XDR-Analyst Evidence Review And Response Actions — 30 Questions

Question 1

An administrator needs to automate a remediation workflow so that whenever a specific critical alert severity is triggered, Cortex XDR automatically runs a script to collect forensic artifacts. Where must this automation be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Response Playbooks -> Playbook Designer. Automated response actions linked to specific alerts and incident triggers are managed via Response Playbooks within Cortex XDR or integrated Cortex XSOAR.

Answer

Agent Settings -> Granular Control

Answer

Security Information and Event Management (SIEM) forwarder

Answer

Data Collection rules

Question 2

An analyst identifies a custom, benign internal tool that is continuously flagged by a BIOC rule in Cortex XDR. To prevent future alerts without disabling the entire rule globally, what is the best practice method to create an exception?

Accepted Answer

Create a local exception using the specific file hash or path within the Exceptions management page.. Creating an exception using file hash or digital signature parameters directly from the alert context ensures targeted suppression without weakening the broader BIOC rule effectiveness.

Answer

Modify the Agent Settings profile to stop reporting all file execution events.

Answer

Disable the BIOC rule globally in the Profiles page.

Answer

Delete the alert from the Incident View to prevent re-triggering.

Question 3

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

Accepted Answer

To determine how the attacker established persistence on the system. Attackers frequently use scheduled tasks for persistence, allowing malicious code or scripts to run automatically at specific times or system events.

Answer

To verify the hardware specifications of the endpoint

Answer

To analyze the local user group membership policies

Answer

To inspect the network throughput limits of the adapter

Question 4

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

Accepted Answer

Identity and authentication logs. Log data containing IP addresses, user agent strings, and geo-location metadata provides the source of truth for identity analytics and impossible travel alerts.

Answer

Network packet capture (PCAP)

Answer

Master Boot Record (MBR) analysis

Answer

Endpoint memory dump

Question 5

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

Accepted Answer

Isolate Endpoint. Isolate Endpoint allows an administrator to sever the network connection of a compromised host while retaining Cortex XDR agent communication and administrative troubleshooting access.

Answer

Disable User

Answer

Kill Process Tree

Answer

Quarantine File

Question 6

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

Accepted Answer

Kill Process Tree. The 'Kill Process Tree' action terminates the targeted process along with all descendant processes spawned by it, ensuring complete neutralization of the threat tree.

Answer

Retrieve File

Answer

Block File Hash

Answer

Isolate Endpoint

Question 7

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

Accepted Answer

Run an XQL Search querying the dataset for the specific file_sha256 value.. XQL Search allows analysts to query dataset tables such as xdr_data using the file_sha256 field to hunt for presence across all onboarded endpoints.

Answer

Review the Global Protect gateway traffic logs for file downloads.

Answer

Create a new BIOC rule and wait for the file to be executed again.

Answer

Export the Windows Event logs from a single machine and compare manually.

Question 8

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

Accepted Answer

Causality Chain. The Causality Chain in Cortex XDR provides a graphical representation of the process tree, showing the chronological sequence of events, parent-child process relationships, and associated artifacts that led to an execution.

Answer

Action Center

Answer

Audit Log

Answer

BIOC Rules Manager

Question 9

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

Accepted Answer

Retrieve File and Forensic File Collection. Cortex XDR allows analysts to trigger forensic data collection, including file retrieval and process information, directly from the incident response tools.

Answer

Global Protect Tunnel Inspection

Answer

Agent Upgrade Schedule

Answer

WildFire Submission Policy

Question 10

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Accepted Answer

It maps the behaviors observed in the incident to known attacker tactics and techniques.. The MITRE ATT&CK tab maps detected tactics and techniques to the standard framework, helping analysts understand attacker behavior and TTPs.

Answer

It provides network routing tables for the compromised subnet.

Answer

It automatically downloads security patches from vendor repositories.

Answer

It lists the hardware warranty status of the affected device.

Question 11

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

Accepted Answer

Cortex XDR Management Console under Exceptions. Global exclusions and exceptions in Cortex XDR are managed centrally under Response -> Exceptions or Agent Settings, ensuring organization-wide application.

Answer

Syslog forwarding rules

Answer

User Identity mapping rules

Answer

Local Windows Registry on each endpoint

Question 12

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

Accepted Answer

Remediate Action (Cleanup). Remediation in Cortex XDR can automatically clean up artifacts such as created files, registry modifications, and processes associated with a malicious execution.

Answer

DNS Flushing

Answer

DHCP Lease Renewal

Answer

Static Route Addition

Question 13

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

Accepted Answer

User Investigation view. The User Investigation view in Cortex XDR aggregates user activity, authentication events, and associated alerts across endpoints and cloud environments.

Answer

Disk Encryption status panel

Answer

Agent Health dashboard

Answer

BIOC Policy editor

Question 14

An organization experiences a false positive alert caused by a legitimate administrative script executed via PowerShell. The analyst wants to create an exception that applies specifically to this script's command-line arguments without whitelisting PowerShell entirely. What type of exception should be configured?

Accepted Answer

Command-line profile exception. Command-line argument exceptions allow administrators to filter out specific benign invocations of legitimate administrative tools like PowerShell while retaining full detection coverage.

Answer

Agent removal exception

Answer

Global file hash exception

Answer

Network connection exclusion

Question 15

An analyst is investigating an alert where an attacker attempted credential dumping via LSASS. To understand the exact API calls and techniques used by the process, which evidence source within Cortex XDR provides low-level OS event telemetry?

Accepted Answer

Causality Graph and raw telemetry event streams. Cortex XDR endpoint telemetry records low-level operating system events, including DLL loads, process creations, and API monitoring events via kernel/user-mode hooks.

Answer

Firewall Security Policy rules

Answer

Email Gateway spam filter logs

Answer

Cloud Storage bucket policies

Question 16

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

Accepted Answer

It reduces alert fatigue by grouping related alerts into a single attack storyline.. Incident grouping correlates related alerts into a single incident based on causality and shared artifacts, reducing alert fatigue and providing a cohesive attack narrative.

Answer

It automatically upgrades endpoint operating system licenses.

Answer

It deletes duplicate log files to save storage space.

Answer

It provisions new virtual machines for containment.

Question 17

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

Accepted Answer

XQL Search querying registry event tables. XQL Search allows analysts to query registry modification events across the entire fleet of endpoints to hunt for persistence mechanisms.

Answer

Syslog server forwarding destination list

Answer

Cortex XDR Agent installation log

Answer

GlobalProtect client configuration wizard

Question 18

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

Accepted Answer

File Details / WildFire Analysis tab. The WildFire analysis report and verdict are accessible directly from the file details or alert inspection panel within Cortex XDR.

Answer

DHCP Server status log

Answer

DNS query statistics panel

Answer

Printer queue management interface

Question 19

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

Accepted Answer

The agent maintains a dedicated management communication channel to the Cortex XDR server while blocking other network traffic.. Endpoint isolation blocks all general network traffic while maintaining a secure, dedicated management channel between the Cortex XDR agent and the backend server.

Answer

The host switches to a backup dial-up modem connection.

Answer

All network traffic is routed through an open public proxy server.

Answer

The host disables its TCP/IP stack entirely.

Question 20

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

Accepted Answer

The endpoint agent must be online and connected to receive the command.. Automated response playbooks require the Cortex XDR agent to be actively connected and online to receive and execute commands such as isolation or file quarantine.

Answer

The user must manually approve every automated step in the playbook.

Answer

The endpoint must have local administrative privileges disabled.

Answer

The endpoint must be running a legacy operating system without secure boot.