XDR-Analyst Identity Threat Detection And Response — Timed 10 Questions

Question 1

While investigating a lateral movement attack, an analyst notices suspicious Kerberos ticket-granting service (TGS) requests in Cortex XDR log queries. Which XQL dataset contains the parsed domain controller event logs required to investigate this potential Kerberos-based attack?

10 minute time limit — choose an answer to begin.

Accepted Answer

dataset = xdr_data | filter action_dataset = "active_directory_raw". Windows security event logs collected from Domain Controllers, such as event ID 4769 (Kerberos service ticket was requested), populate the dataset xdr_data where action_id corresponds to Windows event logs or specialized authentication datasets.

Answer

dataset = endpoint_security_identity

Answer

dataset = pan_wmi_raw

Answer

dataset = xdr_data | filter event_simple_name = "Win-Security-Kerberos-Service-Ticket"

Question 2

An administrator wants to write an XQL query to detect potential Pass-the-Hash activity by evaluating anomalous NTLM authentication events compared against a user's historical baseline. Which XQL function is best suited for statistical deviation analysis?

Accepted Answer

Use standard aggregation commands like stats count by user, source_ip to evaluate frequency anomalies against baseline distributions. The 'cdf' or statistical aggregation functions like 'count', 'earliest', 'latest', or machine learning outlier functions in XQL are used to evaluate baseline deviations.

Answer

Use the 'extract_identity()' parser modifier

Answer

Use the 'wildfire_scan()' function on the authentication stream

Answer

Use the 'isolate_endpoint()' action command inside the search bar

Question 3

When investigating advanced Active Directory attacks such as DCSync or DCShadow using Cortex XDR, which TWO primary indicators or event logs should an analyst look for?

Accepted Answer

Domain Controller event logs showing unauthorized or anomalous GetNCChanges replication requests from non-DC computer accounts. DCSync attacks involve replicating directory changes, which generate Windows Security Event ID 4662 (Directory Service Access) and Event ID 4632/4624/associated replication privilege checks.

Answer

Browser pop-up blocker activation logs

Answer

Local printer driver installation alerts

Answer

DHCP Scope Exhaustion Warning logs

Question 4

Which TWO methods can an administrator use to ingest Active Directory logs into Cortex XDR?

Accepted Answer

Configuring forwarding of Windows Security Event logs via agent or syslog to Cortex XDR. Option A is correct because Cortex XDR can ingest Windows Security Event logs from Active Directory Domain Controllers by forwarding them through the Cortex XDR agent or via syslog to the Cortex XDR management console, which is a supported log-collection method for AD monitoring. Option B is correct because the Cortex XDR Broker VM is specifically designed to collect logs from sources such as Domain Controllers and forward them to Cortex XDR, making it a valid ingestion path for Active Directory logs. Option C is not a supported ingestion method since printing and OCR scanning is not a technical log-forwarding mechanism. Option D is invalid because a USB flash drive cannot be connected directly to the Cortex XDR cloud tenant. Option E is invalid because sending logs as email attachments to a support address is not a supported or secure ingestion method.

Answer

Printing logs to paper and scanning them via OCR

Answer

Connecting a USB flash drive directly to the Cortex XDR cloud tenant

Answer

Sending logs via consumer email attachments to support@paloaltonetworks.com

Question 5

When constructing an advanced XQL query to investigate credential access and lateral movement, which TWO syntax structures or functions are correctly formatted for filtering and aggregation?

Accepted Answer

dataset = xdr_data | filter event_type = "USER_LOGIN" | stats count by user. Valid XQL syntax uses 'dataset = xdr_data' (or equivalent), 'filter' clauses, and 'stats count by' aggregation commands.

Answer

SELECT * FROM active_directory WHERE password = plaintext

Answer

RUN playbook name = "isolate"

Answer

SEARCH logs WHERE identity == true AND action == format

Question 6

An analyst is investigating a compromised user account in Cortex XDR and wants to review identity-based alerts generated by Active Directory monitoring. Which specific view in the Cortex XDR management console provides a consolidated timeline of identity events and authentication anomalies for a specific user?

