XDR-Analyst Identity Threat Detection And Response — Timed 40 Questions

Question 1

While investigating a lateral movement attack, an analyst notices suspicious Kerberos ticket-granting service (TGS) requests in Cortex XDR log queries. Which XQL dataset contains the parsed domain controller event logs required to investigate this potential Kerberos-based attack?

40 minute time limit — choose an answer to begin.

Accepted Answer

dataset = xdr_data | filter action_dataset = "active_directory_raw". Windows security event logs collected from Domain Controllers, such as event ID 4769 (Kerberos service ticket was requested), populate the dataset xdr_data where action_id corresponds to Windows event logs or specialized authentication datasets.

Answer

dataset = endpoint_security_identity

Answer

dataset = pan_wmi_raw

Answer

dataset = xdr_data | filter event_simple_name = "Win-Security-Kerberos-Service-Ticket"

Question 2

An administrator wants to write an XQL query to detect potential Pass-the-Hash activity by evaluating anomalous NTLM authentication events compared against a user's historical baseline. Which XQL function is best suited for statistical deviation analysis?

Accepted Answer

Use standard aggregation commands like stats count by user, source_ip to evaluate frequency anomalies against baseline distributions. The 'cdf' or statistical aggregation functions like 'count', 'earliest', 'latest', or machine learning outlier functions in XQL are used to evaluate baseline deviations.

Answer

Use the 'extract_identity()' parser modifier

Answer

Use the 'wildfire_scan()' function on the authentication stream

Answer

Use the 'isolate_endpoint()' action command inside the search bar

Question 3

When investigating advanced Active Directory attacks such as DCSync or DCShadow using Cortex XDR, which TWO primary indicators or event logs should an analyst look for?

Accepted Answer

Domain Controller event logs showing unauthorized or anomalous GetNCChanges replication requests from non-DC computer accounts. DCSync attacks involve replicating directory changes, which generate Windows Security Event ID 4662 (Directory Service Access) and Event ID 4632/4624/associated replication privilege checks.

Answer

Browser pop-up blocker activation logs

Answer

Local printer driver installation alerts

Answer

DHCP Scope Exhaustion Warning logs

Question 4

Which TWO methods can an administrator use to ingest Active Directory logs into Cortex XDR?

Accepted Answer

Configuring forwarding of Windows Security Event logs via agent or syslog to Cortex XDR. Option A is correct because Cortex XDR can ingest Windows Security Event logs from Active Directory Domain Controllers by forwarding them through the Cortex XDR agent or via syslog to the Cortex XDR management console, which is a supported log-collection method for AD monitoring. Option B is correct because the Cortex XDR Broker VM is specifically designed to collect logs from sources such as Domain Controllers and forward them to Cortex XDR, making it a valid ingestion path for Active Directory logs. Option C is not a supported ingestion method since printing and OCR scanning is not a technical log-forwarding mechanism. Option D is invalid because a USB flash drive cannot be connected directly to the Cortex XDR cloud tenant. Option E is invalid because sending logs as email attachments to a support address is not a supported or secure ingestion method.

Answer

Printing logs to paper and scanning them via OCR

Answer

Connecting a USB flash drive directly to the Cortex XDR cloud tenant

Answer

Sending logs via consumer email attachments to support@paloaltonetworks.com

Question 5

When constructing an advanced XQL query to investigate credential access and lateral movement, which TWO syntax structures or functions are correctly formatted for filtering and aggregation?

Accepted Answer

dataset = xdr_data | filter event_type = "USER_LOGIN" | stats count by user. Valid XQL syntax uses 'dataset = xdr_data' (or equivalent), 'filter' clauses, and 'stats count by' aggregation commands.

Answer

SELECT * FROM active_directory WHERE password = plaintext

Answer

RUN playbook name = "isolate"

Answer

SEARCH logs WHERE identity == true AND action == format

Question 6

An analyst is investigating a compromised user account in Cortex XDR and wants to review identity-based alerts generated by Active Directory monitoring. Which specific view in the Cortex XDR management console provides a consolidated timeline of identity events and authentication anomalies for a specific user?

Accepted Answer

The User View in the Incident or Audit logs. The User View in the Incident or Audit logs provides a consolidated timeline of identity events and authentication anomalies for a specific user. It aggregates data from Active Directory monitoring, including logon events, privilege changes, and other identity-related activities, allowing analysts to investigate a compromised account efficiently. This view is specifically designed for identity-centric investigations.

Answer

The Device Management inventory tab

Answer

The Correlation Rules editor

Answer

The Host Details page under Endpoint Protection

Question 7

Your organization has integrated Azure AD (Entra ID) with Cortex XDR to improve cloud identity visibility. An analyst observes alerts regarding impossible travel and atypical sign-in locations. Which underlying Cortex XDR capability processes these cloud IdP logs to detect such behavioral anomalies?

