XDR-Analyst Identity Threat Detection And Response — All Questions With Answers

Question 1hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

While investigating a lateral movement attack, an analyst notices suspicious Kerberos ticket-granting service (TGS) requests in Cortex XDR log queries. Which XQL dataset contains the parsed domain controller event logs required to investigate this potential Kerberos-based attack?

Question 2hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An administrator wants to write an XQL query to detect potential Pass-the-Hash activity by evaluating anomalous NTLM authentication events compared against a user's historical baseline. Which XQL function is best suited for statistical deviation analysis?

Question 3hardmulti select

Read the full Identity Threat Detection And Response explanation →

When investigating advanced Active Directory attacks such as DCSync or DCShadow using Cortex XDR, which TWO primary indicators or event logs should an analyst look for?

Question 4easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO methods can an administrator use to ingest Active Directory logs into Cortex XDR?

Question 5hardmulti select

Read the full Identity Threat Detection And Response explanation →

When constructing an advanced XQL query to investigate credential access and lateral movement, which TWO syntax structures or functions are correctly formatted for filtering and aggregation?

Question 6easymultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is investigating a compromised user account in Cortex XDR and wants to review identity-based alerts generated by Active Directory monitoring. Which specific view in the Cortex XDR management console provides a consolidated timeline of identity events and authentication anomalies for a specific user?

Question 7hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

Your organization has integrated Azure AD (Entra ID) with Cortex XDR to improve cloud identity visibility. An analyst observes alerts regarding impossible travel and atypical sign-in locations. Which underlying Cortex XDR capability processes these cloud IdP logs to detect such behavioral anomalies?

Question 8mediummultiple choice

Read the full VPN explanation →

An analyst is triaging a Cortex XDR identity alert showing a single user account authenticating successfully from two countries 40 minutes apart, with no VPN or proxy in the environment. The analyst wants to determine whether this is a genuine credential compromise or a false positive before escalating. Which Cortex XDR capability should the analyst use FIRST to correlate the two authentication events and see the related process and endpoint context?

Question 9mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An XDR analyst is investigating an alert showing a service account successfully authenticating to a domain controller via NTLM from a workstation that has never hosted that account's scheduled tasks. The account's password is 14 months old and never rotated. Which Cortex XDR identity analytics signal should the analyst prioritize to confirm suspected credential theft and lateral movement?

Question 10hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst receives an identity alert indicating that a service account performed an interactive logon to a workstation at 02:00, followed by creation of a new local administrator account. The service account's password has not changed in 18 months. Which combination of factors makes this alert MOST likely a genuine credential compromise rather than administrative maintenance?

Question 11easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR administrator wants to enable automated response actions for identity-based threats, such as disabling a user account upon detection of a high-severity credential compromise alert. Which Cortex XDR component should be configured to achieve this?

Question 12mediummulti select

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is building detection coverage for identity-based attacks and wants to identify user behaviors that should trigger ITDR alerts. Which TWO behaviors are the strongest indicators of potential credential compromise that should be prioritized for detection? (Choose two.)

Question 13hardmulti select

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating a potential Golden Ticket attack. The analyst observes a Kerberos TGS request (Event ID 4769) for a service ticket where the account name is 'ANONYMOUS LOGON' and the ticket options include 'forwardable' and 'renewable'. The domain controller is a Windows Server 2019. Which TWO additional artifacts should the analyst examine in Cortex XDR to confirm the use of a forged TGT? (Choose two.)

Question 14easymultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?

Question 15mediummultiple choice

Read the full network assurance explanation →

An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?

Question 16mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

Question 17easymultiple choice

Read the full Identity Threat Detection And Response explanation →

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

Question 18easymultiple choice

Read the full Identity Threat Detection And Response explanation →

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

Question 19mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?

Question 20easymultiple choice

Read the full Identity Threat Detection And Response explanation →

What is the primary purpose of integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR?

Question 21hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An organization experiences a Golden Ticket attack. How does Cortex XDR's identity analytics engine typically detect this type of Kerberos ticket manipulation?

Question 22hardmultiple choice

Read the full VPN explanation →

An ITDR rule in Cortex XDR triggers due to impossible travel detected for a user account. Upon investigation, the analyst discovers the source IP belongs to a corporate VPN egress node. How should the analyst prevent future false positives for this known infrastructure?

Question 23mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is investigating a suspicious user account that accessed sensitive internal shares outside of normal business hours. Which Cortex XDR feature enables the analyst to review all actions taken by this user across endpoints and cloud services in a chronological timeline?

