XDR-Analyst Alert Lifecycle And Incident Correlation Practice Test 4 — 15 Questions

Question 1

During an investigation, an analyst discovers that a raw alert was generated by a legitimate software update tool. To prevent this specific alert from triggering future incidents across all endpoints, how should the analyst proceed within the lifecycle management framework?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an alert exclusion based on the tool's file hash or digital signature. Creating an alert exception or exclusion based on file hash, path, or digital signature prevents future raw alerts and subsequent incident creation.

Answer

Modify the data stitching window to ignore update hours

Answer

Decrease the global incident scoring threshold

Answer

Star the alert and change its status to resolved

Question 2

An organization notices that Cortex XDR incidents are being assigned high severity scores primarily due to a noisy network alert rule that triggers frequently on internal port scans. What is the correct administrative workflow to resolve this scoring inflation?

Accepted Answer

Tune or disable the noisy detector rule, or adjust scoring weight profiles. Scoring inflation from a noisy detector is resolved at the source: tune or disable the offending rule so it stops generating high-severity alerts, and/or adjust the scoring weight profile so that category of alert contributes less to the incident score. Both actions address the root cause — the rule's volume and its weight in the scoring model — rather than masking the symptom.

Answer

Star all alerts generated by the port scan rule

Answer

Hide the port scan column using featured fields

Answer

Enable data stitching overrides for internal ports

Question 3

An analyst wants to filter the Incident View to show only incidents that have been bookmarked by members of the SOC team. Which filter criterion should be applied?

Accepted Answer

Starred incidents filter. Cortex XDR's Incident View includes a 'Starred' filter that shows only incidents bookmarked by analysts. Applying this filter narrows the grid to starred incidents, which is exactly what the SOC team needs to see bookmarked cases. It is a first-class filter criterion in the incident grid's filter panel.

Answer

Incident score range filter

Answer

Featured fields filter

Answer

Data stitching status filter

Question 4

What is the primary benefit of the raw-alert-to-incident lifecycle consolidation in Cortex XDR?

Accepted Answer

It reduces alert fatigue by grouping related alerts into a single cohesive incident. Cortex XDR's raw-alert-to-incident lifecycle consolidation groups related raw alerts (from endpoints, network, identity, and cloud sources) into a single cohesive incident, dramatically reducing the number of items an analyst must triage. This directly addresses alert fatigue by presenting one correlated case with unified timeline, causality chain, and root-cause view instead of dozens of disconnected alerts. The consolidation is the core value proposition of an XDR platform versus standalone EDR or SIEM tools.

Answer

It automatically patches vulnerable operating systems on endpoints

Answer

It encrypts raw log data before sending it to syslog servers

Answer

It replaces the need for data collectors and endpoint agents

Question 5

An analyst is investigating an incident and needs to determine whether lateral movement occurred between two endpoints. Which Cortex XDR feature provides the visual connection between these assets within the incident?

Accepted Answer

The Incident Graph and Causality Chain. The Incident Graph and Causality Chain in Cortex XDR visually maps how processes, alerts, and endpoints relate within an incident, making lateral movement between two endpoints visible as a connected chain of causality. It shows the parent-child process relationships and network connections that link the assets. This is the feature purpose-built for visualizing asset-to-asset relationships in an incident.

Answer

The Data Stitching status indicator

Answer

The Alert Starring bookmark manager

Answer

The Featured Fields configuration panel

Question 6

An administrator configures a custom data stitching rule to correlate custom application logs with endpoint events. After deployment, no new incidents are formed from these logs. What is the most critical factor to verify when troubleshooting custom stitching rules?

Accepted Answer

That the custom log fields correctly map to shared schema identifiers like user or IP. Custom stitching rules only form incidents when the fields in the custom log schema map to the shared identifiers Cortex XDR uses for correlation — typically user, IP, hostname, or agent ID. If the custom log's fields are not mapped to these shared schema identifiers, the stitching engine has no join key and no incidents are created, even though logs are ingested. Verifying field mapping is the most critical troubleshooting step.