Accepted Answer

Cortex XDR Identity Analytics and Machine Learning behavioral profiling. Cortex XDR Identity Analytics applies machine learning algorithms to baseline user behavior across both on-premises Active Directory and cloud IdPs to surface anomalies like impossible travel.

Answer

Local endpoint Anti-Malware scanning engines

Answer

WildFire Static Analysis engine

Answer

Cortex XDR Port Scan detector BIOCs

Question 8

An analyst is triaging a Cortex XDR identity alert showing a single user account authenticating successfully from two countries 40 minutes apart, with no VPN or proxy in the environment. The analyst wants to determine whether this is a genuine credential compromise or a false positive before escalating. Which Cortex XDR capability should the analyst use FIRST to correlate the two authentication events and see the related process and endpoint context?

Accepted Answer

Causality Chain view for the user session. The Causality Chain view is designed to correlate related alerts and events, including identity and endpoint telemetry, into a single investigative timeline. In an impossible-travel scenario, it lets the analyst verify whether both authentications map to the same user session and endpoint context, which is essential before declaring compromise or escalating.

Answer

BIOC rule creation for impossible travel

Answer

Threat Intelligence lookup on the source IP addresses

Answer

Endpoint Isolation for the source host

Question 9

An XDR analyst is investigating an alert showing a service account successfully authenticating to a domain controller via NTLM from a workstation that has never hosted that account's scheduled tasks. The account's password is 14 months old and never rotated. Which Cortex XDR identity analytics signal should the analyst prioritize to confirm suspected credential theft and lateral movement?

Accepted Answer

The account's first-seen NTLM authentication from a new source host, combined with a spike in Kerberos service ticket requests (4769) from that same host.. Correlating a first-seen NTLM authentication source with a concurrent Kerberos service ticket request spike identifies active misuse of a stolen service account credential. Cortex XDR identity analytics surfaces this behavioral anomaly across identity and endpoint telemetry, letting the analyst confirm lateral movement rather than chase hygiene metadata like password age or generic logon counts.

Answer

The workstation's endpoint risk score, because a high-risk endpoint in Cortex XDR automatically proves the service account credentials were dumped from LSASS memory.

Answer

The password age of 14 months, because Cortex XDR assigns a higher identity risk score to accounts that exceed the organization's 90-day rotation policy.

Answer

The volume of Windows Security event 4624 logons on the domain controller, since any successful logon from a workstation indicates the service account was compromised.

Question 10

A Cortex XDR analyst receives an identity alert indicating that a service account performed an interactive logon to a workstation at 02:00, followed by creation of a new local administrator account. The service account's password has not changed in 18 months. Which combination of factors makes this alert MOST likely a genuine credential compromise rather than administrative maintenance?

Accepted Answer

Interactive logon type combined with privileged account creation from a non-admin workstation. Service accounts should not perform interactive logons, and they should not create privileged local accounts. The convergence of an unexpected logon type, anomalous timing, and privilege creation on a non-admin host strongly indicates that an attacker has obtained and is abusing the service account credentials, making this the most defensible conclusion.

Answer

The service account password age exceeding 12 months

Answer

The workstation is not in the domain administrators group

Answer

The logon occurred outside standard business hours

Question 11

A Cortex XDR administrator wants to enable automated response actions for identity-based threats, such as disabling a user account upon detection of a high-severity credential compromise alert. Which Cortex XDR component should be configured to achieve this?

Accepted Answer

Cortex XDR Incident Response Playbooks. Incident Response Playbooks in Cortex XDR are designed to automate response actions based on alert triggers. By configuring a playbook that activates on high-severity identity alerts, administrators can automatically disable compromised user accounts, thereby reducing response time and mitigating threats. This component provides the orchestration needed for such automated identity threat response.

Answer

Cortex XDR Policy Rules

Answer

Cortex XDR User View

Answer

Cortex XDR Analytics BIOC

Question 12

A Cortex XDR analyst is building detection coverage for identity-based attacks and wants to identify user behaviors that should trigger ITDR alerts. Which TWO behaviors are the strongest indicators of potential credential compromise that should be prioritized for detection? (Choose two.)

Accepted Answer

A standard user account suddenly adding itself to a privileged group. Impossible travel and unexpected self-elevation into privileged groups are both high-fidelity indicators that an identity has been compromised or is being abused. They reflect anomalous authentication and privilege behavior that deviates from a user's baseline, making them appropriate priorities for ITDR detection coverage.

Answer

A user account performing a password spray against multiple accounts from a single source

Answer

A user account logging in during normal business hours from the usual office subnet

Answer

A user account accessing a public website over HTTPS

Question 13

A Cortex XDR analyst is investigating a potential Golden Ticket attack. The analyst observes a Kerberos TGS request (Event ID 4769) for a service ticket where the account name is 'ANONYMOUS LOGON' and the ticket options include 'forwardable' and 'renewable'. The domain controller is a Windows Server 2019. Which TWO additional artifacts should the analyst examine in Cortex XDR to confirm the use of a forged TGT? (Choose two.)

