XDR-Analyst Identity Threat Detection And Response Practice Test 3 — 15 Questions

Question 1

An analyst is reviewing an XQL query designed to hunt for suspicious account creation followed by immediate group membership escalation in Active Directory. Which XQL construct is used to join Active Directory event datasets based on a common security identifier (SID)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using the 'join' command matching on the user SID or account name across datasets. XQL supports the 'join' command to combine results from multiple datasets (such as account creation events and group modification events) based on a shared key like user SID or account name.

Answer

Using the 'wildfire_match' operator

Answer

Using the 'isolate' command

Answer

Using the 'parse_kv' modifier exclusively without datasets

Question 2

A security analyst suspects an account compromise after noticing multiple rapid logins from geographically distant IP addresses within minutes. Which Cortex XDR feature automatically aggregates these related anomalous authentication indicators into a single incident?

Accepted Answer

Analytics Alert Grouping engine. Analytics and Alert Grouping engines in Cortex XDR correlate disparate alerts associated with the same entity (such as a compromised user account) into a unified incident.

Answer

Device Control Policy

Answer

WildFire Verdict Engine

Answer

Cortex XSOAR Playbook Auto-Merge

Question 3

What role does the Cortex XDR Broker VM play regarding Active Directory and ITDR log collection?

Accepted Answer

It acts as a collector appliance to ingest and forward syslog, WMI, and Active Directory logs to Cortex XDR. The Cortex XDR Broker VM functions as a collector appliance that ingests and forwards syslog, WMI, and Active Directory logs to Cortex XDR. It acts as an on-premises intermediary that receives telemetry from various sources and securely transmits it to the Cortex XDR management console for analysis and correlation. This is its primary role in AD and ITDR log collection.

Answer

It stores long-term forensic disk images of all enterprise workstations

Answer

It replaces the domain controller operating system

Answer

It functions as an external Next-Generation Firewall

Question 4

An attacker compromises a domain user account and attempts to enumerate domain admins using native Windows utilities (e.g., 'net group "Domain Admins" /domain'). Which Cortex XDR detection mechanism is specifically designed to catch such reconnaissance behaviors without relying solely on static signatures?

Accepted Answer

Behavioral Indicator of Compromise (BIOC) rules tuned for suspicious command-line execution and reconnaissance patterns. Behavioral Indicator of Compromise (BIOC) rules in Cortex XDR are specifically designed to detect suspicious behaviors such as reconnaissance commands, including native Windows utilities like 'net group "Domain Admins" /domain'. BIOCs focus on behavior patterns and command-line execution rather than static signatures, making them effective against living-off-the-land techniques that evade traditional signature-based detection.

Answer

WildFire file quarantine settings

Answer

DNS sinkholing profiles

Answer

Cloud Identity Provider Conditional Access policies

Question 5

Which TWO log sources are commonly ingested into Cortex XDR to support Identity Threat Detection and Response (ITDR)?

Accepted Answer

Cloud Identity Provider Sign-in Logs (e.g., Microsoft Entra ID). Option B is correct because Cortex XDR's ITDR capabilities ingest authentication and sign-in telemetry from cloud identity providers such as Microsoft Entra ID (Azure AD), including events like successful and failed sign-ins, MFA challenges, and risky sign-in detections, which are essential for correlating identity-based attacks across the environment. Option D is correct because Windows Security Event Logs supply the core on-premises identity telemetry Cortex XDR uses for ITDR, including Kerberos authentication events (e.g., 4768, 4769, 4771), logon/logoff events (4624, 4625, 4634), and privilege/account changes (4720, 4728, 4672) that reveal credential theft, pass-the-hash, and lateral movement. Options A, C, and E are not relevant: BIOS firmware update logs, display resolution configuration logs, and printer spooler error logs contain hardware or peripheral configuration data with no authentication or identity context, so they do not feed ITDR analytics.

Answer

BIOS Firmware Update Logs

Answer

Display Resolution Configuration Logs

Answer

Printer Spooler Error Logs

Question 6

Which THREE key components or features in Cortex XDR contribute directly to identifying and investigating compromised user credentials?

