XDR-Analyst Identity Threat Detection And Response Practice Test 4 — 15 Questions

Question 1

Which TWO features in Cortex XDR assist analysts in communicating identity threat findings to stakeholders or compliance auditors?

Accepted Answer

Scheduled and on-demand reporting templates for incident summaries and user risk. Option A is correct because Cortex XDR provides scheduled and on-demand reporting templates that summarize incidents and user risk, giving analysts a repeatable way to present identity threat findings to stakeholders and auditors. Option D is correct because Cortex XDR allows incidents and related data to be exported or shared in formats such as PDF or CSV, which supports evidence handoff and compliance review. Options B, C, and E are incorrect because BIOS flashing, live packet generation, and hard drive partitioning are not Cortex XDR features for communicating identity threat findings; they are unrelated to reporting or audit workflows.

Answer

Automated BIOS flashing utility

Answer

Live packet generator

Answer

Hard drive partition editor

Question 2

An analyst is investigating an incident where an attacker leveraged compromised credentials to establish persistence via Active Directory object manipulation. Which TWO Active Directory event logs or actions captured by ITDR monitoring should the analyst examine?

Accepted Answer

Windows Security Event IDs related to security group membership changes (e.g., adding a user to Domain Admins). Option B is correct because adding a user to a privileged group such as Domain Admins generates Windows Security events like 4728 (member added to a global group) or 4732 (member added to a local group), which are key ITDR indicators of persistence through privilege escalation. Option C is correct because Event ID 5136 is logged when a directory service object is modified, capturing changes to AD object attributes (e.g., userAccountControl, servicePrincipalName, or ACLs) that attackers abuse for persistence. Option A is wrong because DHCP lease renewals are network configuration events unrelated to Active Directory object manipulation. Option D is wrong because switch port duplex status is a Layer 1/2 physical link condition with no bearing on AD persistence. Option E is wrong because antivirus signature update timestamps reflect endpoint protection maintenance, not directory service changes.

Answer

DHCP IP lease renewal event logs

Answer

Network switch port duplex status logs

Answer

Antivirus signature version update timestamps

Question 3

Which THREE indicators collected by Cortex XDR endpoint agents are crucial for identifying post-exploitation credential harvesting activities on a host?

Accepted Answer

Unauthorized process memory access requests targeting lsass.exe. Option B is correct because post-exploitation credential harvesting frequently involves tools that read the memory of lsass.exe (e.g., Mimikatz, ProcDump, comsvcs.dll MiniDump), and Cortex XDR agents flag unauthorized cross-process memory access to LSASS as a high-fidelity indicator of credential theft. Option C is correct because the SAM hive stores local account password hashes and the SYSTEM hive contains the boot key needed to decrypt them, so unauthorized registry access to these hives (e.g., via reg save or esentutl) signals offline credential dumping. Option D is correct because Cortex XDR detects known credential-dumping command-lines and renamed binaries (e.g., procdump.exe -ma lsass.exe, sekurlsa::logonpasswords, lazagne.exe) through behavioral analytics and signature matching, which is a primary detection vector for credential harvesting. Option A is not relevant because changing the desktop wallpaper is a cosmetic/user-preference action with no relation to credential access. Option E is not relevant because clearing browser cache is a routine maintenance or privacy action and does not indicate credential harvesting from OS-level stores such as LSASS or the registry hives.

Answer

Changes to desktop background wallpaper settings

Answer

Default web browser cache clearing

Question 4

An organization notices an increase in credential dumping attacks against local Active Directory environments. They want to configure Cortex XDR Identity Analytics to trigger high-severity alerts when abnormal Kerberos ticket requests (such as potential Silver or Golden ticket activities) are detected. Where should the analyst enable or tune these specific identity behavior analytics rules?

Accepted Answer

Under Settings > Configurations > Analytics in the Cortex XDR console. Identity Analytics behavioral rules are managed within the Analytics configuration section of the Cortex XDR management console under Settings > Configurations > Analytics.

Answer

By modifying local Windows Group Policy Objects (GPOs) pushed to domain controllers

Answer

Within the BIOC (Behavioral Indicator of Compromise) rule builder under Incident Response

Answer

Under Settings > Configurations > Data Node Settings in the Cortex XDR console

Question 5

An analyst needs to verify whether Active Directory audit policies are correctly configured to supply Cortex XDR with the necessary event logs for Identity Threat Detection and Response. Which Windows Event ID range contains the core authentication and credential validation events required by Cortex XDR ITDR?

Accepted Answer

Event IDs 4600 through 4799 (Windows Security Audit logs). Windows Security Event IDs in the 4600-4799 range cover critical authentication events such as logon successes/failures, Kerberos ticket requests, and account modifications.