Accepted Answer

The Kerberos TGS request events (Event ID 4769) for the same user account to check for an unusually high volume of requests to different services within a short time.. Golden Ticket attacks involve forging a TGT, which is then used to request TGS tickets. The forged TGT can have arbitrary domain SID and group memberships, leading to TGS requests (Event ID 4769) that show domain mismatches or anomalous patterns. Additionally, the attacker may rapidly request many TGS tickets for different services to explore the network. These two artifacts—domain mismatches in 4769 events and a high volume of TGS requests—are strong indicators. Other events like TGT requests (4768) are bypassed, and generic logon events or process logs are less specific.

Answer

The Security event log for Event ID 4624 logon events with logon type 3 (network) from the affected user account.

Answer

The Cortex XDR agent's process execution logs for the affected user account to identify tools like Mimikatz or Rubeus.

Answer

The Kerberos TGT request events (Event ID 4768) for the same user account to check for missing pre-authentication.

Question 14

An analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?

Accepted Answer

Process execution telemetry from endpoint agents. Process execution telemetry from endpoint agents is correct because a BIOC rule detects behavioral patterns based on endpoint activity, such as process executions. To detect suspicious use of 'whoami' by an authenticated domain user, the rule must evaluate process execution events, which include the process name, command line, user context, and parent process. This telemetry is collected by the Cortex XDR agent and stored in the endpoint data lake, allowing BIOC rules to trigger on specific behaviors.

Answer

Cloud storage audit logs

Answer

Firewall URL filtering logs

Answer

DHCP lease tables

Question 15

An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?

Accepted Answer

Target process name matching 'lsass.exe' with suspicious access rights from an unauthorized source process. Credential dumping via LSASS memory access is detected by monitoring for suspicious access rights (e.g., PROCESS_VM_READ) requested against the lsass.exe process by an unauthorized or unexpected source process. This behavior is characteristic of tools like Mimikatz and is the core telemetry condition a BIOC rule must evaluate. The other options describe unrelated event types.

Answer

Registry modifications affecting the Windows Firewall state

Answer

DNS query logs for newly registered domains

Answer

Outbound HTTPS connections to unknown external IP addresses on port 443

Question 16

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

Accepted Answer

The Cortex XDR Broker VM configured with the User-ID integration. The Broker VM configured with the User-ID integration is the Cortex XDR component responsible for collecting user and group metadata from Active Directory and other identity sources. It forwards this identity context to Cortex XDR so alerts can be enriched and correlated for ITDR use cases. Without the Broker VM's User-ID integration, AD context would not be available for alert enrichment.

Answer

The Cortex XDR Network Traffic Analyzer

Answer

WildFire cloud analysis engine

Answer

The Cortex XSOAR Content Pack for Active Directory

Question 17

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

Accepted Answer

Comprehensive profile information including recent alerts, associated devices, and identity attributes. The User View in Cortex XDR aggregates identity-centric context: a comprehensive profile showing recent alerts, associated devices, and identity attributes (department, role, risk score). This helps analysts quickly assess whether an identity-based alert is part of a broader pattern or an isolated event.

Answer

Real-time packet captures of the user's active browsing session

Answer

The hardware warranty status of endpoints assigned to the user

Answer

Group Policy Object (GPO) editing capabilities

Question 18

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

Accepted Answer

Incident Response > Alerts, filtering by Analytics category related to Identity. Identity analytics alerts generated by User Behavior Analytics (UBA) in Cortex XDR appear under Incident Response > Alerts, where analysts can filter by the Analytics category and specifically the Identity-related subcategory. This is the centralized alert triage interface where UBA-generated detections (e.g., impossible travel, anomalous login) surface alongside other analytics alerts.

Answer

Cloud > Posture > Identity

Answer

XQL Search > Identity_Raw schema

Answer

Endpoints > Agent Configurations > Identity

Question 19

An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?

Accepted Answer

Windows Security Event logs (specifically Event ID 4769) collected via Broker VM. Kerberoasting is detected by analyzing Windows Security Event log ID 4769 (A Kerberos service ticket was requested), specifically looking for high encryption downgrade requests (e.g., RC4).

Answer

Antivirus scan reports

Answer

DNS query logs showing external root hints

Answer

DHCP lease allocation tables

Question 20

What is the primary purpose of integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR?

Accepted Answer

To provide visibility into cloud authentication events, sign-in anomalies, and identity risks in hybrid environments. Integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR feeds cloud identity telemetry — sign-in events, conditional access results, MFA challenges, and risky user detections — into the XDR console. This lets analysts correlate identity-based threats with endpoint and network activity, which is essential for detecting credential compromise and lateral movement in hybrid environments.

Answer

To replace the Cortex XDR Agent on Linux servers

Answer

To enforce local BIOS password policies

Answer

To automate the deployment of Windows security patches to endpoints