XDR-Analyst Alert Lifecycle And Incident Correlation Practice Test 5 — 15 Questions

Question 1

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Accepted Answer

New. Option A, New, is correct because a newly generated incident in Cortex XDR begins in the New state, which is the initial stage of the standard incident lifecycle before any analyst action is taken. Option D, Under Investigation, is correct because once an analyst begins working an incident, it moves to the Under Investigation state, which is a defined stage in the standard lifecycle. The remaining options do not belong: Featured and Starred are not lifecycle states but rather UI flags or filters used to mark or prioritize incidents for quick access, and Stitched refers to the stitching of related alerts/causality events into an incident, not a lifecycle state.

Answer

Featured

Answer

Starred

Answer

Stitched

Question 2

What THREE conditions can cause data stitching failures between network logs and endpoint telemetry in Cortex XDR? (Choose three)

Accepted Answer

Significant time skew or clock desynchronization between data sources. Data stitching in Cortex XDR correlates network logs with endpoint telemetry by matching on common fields within a bounded time period, so A is correct because significant time skew or clock desynchronization between data sources prevents events from aligning on the timeline and breaks the correlation. C is correct because unmapped or inconsistent user identity formats across systems mean the identity field cannot be normalized and matched between network and endpoint records, so the stitch key fails. D is correct because events occurring outside the predefined data stitching time window fall outside the correlation interval and are never paired, even if all other fields match. B is not a stitching condition—starring endpoint alerts is a triage/UI action that does not alter the underlying correlation logic. E is not a cause of failure—enabling featured fields for the network log source supports parsing and field extraction rather than preventing stitching.

Answer

Starring the endpoint alerts during triage

Answer

Enabling featured fields for the network log source

Question 3

During an investigation, an analyst examines the Causality Chain and Incident Graph. What THREE key insights do these visualization tools provide into the incident lifecycle? (Choose three)

Accepted Answer

The chronological sequence of events spanning the entire incident. Option A is correct because the Causality Chain and Incident Graph present events in chronological order, letting the analyst trace the full timeline of the incident from first activity to resolution. Option B is correct because these visualizations map parent-child process relationships, exposing the process lineage that led to the initial alert and revealing how malicious code was spawned. Option D is correct because the graph links activity across hosts and network segments, making lateral movement pathways between endpoints and networks visible. Option C is not correct because custom featured fields are grid configuration metadata, not insights derived from the causality or incident graph. Option E is not correct because the manual star status is an analyst-assigned triage marker, not a lifecycle insight produced by these visualization tools.

Answer

The custom featured fields assigned to the incident grid

Answer

The manual star status assigned by the shift supervisor

Question 4

What THREE criteria are evaluated by Cortex XDR when determining whether incoming raw alerts should be grouped into an existing incident or spawn a new one? (Choose three)

Accepted Answer

Common affected entities such as hostnames or user accounts. Cortex XDR groups incoming raw alerts into an existing incident primarily based on shared affected entities (Option A), such as the same hostname, endpoint, or user account, since alerts touching the same asset or identity are treated as part of one attack story. It also evaluates shared indicators of compromise (Option C) — matching file hashes, IP addresses, or domains — because overlapping IOCs signal the same underlying activity. Finally, temporal proximity and correlation time windows (Option E) matter, as alerts falling within the configured correlation window are candidates for merging while older alerts fall outside and spawn a new incident. Options B and D are not grouping criteria: starring an alert is only an analyst triage/UI action, and custom featured fields merely control table-view display, neither of which influences incident correlation logic.

Answer

Whether the previous alerts were starred by an analyst

Answer

The presence of custom featured fields in the table view

Question 5

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

Accepted Answer

Update the incident status (e.g., New to Under Investigation). Option A is correct because the Incident View in Cortex XDR provides a status field where analysts can change an incident's state (for example, from New to Under Investigation) as part of the incident lifecycle workflow. Option C is correct because the same Incident View lets you assign the incident to a specific analyst (owner), enabling accountability and routing of the investigation. These are both core incident-management actions exposed directly in the Incident View UI. Option B is not correct because dashboard metric widgets are built in the Dashboards/Reports area, not from an incident record. Option D is not correct because agent installation is handled through endpoint management (e.g., Agent Installations/Endpoints), not the Incident View. Option E is not correct because custom data stitching parser scripts are configured in the data management/parsing settings, not within an incident.

