XDR-Analyst Exam Simulation — 200 Questions

Question 1

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The time delta between the endpoint and network events exceeds the stitching correlation window. Data stitching relies on consistent identity and endpoint mapping. If the time window between events exceeds the stitching threshold or identifiers like MAC/hostname do not match correctly, stitching may fail.

Answer

The incident score was manually overridden to low

Answer

Alert starring was disabled on the network data source

Answer

Featured fields were not configured for the network logs

Question 2

An analyst needs to customize the Incident View columns to display specific custom IOC tags prominently next to the incident name. Which configuration area in Cortex XDR supports this?

Accepted Answer

Featured fields customization. Featured fields allow administrators to customize which fields are prominently displayed within the Incident View and Alert View grids.

Answer

Alert exclusion rules

Answer

Data stitching parameters

Answer

Incident scoring profile

Question 3

An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?

Accepted Answer

Create an alert exclusion or exception rule. Administrators can create alert tuning or exclusion rules to filter out known benign activities so they do not generate unnecessary raw alerts or incidents.

Answer

Manually star all related alerts

Answer

Increase the data stitching window

Answer

Modify featured fields to hide script alerts

Question 4

Which role-based permission is typically required for an analyst to change the status of an incident from 'New' to 'Under Investigation' in Cortex XDR?

Accepted Answer

Cortex XDR Analyst role. Incident management actions such as status changes and assignment require appropriate analyst or administrator roles with incident handling permissions.

Answer

Data stitching configuration role

Answer

Syslog forwarding administrator

Answer

Collector installation role

Question 5

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

Accepted Answer

New. Newly created incidents default to the 'New' status until an analyst takes ownership and updates the status.

Answer

Closed

Answer

Under Investigation

Answer

Resolved

Question 6

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

Accepted Answer

Cross-data-source data stitching. Data stitching correlates logs from endpoints, networks, and cloud sources using common identifiers like IP addresses, usernames, and timestamps into a cohesive incident.

Answer

Automated alert starring

Answer

Incident score weighting tables

Answer

Featured fields column mapping

Question 7

What is the primary benefit of the raw-alert-to-incident lifecycle consolidation in Cortex XDR?

Accepted Answer

It reduces alert fatigue by grouping related alerts into a single cohesive incident. Consolidating numerous raw alerts into structured incidents reduces alert fatigue by presenting correlated threats as single investigative units.

Answer

It automatically patches vulnerable operating systems on endpoints

Answer

It encrypts raw log data before sending it to syslog servers

Answer

It replaces the need for data collectors and endpoint agents

Question 8

Which TWO attributes are typically displayed by default or through featured fields in the Cortex XDR Incident View grid? (Choose two)

Accepted Answer

Incident Severity and Score. The Incident View grid displays essential incident metadata such as Incident Name/ID, Severity, Status, Score, and custom featured fields.

Answer

Syslog server destination IP ports

Answer

Data stitching algorithm version numbers

Answer

Agent collector installation binaries

Question 9

An incident in Cortex XDR contains dozens of low-priority alerts that were grouped together. The analyst determines that one specific alert within the incident is a false positive while the rest are legitimate threats. What is the best practice for handling this specific raw alert?

Accepted Answer

Mark the specific raw alert as a false positive or dismiss it within the incident view. Analysts can manage individual alerts within an incident, suppressing or tuning specific detectors or marking individual alerts as false positives without discarding the entire incident.

Answer

Change the incident score to zero to hide all alerts

Answer

Delete the entire incident and recreate it manually

Answer

Apply an alert starring filter to exclude the false positive

Question 10

An organization requires that specific custom threat intelligence tags appear as primary columns in the Incident View. How can an administrator achieve this?

Accepted Answer

Configure featured fields to include the custom threat intelligence tags. Featured fields allow administrators to select custom fields and tags to be displayed as columns in the Incident View.

Answer

Create a data stitching rule for threat intelligence

Answer

Set up an alert exclusion exception

Answer

Adjust the incident scoring profile weights

Question 11

An organization's security operations center (SOC) wants to adjust how Cortex XDR calculates incident severity scores based on specific asset criticality tags. Where should the administrator configure this behavior?