Question 24easymultiple choice

Read the full Identity Threat Detection And Response explanation →

Where can an administrator view the overall identity risk posture score across all users within the Cortex XDR management console?

Question 25hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An administrator wants to configure automated response actions for high-severity ITDR alerts indicating active credential compromise. Which Cortex XDR feature allows automated actions such as disabling the compromised user account in Active Directory?

Question 26mediummultiple choice

Read the full network assurance explanation →

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Question 27easymultiple choice

Read the full Identity Threat Detection And Response explanation →

Which log source is essential for Cortex XDR to track successful and failed interactive logon events on Windows workstations for ITDR analysis?

Question 28easymultiple choice

Read the full Identity Threat Detection And Response explanation →

What is the primary benefit of using Cortex XDR's identity correlation engine when triaging incidents?

Question 29mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An organization wants to ensure that all administrative logon sessions are closely monitored for anomalous behaviors in Cortex XDR. Where should the administrator configure custom behavioral alert thresholds for privileged users?

Question 30hardmultiple choice

Read the full network assurance explanation →

An analyst is investigating a suspected pass-the-ticket attack where an attacker injects a stolen Kerberos ticket into memory. Which endpoint telemetry data collected by the Cortex XDR Agent helps identify abnormal process behavior related to ticket injection tools (such as Mimikatz 'kerberos::ptt')

Question 31hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is reviewing an XQL query designed to hunt for suspicious account creation followed by immediate group membership escalation in Active Directory. Which XQL construct is used to join Active Directory event datasets based on a common security identifier (SID)?

Question 32mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A security analyst suspects an account compromise after noticing multiple rapid logins from geographically distant IP addresses within minutes. Which Cortex XDR feature automatically aggregates these related anomalous authentication indicators into a single incident?

Question 33easymultiple choice

Read the full Identity Threat Detection And Response explanation →

What role does the Cortex XDR Broker VM play regarding Active Directory and ITDR log collection?

Question 34hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An attacker compromises a domain user account and attempts to enumerate domain admins using native Windows utilities (e.g., 'net group "Domain Admins" /domain'). Which Cortex XDR detection mechanism is specifically designed to catch such reconnaissance behaviors without relying solely on static signatures?

Question 35easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO log sources are commonly ingested into Cortex XDR to support Identity Threat Detection and Response (ITDR)?

Question 36mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE key components or features in Cortex XDR contribute directly to identifying and investigating compromised user credentials?

Question 37mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst notices that a service account is generating alerts for anomalous login locations. Upon review, the account is used by an automated batch script running from a newly provisioned server. How should the analyst resolve this alert while maintaining security best practices?

Question 38hardmulti select

Read the full Identity Threat Detection And Response explanation →

When reviewing identity analytics alerts in Cortex XDR, which THREE behavioral anomalies are typically flagged by the UBA engine as potential indicators of a compromised account?

Question 39mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE features of Cortex XDR assist an analyst in conducting a deep-dive forensic investigation into an identity-based alert?

Question 40mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE actions can be taken directly or via orchestration within Cortex XDR when responding to an active identity-based attack?

Question 41easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO types of user accounts are critical to monitor closely for privilege abuse and anomalous behavior within an ITDR program?

Question 42easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO metrics or components are typically included in a user's risk score calculation within Cortex XDR's identity analytics?

Question 43mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE configuration steps are required to ensure Cortex XDR successfully correlates endpoint events with Active Directory user identities?

Question 44hardmulti select

Read the full Identity Threat Detection And Response explanation →

An enterprise is facing credential stuffing attacks targeting its cloud and on-premises applications. Which TWO detection or mitigation strategies within Cortex XDR and integrated tools help address this threat?

Question 45mediummultiple choice

Read the full network assurance explanation →

You are configuring integration between Cortex XDR and an external Identity Provider (IdP) to ingest user authentication logs for ITDR. Which component is primarily responsible for securely forwarding these IdP telemetry logs to the Cortex XDR data lake?

Question 46easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO features in Cortex XDR assist analysts in communicating identity threat findings to stakeholders or compliance auditors?

Question 47hardmulti select

Read the full Identity Threat Detection And Response explanation →

An analyst is investigating an incident where an attacker leveraged compromised credentials to establish persistence via Active Directory object manipulation. Which TWO Active Directory event logs or actions captured by ITDR monitoring should the analyst examine?

Question 48mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE indicators collected by Cortex XDR endpoint agents are crucial for identifying post-exploitation credential harvesting activities on a host?