Answer

That featured fields are enabled for the custom schema

Answer

That the incident score is locked at maximum

Answer

That all incoming custom logs are starred by default

Question 7

When reviewing an incident, an analyst wants to assign ownership to themselves. Which action should the analyst take?

Accepted Answer

Assign the incident to their user account in the Incident View. Assigning an incident to an analyst updates the incident ownership field in the Cortex XDR console.

Answer

Star the incident and export it to syslog

Answer

Change the data stitching profile name

Answer

Add a featured field with their username

Question 8

An enterprise wants to ensure that all incidents with a score above 80 are automatically escalated and assigned to a Tier-3 incident response queue. Where should an administrator configure this routing logic?

Accepted Answer

Incident assignment and automation rules. Incident assignment and automation rules in Cortex XDR let administrators define conditions (such as incident score thresholds) and the resulting actions (escalate, assign to a queue, change severity). Configuring a rule with a score > 80 condition and a Tier-3 queue target is exactly the intended use. This is the only option that provides routing logic tied to incident attributes.

Answer

Data stitching parameter settings

Answer

Featured fields display configuration

Answer

Alert starring policies

Question 9

Which TWO actions can an analyst perform to manage and highlight specific findings during an incident investigation in Cortex XDR? (Choose two)

Accepted Answer

Star individual alerts within the incident details pane. Option B is correct because Cortex XDR lets analysts star individual alerts inside the incident details pane, which flags those specific findings for quick reference and prioritization during the investigation. Option D is correct because analysts can also star the overall incident in the Incident View, marking the entire case as important so it stands out in the incident list and can be filtered or tracked more easily. These starring actions are the intended mechanisms for managing and highlighting findings without altering the underlying data. Option A is incorrect because the data stitching window is a configuration setting that controls how alerts are correlated, not a way to highlight findings. Option C is incorrect because featured fields are configured in the Cortex XDR management settings, not created per raw alert by an analyst during an investigation. Option E is incorrect because deleting raw alerts is not a supported way to manage findings and would undermine the integrity of the incident rather than recalculate its score.

Answer

Modify the data stitching window for the alert

Answer

Create a new featured field column for every raw alert

Answer

Delete raw alerts to recalculate the incident score

Question 10

During data stitching across endpoints and networks, what THREE core attributes does Cortex XDR typically leverage to correlate disparate logs into a single incident? (Choose three)

Accepted Answer

Timestamps and time correlation windows. Cortex XDR correlates disparate logs into a single incident by leveraging core attributes that are common across data sources. Option A is correct because timestamps and time correlation windows allow the platform to align events that occurred within a defined temporal proximity, which is essential for stitching activity across endpoints and networks. Option C is correct because user identity and account names (e.g., usernames, SIDs, or UPNs) provide a consistent actor reference that links activity observed on different sensors to the same person or account. Option D is correct because source and destination IP addresses are key network-level indicators that tie endpoint telemetry to network logs and help establish communication paths between hosts. Option B is not correct because analyst star bookmarks are an investigation convenience for marking events, not a correlation attribute used to stitch logs. Option E is not correct because featured field column configurations are UI display settings in the Cortex XDR console and do not drive incident correlation.

Answer

Analyst star bookmarks

Answer

Featured field column configurations

Question 11

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

Accepted Answer

Configure exclusions for the vulnerability scanner's IP addresses or signature patterns. Creating exclusion rules for scanner IP addresses or signatures ensures vulnerability assessment traffic does not trigger security incidents.

