XDR-Analyst Evidence Review And Response Actions Practice Test 4 — 15 Questions

Question 1

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

Accepted Answer

Global Indicator Search / Threat Hunting. Option C, Global Indicator Search / Threat Hunting, is correct because it lets an analyst pivot on indicators such as file hashes, IP addresses, domains, and process names across all endpoints and telemetry in the Cortex XDR tenant, revealing every host or artifact tied to the incident enterprise-wide. Option E, XQL Search (Query Builder), is correct because XQL (XDR Query Language) queries the Cortex Data Lake and endpoint datasets, enabling broad, customizable hunting and correlation of events across the entire environment to scope an incident's blast radius. The remaining options do not belong: A (mouse pointer speed settings), B (audio speaker volume mixer), and D (physical keyboard backlight color adjuster) are unrelated OS or hardware cosmetic settings with no security, search, or incident-scoping capability in Cortex XDR.

Answer

Mouse pointer speed settings

Answer

Audio speaker volume mixer

Answer

Physical keyboard backlight color adjuster

Question 2

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Accepted Answer

Verify the digital signature and publisher of the application. Safe exception implementation involves validating binary integrity, verifying legitimate paths, and testing prior to global deployment.

Answer

Disable all Cortex XDR agent security modules across the entire enterprise

Answer

Remove all file access permissions from the operating system kernel

Question 3

When reviewing identity alerts in Cortex XDR, which TWO anomalous behaviors might indicate compromised credentials? (Choose two)

Accepted Answer

Accessing sensitive resources outside normal working hours and baseline behavior. Option A is correct because accessing sensitive resources outside normal working hours and outside the user's established baseline behavior is a classic indicator of compromised credentials — an attacker using stolen credentials often operates at unusual times and targets data the legitimate user does not normally touch, which Cortex XDR surfaces as an identity analytics anomaly. Option C is correct because impossible travel logins from geographically distant locations within minutes are physically impossible for a single human to perform, indicating the credentials are being used by multiple parties or an attacker from a remote location, a well-known credential-compromise signal in Cortex XDR identity alerts. Option B does not belong because connecting a standard corporate wired Ethernet cable is a normal, expected network activity with no identity or credential anomaly. Option D does not belong because printing a standard business document to the local office printer is routine user behavior unrelated to credential misuse. Option E does not belong because a routine login from the user's assigned office desktop during regular business hours matches the expected baseline and shows no anomaly.

Answer

Connecting a standard corporate wired Ethernet cable

Answer

Printing a standard business document to the local office printer

Answer

Routine login from the user's assigned office desktop during regular business hours

Question 4

Which TWO actions can an analyst take when closing an incident in Cortex XDR? (Choose two)

Accepted Answer

Add resolution notes detailing remediation steps taken. Option C is correct because when an analyst closes an incident in Cortex XDR, they can add resolution notes that document the remediation steps taken, providing an audit trail and context for the closure. Option D is correct because Cortex XDR requires the analyst to assign a resolution status such as 'Resolved - True Positive' or 'Resolved - False Positive' to categorize the outcome of the investigation. These two fields are part of the standard incident resolution workflow in the Cortex XDR incident response interface. Option A is incorrect because employee performance reviews are an HR function unrelated to incident closure. Option B is incorrect because ordering replacement laptops is a procurement task, not an incident-closing action. Option E is incorrect because resetting datacenter cooling equipment is a facilities operation with no role in Cortex XDR incident resolution.

Answer

Conduct an employee annual performance review meeting

Answer

Order replacement laptops for all company employees

Answer

Initiate a physical factory reset of the datacenter cooling system

Question 5

Which TWO forensic logs or artifacts are most valuable when investigating a suspected ransomware attack on an endpoint? (Choose two)

Accepted Answer

File system activity logs showing rapid mass file modifications or extensions. Option A is correct because ransomware's defining behavior is rapid, high-volume file encryption, so file system activity logs that show mass file modifications or the appearance of new extensions (e.g., .locked, .encrypted) directly evidence the attack's scope and timeline. Option E is correct because a common ransomware precursor/impact step is destroying backups by deleting Volume Shadow Copies, and process execution logs capturing commands like 'vssadmin delete shadows /all /quiet' or 'wmic shadowcopy delete' reveal this anti-recovery activity. The remaining options are not technical forensic artifacts: visitor badge sign-in sheets (B), cafeteria menu rotations (C), and desk assignment floor plans (D) are physical/administrative records with no endpoint telemetry value for detecting encryption or shadow-copy deletion.

