XDR-Analyst Identity Threat Detection And Response Practice Test 2 — 15 Questions

Question 1

Where can an administrator view the overall identity risk posture score across all users within the Cortex XDR management console?

Accepted Answer

Dashboards and the User Risk view within the Cortex XDR console. The Cortex XDR dashboard and specific Identity/User risk widgets display the aggregated risk posture scores of monitored users.

Answer

License Management > Subscriptions

Answer

Reports > Audit Trail

Answer

Settings > Configurations > Agents

Question 2

An administrator wants to configure automated response actions for high-severity ITDR alerts indicating active credential compromise. Which Cortex XDR feature allows automated actions such as disabling the compromised user account in Active Directory?

Accepted Answer

Response Actions and Playbooks integrated via Cortex XSOAR or native Cortex XDR automation profiles. Cortex XDR incident response and remediation can be automated using Cortex XSOAR integration playbooks or native Cortex XDR response actions triggered by Profile rules.

Answer

Local Windows Group Policy Editor

Answer

Agent Content Update schedules

Answer

Firewall Zone Protection Profiles

Question 3

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Accepted Answer

Directory Service Access and LDAP query event logs from Domain Controllers (such as Event ID 4662). Active Directory enumeration involves LDAP queries (e.g., querying group memberships, ACLs) which are logged in Domain Controller Security Event logs or Directory Service event logs (Event ID 4662).

Answer

Network interface duplex settings

Answer

USB device connection history

Answer

Browser extension inventory reports

Question 4

Which log source is essential for Cortex XDR to track successful and failed interactive logon events on Windows workstations for ITDR analysis?

Accepted Answer

Windows Security Event logs (Event IDs 4624 and 4625). Windows Security Event logs, specifically Event IDs related to logon/logoff (such as 4624 and 4625), are fundamental for tracking Windows authentication.

Answer

System event logs for printer spooler errors

Answer

Antivirus definition update logs

Answer

IIS web server access logs

Question 5

What is the primary benefit of using Cortex XDR's identity correlation engine when triaging incidents?

Accepted Answer

It correlates alerts across endpoints, network, and identity to provide a complete picture of an attack campaign targeting a user. Correlation links disparate alerts across endpoints, networks, and identity sources into a single coherent incident, reducing alert fatigue.

Answer

It generates recurring compliance PDF reports for PCI-DSS audit filing

Answer

It replaces the need for Active Directory Group Policies

Answer

It automatically formats hard drives of compromised endpoints

Question 6

An organization wants to ensure that all administrative logon sessions are closely monitored for anomalous behaviors in Cortex XDR. Where should the administrator configure custom behavioral alert thresholds for privileged users?

Accepted Answer

Settings > Analytics > Analytics Rules / Thresholds. Custom behavioral analytics settings and threshold configurations for user risk and analytics are managed within the Analytics configuration section of Cortex XDR.

Answer

Response > Playbooks > Designer

Answer

Cloud > Settings > CSPM

Answer

Endpoints > Agent Configurations > Profile

Question 7

An analyst is investigating a suspected pass-the-ticket attack where an attacker injects a stolen Kerberos ticket into memory. Which endpoint telemetry data collected by the Cortex XDR Agent helps identify abnormal process behavior related to ticket injection tools (such as Mimikatz 'kerberos::ptt')

Accepted Answer

Endpoint process behavior telemetry capturing handle creation and memory allocation anomalies targeting lsass.exe or LSA services. Process memory inspection and behavioral monitoring via BIOCs/Cortex XDR agent detect API calls and handle manipulations associated with ticket injection into LSASS or other processes.

Answer

SMTP mail delivery status reports

Answer

HTTP proxy CONNECT request headers

Answer

Cloud storage bucket access logs

Question 8

An analyst is reviewing an XQL query designed to hunt for suspicious account creation followed by immediate group membership escalation in Active Directory. Which XQL construct is used to join Active Directory event datasets based on a common security identifier (SID)?

Accepted Answer

Using the 'join' command matching on the user SID or account name across datasets. XQL supports the 'join' command to combine results from multiple datasets (such as account creation events and group modification events) based on a shared key like user SID or account name.