Question 49hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An organization notices an increase in credential dumping attacks against local Active Directory environments. They want to configure Cortex XDR Identity Analytics to trigger high-severity alerts when abnormal Kerberos ticket requests (such as potential Silver or Golden ticket activities) are detected. Where should the analyst enable or tune these specific identity behavior analytics rules?

Question 50easymultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst needs to verify whether Active Directory audit policies are correctly configured to supply Cortex XDR with the necessary event logs for Identity Threat Detection and Response. Which Windows Event ID range contains the core authentication and credential validation events required by Cortex XDR ITDR?

Question 51mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

While reviewing an incident involving suspicious lateral movement, an analyst notices that an adversary utilized compromised service account credentials. The analyst wants to use Cortex XDR response actions to immediately contain the threat without shutting down the entire domain controller. Which ITDR-related action can be executed directly from the Cortex XDR console for a compromised user account?

Question 52easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO data sources can Cortex XDR leverage to build comprehensive user identity behavior profiles for ITDR? (Choose two)

Question 53hardmulti select

Read the full network assurance explanation →

When deploying and troubleshooting the integration between Cortex XDR and Active Directory for ITDR, which TWO steps or configurations are critical to ensure successful telemetry collection? (Choose two)

Question 54mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An administrator is setting up User Risk Scoring within Cortex XDR. They notice that certain service accounts with high volumes of automated authentications are skewing the risk calculations. How should the administrator handle these service accounts in Cortex XDR to prevent false-positive risk elevations?

Question 55mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE key identity-based threat behaviors are typically detected and flagged by Cortex XDR Identity Analytics? (Choose three)

Question 56mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating repeated failed authentications against a domain controller from a single workstation. The failures are followed by one success from the same workstation, after which the account begins accessing file shares it has never touched before. The analyst needs to preserve the identity context while correlating the authentication events with subsequent file activity. Which Cortex XDR capability should the analyst use to pivot from the authentication events to the related endpoint activity?

Question 57mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating an identity alert where a helpdesk technician account successfully authenticated to 14 different workstations within 3 minutes, each logon using explicit credentials rather than interactive console logon. The account has no associated change ticket. Which identity-based detection concept best explains why Cortex XDR raised this as a high-severity alert?

Question 58mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating a suspected pass-the-hash attack. The attacker has captured an NTLM hash and is using it to authenticate to multiple servers without knowing the plaintext password. Which Cortex XDR data source would most directly reveal the anomalous NTLM authentication events indicating this attack?

Question 59hardmulti select

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is building an ITDR detection strategy for a hybrid environment where attackers frequently abuse legitimate credentials rather than malware. The analyst needs to select identity behaviors that should generate high-fidelity alerts because they strongly indicate credential misuse rather than normal user activity. (Choose two.)

Question 60hardmulti select

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is responding to an alert indicating a Golden Ticket attack. The attacker has compromised the KRBTGT account hash and is forging Kerberos ticket-granting tickets (TGTs) to maintain persistent access. Which TWO Cortex XDR capabilities are most effective for detecting and investigating this attack? (Choose two.)

Question 61easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR administrator wants the platform to automatically disable a user account in Active Directory when an identity alert indicates confirmed active credential compromise, without analyst intervention. Which Cortex XDR capability should the administrator configure to achieve this?

Question 62easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR administrator wants to review which user accounts have the highest identity risk based on recent authentication anomalies and privilege changes. The administrator needs a consolidated view that ranks users by their accumulated risk indicators across the environment. Which Cortex XDR feature should the administrator open to obtain this ranked list of at-risk identities?

Question 63hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

During an identity investigation in Cortex XDR, an analyst observes a service account performing a Kerberoasting-style request pattern: multiple TGS requests for accounts with Service Principal Names, followed by an anomalous LDAP query enumerating domain admins. The service account normally runs a backup job nightly. Which interpretation should guide the analyst's next action?

Question 64mediummultiple choice

Read the full network assurance explanation →

A Cortex XDR analyst sees an alert for a user account that authenticated successfully from an unfamiliar ASN, then immediately triggered a privileged role assignment in Azure AD. Which Cortex XDR capability should the analyst use FIRST to correlate the identity activity with endpoint and network telemetry in a single timeline?

Question 65hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

During an investigation, a Cortex XDR analyst observes that a user account successfully authenticated to a server and then, within seconds, accessed a credential store file on that server. The analyst wants to determine whether the account's credentials were subsequently used from a different host. Which Cortex XDR data should the analyst examine to trace whether the stolen credentials were reused elsewhere?

