XDR-Analyst Identity Threat Detection And Response Practice Test 2 — 15 Questions

Question 1

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

Accepted Answer

The Cortex XDR Broker VM configured with the User-ID integration. The Broker VM configured with the User-ID integration is the Cortex XDR component responsible for collecting user and group metadata from Active Directory and other identity sources. It forwards this identity context to Cortex XDR so alerts can be enriched and correlated for ITDR use cases. Without the Broker VM's User-ID integration, AD context would not be available for alert enrichment.

Answer

The Cortex XDR Network Traffic Analyzer

Answer

WildFire cloud analysis engine

Answer

The Cortex XSOAR Content Pack for Active Directory

Question 2

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

Accepted Answer

Comprehensive profile information including recent alerts, associated devices, and identity attributes. The User View in Cortex XDR aggregates identity-centric context: a comprehensive profile showing recent alerts, associated devices, and identity attributes (department, role, risk score). This helps analysts quickly assess whether an identity-based alert is part of a broader pattern or an isolated event.

Answer

Real-time packet captures of the user's active browsing session

Answer

The hardware warranty status of endpoints assigned to the user

Answer

Group Policy Object (GPO) editing capabilities

Question 3

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

Accepted Answer

Incident Response > Alerts, filtering by Analytics category related to Identity. Identity analytics alerts generated by User Behavior Analytics (UBA) in Cortex XDR appear under Incident Response > Alerts, where analysts can filter by the Analytics category and specifically the Identity-related subcategory. This is the centralized alert triage interface where UBA-generated detections (e.g., impossible travel, anomalous login) surface alongside other analytics alerts.

Answer

Cloud > Posture > Identity

Answer

XQL Search > Identity_Raw schema

Answer

Endpoints > Agent Configurations > Identity

Question 4

An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?

Accepted Answer

Windows Security Event logs (specifically Event ID 4769) collected via Broker VM. Kerberoasting is detected by analyzing Windows Security Event log ID 4769 (A Kerberos service ticket was requested), specifically looking for high encryption downgrade requests (e.g., RC4).

Answer

Antivirus scan reports

Answer

DNS query logs showing external root hints

Answer

DHCP lease allocation tables

Question 5

What is the primary purpose of integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR?

Accepted Answer

To provide visibility into cloud authentication events, sign-in anomalies, and identity risks in hybrid environments. Integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR feeds cloud identity telemetry — sign-in events, conditional access results, MFA challenges, and risky user detections — into the XDR console. This lets analysts correlate identity-based threats with endpoint and network activity, which is essential for detecting credential compromise and lateral movement in hybrid environments.

Answer

To replace the Cortex XDR Agent on Linux servers

Answer

To enforce local BIOS password policies

Answer

To automate the deployment of Windows security patches to endpoints

Question 6

An organization experiences a Golden Ticket attack. How does Cortex XDR's identity analytics engine typically detect this type of Kerberos ticket manipulation?

Accepted Answer

By detecting anomalies in Kerberos authentication attributes such as unusual ticket lifetimes or mismatched SID history from domain controller telemetry. Golden Ticket attacks forge Kerberos TGTs with arbitrary lifespans and SIDs. Cortex XDR detects this by correlating anomalous ticket attributes, such as invalid SID history or ticket lifetimes exceeding domain policy, captured from domain controller logs.

Answer

By monitoring USB mass storage insertion events

Answer

By blocking outbound TCP port 80 traffic at the perimeter firewall

Answer

By scanning the master boot record (MBR) of the endpoint for rootkit signatures

Question 7

An ITDR rule in Cortex XDR triggers due to impossible travel detected for a user account. Upon investigation, the analyst discovers the source IP belongs to a corporate VPN egress node. How should the analyst prevent future false positives for this known infrastructure?

Accepted Answer

Add the corporate VPN egress IP ranges to the known corporate network or location exclusions list in Cortex XDR settings. False positives caused by known corporate VPN exit nodes or proxy servers can be mitigated by configuring IP exclusions or tuning threat intelligence/behavioral analytics settings within Cortex XDR.

Answer

Modify the Windows Registry on the user's workstation to disable IPv6

Answer

Disable all behavioral analytics globally

Answer

Uninstall the Cortex XDR agent from all Domain Controllers

Question 8

An analyst is investigating a suspicious user account that accessed sensitive internal shares outside of normal business hours. Which Cortex XDR feature enables the analyst to review all actions taken by this user across endpoints and cloud services in a chronological timeline?

