XDR-Analyst Identity Threat Detection And Response Practice Test 5 — 15 Questions

Question 1

A Cortex XDR administrator wants the platform to automatically disable a user account in Active Directory when an identity alert indicates confirmed active credential compromise, without analyst intervention. Which Cortex XDR capability should the administrator configure to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An automated response action in the alert configuration that invokes the identity provider integration to disable the account.. Automated remediation for identity compromise requires an orchestrated response action tied to alert criteria and integrated with the identity provider. Cortex XDR's automation can invoke the directory integration to disable the account the moment a confirmed compromise alert fires. Reports, detection rules, and endpoint isolation all fail to revoke the account's ability to authenticate, which is the core containment objective.

Answer

A BIOC rule that generates a new high-severity alert whenever a user account is disabled by an administrator.

Answer

A scheduled report that emails the identity team a list of compromised accounts every hour.

Answer

An endpoint isolation policy that quarantines every host the compromised user has ever logged on to.

Question 2

A Cortex XDR administrator wants to review which user accounts have the highest identity risk based on recent authentication anomalies and privilege changes. The administrator needs a consolidated view that ranks users by their accumulated risk indicators across the environment. Which Cortex XDR feature should the administrator open to obtain this ranked list of at-risk identities?

Accepted Answer

The Identity Analytics dashboard, which aggregates user risk scores and identity-related findings. Identity Analytics is the dedicated dashboard that collects identity-related telemetry, applies risk scoring, and ranks users by accumulated indicators such as anomalous authentications and privilege changes. It gives the administrator a single, user-centric view of identity risk posture, which incident, endpoint, or raw query views are not designed to provide.

Answer

The Endpoints page, sorted by the number of alerts per endpoint

Answer

The Cortex XDR Query Builder, executed against the alerts table with a severity filter

Answer

The Incidents page, filtered by severity to show only high-severity incidents

Question 3

During an identity investigation in Cortex XDR, an analyst observes a service account performing a Kerberoasting-style request pattern: multiple TGS requests for accounts with Service Principal Names, followed by an anomalous LDAP query enumerating domain admins. The service account normally runs a backup job nightly. Which interpretation should guide the analyst's next action?

Accepted Answer

The service account is likely compromised and being used for Kerberoasting and reconnaissance, warranting immediate containment and credential rotation.. Mass TGS requests against multiple SPN-bearing accounts followed by privileged group enumeration is a textbook Kerberoasting and reconnaissance sequence. A backup service account has no legitimate reason to exhibit this behavior, so the analyst should treat the account as compromised, contain it, rotate credentials, and hunt for the host and tooling responsible rather than tuning detections or filing change requests.

Answer

The pattern is expected backup behavior and can be closed as benign because service accounts routinely request service tickets.

Answer

The LDAP query is the only suspicious element, so the analyst should tune the Kerberoasting detection to reduce noise and monitor further.

Answer

The activity indicates a misconfigured backup job, so the analyst should open a change request to correct the service account's SPN assignments.

Question 4

A Cortex XDR analyst sees an alert for a user account that authenticated successfully from an unfamiliar ASN, then immediately triggered a privileged role assignment in Azure AD. Which Cortex XDR capability should the analyst use FIRST to correlate the identity activity with endpoint and network telemetry in a single timeline?

Accepted Answer

The Incident View, which stitches identity, endpoint, and network events into one causal chain.. The Incident View is designed to unify identity, endpoint, and network telemetry into one causal timeline, which is exactly what is needed when a suspicious authentication is followed by a privileged role assignment. It surfaces the relationships between alerts and events so the analyst can determine scope and impact before taking response actions. Other console areas either provide raw data, administrative records, or response controls rather than correlated incident context.

Answer

The Audit Log, which records administrative changes made inside the Cortex XDR console.

Answer

The Endpoint Isolation action, which contains the device tied to the identity alert.

Answer

The Query Builder, which runs XQL against raw datasets to reconstruct the chain manually.

Question 5

During an investigation, a Cortex XDR analyst observes that a user account successfully authenticated to a server and then, within seconds, accessed a credential store file on that server. The analyst wants to determine whether the account's credentials were subsequently used from a different host. Which Cortex XDR data should the analyst examine to trace whether the stolen credentials were reused elsewhere?

Accepted Answer

Authentication events correlated by account across all ingested identity data sources. Credential reuse after theft appears as authentication events for the same account originating from new hosts or locations. By correlating authentication records across every ingested identity source, the analyst can detect those later logons and confirm whether the credentials taken from the server were used elsewhere, which single-host process or software views cannot show.