Question 66hardmultiple choice

Read the full VPN explanation →

During an ITDR investigation, an analyst sees a Cortex XDR identity alert: a privileged user authenticated successfully to three different SaaS applications from two countries within 12 minutes. MFA was satisfied via push notification on each attempt. The analyst needs to determine whether this is a legitimate VPN egress or a session-token replay. Which Cortex XDR identity data point best distinguishes session-token theft from legitimate travel?

Question 67mediummulti select

Read the full network assurance explanation →

A Cortex XDR analyst is building an identity threat detection strategy for a hybrid environment with on-premises Active Directory and cloud identity. Which TWO telemetry sources should the analyst prioritize ingesting to detect credential abuse and anomalous authentication across both environments? (Choose two.)

Question 68hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

During an ITDR investigation, an analyst observes that a service account authenticated to a domain controller and then created a new computer object. The analyst wants to determine whether this is a known attack technique involving directory object manipulation. Which Cortex XDR analytic or rule category is MOST relevant to this behavior?

Question 69mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst receives an alert that a privileged account was added to the Domain Admins group outside of a change window. The analyst wants to immediately review the account's recent activity and the group membership change in a single identity-focused investigation context. Where should the analyst navigate to review this identity event alongside the account's related activity?

Question 70easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst receives an ITDR alert indicating a user account performed a Kerberoasting attack against multiple service principal names. The analyst wants to quickly identify every host and process that requested the service tickets to scope the incident. Which Cortex XDR capability should the analyst use?

Question 71hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst reviewing a Cortex XDR identity incident sees that a user's account successfully authenticated from an unfamiliar ASN at 02:00, immediately followed by creation of a new mail forwarding rule and a password reset. The user confirms they were asleep and did not perform these actions. Which conclusion and immediate priority are most appropriate?

Question 72mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is examining an alert where a user account successfully authenticated from two different countries within a 10-minute window. The analyst suspects impossible travel. Which Cortex XDR feature would provide a visual representation of the user's login locations and times to confirm this?

Question 73easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR administrator wants to ensure that when an identity-based attack is detected, the platform can automatically disable the compromised user account in the identity provider. Which integration must be configured to enable this automated response?

Question 74easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A security operations manager wants analysts to quickly see, for any user in Cortex XDR, a consolidated timeline of authentication events, accessed resources, and associated alerts across the environment. Which Cortex XDR feature should analysts use to obtain this per-user consolidated view?

Question 75mediummulti select

Read the full network assurance explanation →

A Cortex XDR analyst is building an ITDR detection strategy for an environment using Microsoft Entra ID and on-premises Active Directory. The analyst wants to identify identity-based attacks that span both cloud and on-premises authentication. Which TWO Cortex XDR data sources provide the authentication telemetry needed to correlate cloud sign-ins with on-premises logons? (Choose two.)

Question 76hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating a suspected credential dumping attack on a Windows endpoint. The attacker used a tool that accessed LSASS memory to extract credentials. Which Cortex XDR capability would most directly detect this activity by monitoring for unauthorized access to LSASS?

Question 77mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is reviewing a Cortex XDR identity alert where a user authenticated with a valid password but from a device that has never been associated with that user. The analyst wants to assess whether the account's privileges make this a high-risk event. Which Cortex XDR data source provides the user's group memberships and role assignments to support this assessment?

Question 78hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is investigating an ITDR incident in Cortex XDR where an attacker used a compromised service account to create a new domain admin account. The analyst needs to review the sequence of authentication and directory-change events leading to the new account creation. Which Cortex XDR feature provides a chronological, identity-centric timeline for this investigation?

Question 79hardmulti select

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is building an ITDR detection strategy for a hybrid environment where attackers frequently abuse valid credentials. Which TWO identity risk signals should the analyst prioritize to detect credential misuse rather than credential theft? (Choose two.)

Question 80mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating an alert where a domain user account triggered the 'First Seen Kerberos Service Ticket Request for User' BIOC. The user normally works in the finance department and has never requested a service ticket for the SQL service before. The analyst wants to determine if this activity is a precursor to a Kerberoasting attack. Which Cortex XDR data source would provide the most direct evidence of the service ticket encryption type and the requested Service Principal Name (SPN)?

Question 81easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst receives an alert for 'Suspicious LDAP Query' from a workstation. The query targeted the 'adminCount' attribute on multiple user objects. The analyst suspects an attacker is using AD reconnaissance to find privileged accounts. Which Cortex XDR feature should the analyst use to quickly visualize the scope of this reconnaissance and identify other affected hosts?

