XDR-Analyst Alert Lifecycle And Incident Correlation Practice Test 3 — 15 Questions

Question 1

What is the primary purpose of starring an alert within an incident details pane?

Accepted Answer

To bookmark and highlight important alerts for tracking and collaboration. Starring an alert in the incident details pane is a bookmarking and highlighting action that lets analysts mark important alerts for tracking and collaboration. It does not change severity, trigger containment, or exclude the alert from future incidents. The star is purely a workflow and communication aid within the incident.

Answer

To permanently exclude the alert from future incident generation

Answer

To increase the incident severity score to critical

Answer

To automatically trigger containment actions on the endpoint

Question 2

An analyst is investigating an incident and needs to quickly view customized columns containing threat actor attribution tags in the incident grid. Which feature must be configured to show these columns?

Accepted Answer

Featured fields configuration. Featured fields in Cortex XDR let analysts define which alert and incident attributes are surfaced as columns in the incident and alert grids. To display threat actor attribution tags, the analyst must add those fields to the featured fields configuration so they render as columns. This is a display-layer configuration, not a detection or scoring change.

Answer

Data stitching parameters

Answer

Raw alert priority rules

Answer

Incident scoring weights

Question 3

A security engineer notices that raw alerts from a third-party firewall are successfully ingested into Cortex XDR but fail to correlate into existing endpoint incidents. Upon inspection, it is discovered that the firewall logs lack internal NAT translation details. How does this impact the raw-alert-to-incident lifecycle?

Accepted Answer

It breaks data stitching because internal and external IP mappings cannot be reconciled. Cortex XDR's stitching engine correlates alerts into incidents by matching shared identifiers such as internal IP, external IP, username, hostname, and NAT translation pairs. When firewall logs omit internal NAT details, the engine cannot map the external-facing IP in the firewall alert back to the internal endpoint IP seen in endpoint alerts, so the alerts remain orphaned and never join the existing incident. This is a data-stitching failure, not a scoring or UI issue.

Answer

It forces the incident score to default to maximum

Answer

It causes all firewall alerts to be automatically starred

Answer

It triggers featured fields to hide the firewall data source

Question 4

Where in the Cortex XDR console can an analyst review the complete lifecycle timeline of an incident, from initial raw alert generation to final resolution?

Accepted Answer

The Incident Details page and Incident Timeline view. The Incident Details page and Incident Timeline view in Cortex XDR provide a unified, chronological record of an incident's entire lifecycle. This includes the initial raw alert generation, subsequent alert grouping into an incident, all investigative actions taken, and the final resolution or closure. Analysts use this view to understand the full scope and progression of a security event without needing to correlate data from multiple separate tools.

Answer

The Syslog forwarding configuration panel

Answer

The Global Dashboard widget builder

Answer

The Agent installation status log

Question 5

An administrator wants to ensure that incidents generated by alerts involving domain controllers are always assigned a 'Critical' score. Which setting should be modified?

Accepted Answer

Asset criticality groups and incident scoring rules. To force incidents involving domain controllers to always score 'Critical,' the administrator must configure asset criticality groups (tagging domain controllers as high-value assets) and the incident scoring rules that map asset criticality to incident severity. This is the only setting that ties asset identity to score escalation.

Answer

Alert starring default policy

Answer

Data stitching time window

Answer

Featured fields display mapper

Question 6

During incident triage, an analyst notices that two completely separate attacks on different endpoints were merged into a single incident by Cortex XDR. What is the underlying reason for this over-correlation?

Accepted Answer

Shared common identifiers such as a NAT gateway IP address within the correlation window. Cortex XDR's correlation engine stitches alerts into incidents by matching shared identifiers — IP addresses, hostnames, usernames, file hashes, and similar artifacts — within a configurable correlation window. When two unrelated attacks both traverse the same NAT gateway, the public IP is identical in both alert sets, so the engine merges them into one incident. This is a classic over-correlation caused by shared infrastructure identifiers rather than true attack linkage.

Answer

All alerts were manually starred by an analyst

Answer

The incident scoring threshold was set too low

Answer

Featured fields were configured to group by IP subnet

Question 7

What action should an analyst take in Cortex XDR when an incident investigation is fully complete and all remediation steps have been verified?