Answer

Using the 'wildfire_match' operator

Answer

Using the 'isolate' command

Answer

Using the 'parse_kv' modifier exclusively without datasets

Question 9

A security analyst suspects an account compromise after noticing multiple rapid logins from geographically distant IP addresses within minutes. Which Cortex XDR feature automatically aggregates these related anomalous authentication indicators into a single incident?

Accepted Answer

Analytics Alert Grouping engine. Analytics and Alert Grouping engines in Cortex XDR correlate disparate alerts associated with the same entity (such as a compromised user account) into a unified incident.

Answer

Device Control Policy

Answer

WildFire Verdict Engine

Answer

Cortex XSOAR Playbook Auto-Merge

Question 10

What role does the Cortex XDR Broker VM play regarding Active Directory and ITDR log collection?

Accepted Answer

It acts as a collector appliance to ingest and forward syslog, WMI, and Active Directory logs to Cortex XDR. Broker VM serves as an internal collector appliance that polls or receives syslog/WMI/LDAP data from on-premises infrastructure like Active Directory and forwards it to Cortex XDR.

Answer

It stores long-term forensic disk images of all enterprise workstations

Answer

It replaces the domain controller operating system

Answer

It functions as an external Next-Generation Firewall

Question 11

An attacker compromises a domain user account and attempts to enumerate domain admins using native Windows utilities (e.g., 'net group "Domain Admins" /domain'). Which Cortex XDR detection mechanism is specifically designed to catch such reconnaissance behaviors without relying solely on static signatures?

Accepted Answer

Behavioral Indicator of Compromise (BIOC) rules tuned for suspicious command-line execution and reconnaissance patterns. BIOCs (Behavioral Indicators of Compromise) and Analytics rules detect malicious command-line patterns and behavioral anomalies associated with domain enumeration tools.

Answer

WildFire file quarantine settings

Answer

DNS sinkholing profiles

Answer

Cloud Identity Provider Conditional Access policies

Question 12

Which TWO log sources are commonly ingested into Cortex XDR to support Identity Threat Detection and Response (ITDR)?

Accepted Answer

Cloud Identity Provider Sign-in Logs (e.g., Microsoft Entra ID). Windows Security Event Logs and Cloud Identity Provider logs (such as Entra ID or Okta) are primary sources for ITDR in Cortex XDR.

Answer

BIOS Firmware Update Logs

Answer

Display Resolution Configuration Logs

Answer

Printer Spooler Error Logs

Question 13

Which THREE key components or features in Cortex XDR contribute directly to identifying and investigating compromised user credentials?

Accepted Answer

Alert Grouping and Correlation engine. User Behavior Analytics (UBA), Incident View/User Timeline, and BIOC/Analytics alert correlation are core components for investigating compromised credentials.

Answer

Hardware Asset Warranty Tracker

Answer

Network QoS Bandwidth Profiler

Question 14

An analyst notices that a service account is generating alerts for anomalous login locations. Upon review, the account is used by an automated batch script running from a newly provisioned server. How should the analyst resolve this alert while maintaining security best practices?

Accepted Answer

Create an exception or tune the analytics rule to account for the new authorized script execution source. If a service account is performing expected automated operations from a new source, the analyst can tune the analytics or add the source IP/service account combination to known exclusions.

Answer

Change the Cortex XDR agent operational mode to 'Disabled'

Answer

Upgrade the firewall firmware version

Answer

Delete the Active Directory domain entirely

Question 15

Which TWO methods can an administrator use to ingest Active Directory logs into Cortex XDR?

Accepted Answer

Configuring forwarding of Windows Security Event logs via agent or syslog to Cortex XDR. Cortex XDR ingests AD logs primarily through the Cortex XDR Broker VM collecting Syslog/WMI or via direct integrations/agent log forwarding.

Answer

Printing logs to paper and scanning them via OCR

Answer

Connecting a USB flash drive directly to the Cortex XDR cloud tenant

Answer

Sending logs via consumer email attachments to support@paloaltonetworks.com