XDR-Analyst Evidence Review And Response Actions Practice Test 3 — 15 Questions

Question 1

An analyst needs to change the status of an incident from 'Under Investigation' to 'Resolved' after completing remediation. Which section of the Incident View allows updating the incident status?

Accepted Answer

Incident Header / Status field. Incident metadata such as status, assignment, and severity can be updated directly from the Incident header or details pane.

Answer

BIOC rule creation dialog

Answer

WildFire file submission form

Answer

Agent upgrade wizard

Question 2

An analyst is investigating an incident and wants to export the full incident report and associated artifact list for compliance reporting. Which option should the analyst select in Cortex XDR?

Accepted Answer

Export Incident report. The export incident functionality allows security analysts to download comprehensive reports containing alerts, artifacts, and investigation notes.

Answer

Format hard drive

Answer

Reboot endpoint agent

Answer

Purge telemetry database

Question 3

An analyst writes an XQL query to investigate lateral movement. Which dataset table in Cortex XDR contains comprehensive network connection telemetry across endpoints?

Accepted Answer

network_event (or xdr_data filtering network events). The xdr_data table or network_event dataset tables in Cortex XDR store parsed network session and connection telemetry.

Answer

user_identity_mapping

Answer

cloud_storage_bucket_policy

Answer

agent_upgrade_history

Question 4

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

Accepted Answer

Cloud audit and API activity logs. Cloud audit and API activity logs (e.g., AWS CloudTrail, Azure Activity Log) record every API call and resource modification in the cloud environment, making them the primary forensic source for cloud incidents. Cortex XDR ingests these to correlate cloud activity with endpoint telemetry.

Answer

Active Directory SYSVOL share

Answer

Local printer driver cache

Answer

Local endpoint SAM registry hive

Question 5

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

Accepted Answer

Signed binary exception with path and certificate verification. Signed binary exceptions combined with valid certificate verification and file path checks allow legitimate administrative or updater tools to operate without generating alerts.

Answer

Configuring a network port forwarding rule

Answer

Deleting the software updater from all endpoints

Answer

Disabling all behavioral monitoring on the subnet

Question 6

An analyst notices suspicious network connections originating from an unknown process on an endpoint. To block outbound communication for this process without isolating the entire host, what action can be taken?

Accepted Answer

Terminate the process and block its file hash or path. Terminate the process and block its file hash or path is correct because this action stops the malicious process from running and prevents it from executing again by blocking its hash or path. In Cortex XDR, analysts can terminate a process directly from the incident view and add the file hash to a blocklist, which is enforced by the agent. This approach contains the threat without disrupting the entire host's network connectivity, unlike full isolation.

Answer

Unplug the physical power cable from the workstation

Answer

Change the local monitor refresh rate

Answer

Reset the enterprise DNS root servers

Question 7

Which TWO automated or manual response actions can be executed directly on an endpoint from the Cortex XDR Incident Response toolbox? (Choose two)

Accepted Answer

Isolate Endpoint. Option D (Isolate Endpoint) is correct because the Cortex XDR Incident Response toolbox includes a network isolation action that cuts the endpoint off from the network (except for the Cortex XDR management channel) to contain a threat during an active incident. Option E (Quarantine File) is correct because the toolbox provides a file quarantine action that moves a malicious file to a protected quarantine location on the endpoint so it can no longer execute. These are standard built-in response actions available directly from the incident response interface. Options A (Upgrade BIOS firmware), B (Calibrate display resolution), and C (Reimage Operating System kernel) are not response actions offered by the Cortex XDR toolbox; they are hardware, display, or OS-level maintenance tasks unrelated to threat containment or remediation.

Answer

Upgrade BIOS firmware

Answer

Calibrate display resolution

Answer

Reimage Operating System kernel

Question 8

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

Accepted Answer

IP Connection (Source/Destination IP and Port). Option A (IP Connection with Source/Destination IP and Port) is correct because Cortex XDR alert details include network artifacts such as the source and destination IP addresses and ports involved in the connection, which are essential for tracing command-and-control or lateral movement activity. Option D (File hash, SHA-256) is correct because Cortex XDR captures cryptographic file hashes (including SHA-256) as part of its file artifacts, enabling analysts to identify known-malicious files and pivot to threat intelligence lookups. The remaining options do not belong: physical RAM stick serial numbers (B), office printer cartridge ink levels (C), and BIOS manufacturer dates (E) are hardware or facilities attributes that Cortex XDR does not collect or surface as alert artifacts.

Answer

Physical RAM stick serial number

Answer

Office printer cartridge ink level

Answer

BIOS manufacturer date

Question 9

An analyst is reviewing the Causality Chain for an alert. Which TWO key insights does this view provide? (Choose two)

Accepted Answer

The chronological sequence of events associated with the detection. Option C is correct because the Causality Chain view presents the chronological sequence of events associated with the detection, allowing the analyst to see how activity unfolded over time leading up to the alert. Option E is correct because the Causality Chain specifically maps the parent-child process relationships that led to the alert, showing which process spawned which and how the detection was ultimately triggered. Options A, B, and D are incorrect because physical server room location, email distribution list membership, and CPU power consumption wattage are unrelated to the process lineage and event timeline that the Causality Chain provides.

