XDR-Analyst Evidence Review And Response Actions Practice Test 2 — 15 Questions

Question 1

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

Accepted Answer

It reduces alert fatigue by grouping related alerts into a single attack storyline.. Incident grouping correlates related alerts into a single incident based on causality and shared artifacts, reducing alert fatigue and providing a cohesive attack narrative.

Answer

It automatically upgrades endpoint operating system licenses.

Answer

It deletes duplicate log files to save storage space.

Answer

It provisions new virtual machines for containment.

Question 2

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

Accepted Answer

XQL Search querying registry event tables. XQL Search allows analysts to query registry modification events across the entire fleet of endpoints to hunt for persistence mechanisms.

Answer

Syslog server forwarding destination list

Answer

Cortex XDR Agent installation log

Answer

GlobalProtect client configuration wizard

Question 3

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

Accepted Answer

File Details / WildFire Analysis tab. The WildFire analysis report and verdict are accessible directly from the file details or alert inspection panel within Cortex XDR.

Answer

DHCP Server status log

Answer

DNS query statistics panel

Answer

Printer queue management interface

Question 4

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

Accepted Answer

The agent maintains a dedicated management communication channel to the Cortex XDR server while blocking other network traffic.. Endpoint isolation blocks all general network traffic while maintaining a secure, dedicated management channel between the Cortex XDR agent and the backend server.

Answer

The host switches to a backup dial-up modem connection.

Answer

All network traffic is routed through an open public proxy server.

Answer

The host disables its TCP/IP stack entirely.

Question 5

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

Accepted Answer

The endpoint agent must be online and connected to receive the command.. Automated response playbooks require the Cortex XDR agent to be actively connected and online to receive and execute commands such as isolation or file quarantine.

Answer

The user must manually approve every automated step in the playbook.

Answer

The endpoint must have local administrative privileges disabled.

Answer

The endpoint must be running a legacy operating system without secure boot.

Question 6

An analyst wants to prevent Cortex XDR from generating alerts on a specific signature-based detection (such as a known vulnerability scanner tool) across a specific endpoint group. Where should this exclusion be created?

Accepted Answer

Exceptions settings page, scoping the rule to the target endpoint group. Exceptions in Cortex XDR can be scoped to specific agent groups and detection types via the Exceptions management interface.

Answer

In the individual user's operating system environment variables

Answer

By modifying the BIOS firmware on the endpoint group

Answer

Through the global firewall packet filter configuration

Question 7

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

Accepted Answer

Network connection details including source, destination, port, and protocol. An IP connection artifact details network communication telemetry, including source IP, destination IP, port, and protocol used during the event.

Answer

Software license expiration dates

Answer

Hardware temperature and fan speed metrics

Answer

Local user account password complexity settings

Question 8

An analyst is investigating a suspected phishing attack and needs to review the command line arguments passed to a suspicious email attachment execution. Where can the analyst find this evidence in Cortex XDR?

Accepted Answer

Process Execution details within the Causality Chain. The Process Execution view and Causality Chain record the exact command line arguments passed when a process is spawned.

Answer

Hardware asset inventory list

Answer

Agent network proxy configuration file

Answer

DNS server cache table

Question 9

An analyst wants to ensure that any file evaluated with a specific SHA-256 hash is immediately blocked from execution across all endpoints managed by Cortex XDR, regardless of its WildFire verdict. Where should this hash be added?

Accepted Answer

Hash Blocklist in Cortex XDR. Blocking specific file hashes across all endpoints is accomplished by adding the hash to the Hash Blocklist under Response or Malware Protection settings.

Answer

Network interface promiscuous mode toggle

Answer

Agent debug log level selector

Answer

Cortex XSOAR integration ticket template

Question 10

An analyst needs to change the status of an incident from 'Under Investigation' to 'Resolved' after completing remediation. Which section of the Incident View allows updating the incident status?

Accepted Answer

Incident Header / Status field. Incident metadata such as status, assignment, and severity can be updated directly from the Incident header or details pane.

Answer

BIOC rule creation dialog

Answer

WildFire file submission form

Answer

Agent upgrade wizard

Question 11

An analyst is investigating an incident and wants to export the full incident report and associated artifact list for compliance reporting. Which option should the analyst select in Cortex XDR?

Accepted Answer

Export Incident report. The export incident functionality allows security analysts to download comprehensive reports containing alerts, artifacts, and investigation notes.

Answer

Format hard drive

Answer

Reboot endpoint agent

Answer

Purge telemetry database

Question 12

An analyst writes an XQL query to investigate lateral movement. Which dataset table in Cortex XDR contains comprehensive network connection telemetry across endpoints?

Accepted Answer

network_event (or xdr_data filtering network events). The xdr_data table or network_event dataset tables in Cortex XDR store parsed network session and connection telemetry.

Answer

user_identity_mapping

Answer

cloud_storage_bucket_policy

Answer

agent_upgrade_history

Question 13

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

Accepted Answer

Cloud audit and API activity logs. Cloud infrastructure logs (like AWS CloudTrail or Azure Activity logs) ingested into Cortex XDR provide the audit trail for cloud resource changes.

Answer

Active Directory SYSVOL share

Answer

Local printer driver cache

Answer

Local endpoint SAM registry hive

Question 14

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

Accepted Answer

Signed binary exception with path and certificate verification. Signed binary exceptions combined with valid certificate verification and file path checks allow legitimate administrative or updater tools to operate without generating alerts.

Answer

Configuring a network port forwarding rule

Answer

Deleting the software updater from all endpoints

Answer

Disabling all behavioral monitoring on the subnet

Question 15

An analyst notices suspicious network connections originating from an unknown process on an endpoint. To block outbound communication for this process without isolating the entire host, what action can be taken?

Accepted Answer

Terminate the process and block its file hash or path. Network rules or process blocking actions in Cortex XDR can restrict malicious processes from communicating over the network while allowing normal OS operations.

Answer

Unplug the physical power cable from the workstation

Answer

Change the local monitor refresh rate

Answer

Reset the enterprise DNS root servers