XDR-Analyst Identity Threat Detection And Response Practice Test 3 — 15 Questions

Question 1

When reviewing identity analytics alerts in Cortex XDR, which THREE behavioral anomalies are typically flagged by the UBA engine as potential indicators of a compromised account?

Accepted Answer

Abnormal volume of data access or file downloads compared to peer group baselines. UBA flags impossible travel, abnormal access times (after hours), and unusual access to sensitive resources or file shares outside a user's normal peer group baseline.

Answer

Using a standard QWERTY keyboard layout

Answer

Connecting an Ethernet cable into port 1 of a switch

Question 2

Which THREE features of Cortex XDR assist an analyst in conducting a deep-dive forensic investigation into an identity-based alert?

Accepted Answer

User View providing identity risk scores and associated device history. Storyline, XQL search, and the User View are essential tools for deep-dive forensic investigations in Cortex XDR.

Answer

Automated disk defragmentation utility

Answer

Printer queue status monitor

Question 3

Which THREE actions can be taken directly or via orchestration within Cortex XDR when responding to an active identity-based attack?

Accepted Answer

Isolating the compromised endpoint from the network. Response actions include isolating endpoints, disabling user accounts (via integration/playbooks), and quarantining files associated with credential dumping tools.

Answer

Rebuilding the physical data center facility electrical grid

Answer

Upgrading the BIOS firmware on enterprise routers

Question 4

Which TWO types of user accounts are critical to monitor closely for privilege abuse and anomalous behavior within an ITDR program?

Accepted Answer

Domain Administrator accounts. Domain Administrators and Service Accounts are high-value targets for attackers and require rigorous monitoring.

Answer

Guest user accounts with zero permissions

Answer

Unassigned printer test accounts

Answer

Deactivated former employee accounts

Question 5

Which TWO metrics or components are typically included in a user's risk score calculation within Cortex XDR's identity analytics?

Accepted Answer

Severity and count of triggered behavioral analytics alerts. User risk scores incorporate failed authentication attempts and alerts triggered by anomalous behavioral patterns.

Answer

Manufacturer of the user's computer monitor

Answer

Total number of desktop wallpaper images stored by the user

Answer

Average length of time the user spends on lunch breaks

Question 6

Which THREE configuration steps are required to ensure Cortex XDR successfully correlates endpoint events with Active Directory user identities?

Accepted Answer

Enabling behavioral analytics and ITDR modules within the Cortex XDR management console. Successful correlation requires installing the Cortex XDR agent on endpoints, configuring Broker VM for AD mapping/User-ID, and enabling analytics in the console.

Answer

Removing all local user accounts from workstations

Answer

Disabling all firewall rules on domain controllers

Question 7

An enterprise is facing credential stuffing attacks targeting its cloud and on-premises applications. Which TWO detection or mitigation strategies within Cortex XDR and integrated tools help address this threat?

Accepted Answer

Analytics rules detecting high-frequency failed login attempts across multiple accounts from distributed source IPs. Credential stuffing can be detected via analytics identifying high volumes of failed logins from distinct external IPs, and mitigated via identity provider conditional access or automated account locking.

Answer

Modifying screen saver timeout intervals via Group Policy

Answer

Configuring printer sharing permissions on all Windows 10 endpoints

Answer

Enabling USB mass storage device blocking

Question 8

You are configuring integration between Cortex XDR and an external Identity Provider (IdP) to ingest user authentication logs for ITDR. Which component is primarily responsible for securely forwarding these IdP telemetry logs to the Cortex XDR data lake?

Accepted Answer

The Cortex XDR Broker VM configured with the appropriate log forwarding profile. The Cortex XDR Collector or Broker VM is used to ingest syslog, HTTP event collector streams, or API-based logs from external IdPs into the Cortex data lake.

Answer

The Traps management service daemon

Answer

The WildFire cloud analysis cluster

Answer

The Cortex XDR Agent installed on domain controllers

Question 9

Which TWO features in Cortex XDR assist analysts in communicating identity threat findings to stakeholders or compliance auditors?

