XDR-Analyst Evidence Review And Response Actions Practice Test 6 — 15 Questions

Question 1

An analyst is reviewing a Cortex XDR incident that contains a 'Behavioral Threat' alert for a process that spawned a child process with suspicious command-line arguments. The analyst wants to see the full process lineage, including the parent process, command line, and the user account that initiated it, to determine if this is a false positive. Which Cortex XDR feature should the analyst use to obtain this information?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Causality Chain view. The Causality Chain view provides a graphical representation of process ancestry, including parent-child relationships, command lines, and user context. This is the most direct and efficient way to understand the full lineage of a suspicious process and determine whether the behavior is malicious or benign. Other options either lack the necessary visual context or are intended for different purposes such as response or custom querying.

Answer

Incident Response Playbook

Answer

Alert Timeline view

Answer

XQL Query Builder

Question 2

An analyst investigating a ransomware incident on a Windows endpoint needs to determine which process originally created the malicious executable that was later detected. The analyst opens the Cortex XDR Causality Chain view for the alert. Which element of the Causality Chain directly identifies the parent process responsible for spawning the malicious file?

Accepted Answer

The immediate ancestor node connected directly above the malicious process node in the causality chain graph.. The Causality Chain in Cortex XDR is a process lineage graph in which every node links back to the process that spawned it. The node immediately above the malicious process is therefore its direct parent, the process that actually created and launched the executable. Examining that ancestor's image path, command line, and user gives the analyst the concrete origin of execution, which is the correct evidence to pursue.

Answer

The alert severity indicator attached to the malicious process node, which reflects how the parent process was classified.

Answer

The WildFire verdict shown alongside the file hash, which records the process that submitted the sample for analysis.

Answer

The root node at the top of the causality chain, which represents the earliest observed process in the chain of execution.

Question 3

An analyst is investigating a potential data exfiltration incident. They have identified a suspicious external IP address that the endpoint communicated with. To gather more context, they want to see all historical network connections involving that IP address across the organization. Which Cortex XDR capability should the analyst use?

Accepted Answer

XQL Search with network connection events. XQL Search is Cortex XDR's query language that enables analysts to search across all collected telemetry, including network connection events. By querying for the suspicious IP address, the analyst can retrieve historical connections from any endpoint, providing the organization-wide visibility needed to assess the extent of the incident.

Answer

Endpoint Management console for the affected endpoint

Answer

Threat Intelligence module for the IP address

Answer

Alert Details page for the specific alert

Question 4

An analyst is investigating a Cortex XDR incident involving a suspicious process on a Windows endpoint. The analyst wants to gather volatile evidence from the endpoint before taking containment actions. Which TWO response actions can be used to collect volatile evidence? (Choose two.)

Accepted Answer

Get Network Connections. Get Process List and Get Network Connections are response actions that collect volatile evidence by capturing the current state of running processes and active network connections, respectively. These are time-sensitive data that can be lost if containment actions are taken first. Other actions like quarantine, isolation, or file retrieval do not collect volatile system state information.

Answer

Isolate Endpoint

Answer

Quarantine File

Answer

Retrieve File

Question 5

A Cortex XDR analyst is reviewing an endpoint alert and wants to capture volatile evidence from the affected host before initiating remediation. The analyst decides to run a live terminal session on the endpoint through the Cortex XDR console. Which statement accurately describes the capability and limitation of this live terminal session?

Accepted Answer

The live terminal provides an interactive shell on the endpoint and supports running built-in OS commands, but sessions are audited and commands are logged for the investigation record.. Live Terminal in Cortex XDR opens an interactive, audited shell on the endpoint, enabling analysts to run native OS commands to collect volatile evidence during triage. Every command and response is recorded in the action audit trail, preserving accountability. The session relies on the agent being healthy and connected, and it is intended for investigation, not for installing persistent tooling or operating independently of the agent.

Answer

The live terminal is read-only and can only display existing log files without executing any new commands on the host.

Answer

The live terminal allows the analyst to install third-party forensic tools permanently on the endpoint for later offline analysis.

Answer

The live terminal bypasses the endpoint agent, so commands execute even if the Cortex XDR agent has been tampered with or stopped.

Question 6

A Cortex XDR analyst is investigating an incident where a user's endpoint was compromised. The analyst needs to determine if the attacker moved laterally to other endpoints by leveraging stolen credentials. Which Cortex XDR data source should the analyst query to identify successful and failed authentication attempts across the environment?

Accepted Answer

Authentication logs from the identity provider. Authentication logs from the identity provider contain records of logon attempts, including success or failure, and often include source and destination information. This makes them the most appropriate data source for detecting lateral movement via stolen credentials. Other sources like process execution or network traffic logs lack the necessary authentication context to confirm such activity.

Answer

Network traffic analysis (NTA) logs

Answer

File system audit logs

Answer

Endpoint process execution logs

Question 7

An analyst is reviewing a Cortex XDR incident involving a compromised Linux server. The analyst needs to retrieve the contents of a suspicious file located at /tmp/malware.bin from the endpoint for further analysis. Which response action should the analyst use?

Accepted Answer

Retrieve File. Retrieve File is the correct response action because it directly collects a specified file from an endpoint and makes it available in the Cortex XDR console for analysis. This allows the analyst to examine the suspicious binary without altering the endpoint's state or requiring custom scripting. Other actions like quarantine or isolation do not provide the file contents, and Run Script is an indirect and less reliable method.

Answer

Quarantine File

Answer

Isolate Endpoint

Answer

Run Script

Question 8

An analyst is reviewing a Cortex XDR incident where a suspicious PowerShell script was executed on an endpoint. The analyst wants to see the exact command-line arguments that were passed to PowerShell at the time of execution. Which Cortex XDR feature should the analyst use to find this information?

