XDR-Analyst Evidence Review And Response Actions — 50 Questions

Question 1

An analyst is investigating an alert where an attacker attempted credential dumping via LSASS. To understand the exact API calls and techniques used by the process, which evidence source within Cortex XDR provides low-level OS event telemetry?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Causality Graph and raw telemetry event streams. Cortex XDR endpoint telemetry records low-level operating system events, including DLL loads, process creations, and API monitoring events via kernel/user-mode hooks.

Answer

Firewall Security Policy rules

Answer

Email Gateway spam filter logs

Answer

Cloud Storage bucket policies

Question 2

Which TWO actions can be performed directly from the Cortex XDR Incident Details page when reviewing evidence? (Choose two)

Accepted Answer

Update incident status and assignment. Option B is correct because the Incident Details page in Cortex XDR provides incident management controls that let analysts change the incident's status (for example, New, Under Investigation, or Resolved) and reassign the incident to a different user or owner directly from that view. Option D is correct because the Incident Details page surfaces the alert timeline and the associated artifacts (such as involved endpoints, files, processes, and network indicators) so investigators can review the evidence without leaving the incident context. The remaining options (A, C, and E) are unrelated office-facilities tasks—catering, window washing, and thermostat calibration—and have no function within the Cortex XDR console or its incident workflow.

Answer

Order office catering supplies for the team meeting

Answer

Schedule routine commercial window washing

Answer

Calibrate the office thermostat temperature

Question 3

During an investigation, an analyst needs to isolate a compromised endpoint from the network while still allowing the Cortex XDR agent to communicate with the management console for remediation. Which Cortex XDR response action should the analyst use?

Accepted Answer

Network Quarantine. Network Quarantine is designed to isolate an endpoint by restricting its network communication to only the Cortex XDR management console and essential services. This allows the analyst to maintain control and perform remediation while preventing lateral movement or data exfiltration, which is exactly what the scenario demands.

Answer

File Quarantine

Answer

Endpoint Isolation

Answer

Terminate Process

Question 4

During a Cortex XDR investigation, an analyst sees an alert for a suspicious process that spawned from a Microsoft Word document. The analyst needs to determine whether the process made any network connections after execution. Which Cortex XDR capability should the analyst use to correlate the process activity with network events?

Accepted Answer

Causality View. Causality View is the correct tool because it automatically maps process lineage and associated network connections, allowing an analyst to see if a suspicious process initiated any outbound connections. It provides a graphical timeline and process tree that correlates events, which is essential for understanding the scope of an attack. Other options either do not provide historical network correlation or require manual effort without the visual context.

Answer

Endpoint Isolation

Answer

XQL Query with process and network event joins

Answer

WildFire Analysis Report

Question 5

An analyst is reviewing a Cortex XDR incident that involves a malicious PowerShell script executed on multiple endpoints. To effectively contain and remediate the threat, which TWO response actions can the analyst take directly from the Cortex XDR Incident Response view? (Choose two.)

Accepted Answer

Run a script to remove the malicious PowerShell script from all affected endpoints.. The Incident Response view in Cortex XDR provides immediate response actions such as running remediation scripts and isolating endpoints via Network Quarantine. These actions can be applied to multiple affected endpoints directly, allowing the analyst to contain and remediate the malicious PowerShell script efficiently.

Answer

Schedule a full antivirus scan on all endpoints in the organization.

Answer

Block the hash of the PowerShell script using the Block List.

Answer

Modify the Windows Registry to disable PowerShell execution.

Question 6

After containing a malware outbreak, an analyst wants to verify that the malicious files identified during the investigation have been removed from all affected endpoints. Which Cortex XDR action should the analyst take to ensure the files are no longer present?

Accepted Answer

Execute the 'Quarantine File' action on the endpoints.. Quarantining a file removes it from its original location and stores it securely, which effectively verifies that it is no longer present in the active file system. This action is part of Cortex XDR's response capabilities and is the most direct way to ensure malicious files are neutralized on endpoints. Other options either do not remove the file or do not provide real-time verification.

Answer

Initiate a scan of all endpoints using the Malware profile.

Answer

Run a query in XQL to check for the file's presence on endpoints.

Answer

Use the 'Retrieve File' action to pull the files from endpoints.

Question 7

A Cortex XDR analyst is reviewing the timeline of a security incident and needs to determine which user account was responsible for launching several suspicious processes on a compromised server. The analyst wants to correlate identity data with process execution events. Which TWO fields available in the Cortex XDR process execution event data can directly identify the user context of the process? (Choose two.)

Accepted Answer

The os_actor_process_user_name field, which records the user name associated with the process that performed the action.. Process execution events in Cortex XDR include identity fields that describe the user context of the acting process. The effective username field captures the token-level identity after impersonation or elevation, while the OS actor user name reflects the account reported by the operating system. Correlating both fields gives a reliable attribution of which user launched the suspicious processes, supporting both investigation and response decisions.

Answer

The actor_process_image_name field, which records the executable name of the process that performed the action.

Answer

The causality_actor_process_image_path field, which shows the full path of the process that originated the causality chain.

Answer

The action_process_signature_vendor field, which identifies the code-signing vendor of the process that performed the action.

Question 8

An administrator needs to automate a remediation workflow so that whenever a specific critical alert severity is triggered, Cortex XDR automatically runs a script to collect forensic artifacts. Where must this automation be configured?

Accepted Answer

Response Playbooks -> Playbook Designer. Automated response actions linked to specific alerts and incident triggers are managed via Response Playbooks within Cortex XDR or integrated Cortex XSOAR.

