XDR-Analyst Evidence Review And Response Actions Practice Test 1 — 15 Questions

Question 1

An administrator needs to automate a remediation workflow so that whenever a specific critical alert severity is triggered, Cortex XDR automatically runs a script to collect forensic artifacts. Where must this automation be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Response Playbooks -> Playbook Designer. Automated response actions linked to specific alerts and incident triggers are managed via Response Playbooks within Cortex XDR or integrated Cortex XSOAR.

Answer

Agent Settings -> Granular Control

Answer

Security Information and Event Management (SIEM) forwarder

Answer

Data Collection rules

Question 2

An analyst identifies a custom, benign internal tool that is continuously flagged by a BIOC rule in Cortex XDR. To prevent future alerts without disabling the entire rule globally, what is the best practice method to create an exception?

Accepted Answer

Create a local exception using the specific file hash or path within the Exceptions management page.. Creating an exception using file hash or digital signature parameters directly from the alert context ensures targeted suppression without weakening the broader BIOC rule effectiveness.

Answer

Modify the Agent Settings profile to stop reporting all file execution events.

Answer

Disable the BIOC rule globally in the Profiles page.

Answer

Delete the alert from the Incident View to prevent re-triggering.

Question 3

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

Accepted Answer

To determine how the attacker established persistence on the system. Attackers frequently use scheduled tasks for persistence, allowing malicious code or scripts to run automatically at specific times or system events.

Answer

To verify the hardware specifications of the endpoint

Answer

To analyze the local user group membership policies

Answer

To inspect the network throughput limits of the adapter

Question 4

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

Accepted Answer

Identity and authentication logs. Log data containing IP addresses, user agent strings, and geo-location metadata provides the source of truth for identity analytics and impossible travel alerts.

Answer

Network packet capture (PCAP)

Answer

Master Boot Record (MBR) analysis

Answer

Endpoint memory dump

Question 5

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

Accepted Answer

Isolate Endpoint. Isolate Endpoint allows an administrator to sever the network connection of a compromised host while retaining Cortex XDR agent communication and administrative troubleshooting access.

Answer

Disable User

Answer

Kill Process Tree

Answer

Quarantine File

Question 6

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

Accepted Answer

Kill Process Tree. The 'Kill Process Tree' action terminates the targeted process along with all descendant processes spawned by it, ensuring complete neutralization of the threat tree.

Answer

Retrieve File

Answer

Block File Hash

Answer

Isolate Endpoint

Question 7

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

Accepted Answer

Run an XQL Search querying the dataset for the specific file_sha256 value.. XQL Search allows analysts to query dataset tables such as xdr_data using the file_sha256 field to hunt for presence across all onboarded endpoints.

Answer

Review the Global Protect gateway traffic logs for file downloads.

Answer

Create a new BIOC rule and wait for the file to be executed again.

Answer

Export the Windows Event logs from a single machine and compare manually.

Question 8

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

Accepted Answer

Causality Chain. The Causality Chain in Cortex XDR provides a graphical representation of the process tree, showing the chronological sequence of events, parent-child process relationships, and associated artifacts that led to an execution.

Answer

Action Center

Answer

Audit Log

Answer

BIOC Rules Manager

Question 9

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

Accepted Answer

Retrieve File and Forensic File Collection. Cortex XDR allows analysts to trigger forensic data collection, including file retrieval and process information, directly from the incident response tools.

Answer

Global Protect Tunnel Inspection

Answer

Agent Upgrade Schedule

Answer

WildFire Submission Policy

Question 10

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Accepted Answer

It maps the behaviors observed in the incident to known attacker tactics and techniques.. The MITRE ATT&CK tab maps detected tactics and techniques to the standard framework, helping analysts understand attacker behavior and TTPs.

Answer

It provides network routing tables for the compromised subnet.

Answer

It automatically downloads security patches from vendor repositories.

Answer

It lists the hardware warranty status of the affected device.

Question 11

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

Accepted Answer

Cortex XDR Management Console under Exceptions. Global exclusions and exceptions in Cortex XDR are managed centrally under Response -> Exceptions or Agent Settings, ensuring organization-wide application.

Answer

Syslog forwarding rules

Answer

User Identity mapping rules

Answer

Local Windows Registry on each endpoint

Question 12

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

Accepted Answer

Remediate Action (Cleanup). Remediation in Cortex XDR can automatically clean up artifacts such as created files, registry modifications, and processes associated with a malicious execution.

Answer

DNS Flushing

Answer

DHCP Lease Renewal

Answer

Static Route Addition

Question 13

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

Accepted Answer

User Investigation view. The User Investigation view in Cortex XDR aggregates user activity, authentication events, and associated alerts across endpoints and cloud environments.

Answer

Disk Encryption status panel

Answer

Agent Health dashboard

Answer

BIOC Policy editor

Question 14

An organization experiences a false positive alert caused by a legitimate administrative script executed via PowerShell. The analyst wants to create an exception that applies specifically to this script's command-line arguments without whitelisting PowerShell entirely. What type of exception should be configured?

Accepted Answer

Command-line profile exception. Command-line argument exceptions allow administrators to filter out specific benign invocations of legitimate administrative tools like PowerShell while retaining full detection coverage.

Answer

Agent removal exception

Answer

Global file hash exception

Answer

Network connection exclusion

Question 15

An analyst is investigating an alert where an attacker attempted credential dumping via LSASS. To understand the exact API calls and techniques used by the process, which evidence source within Cortex XDR provides low-level OS event telemetry?

Accepted Answer

Causality Graph and raw telemetry event streams. Cortex XDR endpoint telemetry records low-level operating system events, including DLL loads, process creations, and API monitoring events via kernel/user-mode hooks.

Answer

Firewall Security Policy rules

Answer

Email Gateway spam filter logs

Answer

Cloud Storage bucket policies