Accepted Answer

Incident View scoring configuration and severity weights. Incident scoring can be customized using scoring rules or profiles that factor in asset criticality to ensure high-value assets elevate incident severity appropriately.

Answer

Featured fields display mapper

Answer

Data stitching engine properties

Answer

Raw alert priority override settings

Question 12

What is the primary purpose of starring an alert within an incident details pane?

Accepted Answer

To bookmark and highlight important alerts for tracking and collaboration. Starring alerts helps analysts highlight key findings or indicators of compromise for collaboration and quick reference during or after an investigation.

Answer

To permanently exclude the alert from future incident generation

Answer

To increase the incident severity score to critical

Answer

To automatically trigger containment actions on the endpoint

Question 13

Where in the Cortex XDR console can an analyst review the complete lifecycle timeline of an incident, from initial raw alert generation to final resolution?

Accepted Answer

The Incident Details page and Incident Timeline view. The Incident View provides a detailed breakdown of an incident, including its timeline, associated alerts, affected assets, and lifecycle status.

Answer

The Syslog forwarding configuration panel

Answer

The Global Dashboard widget builder

Answer

The Agent installation status log

Question 14

Which TWO mechanisms are used by Cortex XDR to prevent alert fatigue during the raw-alert-to-incident lifecycle? (Choose two)

Accepted Answer

Alert exclusion and exception rules. Alert fatigue is mitigated by grouping related raw alerts into single incidents and utilizing exception rules to filter out benign activity.

Answer

Featured fields column configuration

Answer

Manual incident starring

Answer

Syslog log export scheduling

Question 15

An analyst wants to quickly identify all alerts related to a specific external IP address across multiple incidents without opening each incident individually. Which feature in the Cortex XDR console should the analyst use?

Accepted Answer

Alerts View filter and search capabilities. Global search or filtering within the Alerts View allows analysts to query specific IOCs, IPs, or hashes across all incidents and alerts.

Answer

Incident scoring threshold filter

Answer

Featured fields sorting

Answer

Data stitching status toggle

Question 16

A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?

Accepted Answer

Incident starring. Alert starring and incident starring allow analysts to bookmark or star specific items to highlight them for immediate attention and follow-up.

Answer

Incident scoring threshold override

Answer

Data stitching rule assignment

Answer

Featured fields configuration

Question 17

Which TWO factors directly influence how Cortex XDR calculates the overall severity score of an incident? (Choose two)

Accepted Answer

The severity levels of the constituent raw alerts. Incident scores are calculated based on the severity of the constituent raw alerts and the criticality of the affected assets.

Answer

The number of featured fields enabled in the UI

Answer

The frequency of manual alert starring by analysts

Answer

The syslog forwarding port configuration

Question 18

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

Accepted Answer

Suppress or disable the noisy alert rule if it lacks operational value. To prevent false positives from polluting future incidents, analysts can create alert exclusions, tune detector thresholds, or suppress specific behavioral rules.

Answer

Star all future instances of the alert in the incident view

Answer

Add a featured field column to hide the false positive alerts

Question 19

During an investigation, an analyst examines the Causality Chain and Incident Graph. What THREE key insights do these visualization tools provide into the incident lifecycle? (Choose three)

Accepted Answer

The chronological sequence of events spanning the entire incident. The Causality Chain and Incident Graph show process parent-child relationships, lateral movement across assets, and the chronological origin of the attack.

Answer

The custom featured fields assigned to the incident grid

Answer

The manual star status assigned by the shift supervisor

Question 20

A security analyst wants to adjust how Cortex XDR calculates incident severity to ensure that incidents involving domain controllers receive higher priority scores. Where should the analyst configure custom weights or scoring logic for incidents?

Accepted Answer

Under Settings > Configurations > Incident View > Incident Scoring. Incident severity and scoring rules can be customized in Cortex XDR under Incident View and Scoring settings to align with organizational risk appetite and asset criticality.

Answer

Under Endpoint Security > Settings > Profiles > Malware > Severity Adjustment

Answer

Under Response > Action Center > Scoring Policy

Answer

Under Correlation Rules > Custom BIOC > Severity Tab