Answer

Build global dashboard metric widgets

Answer

Install Cortex XDR agents on remote endpoints

Answer

Configure custom data stitching parser scripts

Question 6

Which TWO attributes are typically displayed by default or through featured fields in the Cortex XDR Incident View grid? (Choose two)

Accepted Answer

Incident Severity and Score. The Cortex XDR Incident View grid surfaces each incident's severity level and its associated score as featured columns, allowing analysts to triage and prioritize by risk. Option C (Incident ID and Name) is also correct because the grid displays the unique incident identifier and the incident name as default identifying fields for each row. These fields are part of the standard incident metadata shown in the Incidents table. Options B, D, and E are not default or featured incident grid fields: syslog destination ports relate to log forwarding configuration, data stitching algorithm versions are internal engine details not shown in the grid, and agent collector installation binaries are deployment artifacts rather than incident attributes.

Answer

Syslog server destination IP ports

Answer

Data stitching algorithm version numbers

Answer

Agent collector installation binaries

Question 7

What THREE outcomes typically occur when data stitching successfully links a network alert and an endpoint alert? (Choose three)

Accepted Answer

The timeline reflects a complete attack path across network and endpoint. Option B is correct because successful data stitching correlates the network and endpoint telemetry into one coherent narrative, so the incident timeline shows the full attack path spanning both the network and endpoint sides. Option C is correct because stitching merges the related network and endpoint alerts into a single unified incident rather than leaving them as separate detections. Option E is correct because once the combined evidence from both alerts is linked, the incident's overall score is recalculated to reflect the aggregated severity and confidence. Option A is incorrect because stitching does not wipe or reset featured fields to defaults; featured fields are preserved and enriched. Option D is incorrect because stitching does not automatically star all constituent raw alerts; starring is a manual analyst action, not a stitching outcome.

Answer

Featured fields are wiped out and reset to default

Answer

All constituent raw alerts are automatically starred

Question 8

An XDR Analyst is investigating a newly generated incident in Palo Alto Networks Cortex XDR and notices that multiple disparate alerts from different endpoints and network sensors have been automatically grouped together. Which core mechanism of Cortex XDR is primarily responsible for intelligently grouping these related alerts into a single incident?

Accepted Answer

Incident scoring and analytics correlation engine. Cortex XDR uses a specialized analytics engine and data stitching algorithms to correlate and group related alerts across endpoints, network, and cloud sources into a single incident based on shared indicators of compromise or causality chains.

Answer

Alert starring

Answer

Local Analysis agent configuration

Answer

BIOC rule generation wizard

Question 9

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

Accepted Answer

Under the Incident Details page by selecting the Alerts tab. By drilling down into an incident in Cortex XDR, the analyst can access the Alert tab to inspect the individual raw alerts that make up the incident lineage.

Answer

Under Analytics > BIOC > Alert Log

Answer

Under Response > Action Center > History

Answer

Under Settings > Data Stitching > Raw Logs

Question 10

Cortex XDR stitches together data from multiple telemetry sources to form a cohesive incident. An analyst notices that network logs from a third-party firewall are generating alerts, but they are not stitching correctly with the endpoint alerts for the same compromised host. What is the most likely cause of this stitching failure in the raw-alert-to-incident lifecycle?

Accepted Answer

The third-party firewall logs lack proper field mapping for endpoint IP or hostname identifiers required by the stitching engine.. Data stitching relies on consistent identifiers such as internal IP addresses, MAC addresses, or hostnames. Mismatched or missing identifiers in parsed logs prevent the Cortex XDR causality engine from linking network and endpoint events.

Answer

The incident scoring threshold is set too high for network alerts to be included in endpoint-triggered incidents.

Answer

The alerts are in an 'Unassigned' status, which disables the causality engine.

Answer

Alert starring has not been applied to the network alerts, preventing automated correlation.