Accepted Answer

Alert Grouping and Correlation engine. The Alert Grouping and Correlation engine (A) is correct because it aggregates and links disparate alerts—such as suspicious logons, credential dumping, and lateral movement—into a single correlated incident, which is essential for recognizing credential-compromise patterns across endpoints and identities. The User Behavior Analytics (UBA) engine (B) is correct because it baselines normal user activity and applies behavioral analytics to detect anomalies like impossible travel, atypical login times, or unusual access, which are direct indicators of compromised credentials. The User Timeline and Incident View (C) is correct because it presents a chronological, unified timeline of user and endpoint activity within an incident, letting investigators reconstruct how credentials were abused and trace the attack path. The Hardware Asset Warranty Tracker (D) is not relevant, as it manages device warranty and asset lifecycle information rather than credential threat detection or investigation. The Network QoS Bandwidth Profiler (E) is also not relevant, since it deals with network traffic prioritization and bandwidth management, not identity compromise analysis.

Answer

Hardware Asset Warranty Tracker

Answer

Network QoS Bandwidth Profiler

Question 7

An analyst notices that a service account is generating alerts for anomalous login locations. Upon review, the account is used by an automated batch script running from a newly provisioned server. How should the analyst resolve this alert while maintaining security best practices?

Accepted Answer

Create an exception or tune the analytics rule to account for the new authorized script execution source. If a service account is performing expected automated operations from a new source, the analyst can tune the analytics or add the source IP/service account combination to known exclusions.

Answer

Change the Cortex XDR agent operational mode to 'Disabled'

Answer

Upgrade the firewall firmware version

Answer

Delete the Active Directory domain entirely

Question 8

When reviewing identity analytics alerts in Cortex XDR, which THREE behavioral anomalies are typically flagged by the UBA engine as potential indicators of a compromised account?

Accepted Answer

Abnormal volume of data access or file downloads compared to peer group baselines. The UBA (User and Entity Behavior Analytics) engine in Cortex XDR baselines each user's normal activity and flags deviations, so option B is correct because a spike in data access or file downloads relative to the peer group baseline is a classic exfiltration/compromised-account indicator. Option C is correct because accessing sensitive internal applications or file shares outside the user's normal working hours is an anomalous access pattern the engine scores as risky. Option D is correct because impossible travel — geographically distant logins within an unrealistically short timeframe — is a hallmark UBA detection for credential compromise or session hijacking. Option A is not anomalous since a standard QWERTY keyboard layout is a ubiquitous, benign configuration with no security relevance. Option E is not a user-behavior anomaly at all; plugging an Ethernet cable into switch port 1 is a physical network action, not identity analytics telemetry.

Answer

Using a standard QWERTY keyboard layout

Answer

Connecting an Ethernet cable into port 1 of a switch

Question 9

Which THREE features of Cortex XDR assist an analyst in conducting a deep-dive forensic investigation into an identity-based alert?

Accepted Answer

User View providing identity risk scores and associated device history. Option B is correct because the User View in Cortex XDR aggregates identity-centric context, including user risk scores and the history of devices associated with that identity, which is essential when pivoting from an identity-based alert into a forensic investigation. Option C is correct because XQL (Extended Query Language) Search lets analysts run granular, ad-hoc queries across both raw and normalized datasets (such as the xdr_data and endpoints tables), enabling deep-dive hunting and timeline reconstruction beyond the pre-built alert view. Option D is correct because Cortex XDR Storyline visualizes causal relationships between processes, files, network connections, and other events, allowing an analyst to trace the full chain of activity tied to the identity-based alert. Option A does not belong because disk defragmentation is an OS maintenance function with no forensic or investigative value in Cortex XDR. Option E does not belong because printer queue monitoring is unrelated to identity analytics, endpoint telemetry, or forensic investigation workflows in Cortex XDR.

Answer

Automated disk defragmentation utility

Answer

Printer queue status monitor

Question 10

Which THREE actions can be taken directly or via orchestration within Cortex XDR when responding to an active identity-based attack?

Accepted Answer

Isolating the compromised endpoint from the network. Option B is correct because Cortex XDR can isolate a compromised endpoint from the network, cutting off the attacker's command-and-control and lateral-movement paths while preserving the agent for investigation. Option C is correct because Cortex XDR response actions integrate with identity providers (e.g., Active Directory) to disable the compromised account or force a password reset, terminating the attacker's valid-credential access. Option D is correct because Cortex XDR can quarantine malicious credential-dumping tools (e.g., Mimikatz) found on endpoints, removing the attacker's ability to harvest further credentials. Option A is not a Cortex XDR action since rebuilding a data center's electrical grid is a physical facilities task outside the product's scope. Option E is not a Cortex XDR action because upgrading BIOS firmware on enterprise routers is a hardware/firmware maintenance task unrelated to identity-attack response.