Question 1hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

While investigating a lateral movement attack, an analyst notices suspicious Kerberos ticket-granting service (TGS) requests in Cortex XDR log queries. Which XQL dataset contains the parsed domain controller event logs required to investigate this potential Kerberos-based attack?

Question 2hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An administrator wants to write an XQL query to detect potential Pass-the-Hash activity by evaluating anomalous NTLM authentication events compared against a user's historical baseline. Which XQL function is best suited for statistical deviation analysis?

Question 3hardmulti select

Read the full Identity Threat Detection And Response explanation →

When investigating advanced Active Directory attacks such as DCSync or DCShadow using Cortex XDR, which TWO primary indicators or event logs should an analyst look for?

Question 4easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO methods can an administrator use to ingest Active Directory logs into Cortex XDR?

Question 5hardmulti select

Read the full Identity Threat Detection And Response explanation →

When constructing an advanced XQL query to investigate credential access and lateral movement, which TWO syntax structures or functions are correctly formatted for filtering and aggregation?

Question 6easymultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is investigating a compromised user account in Cortex XDR and wants to review identity-based alerts generated by Active Directory monitoring. Which specific view in the Cortex XDR management console provides a consolidated timeline of identity events and authentication anomalies for a specific user?

Question 7hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

Your organization has integrated Azure AD (Entra ID) with Cortex XDR to improve cloud identity visibility. An analyst observes alerts regarding impossible travel and atypical sign-in locations. Which underlying Cortex XDR capability processes these cloud IdP logs to detect such behavioral anomalies?

Question 8mediummultiple choice

Read the full VPN explanation →

An analyst is triaging a Cortex XDR identity alert showing a single user account authenticating successfully from two countries 40 minutes apart, with no VPN or proxy in the environment. The analyst wants to determine whether this is a genuine credential compromise or a false positive before escalating. Which Cortex XDR capability should the analyst use FIRST to correlate the two authentication events and see the related process and endpoint context?

Question 9mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An XDR analyst is investigating an alert showing a service account successfully authenticating to a domain controller via NTLM from a workstation that has never hosted that account's scheduled tasks. The account's password is 14 months old and never rotated. Which Cortex XDR identity analytics signal should the analyst prioritize to confirm suspected credential theft and lateral movement?

Question 10hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst receives an identity alert indicating that a service account performed an interactive logon to a workstation at 02:00, followed by creation of a new local administrator account. The service account's password has not changed in 18 months. Which combination of factors makes this alert MOST likely a genuine credential compromise rather than administrative maintenance?

Question 11easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR administrator wants to enable automated response actions for identity-based threats, such as disabling a user account upon detection of a high-severity credential compromise alert. Which Cortex XDR component should be configured to achieve this?

Question 12mediummulti select

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is building detection coverage for identity-based attacks and wants to identify user behaviors that should trigger ITDR alerts. Which TWO behaviors are the strongest indicators of potential credential compromise that should be prioritized for detection? (Choose two.)

Question 13hardmulti select

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating a potential Golden Ticket attack. The analyst observes a Kerberos TGS request (Event ID 4769) for a service ticket where the account name is 'ANONYMOUS LOGON' and the ticket options include 'forwardable' and 'renewable'. The domain controller is a Windows Server 2019. Which TWO additional artifacts should the analyst examine in Cortex XDR to confirm the use of a forged TGT? (Choose two.)

Question 14easymultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?

Question 15mediummultiple choice

Read the full network assurance explanation →

An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?

Question 16mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

Question 17easymultiple choice

Read the full Identity Threat Detection And Response explanation →

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

Question 18easymultiple choice

Read the full Identity Threat Detection And Response explanation →

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

Question 19mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?

Question 20easymultiple choice

Read the full Identity Threat Detection And Response explanation →

What is the primary purpose of integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR?

Question 21hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An organization experiences a Golden Ticket attack. How does Cortex XDR's identity analytics engine typically detect this type of Kerberos ticket manipulation?

Question 22hardmultiple choice

Read the full VPN explanation →

An ITDR rule in Cortex XDR triggers due to impossible travel detected for a user account. Upon investigation, the analyst discovers the source IP belongs to a corporate VPN egress node. How should the analyst prevent future false positives for this known infrastructure?

Question 23mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is investigating a suspicious user account that accessed sensitive internal shares outside of normal business hours. Which Cortex XDR feature enables the analyst to review all actions taken by this user across endpoints and cloud services in a chronological timeline?

Question 24easymultiple choice

Read the full Identity Threat Detection And Response explanation →

Where can an administrator view the overall identity risk posture score across all users within the Cortex XDR management console?

