XDR-Analyst Alert Lifecycle And Incident Correlation Practice Test 3 — 15 Questions

Question 1

Which dashboard widget type in Cortex XDR is best suited for tracking the volume of open incidents over time across different severity levels?

Accepted Answer

Incident trend and severity breakdown widgets. Incident trend and severity widgets in Cortex XDR dashboards display historical and real-time metrics categorized by severity levels.

Answer

Syslog export status meter

Answer

Data stitching performance monitor

Answer

Agent health and connectivity graph

Question 2

During an investigation, an analyst discovers that a raw alert was generated by a legitimate software update tool. To prevent this specific alert from triggering future incidents across all endpoints, how should the analyst proceed within the lifecycle management framework?

Accepted Answer

Create an alert exclusion based on the tool's file hash or digital signature. Creating an alert exception or exclusion based on file hash, path, or digital signature prevents future raw alerts and subsequent incident creation.

Answer

Modify the data stitching window to ignore update hours

Answer

Decrease the global incident scoring threshold

Answer

Star the alert and change its status to resolved

Question 3

An organization notices that Cortex XDR incidents are being assigned high severity scores primarily due to a noisy network alert rule that triggers frequently on internal port scans. What is the correct administrative workflow to resolve this scoring inflation?

Accepted Answer

Tune or disable the noisy detector rule, or adjust scoring weight profiles. To fix scoring inflation caused by noisy rules, administrators should tune or disable the specific detector rule or adjust scoring weights rather than ignoring incidents.

Answer

Star all alerts generated by the port scan rule

Answer

Hide the port scan column using featured fields

Answer

Enable data stitching overrides for internal ports

Question 4

An analyst wants to filter the Incident View to show only incidents that have been bookmarked by members of the SOC team. Which filter criterion should be applied?

Accepted Answer

Starred incidents filter. Cortex XDR supports filtering incidents by starred status to isolate bookmarked items.

Answer

Incident score range filter

Answer

Featured fields filter

Answer

Data stitching status filter

Question 5

What is the primary benefit of the raw-alert-to-incident lifecycle consolidation in Cortex XDR?

Accepted Answer

It reduces alert fatigue by grouping related alerts into a single cohesive incident. Consolidating numerous raw alerts into structured incidents reduces alert fatigue by presenting correlated threats as single investigative units.

Answer

It automatically patches vulnerable operating systems on endpoints

Answer

It encrypts raw log data before sending it to syslog servers

Answer

It replaces the need for data collectors and endpoint agents

Question 6

An analyst is investigating an incident and needs to determine whether lateral movement occurred between two endpoints. Which Cortex XDR feature provides the visual connection between these assets within the incident?

Accepted Answer

The Incident Graph and Causality Chain. The Causality Chain and Incident Graph provide visual representations of how threats move between processes, hosts, and networks during an attack.

Answer

The Data Stitching status indicator

Answer

The Alert Starring bookmark manager

Answer

The Featured Fields configuration panel

Question 7

An administrator configures a custom data stitching rule to correlate custom application logs with endpoint events. After deployment, no new incidents are formed from these logs. What is the most critical factor to verify when troubleshooting custom stitching rules?

Accepted Answer

That the custom log fields correctly map to shared schema identifiers like user or IP. Custom data stitching rules require exact field matching (such as matching keys, timestamps, and identifiers) between the custom log schema and the XDR schema.

Answer

That featured fields are enabled for the custom schema

Answer

That the incident score is locked at maximum

Answer

That all incoming custom logs are starred by default

Question 8

When reviewing an incident, an analyst wants to assign ownership to themselves. Which action should the analyst take?

Accepted Answer

Assign the incident to their user account in the Incident View. Assigning an incident to an analyst updates the incident ownership field in the Cortex XDR console.

Answer

Star the incident and export it to syslog

Answer

Change the data stitching profile name

Answer

Add a featured field with their username

Question 9

An enterprise wants to ensure that all incidents with a score above 80 are automatically escalated and assigned to a Tier-3 incident response queue. Where should an administrator configure this routing logic?

Accepted Answer

Incident assignment and automation rules. Automation and response rules in Cortex XDR (such as BIOC/XQL-based automation or incident assignment rules) allow routing based on score thresholds.

Answer

Data stitching parameter settings

Answer

Featured fields display configuration

Answer

Alert starring policies

Question 10

Which TWO actions can an analyst perform to manage and highlight specific findings during an incident investigation in Cortex XDR? (Choose two)

Accepted Answer

Star individual alerts within the incident details pane. Analysts can star individual alerts within an incident and star the overall incident to highlight and track them effectively.

Answer

Modify the data stitching window for the alert

Answer

Create a new featured field column for every raw alert

Answer

Delete raw alerts to recalculate the incident score

Question 11

During data stitching across endpoints and networks, what THREE core attributes does Cortex XDR typically leverage to correlate disparate logs into a single incident? (Choose three)

Accepted Answer

Timestamps and time correlation windows. Data stitching correlates multi-source logs using common identifiers such as internal/external IP addresses, user accounts, and precise timestamps.

Answer

Analyst star bookmarks

Answer

Featured field column configurations

Question 12

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

Accepted Answer

Configure exclusions for the vulnerability scanner's IP addresses or signature patterns. Creating exclusion rules for scanner IP addresses or signatures ensures vulnerability assessment traffic does not trigger security incidents.

Answer

Enable featured fields to hide scanner columns

Answer

Turn off data stitching across all internal subnets

Answer

Star all alerts generated during scanning windows

Question 13

Which TWO factors directly influence how Cortex XDR calculates the overall severity score of an incident? (Choose two)

Accepted Answer

The severity levels of the constituent raw alerts. Incident scores are calculated based on the severity of the constituent raw alerts and the criticality of the affected assets.

Answer

The number of featured fields enabled in the UI

Answer

The frequency of manual alert starring by analysts

Answer

The syslog forwarding port configuration

Question 14

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

Accepted Answer

Utilize asset criticality scoring profiles to elevate key asset visibility. Administrators can configure featured fields to display custom columns and apply scoring profiles to highlight high-priority assets.

Answer

Delete inactive data collectors to clear queue clutter

Answer

Enable automatic alert starring for every raw alert

Answer

Change data stitching rules to alter incident grid sorting

Question 15

Which TWO mechanisms are used by Cortex XDR to prevent alert fatigue during the raw-alert-to-incident lifecycle? (Choose two)

Accepted Answer

Alert exclusion and exception rules. Alert fatigue is mitigated by grouping related raw alerts into single incidents and utilizing exception rules to filter out benign activity.

Answer

Featured fields column configuration

Answer

Manual incident starring

Answer

Syslog log export scheduling