Answer

Event IDs 1100 through 1108 (Event Log Service operational logs)

Answer

Event IDs 1000 through 1005 (Application Error logs)

Answer

Event IDs 7000 through 7045 (Service Control Manager logs)

Question 6

While reviewing an incident involving suspicious lateral movement, an analyst notices that an adversary utilized compromised service account credentials. The analyst wants to use Cortex XDR response actions to immediately contain the threat without shutting down the entire domain controller. Which ITDR-related action can be executed directly from the Cortex XDR console for a compromised user account?

Accepted Answer

Disable User Account or Force Password Reset via Active Directory integration. Cortex XDR's Active Directory integration enables ITDR (Identity Threat Detection and Response) response actions directly from the console, including Disable User Account and Force Password Reset. These actions target the compromised identity itself, immediately neutralizing the adversary's ability to authenticate or use the stolen credentials without disrupting the domain controller or other users. This is the correct ITDR-aligned containment action for a compromised user account.

Answer

Revoke Kerberos TGT and purge DNS cache on the domain controller

Answer

Blacklist the user SID in the local Windows firewall

Answer

Isolate Endpoint via the XDR network containment feature

Question 7

Which TWO data sources can Cortex XDR leverage to build comprehensive user identity behavior profiles for ITDR? (Choose two)

Accepted Answer

Cloud Identity Provider authentication logs (e.g., Azure AD, Okta). Option A is correct because Cortex XDR ingests authentication telemetry from cloud identity providers such as Microsoft Entra ID and Okta (via the identity analytics/ITDR integration), which supplies sign-in events, MFA results, and risk detections needed to baseline user identity behavior. Option D is correct because Active Directory security event logs (e.g., 4624, 4625, 4768, 4769, 4720) provide on-premises authentication, Kerberos, and account-change activity that Cortex XDR correlates to profile user behavior and detect identity threats. Option B is not relevant since printer configuration files contain device settings, not user identity or authentication activity. Option C is not relevant because DHCP lease tables only map IP addresses to MAC addresses and do not describe user identity behavior. Option E is not relevant because BIOS firmware version logs are hardware inventory data with no bearing on user identity behavior profiling.

Answer

Local printer configuration files

Answer

DHCP lease allocation tables

Answer

BIOS firmware version logs

Question 8

When deploying and troubleshooting the integration between Cortex XDR and Active Directory for ITDR, which TWO steps or configurations are critical to ensure successful telemetry collection? (Choose two)

Accepted Answer

Configuring the Cortex XDR Broker VM to receive and parse syslog or Windows event streams from domain controllers. Option B is correct because the Cortex XDR Broker VM acts as the collection and parsing point for ITDR telemetry, ingesting syslog or Windows Event Forwarding streams from domain controllers so identity events reach Cortex XDR. Option C is correct because advanced audit policies (e.g., Audit Logon/Logoff, Audit Account Management, and Directory Service Access) must be enabled on Domain Controllers to generate the authentication and account-change events ITDR relies on. Option A is wrong because BIOS boot order has no bearing on AD telemetry collection. Option D is wrong because DNS root servers do not host AD identity telemetry and installing a kernel driver there is neither required nor appropriate. Option E is wrong because disabling firewall rules to SYSVOL is unnecessary and would weaken security without improving ITDR telemetry.

Answer

Modifying the local BIOS boot order on every user workstation

Answer

Installing the full Cortex XDR Agent kernel driver directly on all DNS root servers

Answer

Disabling all firewall rules between endpoints and the Active Directory SYSVOL share

Question 9

An administrator is setting up User Risk Scoring within Cortex XDR. They notice that certain service accounts with high volumes of automated authentications are skewing the risk calculations. How should the administrator handle these service accounts in Cortex XDR to prevent false-positive risk elevations?

Accepted Answer

Configure Identity Analytics exclusions or entity classifications for known service accounts. The correct approach is to configure Identity Analytics exclusions or entity classifications for known service accounts (A). This allows Cortex XDR to treat these accounts specially, preventing their high-volume automated authentications from skewing risk scores. Exclusions or classifications can be based on account name, group membership, or other attributes, ensuring that legitimate service activity does not trigger false-positive risk elevations.

Answer

Delete all authentication logs associated with service accounts from the Cortex XDR data lake

Answer

Disable Cortex XDR Agent protection on all Domain Controllers

Answer

Convert the service accounts into standard local administrator accounts

Question 10

Which THREE key identity-based threat behaviors are typically detected and flagged by Cortex XDR Identity Analytics? (Choose three)

Accepted Answer

Abnormal privilege escalation or group membership changes. Cortex XDR Identity Analytics baselines identity activity and flags deviations such as Option A, abnormal privilege escalation or group membership changes, because adding accounts to privileged groups or elevating rights is a classic attacker persistence and lateral-movement technique that the analytics engine correlates against normal role behavior. Option B, password spray and brute-force attempts, is detected because Identity Analytics ingests authentication telemetry and identifies repeated failed logons across many accounts or high-volume credential guessing patterns indicative of credential attacks. Option E, impossible travel sign-ins, is flagged because the engine correlates sign-in geolocation and timestamps to detect physically impossible authentication sequences that suggest compromised credentials or session hijacking. Option C does not belong because corrupted sector errors on mechanical hard drives are a hardware/storage reliability issue, not an identity behavior, and Option D does not belong because standard browser bookmark synchronization is benign user activity with no identity threat relevance.

