XDR-Analyst Multiple Select — 50 Questions

Question 1

An analyst is investigating a Cortex XDR incident where the alert source is listed as 'XDR Analytics' and the alert contains a MITRE ATT&CK technique mapping. The analyst wants to understand how the alert was generated and what data contributed to it. Which two actions should the analyst take to gain this understanding? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the alert's 'Alert Details' pane for the analytics description and contributing events. To understand an XDR Analytics alert, the analyst should review the Alert Details pane for the analytics description and contributing events, and examine the Causality Chain to see the event sequence. These provide the 'why' and 'how' of the alert. Other actions like exporting raw logs, modifying BIOC rules, or counting similar alerts do not directly explain the alert's generation.

Answer

Run a query in the Query Builder to count similar alerts

Answer

Modify the BIOC rule that triggered the alert

Answer

Export the raw endpoint logs from the Cortex XDR agent

Question 2

An analyst is reviewing a Cortex XDR incident that includes alerts from multiple sources. The analyst wants to correlate related alerts to identify a coordinated attack. Which two actions can the analyst take to manually correlate alerts into the incident? (Choose two.)

Accepted Answer

Create a new incident from the alert and then merge it with the existing incident.. Manual correlation in Cortex XDR can be achieved by either adding an alert directly to an incident or by creating a new incident from the alert and merging it. Both methods result in the alert being included in the incident's context, enabling unified analysis. Other actions like changing severity or editing descriptions do not establish the necessary link.

Answer

Modify the alert's severity to match the incident's severity.

Answer

Edit the alert's description to include the incident ID.

Answer

Assign the alert to the same analyst who owns the incident.

Question 3

Which THREE actions can be taken directly or via orchestration within Cortex XDR when responding to an active identity-based attack?

Accepted Answer

Isolating the compromised endpoint from the network. Option B is correct because Cortex XDR can isolate a compromised endpoint from the network, cutting off the attacker's command-and-control and lateral-movement paths while preserving the agent for investigation. Option C is correct because Cortex XDR response actions integrate with identity providers (e.g., Active Directory) to disable the compromised account or force a password reset, terminating the attacker's valid-credential access. Option D is correct because Cortex XDR can quarantine malicious credential-dumping tools (e.g., Mimikatz) found on endpoints, removing the attacker's ability to harvest further credentials. Option A is not a Cortex XDR action since rebuilding a data center's electrical grid is a physical facilities task outside the product's scope. Option E is not a Cortex XDR action because upgrading BIOS firmware on enterprise routers is a hardware/firmware maintenance task unrelated to identity-attack response.

Answer

Rebuilding the physical data center facility electrical grid

Answer

Upgrading the BIOS firmware on enterprise routers

Question 4

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

Accepted Answer

File Path and Command-Line arguments. Option A (File Path and Command-Line arguments) is correct because Cortex XDR exceptions can be scoped by the process image path and the exact command-line string, allowing an analyst to suppress a false positive only for a specific executable invocation rather than all activity. Option C (Digital Signature / Certificate information) is correct because exceptions can be tied to the signer or certificate details, so only binaries signed by a trusted publisher are excluded, which is useful for legitimate vendor tools that trigger behavioral alerts. Option E (File Hash (SHA-256)) is correct because hash-based exceptions match a specific known-good file by its SHA-256 value, providing the tightest scope and preventing a different file with the same name or path from being suppressed. Option B (Local user keyboard layout language) is not a security-relevant attribute in Cortex XDR exception criteria, and Option D (Endpoint CPU temperature threshold) is a hardware/health metric that has no role in defining detection exception scope.

Answer

Local user keyboard layout language

Answer

Endpoint CPU temperature threshold

Question 5

Which TWO log sources are commonly ingested into Cortex XDR to support Identity Threat Detection and Response (ITDR)?