Question 11

An administrator is configuring data stitching and alert correlation rules in Cortex XDR to improve incident prioritization. Which TWO actions are best practices to ensure high-fidelity alert grouping and accurate incident scoring? (Choose two)

Accepted Answer

Map critical assets with appropriate priority weights to influence incident scoring accurately.. Option C is correct because Cortex XDR incident scoring factors in asset criticality, so mapping critical assets with appropriate priority weights ensures that alerts affecting high-value systems are scored and prioritized accurately. Option E is correct because data stitching and alert correlation depend on consistent, correctly parsed host and IP identification fields; if third-party log sources do not normalize these fields, Cortex XDR cannot reliably stitch related alerts into a single incident or correlate them across data sources. Option A is incorrect because disabling all default analytics rules removes valuable built-in detections and correlation logic rather than improving fidelity. Option B is incorrect because a 1-minute incident close timeout is far too aggressive and would prematurely close incidents before related alerts can be stitched together. Option D is incorrect because manually starring every alert does not trigger the correlation engine and would simply clutter the alert view without improving grouping or scoring.

Answer

Disable all default Cortex XDR analytics rules to prevent false correlation.

Answer

Set the incident close timeout to 1 minute to speed up alert processing.

Answer

Manually star every incoming alert to trigger the incident correlation engine.

Question 12

An incident responder is investigating a complex incident in Cortex XDR and needs to examine the raw alert-to-incident lifecycle and data stitching relationships. Which THREE components or views in the Cortex XDR console should the responder utilize to thoroughly analyze this data? (Choose three)

Accepted Answer

The Causality View to inspect process execution chains and stitched telemetry.. Responders use the Causality View, Alert Tab, and Incident Graph/Timeline to trace the raw-alert-to-incident lifecycle and data stitching.

Answer

The Agent Upgrade wizard to deploy new software versions.

Answer

The Firewall Rulebase Configuration page to modify packet filters.

Question 13

When managing the alert lifecycle in Cortex XDR, analysts can perform various triage and prioritization tasks. Which THREE features or options are available to analysts when managing active incidents and alerts? (Choose three)

Accepted Answer

Updating the incident status (e.g., New, Under Investigation, Resolved).. Option B is correct because Cortex XDR lets analysts move incidents through the standard lifecycle states such as New, Under Investigation, and Resolved, which is a core triage action for tracking and closing cases. Option C is correct because incidents can be assigned to individual analysts or user groups, enabling ownership and workload distribution during investigations. Option D is correct because analysts can star alerts or incidents to mark them for priority attention or shift handover, a built-in flagging mechanism in the alert and incident views. Option A is not correct because analysts cannot modify the weights of the GlobalProtect cloud service's machine learning algorithm; that is a vendor-controlled backend, not an analyst triage feature. Option E is not correct because writing raw kernel-level driver code to replace the endpoint prevention engine is not an available analyst action in Cortex XDR and would undermine the product's protected agent architecture.

Answer

Directly modifying the core machine learning algorithm weights of the Global Protect cloud service.

Answer

Writing raw kernel-level driver code to replace the endpoint prevention engine.

Question 14

An analyst is investigating a Cortex XDR incident that contains an alert for a suspicious PowerShell script execution on a Windows endpoint. The analyst wants to see the exact command line and parent process that triggered the alert without leaving the incident view. Which action should the analyst take?

Accepted Answer

Open the alert details pane and review the 'Causality' chain.. The alert details pane in Cortex XDR provides a causality chain that displays the process tree, including command lines and parent-child relationships, for the specific alert. This allows analysts to quickly understand the exact sequence of events that triggered the alert without leaving the incident view. Other methods either require additional steps or do not provide the same level of integrated context.

Answer

Run a query in the Query Builder using the 'process' dataset and filter by the endpoint name.

Answer

Export the incident to a CSV file and search for the PowerShell command line.

Answer

Navigate to the Endpoint Security console and look up the endpoint's recent process history.

Question 15

An XDR analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst notices that the network alerts lack associated endpoint process information, even though the same host is involved. What is the most likely cause for this missing correlation?

Accepted Answer

The endpoint telemetry for that host was not ingested or was delayed beyond the stitching window.. Cortex XDR correlates network and endpoint alerts by matching host identifiers and timestamps. If endpoint telemetry is not available or arrives after the stitching window, the network alerts cannot be enriched with process information. This often occurs when endpoints are offline, the agent is not installed, or log forwarding is delayed. Ensuring timely telemetry ingestion is key to maintaining correlation.

Answer

The incident was manually created and does not include automatic stitching.

Answer

The network alerts were generated from a different sensor that does not share endpoint telemetry.

Answer

The network alerts were triggered by a different IP address than the endpoint's IP due to NAT.