XDR-Analyst Alert Lifecycle And Incident Correlation Practice Test 6 — 15 Questions

Question 1

An analyst is investigating a Cortex XDR incident that contains alerts from an endpoint infected with malware. The analyst wants to determine which specific process on that endpoint initiated the malicious network connection. Which Cortex XDR feature should the analyst use to view the parent-child process relationships associated with the alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Causality Chain view. The Causality Chain view is specifically designed to visualize the process execution flow that led to an alert, including parent-child relationships. This allows the analyst to pinpoint the exact process that initiated the malicious network connection, which is critical for understanding the attack vector and scope.

Answer

Alert Details pane

Answer

BIOC Rules

Answer

Incident Timeline

Question 2

An analyst is investigating a Cortex XDR incident that contains alerts from an endpoint infected with malware. The analyst wants to determine which specific process on that endpoint initiated the malicious network connection. Which Cortex XDR feature should the analyst use to view the parent-child process relationships associated with the alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident Timeline. The Incident Timeline is designed to present a chronological sequence of all alerts and activities within an incident, enabling analysts to quickly identify the initiating alert and understand the attack progression. Other features like the Alert Grid or Causality Chain provide related but narrower views that do not fulfill the need for an incident-wide timeline.

Answer

Incident Summary

Answer

Causality Chain

Answer

Alert Grid

Question 3

A security analyst receives a Cortex XDR incident that was automatically created from multiple alerts. The analyst wants to assign the incident to a specific team member for further investigation. Which action should the analyst take?

Accepted Answer

Assign the incident to a user.. Assigning the incident to a user is the direct method to designate ownership and responsibility in Cortex XDR. It notifies the assignee and allows them to manage the incident from their own queue. Other actions like changing severity, commenting, or tagging do not transfer ownership.

Answer

Change the incident's severity level.

Answer

Add a comment to the incident.

Answer

Tag the incident with a custom label.

Question 4

A Cortex XDR analyst receives a critical incident for an endpoint that was quarantined by the organization months ago but is still generating new alerts. The analyst wants to quickly verify whether the endpoint has had any recent network activity that could indicate the alerts are from a live but unmanaged device. Which Cortex XDR feature should the analyst use to view the latest network connections associated with that endpoint?

Accepted Answer

Cortex XDR Network Connections view. The Network Connections view is designed to show recent network activity for an endpoint, including remote addresses and processes. For a quarantined endpoint that continues to trigger alerts, this view helps determine if the device is still active on the network. Other consoles and logs focus on management, automation, or auditing rather than live connection data.

Answer

Cortex XDR Endpoint Administration console

Answer

Cortex XDR Audit Log

Answer

Cortex XDR Incident Response playbook

Question 5

A Cortex XDR incident contains 15 alerts that were automatically stitched together. The analyst determines that 3 of these alerts are false positives caused by a legitimate administrative script. The analyst wants to remove these 3 alerts from the incident without affecting the other 12 alerts. What is the correct action?

Accepted Answer

Select the 3 alerts in the incident and choose 'Remove from Incident' to unlink them, leaving the incident with the remaining 12 alerts.. The correct action is to select the false-positive alerts and use the 'Remove from Incident' function. This unlinks them from the incident, leaving the remaining alerts intact. It is the precise method for refining incident contents without altering the incident's status or creating new incidents.

Answer

Add a note to the incident indicating that the 3 alerts are false positives, and then resolve the incident.

Answer

Change the severity of the 3 alerts to 'Informational' so they no longer contribute to the incident's risk score.

Answer

Close the incident and create a new incident manually with only the 12 relevant alerts.

Question 6

An analyst is reviewing a Cortex XDR incident that includes alerts from multiple sources. The analyst wants to correlate related alerts to identify a coordinated attack. Which two actions can the analyst take to manually correlate alerts into the incident? (Choose two.)

Accepted Answer

Create a new incident from the alert and then merge it with the existing incident.. Manual correlation in Cortex XDR can be achieved by either adding an alert directly to an incident or by creating a new incident from the alert and merging it. Both methods result in the alert being included in the incident's context, enabling unified analysis. Other actions like changing severity or editing descriptions do not establish the necessary link.

Answer

Modify the alert's severity to match the incident's severity.

Answer

Edit the alert's description to include the incident ID.

Answer

Assign the alert to the same analyst who owns the incident.

Question 7

An analyst is reviewing a Cortex XDR incident that was created by the correlation engine. The analyst wants to understand why certain alerts were grouped together. Which two factors does the Cortex XDR correlation engine primarily use to stitch alerts into a single incident? (Choose two.)

Accepted Answer

Shared indicators such as file hashes, IP addresses, or domain names across alerts.. The Cortex XDR correlation engine primarily stitches alerts based on shared indicators (like hashes, IPs, domains) and common entities (user accounts or endpoints). These factors provide strong evidence that alerts are part of the same attack, enabling the engine to group them into a single incident for efficient investigation.

Answer

Alerts with identical severity levels as assigned by the analytics engine.

Answer

The order in which alerts are ingested into the Cortex XDR console.

Answer

Alerts generated within a specific time window, regardless of other similarities.

Question 8

An analyst notices that a Cortex XDR incident contains alerts from three different endpoints that are not related to the same attack. The analyst wants to manually split these unrelated alerts into separate incidents to improve tracking. Which action should the analyst take within the incident view?

Accepted Answer

Use the 'Split Incident' option. The 'Split Incident' option is specifically designed to extract selected alerts from an incident and create a new incident for them. This allows analysts to correct over-correlation and manage unrelated alerts separately. Other actions like changing severity, adding notes, or exporting data do not change the incident grouping and therefore do not solve the problem.