Answer

Enable featured fields to hide scanner columns

Answer

Turn off data stitching across all internal subnets

Answer

Star all alerts generated during scanning windows

Question 12

Which TWO factors directly influence how Cortex XDR calculates the overall severity score of an incident? (Choose two)

Accepted Answer

The severity levels of the constituent raw alerts. Cortex XDR derives an incident's overall severity from the severity of the individual alerts that are grouped into it, so option A is correct because the constituent raw alerts' severity levels are a direct input to the incident severity calculation. Option C is also correct because Cortex XDR factors in the criticality weighting of the affected assets (for example, asset criticality values configured in the asset inventory) when computing the incident severity. Option B is incorrect because enabling featured fields only changes which columns are displayed in the UI and has no effect on severity scoring. Option D is incorrect because manually starring alerts is an analyst triage action, not a scoring input. Option E is incorrect because syslog forwarding port configuration relates only to external log export and does not influence incident severity.

Answer

The number of featured fields enabled in the UI

Answer

The frequency of manual alert starring by analysts

Answer

The syslog forwarding port configuration

Question 13

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

Accepted Answer

Utilize asset criticality scoring profiles to elevate key asset visibility. Option D is correct because Cortex XDR lets administrators configure featured fields, which add custom columns to the Incident View so that specific metadata relevant to their environment is displayed directly in the incident grid. Option C is correct because asset criticality scoring profiles assign criticality values to assets, and this criticality metadata is surfaced in the Incident View to elevate the visibility of incidents involving key or high-value assets. Option A is incorrect because deleting inactive data collectors only removes unused collector entries and does not customize or enhance incident metadata visibility. Option B is incorrect because automatically starring every raw alert would simply flag all alerts indiscriminately and does not add or customize metadata columns in the Incident View. Option E is incorrect because data stitching rules determine how alerts are correlated into incidents, not how the incident grid is sorted or which metadata columns are shown.

Answer

Delete inactive data collectors to clear queue clutter

Answer

Enable automatic alert starring for every raw alert

Answer

Change data stitching rules to alter incident grid sorting

Question 14

Which TWO mechanisms are used by Cortex XDR to prevent alert fatigue during the raw-alert-to-incident lifecycle? (Choose two)

Accepted Answer

Alert exclusion and exception rules. Option A (Alert exclusion and exception rules) is correct because Cortex XDR lets analysts define exclusion and exception policies that suppress or filter known-benign raw alerts before they escalate, directly reducing the volume of noise that would otherwise contribute to alert fatigue. Option B (Automated alert grouping and incident correlation) is correct because Cortex XDR automatically groups related raw alerts and correlates them into a single incident, so multiple low-level alerts become one actionable case rather than many separate notifications, which is a core anti-fatigue mechanism in the raw-alert-to-incident lifecycle. Option C (Featured fields column configuration) is incorrect because it only customizes how columns are displayed in the alert table and does not reduce or consolidate alert volume. Option D (Manual incident starring) is incorrect because starring is a manual analyst convenience for flagging incidents and does not prevent fatigue through automated suppression or grouping. Option E (Syslog log export scheduling) is incorrect because scheduling syslog exports is a data-forwarding/reporting function and has no role in reducing alert fatigue within the incident lifecycle.

Answer

Featured fields column configuration

Answer

Manual incident starring

Answer

Syslog log export scheduling

Question 15

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

Accepted Answer

Suppress or disable the noisy alert rule if it lacks operational value. Option B is correct because suppressing or disabling an alert rule that has no operational value stops the recurring false positive from generating new incidents, directly reducing incident pollution at the rule level. Option C is correct because tuning the specific detector or BIOC rule parameters (for example, adjusting thresholds, logic, or conditions) refines detection so the benign activity no longer triggers the rule while preserving its legitimate detections. Option E is correct because creating an alert exclusion rule scoped to unique file hashes or paths precisely filters out the known-benign artifacts, preventing those specific false positives from re-entering the incident queue without broadly weakening detection. Option A does not belong because starring alerts only flags them for visibility and does not prevent them from being generated or polluting incidents. Option D does not belong because adding a featured field column merely changes how alerts are displayed and hides nothing from the incident pipeline, so the false positives still occur.

Answer

Star all future instances of the alert in the incident view

Answer

Add a featured field column to hide the false positive alerts