Accepted Answer

Scheduled and on-demand reporting templates for incident summaries and user risk. Customizable reporting and incident export capabilities allow analysts to share investigation findings and summaries with stakeholders.

Answer

Automated BIOS flashing utility

Answer

Live packet generator

Answer

Hard drive partition editor

Question 10

An analyst is investigating a compromised user account in Cortex XDR and wants to review identity-based alerts generated by Active Directory monitoring. Which specific view in the Cortex XDR management console provides a consolidated timeline of identity events and authentication anomalies for a specific user?

Accepted Answer

The User View in the Incident or Audit logs. The User View in Cortex XDR consolidates identity-related telemetry, user risk scoring, and activity timelines across connected identity sources like Active Directory and Okta.

Answer

The Device Management inventory tab

Answer

The Correlation Rules editor

Answer

The Host Details page under Endpoint Protection

Question 11

An analyst is investigating an incident where an attacker leveraged compromised credentials to establish persistence via Active Directory object manipulation. Which TWO Active Directory event logs or actions captured by ITDR monitoring should the analyst examine?

Accepted Answer

Windows Security Event IDs related to security group membership changes (e.g., adding a user to Domain Admins). Persistence via AD object manipulation is logged via Security Event ID 5136 (Directory Service Object was modified) and group membership additions (Event ID 4728/4732).

Answer

DHCP IP lease renewal event logs

Answer

Network switch port duplex status logs

Answer

Antivirus signature version update timestamps

Question 12

Which THREE indicators collected by Cortex XDR endpoint agents are crucial for identifying post-exploitation credential harvesting activities on a host?

Accepted Answer

Unauthorized process memory access requests targeting lsass.exe. Credential harvesting leaves traces such as suspicious LSASS process access, memory dumping tool executions, and unexpected credential file access (e.g., SAM hive reads).

Answer

Changes to desktop background wallpaper settings

Answer

Default web browser cache clearing

Question 13

An organization notices an increase in credential dumping attacks against local Active Directory environments. They want to configure Cortex XDR Identity Analytics to trigger high-severity alerts when abnormal Kerberos ticket requests (such as potential Silver or Golden ticket activities) are detected. Where should the analyst enable or tune these specific identity behavior analytics rules?

Accepted Answer

Under Settings > Configurations > Analytics in the Cortex XDR console. Identity Analytics behavioral rules are managed within the Analytics configuration section of the Cortex XDR management console under Settings > Configurations > Analytics.

Answer

By modifying local Windows Group Policy Objects (GPOs) pushed to domain controllers

Answer

Within the BIOC (Behavioral Indicator of Compromise) rule builder under Incident Response

Answer

Under Settings > Configurations > Data Node Settings in the Cortex XDR console

Question 14

An analyst needs to verify whether Active Directory audit policies are correctly configured to supply Cortex XDR with the necessary event logs for Identity Threat Detection and Response. Which Windows Event ID range contains the core authentication and credential validation events required by Cortex XDR ITDR?

Accepted Answer

Event IDs 4600 through 4799 (Windows Security Audit logs). Windows Security Event IDs in the 4600-4799 range cover critical authentication events such as logon successes/failures, Kerberos ticket requests, and account modifications.

Answer

Event IDs 1100 through 1108 (Event Log Service operational logs)

Answer

Event IDs 1000 through 1005 (Application Error logs)

Answer

Event IDs 7000 through 7045 (Service Control Manager logs)

Question 15

While reviewing an incident involving suspicious lateral movement, an analyst notices that an adversary utilized compromised service account credentials. The analyst wants to use Cortex XDR response actions to immediately contain the threat without shutting down the entire domain controller. Which ITDR-related action can be executed directly from the Cortex XDR console for a compromised user account?

Accepted Answer

Disable User Account or Force Password Reset via Active Directory integration. Cortex XDR supports user-level response actions, such as forcing a password reset or disabling the user account in Active Directory directly from the incident response interface.

Answer

Revoke Kerberos TGT and purge DNS cache on the domain controller

Answer

Blacklist the user SID in the local Windows firewall

Answer

Isolate Endpoint via the XDR network containment feature