XDR-Analyst Timed Hard Questions — 25 Difficult Questions

Question 1

An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?

15 minute time limit — choose an answer to begin.

Accepted Answer

TCP port 443 for HTTPS API and tenant communication. Broker VM requires outbound HTTPS access on port 443 to communicate with the Cortex XDR tenant cloud backend.

Answer

TCP port 22 for SSH tunnel maintenance

Answer

TCP port 389 and 636 for directory synchronization

Answer

TCP port 6514 for secure syslog ingestion

Question 2

An XDR analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst notices that the network alerts lack associated endpoint process information, even though the same host is involved. What is the most likely cause for this missing correlation?

Accepted Answer

The endpoint telemetry for that host was not ingested or was delayed beyond the stitching window.. Cortex XDR correlates network and endpoint alerts by matching host identifiers and timestamps. If endpoint telemetry is not available or arrives after the stitching window, the network alerts cannot be enriched with process information. This often occurs when endpoints are offline, the agent is not installed, or log forwarding is delayed. Ensuring timely telemetry ingestion is key to maintaining correlation.

Answer

The incident was manually created and does not include automatic stitching.

Answer

The network alerts were generated from a different sensor that does not share endpoint telemetry.

Answer

The network alerts were triggered by a different IP address than the endpoint's IP due to NAT.

Question 3

An analyst is investigating a Cortex XDR incident where the alert source is listed as 'XDR Analytics' and the alert contains a MITRE ATT&CK technique mapping. The analyst wants to understand how the alert was generated and what data contributed to it. Which two actions should the analyst take to gain this understanding? (Choose two.)

Accepted Answer

Review the alert's 'Alert Details' pane for the analytics description and contributing events. To understand an XDR Analytics alert, the analyst should review the Alert Details pane for the analytics description and contributing events, and examine the Causality Chain to see the event sequence. These provide the 'why' and 'how' of the alert. Other actions like exporting raw logs, modifying BIOC rules, or counting similar alerts do not directly explain the alert's generation.

Answer

Run a query in the Query Builder to count similar alerts

Answer

Modify the BIOC rule that triggered the alert

Answer

Export the raw endpoint logs from the Cortex XDR agent

Question 4

An analyst is reviewing a Cortex XDR incident that includes alerts from multiple sources. The analyst wants to correlate related alerts to identify a coordinated attack. Which two actions can the analyst take to manually correlate alerts into the incident? (Choose two.)

Accepted Answer

Create a new incident from the alert and then merge it with the existing incident.. Manual correlation in Cortex XDR can be achieved by either adding an alert directly to an incident or by creating a new incident from the alert and merging it. Both methods result in the alert being included in the incident's context, enabling unified analysis. Other actions like changing severity or editing descriptions do not establish the necessary link.

Answer

Modify the alert's severity to match the incident's severity.

Answer

Edit the alert's description to include the incident ID.

Answer

Assign the alert to the same analyst who owns the incident.

Question 5

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

Accepted Answer

File Path and Command-Line arguments. Option A (File Path and Command-Line arguments) is correct because Cortex XDR exceptions can be scoped by the process image path and the exact command-line string, allowing an analyst to suppress a false positive only for a specific executable invocation rather than all activity. Option C (Digital Signature / Certificate information) is correct because exceptions can be tied to the signer or certificate details, so only binaries signed by a trusted publisher are excluded, which is useful for legitimate vendor tools that trigger behavioral alerts. Option E (File Hash (SHA-256)) is correct because hash-based exceptions match a specific known-good file by its SHA-256 value, providing the tightest scope and preventing a different file with the same name or path from being suppressed. Option B (Local user keyboard layout language) is not a security-relevant attribute in Cortex XDR exception criteria, and Option D (Endpoint CPU temperature threshold) is a hardware/health metric that has no role in defining detection exception scope.

Answer

Local user keyboard layout language

Answer

Endpoint CPU temperature threshold

Question 6

A Cortex XDR incident contains 15 alerts that were automatically stitched together. The analyst determines that 3 of these alerts are false positives caused by a legitimate administrative script. The analyst wants to remove these 3 alerts from the incident without affecting the other 12 alerts. What is the correct action?

Accepted Answer

Select the 3 alerts in the incident and choose 'Remove from Incident' to unlink them, leaving the incident with the remaining 12 alerts.. The correct action is to select the false-positive alerts and use the 'Remove from Incident' function. This unlinks them from the incident, leaving the remaining alerts intact. It is the precise method for refining incident contents without altering the incident's status or creating new incidents.

Answer

Add a note to the incident indicating that the 3 alerts are false positives, and then resolve the incident.

Answer

Change the severity of the 3 alerts to 'Informational' so they no longer contribute to the incident's risk score.

Answer

Close the incident and create a new incident manually with only the 12 relevant alerts.

