XDR-Analyst Evidence Review And Response Actions Practice Test 2 — 15 Questions

Question 1

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

Accepted Answer

Retrieve File and Forensic File Collection. Cortex XDR allows analysts to trigger forensic data collection, including file retrieval and process information, directly from the incident response tools.

Answer

Global Protect Tunnel Inspection

Answer

Agent Upgrade Schedule

Answer

WildFire Submission Policy

Question 2

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Accepted Answer

It maps the behaviors observed in the incident to known attacker tactics and techniques.. The MITRE ATT&CK tab in Cortex XDR incident details maps observed behaviors to the MITRE ATT&CK framework, which is a curated knowledge base of adversary tactics, techniques, and procedures (TTPs). This mapping helps analysts understand the attacker's intent, identify the stage of the attack lifecycle, and prioritize response actions. It provides context beyond raw alerts by categorizing activities like 'Credential Dumping' (T1003) or 'Spearphishing Attachment' (T1566), enabling faster triage and correlation with threat intelligence.

Answer

It provides network routing tables for the compromised subnet.

Answer

It automatically downloads security patches from vendor repositories.

Answer

It lists the hardware warranty status of the affected device.

Question 3

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

Accepted Answer

Cortex XDR Management Console under Exceptions. Cortex XDR Exceptions defined in the management console are pushed as policy to all agents, allowing a known tool (e.g., an internal pen-test binary) to be excluded from prevention and/or alerting globally. This is the centralized, supported mechanism for organization-wide exclusions.

Answer

Syslog forwarding rules

Answer

User Identity mapping rules

Answer

Local Windows Registry on each endpoint

Question 4

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

Accepted Answer

Remediate Action (Cleanup). The Remediate Action (Cleanup) capability in Cortex XDR supports automatic remediation of file drops and registry modifications by reverting changes made by malicious processes. It can remove dropped files, delete registry keys, and undo other system modifications based on the causality chain. This is the built-in remediation feature designed for cleanup after an incident.

Answer

DNS Flushing

Answer

DHCP Lease Renewal

Answer

Static Route Addition

Question 5

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

Accepted Answer

User Investigation view. The User Investigation view in Cortex XDR aggregates user activity, authentication events, and associated alerts across endpoints and cloud environments.

Answer

Disk Encryption status panel

Answer

Agent Health dashboard

Answer

BIOC Policy editor

Question 6

An organization experiences a false positive alert caused by a legitimate administrative script executed via PowerShell. The analyst wants to create an exception that applies specifically to this script's command-line arguments without whitelisting PowerShell entirely. What type of exception should be configured?

Accepted Answer

Command-line profile exception. Command-line argument exceptions allow administrators to filter out specific benign invocations of legitimate administrative tools like PowerShell while retaining full detection coverage.

Answer

Agent removal exception

Answer

Global file hash exception

Answer

Network connection exclusion

Question 7

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

Accepted Answer

It reduces alert fatigue by grouping related alerts into a single attack storyline.. The Incident Viewer's primary value is correlating multiple related alerts across machines into a single attack storyline, which reduces alert fatigue and helps analysts understand the full scope of an attack rather than investigating isolated alerts. By grouping alerts that share causality (same actor, same malware family, same timeline), it reveals the attack chain from initial access to impact.

Answer

It automatically upgrades endpoint operating system licenses.

Answer

It deletes duplicate log files to save storage space.

Answer

It provisions new virtual machines for containment.

Question 8

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

Accepted Answer

XQL Search querying registry event tables. XQL Search querying registry event tables is correct because Cortex XDR collects and stores registry modification events from all endpoints in its data lake. By writing an XQL query against the registry event table, the analyst can search across the entire fleet for the specific Run key and its value, identifying any other affected machines. This leverages the centralized telemetry that the XDR agent provides, enabling rapid scoping of the threat without manually inspecting each host.

Answer

Syslog server forwarding destination list

Answer

Cortex XDR Agent installation log

Answer

GlobalProtect client configuration wizard

Question 9

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

Accepted Answer

File Details / WildFire Analysis tab. In Cortex XDR, when a file is submitted to WildFire, the verdict and full sandbox report are accessible from the File Details view under the WildFire Analysis tab. This shows the verdict (malicious/benign/graymail), behavioral summary, and MITRE-mapped activity.