Accepted Answer

Cloud Identity Provider Sign-in Logs (e.g., Microsoft Entra ID). Option B is correct because Cortex XDR's ITDR capabilities ingest authentication and sign-in telemetry from cloud identity providers such as Microsoft Entra ID (Azure AD), including events like successful and failed sign-ins, MFA challenges, and risky sign-in detections, which are essential for correlating identity-based attacks across the environment. Option D is correct because Windows Security Event Logs supply the core on-premises identity telemetry Cortex XDR uses for ITDR, including Kerberos authentication events (e.g., 4768, 4769, 4771), logon/logoff events (4624, 4625, 4634), and privilege/account changes (4720, 4728, 4672) that reveal credential theft, pass-the-hash, and lateral movement. Options A, C, and E are not relevant: BIOS firmware update logs, display resolution configuration logs, and printer spooler error logs contain hardware or peripheral configuration data with no authentication or identity context, so they do not feed ITDR analytics.

Answer

BIOS Firmware Update Logs

Answer

Display Resolution Configuration Logs

Answer

Printer Spooler Error Logs

Question 6

An administrator is designing a disaster recovery and high availability strategy for Broker VM deployments in a large enterprise. Which THREE practices ensure high availability and resilience for Broker VM services?

Accepted Answer

Continuously monitoring Broker VM health, connectivity status, and app status in the Cortex XDR console. Option A is correct because continuous monitoring of Broker VM health, connectivity status, and app status in the Cortex XDR console provides the visibility needed to detect failures or degraded services early and trigger remediation, which is essential for maintaining high availability. Option B is correct because hypervisor-level HA such as VMware vSphere HA automatically restarts Broker VM virtual machines on another host when a host failure occurs, reducing downtime without manual intervention. Option C is correct because deploying multiple Broker VM instances in active-active or active-passive configurations across different hypervisor hosts removes single points of failure and ensures service continuity if one instance or host becomes unavailable. Option D does not belong because connecting virtual disks to a local USB thumb drive is not a supported or reliable HA mechanism and introduces a single point of failure rather than resilience. Option E does not belong because Broker VM is a virtual appliance deployed on a hypervisor, not software that runs inside a web browser tab, so it cannot provide the required availability or performance.

Answer

Connecting the Broker VM virtual disks to a local USB thumb drive for manual failover

Answer

Running the Broker VM software directly inside a web browser tab

Question 7

An administrator is configuring data stitching and alert correlation rules in Cortex XDR to improve incident prioritization. Which TWO actions are best practices to ensure high-fidelity alert grouping and accurate incident scoring? (Choose two)

Accepted Answer

Map critical assets with appropriate priority weights to influence incident scoring accurately.. Option C is correct because Cortex XDR incident scoring factors in asset criticality, so mapping critical assets with appropriate priority weights ensures that alerts affecting high-value systems are scored and prioritized accurately. Option E is correct because data stitching and alert correlation depend on consistent, correctly parsed host and IP identification fields; if third-party log sources do not normalize these fields, Cortex XDR cannot reliably stitch related alerts into a single incident or correlate them across data sources. Option A is incorrect because disabling all default analytics rules removes valuable built-in detections and correlation logic rather than improving fidelity. Option B is incorrect because a 1-minute incident close timeout is far too aggressive and would prematurely close incidents before related alerts can be stitched together. Option D is incorrect because manually starring every alert does not trigger the correlation engine and would simply clutter the alert view without improving grouping or scoring.

Answer

Disable all default Cortex XDR analytics rules to prevent false correlation.

Answer

Set the incident close timeout to 1 minute to speed up alert processing.

Answer

Manually star every incoming alert to trigger the incident correlation engine.

Question 8

Which TWO evidence sources help an analyst investigate whether an unauthorized user accessed a compromised workstation locally? (Choose two)

Accepted Answer

Windows Security Event logs (Event IDs for logon successes and failures). Local workstation access investigations rely on Windows Security Event logs (Logon/Logoff events) and user session telemetry.

Answer

Corporate vehicle fleet GPS tracking logs

Answer

Office cafeteria refrigerator temperature charts

Answer

Office janitorial cleaning supply invoices

Question 9

An analyst is reviewing a Cortex XDR alert for a suspicious PowerShell script that was executed on a Windows endpoint. The analyst wants to gather additional context about the script's execution. Which TWO data sources are available directly in the Cortex XDR alert details to help understand the script's behavior? (Choose two.)