Answer

The endpoint's installed software inventory, compared against a known-good baseline

Answer

The process execution history on the original server, filtered by the accessing user

Answer

The firewall rule base, reviewed for recently modified rules affecting the server

Question 6

During an ITDR investigation, an analyst sees a Cortex XDR identity alert: a privileged user authenticated successfully to three different SaaS applications from two countries within 12 minutes. MFA was satisfied via push notification on each attempt. The analyst needs to determine whether this is a legitimate VPN egress or a session-token replay. Which Cortex XDR identity data point best distinguishes session-token theft from legitimate travel?

Accepted Answer

The device fingerprint and session identifier for each authentication, because a replayed token reuses the original device and session context rather than creating a new one.. The decisive signal is whether the authenticated session context, including device fingerprint and session identifier, is reused across geographically distant authentications. A replayed session token preserves the original device and session context while the source IP changes, which Cortex XDR identity analytics flags. Legitimate travel creates fresh device and session context at each new location.

Answer

The user's department and manager fields in the identity profile, since HR attributes determine whether international travel is expected.

Answer

The number of SaaS applications accessed, because accessing three applications in 12 minutes exceeds the threshold that Cortex XDR uses to flag credential stuffing.

Answer

The MFA push notification delivery status, because a successful push proves the legitimate user approved the login from each location.

Question 7

A Cortex XDR analyst is building an identity threat detection strategy for a hybrid environment with on-premises Active Directory and cloud identity. Which TWO telemetry sources should the analyst prioritize ingesting to detect credential abuse and anomalous authentication across both environments? (Choose two.)

Accepted Answer

Windows Security event logs from domain controllers, including authentication and Kerberos events.. Effective hybrid identity threat detection requires visibility into both authentication authorities. Domain controller security logs expose on-premises Kerberos and logon behavior, while cloud identity provider sign-in and audit logs expose cloud authentication and directory changes. Together they let Cortex XDR baseline and correlate identity behavior across environments. Network, DHCP, and print logs lack the credential and authentication context needed for identity-focused detection.

Answer

Endpoint firewall connection logs recording outbound TCP and UDP flows from user workstations.

Answer

Print server spooler logs capturing document names and submitting user accounts.

Answer

DHCP lease logs from the internal network recording IP address assignments to endpoints.

Question 8

During an ITDR investigation, an analyst observes that a service account authenticated to a domain controller and then created a new computer object. The analyst wants to determine whether this is a known attack technique involving directory object manipulation. Which Cortex XDR analytic or rule category is MOST relevant to this behavior?

Accepted Answer

Behavioral Indicators of Compromise (BIOCs) focused on Active Directory object creation and modification.. Behavioral Indicators of Compromise are the analytic category built to detect sequences of suspicious actions, including directory object creation and modification by accounts that should not perform them. Because the scenario involves an authenticated service account performing an unusual directory operation, a BIOC provides the technique-level visibility needed. Static IOCs, prevention profiles, and vulnerability scans address different layers and would not classify this behavior as an identity attack technique.

Answer

Indicators of Compromise (IOCs) based on known malicious file hashes and domains.

Answer

Vulnerability assessment scans that identify missing patches on domain controllers.

Answer

Custom prevention profiles that block specific executables from running on domain controllers.

Question 9

A Cortex XDR analyst receives an alert that a privileged account was added to the Domain Admins group outside of a change window. The analyst wants to immediately review the account's recent activity and the group membership change in a single identity-focused investigation context. Where should the analyst navigate to review this identity event alongside the account's related activity?

Accepted Answer

The User View within the Cortex XDR investigation interface. The User View is purpose-built for identity investigations, aggregating an account's recent activity, associated alerts, and directory changes into one context. Reviewing the Domain Admins addition there allows the analyst to immediately assess whether the privileged account's other behavior is consistent with the change, which host-centric or aggregate views cannot deliver.

Answer

The Cortex XDR dashboard widget showing top alert categories

Answer

The network map, filtered by the subnet containing the domain controller

Answer

The Host View on the domain controller that recorded the group change

Question 10

A Cortex XDR analyst receives an ITDR alert indicating a user account performed a Kerberoasting attack against multiple service principal names. The analyst wants to quickly identify every host and process that requested the service tickets to scope the incident. Which Cortex XDR capability should the analyst use?

Accepted Answer

The Query Builder with the XDR dataset, filtering on the Kerberos service ticket event and pivoting on the requesting host and process.. Query Builder against the XDR dataset gives the analyst direct, event-level access to Kerberos service ticket requests, allowing a pivot on requesting host and process. This is the native Cortex XDR method for enumerating every system involved in the Kerberoasting activity and accurately scoping the incident without external tooling or latency.