Answer

Change the incident's severity to Low

Answer

Add a note to the incident

Answer

Export the incident to a CSV file

Question 9

During incident triage, an analyst notices that a Cortex XDR incident contains alerts from both a Windows endpoint and a Linux server. The analyst wants to see the specific MITRE ATT&CK techniques associated with each alert to understand the adversary's tactics. Where can the analyst find this information?

Accepted Answer

In the Alert details pane, under the 'MITRE ATT&CK' tab.. The alert details pane in Cortex XDR includes a 'MITRE ATT&CK' tab that maps the alert to specific tactics and techniques. This is the most direct and comprehensive place to view technique information for each alert, regardless of the endpoint's operating system.

Answer

In the Causality Chain, each process is annotated with its MITRE technique.

Answer

In the Incident Timeline, each alert displays its MITRE technique.

Answer

In the Incident Summary, a list of all MITRE techniques is provided.

Question 10

An analyst is investigating a Cortex XDR incident that contains alerts from an endpoint infected with malware. The analyst wants to determine which specific process on that endpoint initiated the malicious network connection. Which Cortex XDR feature should the analyst use to view the parent-child process relationships associated with the alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the alert's 'Alert Details' pane for the analytics description and contributing events. To understand an XDR Analytics alert, the analyst should review the Alert Details pane for the analytics description and contributing events, and examine the Causality Chain to see the event sequence. These provide the 'why' and 'how' of the alert. Other actions like exporting raw logs, modifying BIOC rules, or counting similar alerts do not directly explain the alert's generation.

Answer

Run a query in the Query Builder to count similar alerts

Answer

Modify the BIOC rule that triggered the alert

Answer

Export the raw endpoint logs from the Cortex XDR agent

Question 11

An analyst is examining a Cortex XDR incident that includes a high-severity alert for a suspicious process execution. The analyst wants to determine the parent process that spawned the suspicious process and the command line arguments used. Which Cortex XDR feature should the analyst use to obtain this information?

Accepted Answer

Incident View > Causality Chain. The Causality Chain is designed to visualize the process execution flow that triggered an alert. It shows the parent process, the suspicious process, and any child processes, along with command line arguments. This allows the analyst to quickly understand how the suspicious process was launched and what it did, which is critical for determining the scope and nature of the threat.

Answer

Endpoint Investigation > Search, using a process name filter

Answer

Incident View > Timeline, filtered by process name

Answer

Incident View > Alerts tab, then click the alert to view its details

Question 12

An analyst is investigating a Cortex XDR incident that contains alerts from an endpoint infected with malware. The analyst wants to determine which specific process on that endpoint initiated the malicious network connection. Which Cortex XDR feature should the analyst use to view the parent-child process relationships associated with the alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the alert from the incident and create a new incident for it.. To correct an incorrect grouping, the analyst should remove the mis-grouped alert from the incident. Cortex XDR provides this manual action, allowing the analyst to then handle the alert separately, such as creating a new incident. Other actions like editing causality IDs or merging incidents do not achieve the desired separation.

Answer

Change the alert's causality ID to a different value.

Answer

Close the incident and reopen it with a filter that excludes the alert.

Answer

Merge the incident with another incident that contains the correct alerts.

Question 13

An analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst wants to see a visual representation of how the alerts are related over time to better understand the attack progression. Which Cortex XDR feature should the analyst use?

Accepted Answer

Incident Timeline. The Incident Timeline is designed to visually map alerts and events chronologically, revealing causal and temporal relationships. This is ideal for understanding attack progression across multiple telemetry sources. The Alert Grid, isolation status, and threat intelligence match do not provide the required visual timeline of related alerts.

Answer

Threat Intelligence Match

Answer

Alert Grid

Answer

Endpoint Isolation Status

Question 14

An analyst notices that a Cortex XDR incident contains alerts from two different endpoints that appear to be part of the same attack campaign. The analyst wants to confirm that the incidents are linked by a common threat actor. Which Cortex XDR feature provides a graphical representation of the relationships between alerts, endpoints, and indicators of compromise (IOCs) to help identify such connections?

Accepted Answer

Incident View > Graph. The Graph view is specifically designed to visualize the relationships between entities within an incident, such as alerts, endpoints, and IOCs. It allows analysts to quickly spot shared indicators or communication paths that suggest a coordinated attack. This graphical correlation is essential for linking seemingly separate alerts to a single threat actor.

Answer

Incident View > Alert Timeline

Answer

Incident View > Timeline

Answer

Incident View > Causality Chain

Question 15

An analyst is investigating a Cortex XDR incident that contains alerts from an endpoint infected with malware. The analyst wants to determine which specific process on that endpoint initiated the malicious network connection. Which Cortex XDR feature should the analyst use to view the parent-child process relationships associated with the alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The network alert lacks a valid host identifier that matches the endpoint's hostname or IP address in the endpoint alert.. Correlation in Cortex XDR relies on shared entities such as hostnames, IP addresses, or usernames. If a network alert does not contain a host identifier that matches the endpoint alert's hostname or IP, the system cannot stitch them together. This often happens when network logs lack endpoint context or when NAT obscures the internal IP. Thus, the missing or mismatched host identifier is the most likely cause.

Answer

The network alert and endpoint alert have different severity levels, so Cortex XDR does not correlate them.

Answer

The two alerts occurred more than 5 minutes apart, exceeding the correlation time window.

Answer

The endpoint alert was generated by a different Cortex XDR agent version than the network alert's sensor.