Answer

Visitor badge sign-in sheets

Answer

Cafeteria menu rotation schedules

Answer

Office desk assignment floor plans

Question 6

An analyst is performing advanced threat hunting in Cortex XDR using XQL. Which THREE clauses or functions are commonly used when constructing analytical queries for evidence review? (Choose three)

Accepted Answer

fields command to select and display specific attributes or columns. XQL queries utilize clauses like dataset filtering, field projection (fields), and aggregation (alt / dedup / count) to analyze telemetry.

Answer

reboot operating system kernel function

Answer

format hard drive command to wipe the query storage engine

Question 7

Which TWO details are typically reviewed when inspecting an alert in the Cortex XDR Incident Viewer? (Choose two)

Accepted Answer

Timestamp of when the event occurred. In the Cortex XDR Incident Viewer, the alert details pane surfaces the event's timestamp so analysts can establish when the activity occurred and correlate it with other telemetry — making option A correct. It also displays the alert description and the name of the detection rule (or BIOC/analytics signature) that fired, which tells the analyst what behavior was detected and why — making option C correct. Options B, D, and E are unrelated business records (cafeteria receipts, travel itineraries, parking gate codes) and have no place in the alert inspection workflow, so they are not reviewed details.

Answer

Local cafeteria lunch receipt totals

Answer

Corporate travel booking itineraries

Answer

Office building parking garage gate codes

Question 8

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Accepted Answer

Windows Scheduled Tasks. Option C is correct because Windows Scheduled Tasks are a common APT persistence mechanism, allowing malware to execute on a schedule or at logon/boot, and Cortex XDR telemetry captures task creation and modification events (e.g., schtasks.exe, Task Scheduler operational logs). Option D is correct because creating or modifying Windows Services (e.g., via sc.exe, New-Service, or service DLL hijacking) enables persistence by launching malicious code at system startup, and Cortex XDR records service installation and configuration changes. Option E is correct because Registry Run and RunOnce keys (HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce) are classic autostart locations that Cortex XDR monitors for registry modifications tied to persistence. Options A and B are incorrect because office desk relocation requests and breakroom coffee machine maintenance schedules are physical facilities matters with no relation to host-based persistence or endpoint telemetry.

Answer

Office desk relocation requests

Answer

Breakroom coffee machine maintenance schedules

Question 9

When an endpoint is isolated during an incident response action in Cortex XDR, which TWO types of network traffic are generally permitted to ensure continued management and minimal disruption? (Choose two)

Accepted Answer

Communication channel between the Cortex XDR agent and the management server. Option B is correct because when Cortex XDR isolates an endpoint, the agent must retain its communication channel to the Cortex XDR management server so the analyst can continue issuing commands, collect telemetry, and later release the endpoint from isolation. Option D is correct because isolation policies typically allow traffic to explicitly defined exceptions or management infrastructure, such as DNS and Active Directory, so the host can still resolve names and authenticate while remaining contained. Options A, C, and E are incorrect because peer-to-peer torrent sharing, social media video streaming, and public online gaming are unrelated to incident response management and would undermine the purpose of network isolation.

Answer

Unrestricted peer-to-peer torrent file sharing traffic

Answer

Personal social media video streaming broadcasts

Answer

Public online gaming multiplayer connections

Question 10

When responding to a malware alert, an analyst decides to quarantine the offending file. Which TWO outcomes occur when Cortex XDR performs a file quarantine? (Choose two)

Accepted Answer

Running processes associated with the file are terminated.. Quarantine terminates the running process instance (if applicable) and moves the file binary from its original path to a secure, encrypted quarantine location on the endpoint.

Answer

All network routers in the enterprise data center are reset.

Answer

The computer's power supply unit is permanently disabled.

Answer

The endpoint operating system hard drive is physically wiped clean.

Question 11

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

Accepted Answer

Incident Timeline / Causality view. Option A, the Incident Timeline / Causality view, is correct because in Cortex XDR this view reconstructs the sequence of events (process execution, network connections, file writes, registry changes) around an alert, letting analysts trace the root cause and forensic artifacts collected from the endpoint. Option C, the File Details / Forensic File Collection view, is correct because it exposes the actual collected forensic artifacts such as quarantined files, hashes, and file metadata retrieved from the endpoint during an investigation. The remaining options (B, D, and E) are unrelated administrative or facilities records and have no role in Cortex XDR forensic artifact analysis.