Accepted Answer

Process Execution History in the Causality Chain. The Causality Chain in Cortex XDR provides a detailed view of process execution, including the command-line arguments used when each process was started. By inspecting the Process Execution History within the Causality Chain, the analyst can see the exact PowerShell command line and its arguments. Other features like the Alerts Table, isolation logs, or policy audits do not offer this level of process detail.

Answer

Alerts Table

Answer

Endpoint Isolation Logs

Answer

Policy Audit Trail

Question 9

An analyst is reviewing a Cortex XDR alert for a suspicious PowerShell script that was executed on a Windows endpoint. The analyst wants to gather additional context about the script's execution. Which TWO data sources are available directly in the Cortex XDR alert details to help understand the script's behavior? (Choose two.)

Accepted Answer

Network connections initiated by the process. The alert details in Cortex XDR provide process execution details and network connections associated with the process. These allow the analyst to see how the script was launched and whether it communicated externally. Memory dumps, registry modifications, and user login history are not standard data sources directly available in the alert details for a specific process, making them incorrect choices.

Answer

Full memory dump of the PowerShell process

Answer

Windows Registry modifications made by the script

Answer

User login history for the account that executed the script

Question 10

An analyst is investigating a series of alerts related to a suspicious scheduled task created on a Windows endpoint. They want to determine the user account that created the task and the exact command that was scheduled. Which Cortex XDR data source should the analyst review to find this information?

Accepted Answer

Scheduled task events. Scheduled task events in Cortex XDR are specifically designed to capture the creation, modification, and deletion of scheduled tasks, including the responsible user account and the command line. This data source directly answers the analyst's questions about who created the task and what command was scheduled.

Answer

Process execution events

Answer

File creation events

Answer

Registry modification events

Question 11

An analyst is investigating a Cortex XDR incident and wants to add a note to the incident timeline to document the steps taken so far. Where in the Cortex XDR console can the analyst add this note?

Accepted Answer

Incident Details page, under the Notes section. The Incident Details page has a dedicated Notes section where analysts can add documentation that is automatically included in the incident timeline. This is the correct place to record investigation steps. Other areas like Endpoint Management, Causality View, or XQL Query Builder do not provide a way to add notes to the incident timeline, making them incorrect.

Answer

Causality View, by right-clicking an event

Answer

XQL Query Builder, by saving a query with a comment

Answer

Endpoint Management console, under the endpoint's details

Question 12

After containing a malware outbreak, a Cortex XDR analyst needs to verify that the malicious file was removed from all affected endpoints. The analyst wants to confirm the current state of the endpoints without waiting for the next scheduled scan. Which Cortex XDR action allows the analyst to query endpoint file system state on demand and return results to the console?

Accepted Answer

Run a script or command through the Cortex XDR Live Terminal or action center to check for the file's presence and capture the output.. To verify current endpoint state on demand, Cortex XDR provides Live Terminal and script-based response actions that execute directly on endpoints and return output to the console. These actions query the live file system, so the analyst can confirm whether the malicious file persists and immediately remediate if it does, rather than waiting for scheduled scans or relying on historical detection records.

Answer

Modify the endpoint protection policy to enable real-time file monitoring and rely on future alerts to confirm removal.

Answer

Initiate a WildFire submission of the file hash to obtain a fresh verdict and infer that the file was removed.

Answer

Review the Incident Details page timeline for the original detection and confirm that the file was quarantined at that time.

Question 13

An analyst is investigating a security incident and needs to review the timeline of events that occurred on a compromised endpoint. The analyst wants to see a chronological list of all alerts, process executions, and network connections related to the incident. Which Cortex XDR view should the analyst use?

Accepted Answer

Incident Details page. The Incident Details page is specifically designed to present all relevant information for an incident in one place, including a chronological timeline of alerts, process executions, and network connections. This allows the analyst to quickly understand the sequence of events without manual querying. Other options serve different purposes such as endpoint management, threat intelligence, or custom querying.

Answer

Endpoint Management console

Answer

Threat Intelligence module

Answer

XQL Query Center

Question 14

An analyst is reviewing a Cortex XDR incident where an endpoint has been compromised by malware that established persistence via a scheduled task. The analyst wants to remove the scheduled task remotely. Which response action should the analyst use?

Accepted Answer

Run Script. Run Script is the correct response action because it enables the analyst to execute a custom script that can delete the scheduled task. Cortex XDR does not have a dedicated 'Remove Scheduled Task' action, so Run Script provides the necessary flexibility. Quarantine File, Terminate Process, and Isolate Endpoint do not remove the scheduled task and thus do not fully remediate the persistence.

Answer

Quarantine File

Answer

Terminate Process

Answer

Isolate Endpoint

Question 15

During an investigation, a Cortex XDR analyst notices that an endpoint generated a high volume of network connection events to a suspicious external IP address. The analyst wants to isolate the host from the network while still allowing the Cortex XDR agent to communicate with the console for continued investigation. Which Cortex XDR response action should the analyst use?

Accepted Answer

Isolate the endpoint using the Cortex XDR network isolation capability, which blocks external traffic while permitting agent-to-console communication.. Cortex XDR network isolation contains an endpoint by blocking its network traffic while preserving the agent's connection to the console. This stops command-and-control and lateral movement but keeps the host manageable for continued evidence collection and response. It directly satisfies the requirement to cut the suspicious external communication without losing investigative visibility.

Answer

Terminate the malicious process only, leaving the endpoint fully connected so that the analyst can observe further attacker behavior.

Answer

Add the external IP address to the block list in the endpoint policy and wait for the policy to synchronize to the endpoint.

Answer

Quarantine the endpoint, which disables all network interfaces including the agent's management channel.