Answer

Corrupted sector errors on mechanical hard drives

Answer

Standard browser bookmark synchronization

Question 11

A Cortex XDR analyst is investigating repeated failed authentications against a domain controller from a single workstation. The failures are followed by one success from the same workstation, after which the account begins accessing file shares it has never touched before. The analyst needs to preserve the identity context while correlating the authentication events with subsequent file activity. Which Cortex XDR capability should the analyst use to pivot from the authentication events to the related endpoint activity?

Accepted Answer

The Causality View, which groups related alerts and events by their shared causality chain. The Causality View is designed to group related alerts, events, and processes into a single investigation thread so analysts can follow an attack from initial authentication anomalies through subsequent endpoint behavior. Because the failed logons, the successful logon, and the file share access all share a causal relationship, this view lets the analyst preserve identity context and see the full sequence without manually stitching together separate event tables.

Answer

The Endpoint Isolation action, which quarantines the workstation from the network

Answer

The Threat Intelligence module, which enriches indicators with external reputation data

Answer

The Policy Audit report, which lists all endpoint security policy changes

Question 12

A Cortex XDR analyst is investigating an identity alert where a helpdesk technician account successfully authenticated to 14 different workstations within 3 minutes, each logon using explicit credentials rather than interactive console logon. The account has no associated change ticket. Which identity-based detection concept best explains why Cortex XDR raised this as a high-severity alert?

Accepted Answer

The account exhibited anomalous lateral movement behavior using explicit credentials across multiple endpoints in a short window.. Cortex XDR's identity analytics baseline normal account behavior and elevate alerts when an account deviates sharply. A helpdesk account authenticating with explicit credentials to many endpoints in a very short window, without a change ticket, matches lateral movement tradecraft. The severity derives from anomalous account behavior patterns, not from failed logons, geographic displacement, or decoy account usage.

Answer

The account was identified as a honeypot credential because it authenticated to decoy accounts configured in the identity store.

Answer

The account was flagged for impossible travel because its logons originated from geographically distant source IP addresses.

Answer

The account triggered a brute-force detection because multiple failed logons preceded each successful explicit credential logon.

Question 13

A Cortex XDR analyst is investigating a suspected pass-the-hash attack. The attacker has captured an NTLM hash and is using it to authenticate to multiple servers without knowing the plaintext password. Which Cortex XDR data source would most directly reveal the anomalous NTLM authentication events indicating this attack?

Accepted Answer

Windows Security Event Logs. Pass-the-hash attacks involve using an NTLM hash to authenticate to remote systems, generating network logon events. Windows Security Event Logs capture these events with details such as logon type and authentication package, enabling Cortex XDR to detect anomalies like a single user authenticating to multiple servers in a short time. This data source is essential for identifying such credential misuse.

Answer

DNS query logs

Answer

Endpoint process execution logs

Answer

Firewall logs

Question 14

A Cortex XDR analyst is building an ITDR detection strategy for a hybrid environment where attackers frequently abuse legitimate credentials rather than malware. The analyst needs to select identity behaviors that should generate high-fidelity alerts because they strongly indicate credential misuse rather than normal user activity. (Choose two.)

Accepted Answer

A user account obtaining a Kerberos ticket-granting ticket with an encryption type downgraded from AES to RC4. Interactive logons by service accounts from multiple workstations and Kerberos ticket requests downgraded to RC4 both deviate sharply from normal identity baselines and map directly to known credential abuse techniques. Service accounts should remain non-interactive and host-bound, while modern Kerberos negotiation should use AES; violations of either expectation provide high-fidelity evidence that credentials have been stolen or manipulated.

Answer

A user changing their password through the self-service portal after a password expiration prompt

Answer

A user logging out of their workstation at the end of the business day

Answer

A standard user authenticating successfully to a single workstation at the start of their normal shift

Question 15

A Cortex XDR analyst is responding to an alert indicating a Golden Ticket attack. The attacker has compromised the KRBTGT account hash and is forging Kerberos ticket-granting tickets (TGTs) to maintain persistent access. Which TWO Cortex XDR capabilities are most effective for detecting and investigating this attack? (Choose two.)

Accepted Answer

Behavioral analytics on Kerberos ticket requests. Golden Ticket attacks involve forging Kerberos TGTs using the KRBTGT hash, leading to anomalies in Kerberos ticket requests and domain controller logs. Cortex XDR's behavioral analytics and integration with Active Directory Domain Controller security logs are essential for detecting such anomalies, as they can identify unusual ticket properties and missing corresponding events, enabling effective investigation.

Answer

File integrity monitoring on domain controllers

Answer

Endpoint process execution monitoring for LSASS access

Answer

Network traffic analysis for SMB signing bypass