Answer

Corporate gym membership roster

Answer

Cloud printer ink supply level gauge

Answer

Cafeteria food inventory management sheet

Question 12

An analyst is investigating an alert involving suspicious PowerShell execution. To thoroughly review the evidence, which THREE investigative steps should the analyst take within Cortex XDR? (Choose three)

Accepted Answer

Examine the exact command-line arguments passed to powershell.exe. Option A is correct because examining the exact command-line arguments passed to powershell.exe reveals the actual script, encoded commands (e.g., -EncodedCommand), or download-and-execute strings that define the malicious behavior, which is essential evidence in a PowerShell alert. Option C is correct because the Causality Chain in Cortex XDR shows the process lineage, letting the analyst identify the parent process that spawned PowerShell (e.g., winword.exe or wmiprvse.exe) and determine the initial infection vector. Option E is correct because inspecting network connections initiated by the PowerShell process exposes command-and-control traffic, exfiltration, or payload downloads, tying the execution to external infrastructure. Options B and D are incorrect because desk phone extensions and physical badge reader logs are physical-security artifacts unrelated to host-based PowerShell process telemetry and are not investigative data available within Cortex XDR for this alert.

Answer

Check the physical desk phone extension number of the user

Answer

Verify the physical building entry badge reader logs

Question 13

Which TWO actions are available to an analyst when managing an incident's assignment in Cortex XDR? (Choose two)

Accepted Answer

Assign the incident to a specific analyst user account. Option A is correct because Cortex XDR incident management allows an analyst to assign an incident to a specific analyst user account, which sets that named user as the owner responsible for triaging and resolving the incident. Option E is correct because incidents can also be assigned to a specific SOC analyst group or tier, enabling team-based ownership and routing to the appropriate skill level rather than a single individual. Both actions are core assignment operations in the Cortex XDR incident response workflow, letting analysts direct ownership either to a person or to a group/tier. Options B, C, and D are incorrect because stock ticker symbols, office mail delivery, and security guard shifts are unrelated to Cortex XDR incident assignment and have no place in the platform's incident management features.

Answer

Update corporate stock market ticker symbols

Answer

Re-route office mail delivery to a new address

Answer

Change corporate office building security guard shifts

Question 14

An administrator needs to configure automated incident response actions in Cortex XDR. Which THREE components are critical for building a successful automated response workflow? (Choose three)

Accepted Answer

Playbook actions and logic steps (such as quarantine or enrichment). Option C is correct because playbook actions and logic steps are the executable core of an automated response workflow in Cortex XDR, defining what happens (e.g., isolate endpoint, quarantine file, enrich indicators) and in what order. Option D is correct because integration configurations are required to connect Cortex XDR with external tools such as Cortex XSOAR, threat intelligence providers, or ticketing systems so the playbook can invoke those services during response. Option E is correct because trigger conditions determine when the automation fires, using criteria such as incident severity, alert type, or specific detection rules to scope the workflow appropriately. Options A and B are incorrect because cafeteria menu pricing and server room coolant levels are unrelated to incident response automation and have no role in Cortex XDR playbook design or execution.

Answer

Corporate cafeteria catering menu pricing sheets

Answer

Physical server room air conditioning coolant levels

Question 15

Which TWO details does the Cortex XDR Incident Graph display during evidence review? (Choose two)

Accepted Answer

Key attack entities such as suspicious files, IP addresses, and user accounts. The Cortex XDR Incident Graph is designed to visualize an incident's scope and progression by mapping the key attack entities involved, such as suspicious files, IP addresses, and user accounts, which is exactly what option A describes and why it is correct. It also depicts the causal and relational links between alerts, endpoints, and malicious artifacts, showing how they connect across the incident timeline, which is what option C correctly identifies. Options B, D, and E are all irrelevant non-security details (parking lot lighting, chair ergonomics, and microwave wattage) that have nothing to do with incident evidence review or the Incident Graph's visualization of threat data.

Answer

Corporate parking lot lighting schedules

Answer

Office desk chair ergonomic adjustment instructions

Answer

Breakroom microwave operational wattage ratings