Accepted Answer

Update the incident status to 'Resolved' or 'Closed'. Once an investigation and remediation are complete, the analyst should update the incident status to 'Resolved' or 'Closed'.

Answer

Apply a featured field to hide the incident

Answer

Star every alert in the incident queue

Answer

Delete all raw alerts associated with the incident

Question 8

An organization requires that specific custom threat intelligence tags appear as primary columns in the Incident View. How can an administrator achieve this?

Accepted Answer

Configure featured fields to include the custom threat intelligence tags. Featured fields in Cortex XDR let administrators choose which fields appear as primary columns in the Incident View, including custom threat intelligence tags. By adding the custom TI tag field to the featured fields configuration, those tags render as top-level columns for every incident, giving analysts immediate visibility without drilling into details.

Answer

Create a data stitching rule for threat intelligence

Answer

Set up an alert exclusion exception

Answer

Adjust the incident scoring profile weights

Question 9

An analyst is reviewing a raw alert that was generated by Cortex XDR analytics. The alert indicates suspicious behavior, but no incident was created. What is the most likely explanation?

Accepted Answer

The raw alert did not meet the threshold for incident creation or was grouped into an existing incident. Analytics generate raw alerts, but an alert must meet specific correlation thresholds or aggregation criteria before an incident is spawned, or it may have been grouped into an existing incident.

Answer

Featured fields were disabled for the analytic detector

Answer

The alert was automatically starred, preventing incident promotion

Answer

Data stitching was turned off globally

Question 10

When sorting incidents in the Cortex XDR console to find the most severe threats first, which attribute is most commonly used?

Accepted Answer

Incident Score / Severity. The Incident Score (also surfaced as Severity) is the primary numeric attribute used to rank incidents by threat severity in Cortex XDR. Sorting the Incident View by Incident Score descending brings the highest-risk incidents to the top, which is the standard triage workflow. It aggregates alert severity, asset criticality, and other weighted factors into a single comparable value.

Answer

Data stitching identifier

Answer

Featured field display order

Answer

Agent version number

Question 11

An analyst wants to flag a particular high-priority incident so that other shift analysts immediately notice it when they log in. What is the most direct feature to use?

Accepted Answer

Incident starring. Incident starring is the built-in Cortex XDR feature that lets an analyst bookmark an incident so it stands out for other team members. Starred incidents are visually flagged in the Incident View and can be filtered, making it the most direct way to draw a shift's attention to a specific case. It requires no rule changes or forwarding configuration.

Answer

Alert exclusion rule

Answer

Syslog forwarding profile

Answer

Data stitching configuration

Question 12

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

Accepted Answer

New. When the Cortex XDR correlation engine automatically generates an incident from correlated alerts, it is assigned the status 'New' by default. This indicates the incident has been created but not yet triaged, assigned, or acted upon by an analyst. Status transitions (e.g., Under Investigation, Resolved, Closed) occur only after human or automated workflow actions.

Answer

Closed

Answer

Under Investigation

Answer

Resolved

Question 13

An administrator needs to customize the incident queue to show the 'OS Version' column for all displayed incidents. Which configuration interface should be accessed?

Accepted Answer

Featured fields settings. Featured fields configuration allows administrators to add standard or custom attributes like OS Version as columns in the incident table.

Answer

Incident scoring weight profiles

Answer

Alert exclusion rule manager

Answer

Data stitching correlation parameters

Question 14

An enterprise ingests proxy logs and endpoint telemetry into Cortex XDR. An analyst notices that web traffic alerts for a specific user are not correlating with the user's endpoint malware alerts. What is a common prerequisite for successful identity-based data stitching across network and endpoint sources?

Accepted Answer

Consistent user naming conventions and identity mapping across log sources. Identity stitching requires consistent username formatting and mapping (such as Active Directory user principal names or NetBIOS names) across all ingested log sources.

Answer

Incident scoring must be set to manual mode

Answer

All alerts must be manually starred by an analyst

Answer

Featured fields must be enabled for proxy logs

Question 15

Which dashboard widget type in Cortex XDR is best suited for tracking the volume of open incidents over time across different severity levels?

Accepted Answer

Incident trend and severity breakdown widgets. Incident trend and severity widgets in Cortex XDR dashboards display historical and real-time metrics categorized by severity levels.

Answer

Syslog export status meter

Answer

Data stitching performance monitor

Answer

Agent health and connectivity graph