engine continuously recalculates an incident's score as new related alerts are stitched into it, factoring in alert severity, asset criticality, and alert volume. This is why the score rises over time as more correlated alerts arrive — it is the scoring engine, not any UI or retention component, that drives the dynamic behavior.

Answer

The manual analyst assignment workflow

Answer

The log collector retention policy

Answer

The featured fields rendering engine