Answer

The physical location of the server room containing the host

Answer

The corporate email distribution list membership

Answer

The power consumption wattage of the CPU

Question 10

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

Accepted Answer

Review command-line arguments for utility tools utilized during the attack. Option D is correct because reviewing command-line arguments for utility tools (e.g., procdump, comsvcs.dll MiniDump, or Mimikatz invocations) reveals the exact syntax and target used to dump credentials, which is critical evidence in a credential dumping investigation. Option E is correct because LSASS.exe holds credential material in memory, so inspecting process access events (e.g., Sysmon Event ID 10, ProcessAccess with GrantedAccess like 0x1010 or 0x1410) targeting LSASS.exe directly identifies the credential dumping attempt. Options A and B are incorrect because badge swipe times and HVAC temperature logs are physical/environmental records unrelated to memory-based credential theft. Option C is incorrect because point-of-sale receipt records pertain to retail transactions and have no bearing on credential dumping activity on endpoints.

Answer

Verify employee cafeteria badge swipe access times

Answer

Check the office HVAC temperature logs

Answer

Analyze cafeteria point-of-sale receipt records

Question 11

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

Accepted Answer

File Path and Command-Line arguments. Option A (File Path and Command-Line arguments) is correct because Cortex XDR exceptions can be scoped by the process image path and the exact command-line string, allowing an analyst to suppress a false positive only for a specific executable invocation rather than all activity. Option C (Digital Signature / Certificate information) is correct because exceptions can be tied to the signer or certificate details, so only binaries signed by a trusted publisher are excluded, which is useful for legitimate vendor tools that trigger behavioral alerts. Option E (File Hash (SHA-256)) is correct because hash-based exceptions match a specific known-good file by its SHA-256 value, providing the tightest scope and preventing a different file with the same name or path from being suppressed. Option B (Local user keyboard layout language) is not a security-relevant attribute in Cortex XDR exception criteria, and Option D (Endpoint CPU temperature threshold) is a hardware/health metric that has no role in defining detection exception scope.

Answer

Local user keyboard layout language

Answer

Endpoint CPU temperature threshold

Question 12

Which TWO pieces of information are displayed in the Incident summary dashboard of Cortex XDR? (Choose two)

Accepted Answer

Overall incident severity distribution. The Incident summary provides high-level metrics such as total incident count, severity distribution, and affected host counts.

Answer

Cellular phone network tower signal strengths

Answer

Local employee salary payroll database records

Answer

Commercial airline flight booking schedules

Question 13

When managing exclusions and exceptions in Cortex XDR, which THREE best practices should an analyst follow to maintain security posture? (Choose three)

Accepted Answer

Scope exceptions as narrowly as possible (e.g., specific hash and path). Effective exception management requires scoping rules tightly, documenting justifications, and reviewing exceptions periodically.

Answer

Share internal exception hashes publicly on open social media channels

Answer

Disable all default Cortex XDR BIOC rules globally upon deployment

Question 14

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

Accepted Answer

Process execution telemetry showing WmiPrvSE.exe spawning child processes. Option B is correct because WMI script execution is carried out by the WMI Provider Host process (WmiPrvSE.exe), so process execution telemetry (e.g., Sysmon Event ID 1 or Security 4688) that shows WmiPrvSE.exe spawning child processes such as cmd.exe, powershell.exe, or wscript.exe directly reveals the unauthorized script being launched. Option E is correct because attackers often achieve persistence through WMI by creating permanent event subscriptions, and examining WMI event subscription and consumer logs (e.g., Sysmon Event IDs 19, 20, and 21, or the WMI-Activity operational log) exposes the __EventFilter, __EventConsumer, and __FilterToConsumerBinding objects used to trigger the malicious script. Option A is not relevant because Bluetooth pairing histories relate to wireless peripheral connections, not WMI execution. Option C is not relevant because monitor color calibration profiles are display settings unrelated to process or script activity. Option D is not relevant because desktop wallpaper file paths are cosmetic user configuration data with no bearing on tracing WMI-based script execution.

Answer

Bluetooth peripheral pairing histories

Answer

Local monitor color calibration profiles

Answer

Desktop wallpaper image file paths

Question 15

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

Accepted Answer

Quarantine File. Option A (Quarantine File) is correct because Cortex XDR playbooks can invoke the quarantine action to move a malicious file into the local quarantine vault and prevent its execution on the endpoint. Option B (Isolate Endpoint) is correct because endpoint isolation is a core automated containment action that restricts network communication to only the Cortex XDR management channel, blocking lateral movement during an incident. Option D (Collect forensic investigation package from the host) is correct because Cortex XDR supports triggering a forensic data collection (e.g., triage package with running processes, autoruns, and logs) directly from a playbook for offline analysis. Option C is not valid because physically replacing motherboard hardware is a manual, hands-on task that no software playbook can perform. Option E is not valid because modifying a corporate website's DNS homepage banner is unrelated to endpoint containment and outside the scope of Cortex XDR response actions.

Answer

Physically replace damaged endpoint motherboard hardware

Answer

Update the corporate website DNS homepage banner