Answer

Agent Settings -> Granular Control

Answer

Security Information and Event Management (SIEM) forwarder

Answer

Data Collection rules

Question 9

An analyst identifies a custom, benign internal tool that is continuously flagged by a BIOC rule in Cortex XDR. To prevent future alerts without disabling the entire rule globally, what is the best practice method to create an exception?

Accepted Answer

Create a local exception using the specific file hash or path within the Exceptions management page.. Creating an exception using file hash or digital signature parameters directly from the alert context ensures targeted suppression without weakening the broader BIOC rule effectiveness.

Answer

Modify the Agent Settings profile to stop reporting all file execution events.

Answer

Disable the BIOC rule globally in the Profiles page.

Answer

Delete the alert from the Incident View to prevent re-triggering.

Question 10

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

Accepted Answer

To determine how the attacker established persistence on the system. Attackers frequently use scheduled tasks for persistence, allowing malicious code or scripts to run automatically at specific times or system events.

Answer

To verify the hardware specifications of the endpoint

Answer

To analyze the local user group membership policies

Answer

To inspect the network throughput limits of the adapter

Question 11

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

Accepted Answer

Identity and authentication logs. Impossible travel alerts are generated by comparing login locations and timestamps for a user account, so the authoritative evidence is the identity and authentication logs. These logs contain the source IP, geolocation, timestamp, and authentication result needed to validate whether the two logins are physically impossible. Inspecting them confirms or refutes the alert.

Answer

Network packet capture (PCAP)

Answer

Master Boot Record (MBR) analysis

Answer

Endpoint memory dump

Question 12

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

Accepted Answer

Isolate Endpoint. Isolate Endpoint allows an administrator to sever the network connection of a compromised host while retaining Cortex XDR agent communication and administrative troubleshooting access.

Answer

Disable User

Answer

Kill Process Tree

Answer

Quarantine File

Question 13

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

Accepted Answer

Kill Process Tree. Kill Process Tree terminates the specified process and all of its child processes on the targeted endpoint, which is exactly what's needed to stop a malicious parent and its spawned children in one action. It's available directly from the Cortex XDR incident/endpoint view.

Answer

Retrieve File

Answer

Block File Hash

Answer

Isolate Endpoint

Question 14

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

Accepted Answer

Run an XQL Search querying the dataset for the specific file_sha256 value.. XQL Search in Cortex XDR queries the endpoint telemetry dataset (e.g., xdr_data / process events) which includes file_sha256 for every process execution. Searching by the specific file_sha256 value returns every endpoint where that exact binary executed, giving immediate organization-wide scope. This is the fastest, most precise way to hunt for other instances of the same file.

Answer

Review the Global Protect gateway traffic logs for file downloads.

Answer

Create a new BIOC rule and wait for the file to be executed again.

Answer

Export the Windows Event logs from a single machine and compare manually.

Question 15

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

Accepted Answer

Causality Chain. The Causality Chain view in Cortex XDR visualizes the process tree and root-cause relationships that led to an alert, showing parent-child process lineage. To trace how a suspicious PowerShell command was spawned, the analyst examines the Causality Chain to see the originating process, its parent, and the full execution path. This is the core forensic view for process-level investigation.

Answer

Action Center

Answer

Audit Log

Answer

BIOC Rules Manager

Question 16

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

Accepted Answer

Retrieve File and Forensic File Collection. Cortex XDR allows analysts to trigger forensic data collection, including file retrieval and process information, directly from the incident response tools.

Answer

Global Protect Tunnel Inspection

Answer

Agent Upgrade Schedule

Answer

WildFire Submission Policy

Question 17

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Accepted Answer

It maps the behaviors observed in the incident to known attacker tactics and techniques.. The MITRE ATT&CK tab in Cortex XDR incident details maps observed behaviors to the MITRE ATT&CK framework, which is a curated knowledge base of adversary tactics, techniques, and procedures (TTPs). This mapping helps analysts understand the attacker's intent, identify the stage of the attack lifecycle, and prioritize response actions. It provides context beyond raw alerts by categorizing activities like 'Credential Dumping' (T1003) or 'Spearphishing Attachment' (T1566), enabling faster triage and correlation with threat intelligence.

Answer

It provides network routing tables for the compromised subnet.

Answer

It automatically downloads security patches from vendor repositories.

Answer

It lists the hardware warranty status of the affected device.

Question 18

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

Accepted Answer

Cortex XDR Management Console under Exceptions. Cortex XDR Exceptions defined in the management console are pushed as policy to all agents, allowing a known tool (e.g., an internal pen-test binary) to be excluded from prevention and/or alerting globally. This is the centralized, supported mechanism for organization-wide exclusions.

Answer

Syslog forwarding rules

Answer

User Identity mapping rules

Answer

Local Windows Registry on each endpoint

Question 19

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

Accepted Answer

Remediate Action (Cleanup). The Remediate Action (Cleanup) capability in Cortex XDR supports automatic remediation of file drops and registry modifications by reverting changes made by malicious processes. It can remove dropped files, delete registry keys, and undo other system modifications based on the causality chain. This is the built-in remediation feature designed for cleanup after an incident.

Answer

DNS Flushing

Answer

DHCP Lease Renewal

Answer

Static Route Addition

Question 20

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

Accepted Answer

User Investigation view. The User Investigation view in Cortex XDR aggregates user activity, authentication events, and associated alerts across endpoints and cloud environments.

Answer

Disk Encryption status panel

Answer

Agent Health dashboard

Answer

BIOC Policy editor