Question 25hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An administrator wants to configure automated response actions for high-severity ITDR alerts indicating active credential compromise. Which Cortex XDR feature allows automated actions such as disabling the compromised user account in Active Directory?

Question 26mediummultiple choice

Read the full network assurance explanation →

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Question 27easymultiple choice

Read the full Identity Threat Detection And Response explanation →

Which log source is essential for Cortex XDR to track successful and failed interactive logon events on Windows workstations for ITDR analysis?

Question 28easymultiple choice

Read the full Identity Threat Detection And Response explanation →

What is the primary benefit of using Cortex XDR's identity correlation engine when triaging incidents?

Question 29mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An organization wants to ensure that all administrative logon sessions are closely monitored for anomalous behaviors in Cortex XDR. Where should the administrator configure custom behavioral alert thresholds for privileged users?

Question 30hardmultiple choice

Read the full network assurance explanation →

An analyst is investigating a suspected pass-the-ticket attack where an attacker injects a stolen Kerberos ticket into memory. Which endpoint telemetry data collected by the Cortex XDR Agent helps identify abnormal process behavior related to ticket injection tools (such as Mimikatz 'kerberos::ptt')

Question 31hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is reviewing an XQL query designed to hunt for suspicious account creation followed by immediate group membership escalation in Active Directory. Which XQL construct is used to join Active Directory event datasets based on a common security identifier (SID)?

Question 32mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A security analyst suspects an account compromise after noticing multiple rapid logins from geographically distant IP addresses within minutes. Which Cortex XDR feature automatically aggregates these related anomalous authentication indicators into a single incident?

Question 33easymultiple choice

Read the full Identity Threat Detection And Response explanation →

What role does the Cortex XDR Broker VM play regarding Active Directory and ITDR log collection?

Question 34hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An attacker compromises a domain user account and attempts to enumerate domain admins using native Windows utilities (e.g., 'net group "Domain Admins" /domain'). Which Cortex XDR detection mechanism is specifically designed to catch such reconnaissance behaviors without relying solely on static signatures?

Question 35easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO log sources are commonly ingested into Cortex XDR to support Identity Threat Detection and Response (ITDR)?

Question 36mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE key components or features in Cortex XDR contribute directly to identifying and investigating compromised user credentials?

Question 37mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst notices that a service account is generating alerts for anomalous login locations. Upon review, the account is used by an automated batch script running from a newly provisioned server. How should the analyst resolve this alert while maintaining security best practices?

Question 38hardmulti select

Read the full Identity Threat Detection And Response explanation →

When reviewing identity analytics alerts in Cortex XDR, which THREE behavioral anomalies are typically flagged by the UBA engine as potential indicators of a compromised account?

Question 39mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE features of Cortex XDR assist an analyst in conducting a deep-dive forensic investigation into an identity-based alert?

Question 40mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE actions can be taken directly or via orchestration within Cortex XDR when responding to an active identity-based attack?

Question 41easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO types of user accounts are critical to monitor closely for privilege abuse and anomalous behavior within an ITDR program?

Question 42easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO metrics or components are typically included in a user's risk score calculation within Cortex XDR's identity analytics?

Question 43mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE configuration steps are required to ensure Cortex XDR successfully correlates endpoint events with Active Directory user identities?

Question 44hardmulti select

Read the full Identity Threat Detection And Response explanation →

An enterprise is facing credential stuffing attacks targeting its cloud and on-premises applications. Which TWO detection or mitigation strategies within Cortex XDR and integrated tools help address this threat?

Question 45mediummultiple choice

Read the full network assurance explanation →

You are configuring integration between Cortex XDR and an external Identity Provider (IdP) to ingest user authentication logs for ITDR. Which component is primarily responsible for securely forwarding these IdP telemetry logs to the Cortex XDR data lake?

Question 46easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO features in Cortex XDR assist analysts in communicating identity threat findings to stakeholders or compliance auditors?

Question 47hardmulti select

Read the full Identity Threat Detection And Response explanation →

An analyst is investigating an incident where an attacker leveraged compromised credentials to establish persistence via Active Directory object manipulation. Which TWO Active Directory event logs or actions captured by ITDR monitoring should the analyst examine?

Question 48mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE indicators collected by Cortex XDR endpoint agents are crucial for identifying post-exploitation credential harvesting activities on a host?

Question 49hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An organization notices an increase in credential dumping attacks against local Active Directory environments. They want to configure Cortex XDR Identity Analytics to trigger high-severity alerts when abnormal Kerberos ticket requests (such as potential Silver or Golden ticket activities) are detected. Where should the analyst enable or tune these specific identity behavior analytics rules?