Question 7

An administrator is designing a disaster recovery and high availability strategy for Broker VM deployments in a large enterprise. Which THREE practices ensure high availability and resilience for Broker VM services?

Accepted Answer

Continuously monitoring Broker VM health, connectivity status, and app status in the Cortex XDR console. Option A is correct because continuous monitoring of Broker VM health, connectivity status, and app status in the Cortex XDR console provides the visibility needed to detect failures or degraded services early and trigger remediation, which is essential for maintaining high availability. Option B is correct because hypervisor-level HA such as VMware vSphere HA automatically restarts Broker VM virtual machines on another host when a host failure occurs, reducing downtime without manual intervention. Option C is correct because deploying multiple Broker VM instances in active-active or active-passive configurations across different hypervisor hosts removes single points of failure and ensures service continuity if one instance or host becomes unavailable. Option D does not belong because connecting virtual disks to a local USB thumb drive is not a supported or reliable HA mechanism and introduces a single point of failure rather than resilience. Option E does not belong because Broker VM is a virtual appliance deployed on a hypervisor, not software that runs inside a web browser tab, so it cannot provide the required availability or performance.

Answer

Connecting the Broker VM virtual disks to a local USB thumb drive for manual failover

Answer

Running the Broker VM software directly inside a web browser tab

Question 8

An administrator is configuring data stitching and alert correlation rules in Cortex XDR to improve incident prioritization. Which TWO actions are best practices to ensure high-fidelity alert grouping and accurate incident scoring? (Choose two)

Accepted Answer

Map critical assets with appropriate priority weights to influence incident scoring accurately.. Option C is correct because Cortex XDR incident scoring factors in asset criticality, so mapping critical assets with appropriate priority weights ensures that alerts affecting high-value systems are scored and prioritized accurately. Option E is correct because data stitching and alert correlation depend on consistent, correctly parsed host and IP identification fields; if third-party log sources do not normalize these fields, Cortex XDR cannot reliably stitch related alerts into a single incident or correlate them across data sources. Option A is incorrect because disabling all default analytics rules removes valuable built-in detections and correlation logic rather than improving fidelity. Option B is incorrect because a 1-minute incident close timeout is far too aggressive and would prematurely close incidents before related alerts can be stitched together. Option D is incorrect because manually starring every alert does not trigger the correlation engine and would simply clutter the alert view without improving grouping or scoring.

Answer

Disable all default Cortex XDR analytics rules to prevent false correlation.

Answer

Set the incident close timeout to 1 minute to speed up alert processing.

Answer

Manually star every incoming alert to trigger the incident correlation engine.

Question 9

An organization notices an increase in credential dumping attacks against local Active Directory environments. They want to configure Cortex XDR Identity Analytics to trigger high-severity alerts when abnormal Kerberos ticket requests (such as potential Silver or Golden ticket activities) are detected. Where should the analyst enable or tune these specific identity behavior analytics rules?

Accepted Answer

Under Settings > Configurations > Analytics in the Cortex XDR console. Identity Analytics behavioral rules are managed within the Analytics configuration section of the Cortex XDR management console under Settings > Configurations > Analytics.

Answer

By modifying local Windows Group Policy Objects (GPOs) pushed to domain controllers

Answer

Within the BIOC (Behavioral Indicator of Compromise) rule builder under Incident Response

Answer

Under Settings > Configurations > Data Node Settings in the Cortex XDR console

Question 10

An administrator is setting up syslog log collection on a Broker VM. By default, which UDP and TCP port does the Broker VM Syslog collector listen on for incoming syslog messages from network devices?

Accepted Answer

TCP/UDP port 514. By default, standard syslog collection listens on TCP/UDP port 514, though configurable in the Broker VM app settings.

Answer

TCP port 636 for secure LDAP syslog

Answer

UDP port 123 for Network Time Protocol

Answer

TCP port 8080 for HTTP forwarding

Question 11

Your organization has integrated Azure AD (Entra ID) with Cortex XDR to improve cloud identity visibility. An analyst observes alerts regarding impossible travel and atypical sign-in locations. Which underlying Cortex XDR capability processes these cloud IdP logs to detect such behavioral anomalies?

Accepted Answer

Cortex XDR Identity Analytics and Machine Learning behavioral profiling. Cortex XDR Identity Analytics applies machine learning algorithms to baseline user behavior across both on-premises Active Directory and cloud IdPs to surface anomalies like impossible travel.

Answer

Local endpoint Anti-Malware scanning engines

Answer

WildFire Static Analysis engine

Answer

Cortex XDR Port Scan detector BIOCs

Question 12

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

Accepted Answer

Configure exclusions for the vulnerability scanner's IP addresses or signature patterns. Creating exclusion rules for scanner IP addresses or signatures ensures vulnerability assessment traffic does not trigger security incidents.