Answer

The Cortex XDR Marketplace, by installing a third-party Kerberos auditing app that exports ticket requests to an external SIEM.

Answer

The Incidents view, by sorting incidents by severity and reviewing the incident description for the list of affected hosts.

Answer

The Endpoint Administration console, by reviewing the agent version and content update status of each domain-joined workstation.

Question 11

An analyst reviewing a Cortex XDR identity incident sees that a user's account successfully authenticated from an unfamiliar ASN at 02:00, immediately followed by creation of a new mail forwarding rule and a password reset. The user confirms they were asleep and did not perform these actions. Which conclusion and immediate priority are most appropriate?

Accepted Answer

The account is compromised with confirmed attacker control, so the priority is to revoke sessions, reset credentials, and remove the malicious forwarding rule.. When a user denies activity that matches a coherent attack sequence, the account should be treated as compromised. The unfamiliar-ASN sign-in, malicious mail forwarding rule, and attacker-initiated password reset together indicate both persistent access and data exfiltration. Containment must revoke sessions, reset credentials, and remove the forwarding rule, because addressing only one element leaves the attacker a path back in or a channel to continue stealing mail.

Answer

The password reset indicates the user regained control, so the priority is to close the incident and monitor for recurrence.

Answer

The events are likely a synchronization error between the identity provider and Cortex XDR, so the priority is to reingest the logs and recheck.

Answer

The mail forwarding rule is the only malicious element, so the priority is to delete the rule and take no further containment action.

Question 12

A Cortex XDR analyst is examining an alert where a user account successfully authenticated from two different countries within a 10-minute window. The analyst suspects impossible travel. Which Cortex XDR feature would provide a visual representation of the user's login locations and times to confirm this?

Accepted Answer

User View timeline. User View in Cortex XDR provides a consolidated timeline of user activities, including authentication events with geographic locations and timestamps. This feature enables analysts to visualize login patterns and quickly identify impossible travel by showing the sequence of logins from disparate locations within a short timeframe, confirming the anomaly.

Answer

Endpoint device control audit

Answer

Network traffic flow analysis

Answer

Incident Response Playbook execution log

Question 13

A Cortex XDR administrator wants to ensure that when an identity-based attack is detected, the platform can automatically disable the compromised user account in the identity provider. Which integration must be configured to enable this automated response?

Accepted Answer

A Cortex XDR identity provider integration that supports user account actions.. Automated identity response actions such as disabling a user account depend on an integration between Cortex XDR and the identity provider that exposes user management APIs. This integration gives the platform the authority and mechanism to revoke access when an identity-based attack is detected. Log forwarding, endpoint prevention, and network segmentation operate at different layers and cannot disable an account in the directory.

Answer

An endpoint prevention policy that blocks credential theft techniques on domain controllers.

Answer

A network segmentation rule isolating the VLAN used by the affected user.

Answer

A syslog forwarding rule from the domain controller to the Cortex XDR console.

Question 14

A security operations manager wants analysts to quickly see, for any user in Cortex XDR, a consolidated timeline of authentication events, accessed resources, and associated alerts across the environment. Which Cortex XDR feature should analysts use to obtain this per-user consolidated view?

Accepted Answer

User View. User View in Cortex XDR is purpose-built to consolidate a single user's authentication events, resource access, and related alerts into one investigative surface. It enables analysts to quickly assess whether an account's behavior is anomalous without manually correlating multiple log sources, which is exactly what the manager wants.

Answer

Incident Response Investigation

Answer

Threat Intelligence Management

Answer

Policy Audit

Question 15

A Cortex XDR analyst is building an ITDR detection strategy for an environment using Microsoft Entra ID and on-premises Active Directory. The analyst wants to identify identity-based attacks that span both cloud and on-premises authentication. Which TWO Cortex XDR data sources provide the authentication telemetry needed to correlate cloud sign-ins with on-premises logons? (Choose two.)

Accepted Answer

Microsoft Entra ID sign-in and audit logs ingested via the Cortex XDR cloud identity connector.. Correlating cloud and on-premises identity attacks requires authentication telemetry from both planes. Entra ID sign-in and audit logs provide cloud authentication context, while domain controller Windows Security logs provide Kerberos, NTLM, and logon events. Together they let Cortex XDR link a cloud sign-in to an on-premises logon and expose hybrid attacks such as password spray or token theft spanning both environments.

Answer

DNS query logs from internal resolvers, including queries for external domains.

Answer

Endpoint process execution logs from user workstations, including command-line arguments.

Answer

Firewall traffic logs showing outbound connections to known malicious IP addresses.