XDR-Analyst Identity Threat Detection And Response Practice Test 1 — 15 Questions

Question 1

While investigating a lateral movement attack, an analyst notices suspicious Kerberos ticket-granting service (TGS) requests in Cortex XDR log queries. Which XQL dataset contains the parsed domain controller event logs required to investigate this potential Kerberos-based attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dataset = xdr_data | filter action_dataset = "active_directory_raw". Windows security event logs collected from Domain Controllers, such as event ID 4769 (Kerberos service ticket was requested), populate the dataset xdr_data where action_id corresponds to Windows event logs or specialized authentication datasets.

Answer

dataset = endpoint_security_identity

Answer

dataset = pan_wmi_raw

Answer

dataset = xdr_data | filter event_simple_name = "Win-Security-Kerberos-Service-Ticket"

Question 2

An administrator wants to write an XQL query to detect potential Pass-the-Hash activity by evaluating anomalous NTLM authentication events compared against a user's historical baseline. Which XQL function is best suited for statistical deviation analysis?

Accepted Answer

Use standard aggregation commands like stats count by user, source_ip to evaluate frequency anomalies against baseline distributions. The 'cdf' or statistical aggregation functions like 'count', 'earliest', 'latest', or machine learning outlier functions in XQL are used to evaluate baseline deviations.

Answer

Use the 'extract_identity()' parser modifier

Answer

Use the 'wildfire_scan()' function on the authentication stream

Answer

Use the 'isolate_endpoint()' action command inside the search bar

Question 3

When investigating advanced Active Directory attacks such as DCSync or DCShadow using Cortex XDR, which TWO primary indicators or event logs should an analyst look for?

Accepted Answer

Domain Controller event logs showing unauthorized or anomalous GetNCChanges replication requests from non-DC computer accounts. DCSync attacks involve replicating directory changes, which generate Windows Security Event ID 4662 (Directory Service Access) and Event ID 4632/4624/associated replication privilege checks.

Answer

Browser pop-up blocker activation logs

Answer

Local printer driver installation alerts

Answer

DHCP Scope Exhaustion Warning logs

Question 4

When constructing an advanced XQL query to investigate credential access and lateral movement, which TWO syntax structures or functions are correctly formatted for filtering and aggregation?

Accepted Answer

dataset = xdr_data | filter event_type = "USER_LOGIN" | stats count by user. Valid XQL syntax uses 'dataset = xdr_data' (or equivalent), 'filter' clauses, and 'stats count by' aggregation commands.

Answer

SELECT * FROM active_directory WHERE password = plaintext

Answer

RUN playbook name = "isolate"

Answer

SEARCH logs WHERE identity == true AND action == format

Question 5

Your organization has integrated Azure AD (Entra ID) with Cortex XDR to improve cloud identity visibility. An analyst observes alerts regarding impossible travel and atypical sign-in locations. Which underlying Cortex XDR capability processes these cloud IdP logs to detect such behavioral anomalies?

Accepted Answer

Cortex XDR Identity Analytics and Machine Learning behavioral profiling. Cortex XDR Identity Analytics applies machine learning algorithms to baseline user behavior across both on-premises Active Directory and cloud IdPs to surface anomalies like impossible travel.

Answer

Local endpoint Anti-Malware scanning engines

Answer

WildFire Static Analysis engine

Answer

Corta XDR Port Scan detector BIOCs

Question 6

An analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?

Accepted Answer

Process execution telemetry from endpoint agents. BIOC rules for process execution evaluate endpoint telemetry data, specifically process creation events.

Answer

Cloud storage audit logs

Answer

Firewall URL filtering logs

Answer

DHCP lease tables

Question 7

An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?

Accepted Answer

Target process name matching 'lsass.exe' with suspicious access rights from an unauthorized source process. LSASS credential dumping typically involves specific process open requests (e.g., OpenProcess with PROCESS_VM_READ or PROCESS_QUERY_LIMITED_INFORMATION) targeting lsass.exe.