Answer

Enable featured fields to hide scanner columns

Answer

Turn off data stitching across all internal subnets

Answer

Star all alerts generated during scanning windows

Question 13

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Accepted Answer

Verify the digital signature and publisher of the application. Safe exception implementation involves validating binary integrity, verifying legitimate paths, and testing prior to global deployment.

Answer

Disable all Cortex XDR agent security modules across the entire enterprise

Answer

Remove all file access permissions from the operating system kernel

Question 14

When analyzing a complex multi-stage attack in Cortex XDR, an analyst examines the Causality Chain. How does the Causality Chain assist in understanding the raw-alert-to-incident lifecycle?

Accepted Answer

It traces the parent-child process relationship and telemetry leading to the alert. The Causality Chain visualizes the chronological sequence of processes, network connections, and file modifications that led to an alert, helping trace the origin of the incident.

Answer

It automatically recalculates the incident score based on user activity

Answer

It stitches network logs with endpoint logs using IP subnet masks

Answer

It filters featured fields to highlight malicious hashes

Question 15

Which THREE configuration settings or components are directly involved in managing raw alerts before they become full incidents? (Choose three)

Accepted Answer

Detector and BIOC tuning parameters. Raw alerts are managed before incident creation using alert exclusion rules, detector tuning parameters, and BIOC/analytics configurations.

Answer

Featured fields UI grid mapper

Answer

Alert exclusion and exception rules

Answer

Analyst incident starring bookmarks

Question 16

When constructing an advanced XQL query to investigate credential access and lateral movement, which TWO syntax structures or functions are correctly formatted for filtering and aggregation?

Accepted Answer

dataset = xdr_data | filter event_type = "USER_LOGIN" | stats count by user. Valid XQL syntax uses 'dataset = xdr_data' (or equivalent), 'filter' clauses, and 'stats count by' aggregation commands.

Answer

SELECT * FROM active_directory WHERE password = plaintext

Answer

RUN playbook name = "isolate"

Answer

SEARCH logs WHERE identity == true AND action == format

Question 17

An administrator is troubleshooting a Broker VM that has lost connectivity to the Cortex XDR cloud tenant. After logging into the Broker VM CLI, which command should the administrator use to test connectivity and troubleshoot DNS/HTTPS communication to the cloud backend?

Accepted Answer

show broker status and test connection. The Broker VM CLI provides a dedicated command 'show broker status' and a 'test connection' option to verify connectivity to the Cortex XDR cloud tenant. These commands check DNS resolution, HTTPS reachability, and authentication with the cloud backend, making them the correct tool for troubleshooting connectivity issues. They are purpose-built for the Broker VM and give actionable output about the connection state.

Answer

traceroute -m 64 gateway

Answer

ping -t customer.paloaltonetworks.com

Answer

tail -f /var/log/pan_broker_vm.log

Question 18

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Accepted Answer

The time delta between the endpoint and network events exceeds the stitching correlation window. Cortex XDR stitches alerts into incidents by correlating on shared featured fields (such as IP, user, hostname) within a defined time window. If the endpoint event and the network event occur too far apart in time, the correlation engine will not merge them, so they appear as separate incidents even though the IP and user match. The most likely cause is therefore that the time delta exceeds the stitching window.

Answer

The incident score was manually overridden to low

Answer

Alert starring was disabled on the network data source

Answer

Featured fields were not configured for the network logs

Question 19

An analyst is reviewing a Cortex XDR incident involving a suspicious PowerShell script that was executed on multiple endpoints. The analyst needs to gather evidence to determine the script's origin and impact. Which TWO actions should the analyst take to collect relevant evidence from the endpoints? (Choose two.)

Accepted Answer

Retrieve the PowerShell script file from the endpoints using the 'Retrieve File' action.. Retrieving the PowerShell script file provides direct evidence of its contents, while querying process execution events via XQL gives context about how and where it ran. Together, these actions allow the analyst to understand the script's origin, execution parameters, and impact across endpoints. The other options are either containment or detection measures that do not directly collect the needed evidence.

Answer

Initiate a full antivirus scan on the endpoints.

Answer

Isolate the endpoints from the network immediately.

Answer

Review the endpoints' Windows Event Logs for PowerShell operational events.

Question 20

An analyst is investigating a Cortex XDR incident and wants to correlate alerts from different endpoints that share the same file hash. The analyst needs to quickly find all other incidents that contain this hash to assess the scope of the campaign. Which Cortex XDR feature should the analyst use?

Accepted Answer

Incident Search with a filter on the file hash. Incident Search is the only feature that allows querying across all incidents using fields like file hash. By filtering on the hash, the analyst can identify every incident that includes that hash, thereby mapping the campaign's reach. Endpoint Search, Threat Intelligence Lookup, and Causality Chain do not provide cross-incident correlation by hash.

Answer

Endpoint Search for the file hash

Answer

Causality Chain view for the file hash

Answer

Threat Intelligence Lookup for the file hash