Question 50easymultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst needs to verify whether Active Directory audit policies are correctly configured to supply Cortex XDR with the necessary event logs for Identity Threat Detection and Response. Which Windows Event ID range contains the core authentication and credential validation events required by Cortex XDR ITDR?

Question 51mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

While reviewing an incident involving suspicious lateral movement, an analyst notices that an adversary utilized compromised service account credentials. The analyst wants to use Cortex XDR response actions to immediately contain the threat without shutting down the entire domain controller. Which ITDR-related action can be executed directly from the Cortex XDR console for a compromised user account?

Question 52easymulti select

Read the full Identity Threat Detection And Response explanation →

Which TWO data sources can Cortex XDR leverage to build comprehensive user identity behavior profiles for ITDR? (Choose two)

Question 53hardmulti select

Read the full network assurance explanation →

When deploying and troubleshooting the integration between Cortex XDR and Active Directory for ITDR, which TWO steps or configurations are critical to ensure successful telemetry collection? (Choose two)

Question 54mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An administrator is setting up User Risk Scoring within Cortex XDR. They notice that certain service accounts with high volumes of automated authentications are skewing the risk calculations. How should the administrator handle these service accounts in Cortex XDR to prevent false-positive risk elevations?

Question 55mediummulti select

Read the full Identity Threat Detection And Response explanation →

Which THREE key identity-based threat behaviors are typically detected and flagged by Cortex XDR Identity Analytics? (Choose three)

Question 56mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating repeated failed authentications against a domain controller from a single workstation. The failures are followed by one success from the same workstation, after which the account begins accessing file shares it has never touched before. The analyst needs to preserve the identity context while correlating the authentication events with subsequent file activity. Which Cortex XDR capability should the analyst use to pivot from the authentication events to the related endpoint activity?

Question 57mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating an identity alert where a helpdesk technician account successfully authenticated to 14 different workstations within 3 minutes, each logon using explicit credentials rather than interactive console logon. The account has no associated change ticket. Which identity-based detection concept best explains why Cortex XDR raised this as a high-severity alert?

Question 58mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating a suspected pass-the-hash attack. The attacker has captured an NTLM hash and is using it to authenticate to multiple servers without knowing the plaintext password. Which Cortex XDR data source would most directly reveal the anomalous NTLM authentication events indicating this attack?

Question 59hardmulti select

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is building an ITDR detection strategy for a hybrid environment where attackers frequently abuse legitimate credentials rather than malware. The analyst needs to select identity behaviors that should generate high-fidelity alerts because they strongly indicate credential misuse rather than normal user activity. (Choose two.)

Question 60hardmulti select

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is responding to an alert indicating a Golden Ticket attack. The attacker has compromised the KRBTGT account hash and is forging Kerberos ticket-granting tickets (TGTs) to maintain persistent access. Which TWO Cortex XDR capabilities are most effective for detecting and investigating this attack? (Choose two.)

Question 61easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR administrator wants the platform to automatically disable a user account in Active Directory when an identity alert indicates confirmed active credential compromise, without analyst intervention. Which Cortex XDR capability should the administrator configure to achieve this?

Question 62easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR administrator wants to review which user accounts have the highest identity risk based on recent authentication anomalies and privilege changes. The administrator needs a consolidated view that ranks users by their accumulated risk indicators across the environment. Which Cortex XDR feature should the administrator open to obtain this ranked list of at-risk identities?

Question 63hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

During an identity investigation in Cortex XDR, an analyst observes a service account performing a Kerberoasting-style request pattern: multiple TGS requests for accounts with Service Principal Names, followed by an anomalous LDAP query enumerating domain admins. The service account normally runs a backup job nightly. Which interpretation should guide the analyst's next action?

Question 64mediummultiple choice

Read the full network assurance explanation →

A Cortex XDR analyst sees an alert for a user account that authenticated successfully from an unfamiliar ASN, then immediately triggered a privileged role assignment in Azure AD. Which Cortex XDR capability should the analyst use FIRST to correlate the identity activity with endpoint and network telemetry in a single timeline?

Question 65hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

During an investigation, a Cortex XDR analyst observes that a user account successfully authenticated to a server and then, within seconds, accessed a credential store file on that server. The analyst wants to determine whether the account's credentials were subsequently used from a different host. Which Cortex XDR data should the analyst examine to trace whether the stolen credentials were reused elsewhere?