Answer

Registry modifications affecting the Windows Firewall state

Answer

DNS query logs for newly registered domains

Answer

Outbound HTTPS connections to unknown external IP addresses on port 443

Question 8

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

Accepted Answer

The Cortex XDR Broker VM configured with the User-ID integration. The Cortex XDR Collector (or BIOC/agent mapping combined with Active Directory integration) requires the User-ID agent or Cortex XDR Agent visibility to sync identity metadata.

Answer

The Cortex XDR Network Traffic Analyzer

Answer

WildFire cloud analysis engine

Answer

The Cortex XSOAR Content Pack for Active Directory

Question 9

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

Accepted Answer

Comprehensive profile information including recent alerts, associated devices, and identity attributes. The User View in Cortex XDR aggregates user-centric data, including associated endpoints, active directory attributes, risk scores, and correlated alerts.

Answer

Real-time packet captures of the user's active browsing session

Answer

The hardware warranty status of endpoints assigned to the user

Answer

Group Policy Object (GPO) editing capabilities

Question 10

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

Accepted Answer

Incident Response > Alerts, filtering by Analytics category related to Identity. Cortex XDR consolidates identity-based threats and user behavior analytics within the Incident Response and Alerts views, specifically filtered by analytics categories such as compromised credentials.

Answer

Cloud > Posture > Identity

Answer

XQL Search > Identity_Raw schema

Answer

Endpoints > Agent Configurations > Identity

Question 11

An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?

Accepted Answer

Windows Security Event logs (specifically Event ID 4769) collected via Broker VM. Kerberoasting is detected by analyzing Windows Security Event log ID 4769 (A Kerberos service ticket was requested), specifically looking for high encryption downgrade requests (e.g., RC4).

Answer

Antivirus scan reports

Answer

DNS query logs showing external root hints

Answer

DHCP lease allocation tables

Question 12

What is the primary purpose of integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR?

Accepted Answer

To provide visibility into cloud authentication events, sign-in anomalies, and identity risks in hybrid environments. Integrating cloud identity provider logs provides visibility into cloud-based authentications, conditional access failures, and SaaS app logins for comprehensive ITDR.

Answer

To replace the Cortex XDR Agent on Linux servers

Answer

To enforce local BIOS password policies

Answer

To automate the deployment of Windows security patches to endpoints

Question 13

An organization experiences a Golden Ticket attack. How does Cortex XDR's identity analytics engine typically detect this type of Kerberos ticket manipulation?

Accepted Answer

By detecting anomalies in Kerberos authentication attributes such as unusual ticket lifetimes or mismatched SID history from domain controller telemetry. Golden Ticket attacks forge Kerberos TGTs with arbitrary lifespans and SIDs. Cortex XDR detects this by correlating anomalous ticket attributes, such as invalid SID history or ticket lifetimes exceeding domain policy, captured from domain controller logs.

Answer

By monitoring USB mass storage insertion events

Answer

By blocking outbound TCP port 80 traffic at the perimeter firewall

Answer

By scanning the master boot record (MBR) of the endpoint for rootkit signatures

Question 14

An ITDR rule in Cortex XDR triggers due to impossible travel detected for a user account. Upon investigation, the analyst discovers the source IP belongs to a corporate VPN egress node. How should the analyst prevent future false positives for this known infrastructure?

Accepted Answer

Add the corporate VPN egress IP ranges to the known corporate network or location exclusions list in Cortex XDR settings. False positives caused by known corporate VPN exit nodes or proxy servers can be mitigated by configuring IP exclusions or tuning threat intelligence/behavioral analytics settings within Cortex XDR.

Answer

Modify the Windows Registry on the user's workstation to disable IPv6

Answer

Disable all behavioral analytics globally

Answer

Uninstall the Cortex XDR agent from all Domain Controllers

Question 15

An analyst is investigating a suspicious user account that accessed sensitive internal shares outside of normal business hours. Which Cortex XDR feature enables the analyst to review all actions taken by this user across endpoints and cloud services in a chronological timeline?

Accepted Answer

The Incident Storyline and User Timeline view. The Cortex XDR Incident View and User Timeline provide a chronological sequence of events and alerts associated with a specific user entity.

Answer

The Static File Analysis Report

Answer

The Network Packet Capture Utility

Answer

The Host Isolation Status page