Answer

DHCP Server status log

Answer

DNS query statistics panel

Answer

Printer queue management interface

Question 10

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

Accepted Answer

The agent maintains a dedicated management communication channel to the Cortex XDR server while blocking other network traffic.. When Cortex XDR isolates a host, the agent maintains a dedicated management communication channel to the Cortex XDR server while blocking other network traffic. This allows the analyst to retain visibility and control (e.g., run scripts, collect forensics) even though the endpoint cannot reach internal file shares or the internet. The isolation is selective, not a full network shutdown.

Answer

The host switches to a backup dial-up modem connection.

Answer

All network traffic is routed through an open public proxy server.

Answer

The host disables its TCP/IP stack entirely.

Question 11

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

Accepted Answer

The endpoint agent must be online and connected to receive the command.. Cortex XDR response playbooks issue remediation commands (isolate endpoint, kill process, quarantine file) through the agent's management channel, so the agent must be online and connected to the Cortex XDR management server for the command to be delivered and acknowledged. If the endpoint is offline, the action is queued but cannot execute until the agent reconnects.

Answer

The user must manually approve every automated step in the playbook.

Answer

The endpoint must have local administrative privileges disabled.

Answer

The endpoint must be running a legacy operating system without secure boot.

Question 12

An analyst wants to prevent Cortex XDR from generating alerts on a specific signature-based detection (such as a known vulnerability scanner tool) across a specific endpoint group. Where should this exclusion be created?

Accepted Answer

Exceptions settings page, scoping the rule to the target endpoint group. Cortex XDR handles signature-based detection exclusions through the Exceptions settings page, where an analyst can create a rule and scope it to a specific endpoint group so the exclusion applies only to those endpoints. This is the designed mechanism for suppressing known-good tools like vulnerability scanners without disabling the detection globally. Scoping to the endpoint group ensures other groups still receive the alert.

Answer

In the individual user's operating system environment variables

Answer

By modifying the BIOS firmware on the endpoint group

Answer

Through the global firewall packet filter configuration

Question 13

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

Accepted Answer

Network connection details including source, destination, port, and protocol. Network connection details including source, destination, port, and protocol is correct because an 'IP Connection' artifact in Cortex XDR represents a network connection event, capturing the source IP, destination IP, destination port, and protocol (e.g., TCP, UDP). This information is crucial for understanding command-and-control (C2) traffic, data exfiltration, or lateral movement. The artifact is generated from endpoint telemetry and provides context for the connection, such as the responsible process.

Answer

Software license expiration dates

Answer

Hardware temperature and fan speed metrics

Answer

Local user account password complexity settings

Question 14

An analyst is investigating a suspected phishing attack and needs to review the command line arguments passed to a suspicious email attachment execution. Where can the analyst find this evidence in Cortex XDR?

Accepted Answer

Process Execution details within the Causality Chain. Cortex XDR captures process execution telemetry as part of its endpoint data collection, and the Causality Chain view links each process to its parent, showing the full command line arguments used when the process was launched. When a suspicious email attachment executes, the spawned process (e.g., WINWORD.EXE launching a script or executable) appears in the Causality Chain with its exact command line, allowing the analyst to see what arguments were passed. This is the authoritative location for process-level execution evidence in Cortex XDR.

Answer

Hardware asset inventory list

Answer

Agent network proxy configuration file

Answer

DNS server cache table

Question 15

An analyst wants to ensure that any file evaluated with a specific SHA-256 hash is immediately blocked from execution across all endpoints managed by Cortex XDR, regardless of its WildFire verdict. Where should this hash be added?

Accepted Answer

Hash Blocklist in Cortex XDR. The Hash Blocklist in Cortex XDR lets analysts add a specific SHA-256 (or MD5) hash that is blocked from execution across all managed endpoints, regardless of WildFire verdict. This is the centralized, immediate enforcement mechanism for known-bad files.

Answer

Network interface promiscuous mode toggle

Answer

Agent debug log level selector

Answer

Cortex XSOAR integration ticket template