XDR-Analyst Alert Lifecycle And Incident Correlation Practice Test 4 — 15 Questions

Question 1

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

Accepted Answer

Suppress or disable the noisy alert rule if it lacks operational value. To prevent false positives from polluting future incidents, analysts can create alert exclusions, tune detector thresholds, or suppress specific behavioral rules.

Answer

Star all future instances of the alert in the incident view

Answer

Add a featured field column to hide the false positive alerts

Question 2

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Accepted Answer

New. Standard incident lifecycle statuses in Cortex XDR include 'New', 'Under Investigation', 'Resolved', and 'Closed'.

Answer

Featured

Answer

Starred

Answer

Stitched

Question 3

Which TWO features assist an analyst in prioritizing which incidents to investigate first within the Cortex XDR console? (Choose two)

Accepted Answer

Incident Starring indicators. Analysts prioritize incidents using the Incident Score (severity) and Incident Starring for bookmarked high-priority items.

Answer

Data stitching status logs

Answer

Agent version compliance meters

Answer

Featured fields display order

Question 4

What THREE conditions can cause data stitching failures between network logs and endpoint telemetry in Cortex XDR? (Choose three)

Accepted Answer

Significant time skew or clock desynchronization between data sources. Data stitching can fail due to clock desynchronization, missing or unmapped user/IP identifiers, or events falling outside the correlation time window.

Answer

Starring the endpoint alerts during triage

Answer

Enabling featured fields for the network log source

Question 5

During an investigation, an analyst examines the Causality Chain and Incident Graph. What THREE key insights do these visualization tools provide into the incident lifecycle? (Choose three)

Accepted Answer

The chronological sequence of events spanning the entire incident. The Causality Chain and Incident Graph show process parent-child relationships, lateral movement across assets, and the chronological origin of the attack.

Answer

The custom featured fields assigned to the incident grid

Answer

The manual star status assigned by the shift supervisor

Question 6

Which TWO actions can an administrator take to tune incident scoring for high-value assets? (Choose two)

Accepted Answer

Assign assets to high criticality groups. Administrators can adjust asset criticality groups and configure scoring profiles to ensure high-value assets receive appropriate severity weights.

Answer

Enable automatic starring for all alerts on those assets

Answer

Adjust the global data stitching window

Answer

Create featured fields to display asset scores

Question 7

What THREE criteria are evaluated by Cortex XDR when determining whether incoming raw alerts should be grouped into an existing incident or spawn a new one? (Choose three)

Accepted Answer

Common affected entities such as hostnames or user accounts. Alert grouping is determined by shared indicators of compromise (IOCs), common affected entities (hosts/users), and temporal proximity.

Answer

Whether the previous alerts were starred by an analyst

Answer

The presence of custom featured fields in the table view

Question 8

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

Accepted Answer

Update the incident status (e.g., New to Under Investigation). Analysts can change incident statuses and assign ownership directly from the Incident View.

Answer

Build global dashboard metric widgets

Answer

Install Cortex XDR agents on remote endpoints

Answer

Configure custom data stitching parser scripts

Question 9

Which TWO attributes are typically displayed by default or through featured fields in the Cortex XDR Incident View grid? (Choose two)

Accepted Answer

Incident Severity and Score. The Incident View grid displays essential incident metadata such as Incident Name/ID, Severity, Status, Score, and custom featured fields.

Answer

Syslog server destination IP ports

Answer

Data stitching algorithm version numbers

Answer

Agent collector installation binaries

Question 10

What THREE outcomes typically occur when data stitching successfully links a network alert and an endpoint alert? (Choose three)

Accepted Answer

The timeline reflects a complete attack path across network and endpoint. Successful data stitching results in a unified incident containing both alerts, an updated aggregate incident score, and enriched asset visibility in the timeline.

Answer

Featured fields are wiped out and reset to default

Answer

All constituent raw alerts are automatically starred

Question 11

An XDR Analyst is investigating a newly generated incident in Palo Alto Networks Cortex XDR and notices that multiple disparate alerts from different endpoints and network sensors have been automatically grouped together. Which core mechanism of Cortex XDR is primarily responsible for intelligently grouping these related alerts into a single incident?

Accepted Answer

Incident scoring and analytics correlation engine. Cortex XDR uses a specialized analytics engine and data stitching algorithms to correlate and group related alerts across endpoints, network, and cloud sources into a single incident based on shared indicators of compromise or causality chains.

Answer

Alert starring

Answer

Local Analysis agent configuration

Answer

BIOC rule generation wizard

Question 12

A security analyst wants to adjust how Cortex XDR calculates incident severity to ensure that incidents involving domain controllers receive higher priority scores. Where should the analyst configure custom weights or scoring logic for incidents?

Accepted Answer

Under Settings > Configurations > Incident View > Incident Scoring. Incident severity and scoring rules can be customized in Cortex XDR under Incident View and Scoring settings to align with organizational risk appetite and asset criticality.

Answer

Under Endpoint Security > Settings > Profiles > Malware > Severity Adjustment

Answer

Under Response > Action Center > Scoring Policy

Answer

Under Correlation Rules > Custom BIOC > Severity Tab

Question 13

During an investigation of an advanced persistent threat, an analyst wants to customize the Incident View layout to ensure that custom fields populated via parsed log ingestion are prominently displayed at the top of every incident summary. How should the analyst achieve this?

Accepted Answer

By modifying the Incident Layout via Settings > Configurations > Incident View > Featured Fields. Cortex XDR allows administrators to configure featured fields to determine which data points appear prominently in the incident summary and table columns.

Answer

By creating a custom BIOC rule with output variables mapped to incident tags

Answer

By exporting the incident JSON schema and modifying the UI template mapping

Answer

By editing the Incident Scoring configuration file via the CLI

Question 14

An analyst is reviewing the Incidents page in Cortex XDR and wants to quickly highlight a critical ransomware incident so that the shift supervisor can review it immediately without changing its status. Which feature should the analyst use?

Accepted Answer

Alert starring. Analysts use alert or incident starring to flag items of interest for review, handover, or collaboration during triage.

Answer

Severity override

Answer

Incident assignment

Answer

Featured fields configuration

Question 15

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

Accepted Answer

Under the Incident Details page by selecting the Alerts tab. By drilling down into an incident in Cortex XDR, the analyst can access the Alert tab to inspect the individual raw alerts that make up the incident lineage.

Answer

Under Analytics > BIOC > Alert Log

Answer

Under Response > Action Center > History

Answer

Under Settings > Data Stitching > Raw Logs