Accepted Answer

The Incident Storyline and User Timeline view. The Incident Storyline and User Timeline view in Cortex XDR aggregates all telemetry—process executions, network connections, file operations, and cloud audit events—associated with a specific user or endpoint into a single chronological narrative. This allows the analyst to reconstruct the sequence of actions taken by the suspicious account across both endpoints and cloud services, which is exactly what the question requires. It is purpose-built for cross-domain, time-ordered investigation rather than static analysis or packet-level inspection.

Answer

The Static File Analysis Report

Answer

The Network Packet Capture Utility

Answer

The Host Isolation Status page

Question 9

Where can an administrator view the overall identity risk posture score across all users within the Cortex XDR management console?

Accepted Answer

Dashboards and the User Risk view within the Cortex XDR console. The Cortex XDR dashboard and specific Identity/User risk widgets display the aggregated risk posture scores of monitored users.

Answer

License Management > Subscriptions

Answer

Reports > Audit Trail

Answer

Settings > Configurations > Agents

Question 10

An administrator wants to configure automated response actions for high-severity ITDR alerts indicating active credential compromise. Which Cortex XDR feature allows automated actions such as disabling the compromised user account in Active Directory?

Accepted Answer

Response Actions and Playbooks integrated via Cortex XSOAR or native Cortex XDR automation profiles. Cortex XDR supports automated response actions through native automation profiles and playbooks, and can integrate with Cortex XSOAR for more complex orchestration. For ITDR alerts indicating active credential compromise, these features can automatically disable the compromised AD account, force password reset, or revoke sessions, reducing dwell time.

Answer

Local Windows Group Policy Editor

Answer

Agent Content Update schedules

Answer

Firewall Zone Protection Profiles

Question 11

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Accepted Answer

Directory Service Access and LDAP query event logs from Domain Controllers (such as Event ID 4662). BloodHound enumerates Active Directory by issuing LDAP queries and accessing directory service objects, which generates Directory Service Access events on domain controllers, including Event ID 4662. Cortex XDR can ingest these Domain Controller event logs to detect the enumeration patterns characteristic of BloodHound reconnaissance.

Answer

Network interface duplex settings

Answer

USB device connection history

Answer

Browser extension inventory reports

Question 12

Which log source is essential for Cortex XDR to track successful and failed interactive logon events on Windows workstations for ITDR analysis?

Accepted Answer

Windows Security Event logs (Event IDs 4624 and 4625). Windows Security Event logs, specifically Event IDs related to logon/logoff (such as 4624 and 4625), are fundamental for tracking Windows authentication.

Answer

System event logs for printer spooler errors

Answer

Antivirus definition update logs

Answer

IIS web server access logs

Question 13

What is the primary benefit of using Cortex XDR's identity correlation engine when triaging incidents?

Accepted Answer

It correlates alerts across endpoints, network, and identity to provide a complete picture of an attack campaign targeting a user. Cortex XDR's identity correlation engine links alerts from endpoints, network sensors, and identity sources (like AD and cloud IdPs) to a single user identity, revealing the full scope of an attack campaign targeting that user. This unified view helps analysts see lateral movement, credential abuse, and privilege escalation across disparate telemetry sources in one incident timeline.

Answer

It generates recurring compliance PDF reports for PCI-DSS audit filing

Answer

It replaces the need for Active Directory Group Policies

Answer

It automatically formats hard drives of compromised endpoints

Question 14

An organization wants to ensure that all administrative logon sessions are closely monitored for anomalous behaviors in Cortex XDR. Where should the administrator configure custom behavioral alert thresholds for privileged users?

Accepted Answer

Settings > Analytics > Analytics Rules / Thresholds. Custom behavioral alert thresholds for privileged users in Cortex XDR are configured under Settings > Analytics > Analytics Rules / Thresholds. This section allows administrators to define and tune detection rules, including behavioral analytics thresholds that govern when alerts fire for anomalous activity such as unusual administrative logons. It is the centralized location for managing detection logic and sensitivity.

Answer

Response > Playbooks > Designer

Answer

Cloud > Settings > CSPM

Answer

Endpoints > Agent Configurations > Profile

Question 15

An analyst is investigating a suspected pass-the-ticket attack where an attacker injects a stolen Kerberos ticket into memory. Which endpoint telemetry data collected by the Cortex XDR Agent helps identify abnormal process behavior related to ticket injection tools (such as Mimikatz 'kerberos::ptt')

Accepted Answer

Endpoint process behavior telemetry capturing handle creation and memory allocation anomalies targeting lsass.exe or LSA services. Process memory inspection and behavioral monitoring via BIOCs/Cortex XDR agent detect API calls and handle manipulations associated with ticket injection into LSASS or other processes.

Answer

SMTP mail delivery status reports

Answer

HTTP proxy CONNECT request headers

Answer

Cloud storage bucket access logs