XDR-Analyst Evidence Review And Response Actions Practice Test 3 — 15 Questions

Question 1

Which TWO automated or manual response actions can be executed directly on an endpoint from the Cortex XDR Incident Response toolbox? (Choose two)

Accepted Answer

Isolate Endpoint. Cortex XDR provides direct endpoint response capabilities such as endpoint isolation and file quarantine.

Answer

Upgrade BIOS firmware

Answer

Calibrate display resolution

Answer

Reimage Operating System kernel

Question 2

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

Accepted Answer

IP Connection (Source/Destination IP and Port). Cortex XDR incident and alert views capture various telemetry artifacts, notably file hashes and network connection details.

Answer

Physical RAM stick serial number

Answer

Office printer cartridge ink level

Answer

BIOS manufacturer date

Question 3

An analyst is reviewing the Causality Chain for an alert. Which TWO key insights does this view provide? (Choose two)

Accepted Answer

The chronological sequence of events associated with the detection. The Causality Chain illustrates the process lineage and the temporal sequence of events leading to an alert.

Answer

The physical location of the server room containing the host

Answer

The corporate email distribution list membership

Answer

The power consumption wattage of the CPU

Question 4

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

Accepted Answer

Review command-line arguments for utility tools utilized during the attack. Credential dumping investigations involve analyzing process access telemetry and examining associated endpoint logs.

Answer

Verify employee cafeteria badge swipe access times

Answer

Check the office HVAC temperature logs

Answer

Analyze cafeteria point-of-sale receipt records

Question 5

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

Accepted Answer

File Path and Command-Line arguments. Cortex XDR supports granular exception configuration using file hashes, digital signatures, and file paths or command-line arguments.

Answer

Local user keyboard layout language

Answer

Endpoint CPU temperature threshold

Question 6

Which TWO pieces of information are displayed in the Incident summary dashboard of Cortex XDR? (Choose two)

Accepted Answer

Overall incident severity distribution. The Incident summary provides high-level metrics such as total incident count, severity distribution, and affected host counts.

Answer

Cellular phone network tower signal strengths

Answer

Local employee salary payroll database records

Answer

Commercial airline flight booking schedules

Question 7

When managing exclusions and exceptions in Cortex XDR, which THREE best practices should an analyst follow to maintain security posture? (Choose three)

Accepted Answer

Scope exceptions as narrowly as possible (e.g., specific hash and path). Effective exception management requires scoping rules tightly, documenting justifications, and reviewing exceptions periodically.

Answer

Share internal exception hashes publicly on open social media channels

Answer

Disable all default Cortex XDR BIOC rules globally upon deployment

Question 8

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

Accepted Answer

Process execution telemetry showing WmiPrvSE.exe spawning child processes. WMI activity generates specific process execution and WMI event consumer telemetry logs.

Answer

Bluetooth peripheral pairing histories

Answer

Local monitor color calibration profiles

Answer

Desktop wallpaper image file paths

Question 9

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

Accepted Answer

Quarantine File. Playbooks support automated containment and investigative tasks such as endpoint isolation, file quarantine, and artifact gathering.

Answer

Physically replace damaged endpoint motherboard hardware

Answer

Update the corporate website DNS homepage banner

Question 10

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

Accepted Answer

Global Indicator Search / Threat Hunting. Enterprise scoping is accomplished using XQL search and global threat hunting tools.

Answer

Mouse pointer speed settings

Answer

Audio speaker volume mixer

Answer

Physical keyboard backlight color adjuster

Question 11

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Accepted Answer

Verify the digital signature and publisher of the application. Safe exception implementation involves validating binary integrity, verifying legitimate paths, and testing prior to global deployment.

Answer

Disable all Cortex XDR agent security modules across the entire enterprise

Answer

Remove all file access permissions from the operating system kernel

Question 12

When reviewing identity alerts in Cortex XDR, which TWO anomalous behaviors might indicate compromised credentials? (Choose two)

Accepted Answer

Accessing sensitive resources outside normal working hours and baseline behavior. Identity analytics look for unusual access patterns such as impossible travel or abnormal login times.

Answer

Connecting a standard corporate wired Ethernet cable

Answer

Printing a standard business document to the local office printer

Answer

Routine login from the user's assigned office desktop during regular business hours

Question 13

Which TWO actions can an analyst take when closing an incident in Cortex XDR? (Choose two)

Accepted Answer

Add resolution notes detailing remediation steps taken. Incidents can be closed with specific resolution statuses and closing notes to document the outcome.

Answer

Conduct an employee annual performance review meeting

Answer

Order replacement laptops for all company employees

Answer

Initiate a physical factory reset of the datacenter cooling system

Question 14

Which TWO forensic logs or artifacts are most valuable when investigating a suspected ransomware attack on an endpoint? (Choose two)

Accepted Answer

File system activity logs showing rapid mass file modifications or extensions. Ransomware investigations rely heavily on file activity logs (mass modifications/renaming) and volume shadow copy deletion logs.

Answer

Visitor badge sign-in sheets

Answer

Cafeteria menu rotation schedules

Answer

Office desk assignment floor plans

Question 15

An analyst is performing advanced threat hunting in Cortex XDR using XQL. Which THREE clauses or functions are commonly used when constructing analytical queries for evidence review? (Choose three)

Accepted Answer

fields command to select and display specific attributes or columns. XQL queries utilize clauses like dataset filtering, field projection (fields), and aggregation (alt / dedup / count) to analyze telemetry.

Answer

reboot operating system kernel function

Answer

format hard drive command to wipe the query storage engine