Accepted Answer

The User View in the Incident or Audit logs. The User View in the Incident or Audit logs provides a consolidated timeline of identity events and authentication anomalies for a specific user. It aggregates data from Active Directory monitoring, including logon events, privilege changes, and other identity-related activities, allowing analysts to investigate a compromised account efficiently. This view is specifically designed for identity-centric investigations.

Answer

The Device Management inventory tab

Answer

The Correlation Rules editor

Answer

The Host Details page under Endpoint Protection

Question 7

Your organization has integrated Azure AD (Entra ID) with Cortex XDR to improve cloud identity visibility. An analyst observes alerts regarding impossible travel and atypical sign-in locations. Which underlying Cortex XDR capability processes these cloud IdP logs to detect such behavioral anomalies?

Accepted Answer

Cortex XDR Identity Analytics and Machine Learning behavioral profiling. Cortex XDR Identity Analytics applies machine learning algorithms to baseline user behavior across both on-premises Active Directory and cloud IdPs to surface anomalies like impossible travel.

Answer

Local endpoint Anti-Malware scanning engines

Answer

WildFire Static Analysis engine

Answer

Cortex XDR Port Scan detector BIOCs

Question 8

An analyst is triaging a Cortex XDR identity alert showing a single user account authenticating successfully from two countries 40 minutes apart, with no VPN or proxy in the environment. The analyst wants to determine whether this is a genuine credential compromise or a false positive before escalating. Which Cortex XDR capability should the analyst use FIRST to correlate the two authentication events and see the related process and endpoint context?

Accepted Answer

Causality Chain view for the user session. The Causality Chain view is designed to correlate related alerts and events, including identity and endpoint telemetry, into a single investigative timeline. In an impossible-travel scenario, it lets the analyst verify whether both authentications map to the same user session and endpoint context, which is essential before declaring compromise or escalating.

Answer

BIOC rule creation for impossible travel

Answer

Threat Intelligence lookup on the source IP addresses

Answer

Endpoint Isolation for the source host

Question 9

An XDR analyst is investigating an alert showing a service account successfully authenticating to a domain controller via NTLM from a workstation that has never hosted that account's scheduled tasks. The account's password is 14 months old and never rotated. Which Cortex XDR identity analytics signal should the analyst prioritize to confirm suspected credential theft and lateral movement?

Accepted Answer

The account's first-seen NTLM authentication from a new source host, combined with a spike in Kerberos service ticket requests (4769) from that same host.. Correlating a first-seen NTLM authentication source with a concurrent Kerberos service ticket request spike identifies active misuse of a stolen service account credential. Cortex XDR identity analytics surfaces this behavioral anomaly across identity and endpoint telemetry, letting the analyst confirm lateral movement rather than chase hygiene metadata like password age or generic logon counts.

Answer

The workstation's endpoint risk score, because a high-risk endpoint in Cortex XDR automatically proves the service account credentials were dumped from LSASS memory.

Answer

The password age of 14 months, because Cortex XDR assigns a higher identity risk score to accounts that exceed the organization's 90-day rotation policy.

Answer

The volume of Windows Security event 4624 logons on the domain controller, since any successful logon from a workstation indicates the service account was compromised.

Question 10

A Cortex XDR analyst receives an identity alert indicating that a service account performed an interactive logon to a workstation at 02:00, followed by creation of a new local administrator account. The service account's password has not changed in 18 months. Which combination of factors makes this alert MOST likely a genuine credential compromise rather than administrative maintenance?

Accepted Answer

Interactive logon type combined with privileged account creation from a non-admin workstation. Service accounts should not perform interactive logons, and they should not create privileged local accounts. The convergence of an unexpected logon type, anomalous timing, and privilege creation on a non-admin host strongly indicates that an attacker has obtained and is abusing the service account credentials, making this the most defensible conclusion.

Answer

The service account password age exceeding 12 months

Answer

The workstation is not in the domain administrators group

Answer

The logon occurred outside standard business hours