Answer

Rebuilding the physical data center facility electrical grid

Answer

Upgrading the BIOS firmware on enterprise routers

Question 11

Which TWO types of user accounts are critical to monitor closely for privilege abuse and anomalous behavior within an ITDR program?

Accepted Answer

Domain Administrator accounts. Domain Administrator accounts (B) are the highest-value targets in any environment, since they hold near-unrestricted rights over Active Directory (e.g., DCSync, Golden Ticket, and domain-wide policy changes), so any anomalous logon, privilege escalation, or lateral movement tied to them is a top ITDR detection priority. Service accounts with elevated permissions (D) are equally critical because they typically run with non-interactive, often non-expiring credentials and broad rights, making them prime targets for Kerberoasting, credential dumping, and abuse that blends into normal automated activity. The remaining options are not the focus of privilege-abuse monitoring: guest accounts with zero permissions (A) and unassigned printer test accounts (C) lack meaningful privileges, and deactivated former employee accounts (E) should be disabled or removed, so they represent an account-lifecycle/hygiene issue rather than active privileged-account monitoring.

Answer

Guest user accounts with zero permissions

Answer

Unassigned printer test accounts

Answer

Deactivated former employee accounts

Question 12

Which TWO metrics or components are typically included in a user's risk score calculation within Cortex XDR's identity analytics?

Accepted Answer

Severity and count of triggered behavioral analytics alerts. User risk scores incorporate failed authentication attempts and alerts triggered by anomalous behavioral patterns.

Answer

Manufacturer of the user's computer monitor

Answer

Total number of desktop wallpaper images stored by the user

Answer

Average length of time the user spends on lunch breaks

Question 13

Which THREE configuration steps are required to ensure Cortex XDR successfully correlates endpoint events with Active Directory user identities?

Accepted Answer

Enabling behavioral analytics and ITDR modules within the Cortex XDR management console. Option C is correct because enabling behavioral analytics and ITDR (Identity Threat Detection and Response) modules in the Cortex XDR management console activates the identity-correlation and analytics engines that map endpoint activity to AD user identities. Option D is correct because Cortex XDR agents must be deployed on enterprise endpoints to collect the process, network, and user telemetry that is later correlated with Active Directory identities. Option E is correct because the Broker VM ingests Active Directory and User-ID mapping data (e.g., via WinRM/AD queries and User-ID agents), providing the identity context needed to associate endpoint events with AD users. Option A is not required and would be counterproductive, since removing local accounts does not enable AD correlation and can break legitimate access. Option B is not required and would weaken security, as disabling domain controller firewall rules is unrelated to identity correlation and exposes critical services.

Answer

Removing all local user accounts from workstations

Answer

Disabling all firewall rules on domain controllers

Question 14

An enterprise is facing credential stuffing attacks targeting its cloud and on-premises applications. Which TWO detection or mitigation strategies within Cortex XDR and integrated tools help address this threat?

Accepted Answer

Analytics rules detecting high-frequency failed login attempts across multiple accounts from distributed source IPs. Option A is correct because credential stuffing manifests as many failed authentication attempts spread across numerous accounts from many different source IPs, and Cortex XDR analytics rules (BIOC/correlation rules) can detect this high-frequency failed-login pattern to trigger alerts and response actions. Option E is correct because integrating cloud identity provider (IdP) logs — such as Microsoft Entra ID/Entra ID, Okta, or similar — into Cortex XDR lets you monitor sign-in risk policies, conditional access outcomes, and automated lockout thresholds, which are key controls against credential stuffing. Options B, C, and D do not belong: screen saver timeouts, printer sharing permissions, and USB mass storage blocking address physical endpoint hygiene or data-loss concerns, not credential-based authentication attacks, and none of them detect or mitigate distributed failed-login activity.

Answer

Modifying screen saver timeout intervals via Group Policy

Answer

Configuring printer sharing permissions on all Windows 10 endpoints

Answer

Enabling USB mass storage device blocking

Question 15

You are configuring integration between Cortex XDR and an external Identity Provider (IdP) to ingest user authentication logs for ITDR. Which component is primarily responsible for securely forwarding these IdP telemetry logs to the Cortex XDR data lake?

Accepted Answer

The Cortex XDR Broker VM configured with the appropriate log forwarding profile. The Cortex XDR Collector or Broker VM is used to ingest syslog, HTTP event collector streams, or API-based logs from external IdPs into the Cortex data lake.

Answer

The Traps management service daemon

Answer

The WildFire cloud analysis cluster

Answer

The Cortex XDR Agent installed on domain controllers