Question 66hardmultiple choice

Read the full VPN explanation →

During an ITDR investigation, an analyst sees a Cortex XDR identity alert: a privileged user authenticated successfully to three different SaaS applications from two countries within 12 minutes. MFA was satisfied via push notification on each attempt. The analyst needs to determine whether this is a legitimate VPN egress or a session-token replay. Which Cortex XDR identity data point best distinguishes session-token theft from legitimate travel?

Question 67mediummulti select

Read the full network assurance explanation →

A Cortex XDR analyst is building an identity threat detection strategy for a hybrid environment with on-premises Active Directory and cloud identity. Which TWO telemetry sources should the analyst prioritize ingesting to detect credential abuse and anomalous authentication across both environments? (Choose two.)

Question 68hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

During an ITDR investigation, an analyst observes that a service account authenticated to a domain controller and then created a new computer object. The analyst wants to determine whether this is a known attack technique involving directory object manipulation. Which Cortex XDR analytic or rule category is MOST relevant to this behavior?

Question 69mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst receives an alert that a privileged account was added to the Domain Admins group outside of a change window. The analyst wants to immediately review the account's recent activity and the group membership change in a single identity-focused investigation context. Where should the analyst navigate to review this identity event alongside the account's related activity?

Question 70easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst receives an ITDR alert indicating a user account performed a Kerberoasting attack against multiple service principal names. The analyst wants to quickly identify every host and process that requested the service tickets to scope the incident. Which Cortex XDR capability should the analyst use?

Question 71hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst reviewing a Cortex XDR identity incident sees that a user's account successfully authenticated from an unfamiliar ASN at 02:00, immediately followed by creation of a new mail forwarding rule and a password reset. The user confirms they were asleep and did not perform these actions. Which conclusion and immediate priority are most appropriate?

Question 72mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is examining an alert where a user account successfully authenticated from two different countries within a 10-minute window. The analyst suspects impossible travel. Which Cortex XDR feature would provide a visual representation of the user's login locations and times to confirm this?

Question 73easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR administrator wants to ensure that when an identity-based attack is detected, the platform can automatically disable the compromised user account in the identity provider. Which integration must be configured to enable this automated response?

Question 74easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A security operations manager wants analysts to quickly see, for any user in Cortex XDR, a consolidated timeline of authentication events, accessed resources, and associated alerts across the environment. Which Cortex XDR feature should analysts use to obtain this per-user consolidated view?

Question 75mediummulti select

Read the full network assurance explanation →

A Cortex XDR analyst is building an ITDR detection strategy for an environment using Microsoft Entra ID and on-premises Active Directory. The analyst wants to identify identity-based attacks that span both cloud and on-premises authentication. Which TWO Cortex XDR data sources provide the authentication telemetry needed to correlate cloud sign-ins with on-premises logons? (Choose two.)

Question 76hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating a suspected credential dumping attack on a Windows endpoint. The attacker used a tool that accessed LSASS memory to extract credentials. Which Cortex XDR capability would most directly detect this activity by monitoring for unauthorized access to LSASS?

Question 77mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is reviewing a Cortex XDR identity alert where a user authenticated with a valid password but from a device that has never been associated with that user. The analyst wants to assess whether the account's privileges make this a high-risk event. Which Cortex XDR data source provides the user's group memberships and role assignments to support this assessment?

Question 78hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

An analyst is investigating an ITDR incident in Cortex XDR where an attacker used a compromised service account to create a new domain admin account. The analyst needs to review the sequence of authentication and directory-change events leading to the new account creation. Which Cortex XDR feature provides a chronological, identity-centric timeline for this investigation?

Question 79hardmulti select

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is building an ITDR detection strategy for a hybrid environment where attackers frequently abuse valid credentials. Which TWO identity risk signals should the analyst prioritize to detect credential misuse rather than credential theft? (Choose two.)

Question 80mediummultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst is investigating an alert where a domain user account triggered the 'First Seen Kerberos Service Ticket Request for User' BIOC. The user normally works in the finance department and has never requested a service ticket for the SQL service before. The analyst wants to determine if this activity is a precursor to a Kerberoasting attack. Which Cortex XDR data source would provide the most direct evidence of the service ticket encryption type and the requested Service Principal Name (SPN)?

Question 81easymultiple choice

Read the full Identity Threat Detection And Response explanation →

A Cortex XDR analyst receives an alert for 'Suspicious LDAP Query' from a workstation. The query targeted the 'adminCount' attribute on multiple user objects. The analyst suspects an attacker is using AD reconnaissance to find privileged accounts. Which Cortex XDR feature should the analyst use to quickly visualize the scope of this reconnaissance and identify other affected hosts?