Accepted Answer

Network connections initiated by the process. The alert details in Cortex XDR provide process execution details and network connections associated with the process. These allow the analyst to see how the script was launched and whether it communicated externally. Memory dumps, registry modifications, and user login history are not standard data sources directly available in the alert details for a specific process, making them incorrect choices.

Answer

Full memory dump of the PowerShell process

Answer

Windows Registry modifications made by the script

Answer

User login history for the account that executed the script

Question 10

When responding to a malware alert, an analyst decides to quarantine the offending file. Which TWO outcomes occur when Cortex XDR performs a file quarantine? (Choose two)

Accepted Answer

Running processes associated with the file are terminated.. Quarantine terminates the running process instance (if applicable) and moves the file binary from its original path to a secure, encrypted quarantine location on the endpoint.

Answer

All network routers in the enterprise data center are reset.

Answer

The computer's power supply unit is permanently disabled.

Answer

The endpoint operating system hard drive is physically wiped clean.

Question 11

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

Accepted Answer

Incident Timeline / Causality view. Option A, the Incident Timeline / Causality view, is correct because in Cortex XDR this view reconstructs the sequence of events (process execution, network connections, file writes, registry changes) around an alert, letting analysts trace the root cause and forensic artifacts collected from the endpoint. Option C, the File Details / Forensic File Collection view, is correct because it exposes the actual collected forensic artifacts such as quarantined files, hashes, and file metadata retrieved from the endpoint during an investigation. The remaining options (B, D, and E) are unrelated administrative or facilities records and have no role in Cortex XDR forensic artifact analysis.

Answer

Corporate gym membership roster

Answer

Cloud printer ink supply level gauge

Answer

Cafeteria food inventory management sheet

Question 12

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Accepted Answer

New. Option A, New, is correct because a newly generated incident in Cortex XDR begins in the New state, which is the initial stage of the standard incident lifecycle before any analyst action is taken. Option D, Under Investigation, is correct because once an analyst begins working an incident, it moves to the Under Investigation state, which is a defined stage in the standard lifecycle. The remaining options do not belong: Featured and Starred are not lifecycle states but rather UI flags or filters used to mark or prioritize incidents for quick access, and Stitched refers to the stitching of related alerts/causality events into an incident, not a lifecycle state.

Answer

Featured

Answer

Starred

Answer

Stitched

Question 13

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Accepted Answer

Verify the digital signature and publisher of the application. Safe exception implementation involves validating binary integrity, verifying legitimate paths, and testing prior to global deployment.

Answer

Disable all Cortex XDR agent security modules across the entire enterprise

Answer

Remove all file access permissions from the operating system kernel

Question 14

A Cortex XDR analyst is building an identity threat detection strategy for a hybrid environment with on-premises Active Directory and cloud identity. Which TWO telemetry sources should the analyst prioritize ingesting to detect credential abuse and anomalous authentication across both environments? (Choose two.)

Accepted Answer

Windows Security event logs from domain controllers, including authentication and Kerberos events.. Effective hybrid identity threat detection requires visibility into both authentication authorities. Domain controller security logs expose on-premises Kerberos and logon behavior, while cloud identity provider sign-in and audit logs expose cloud authentication and directory changes. Together they let Cortex XDR baseline and correlate identity behavior across environments. Network, DHCP, and print logs lack the credential and authentication context needed for identity-focused detection.

Answer

Endpoint firewall connection logs recording outbound TCP and UDP flows from user workstations.

Answer

Print server spooler logs capturing document names and submitting user accounts.

Answer

DHCP lease logs from the internal network recording IP address assignments to endpoints.

Question 15

An analyst is reviewing a Cortex XDR incident involving a suspicious PowerShell script that was executed on multiple endpoints. The analyst needs to gather evidence to determine the script's origin and impact. Which TWO actions should the analyst take to collect relevant evidence from the endpoints? (Choose two.)

Accepted Answer

Retrieve the PowerShell script file from the endpoints using the 'Retrieve File' action.. Retrieving the PowerShell script file provides direct evidence of its contents, while querying process execution events via XQL gives context about how and where it ran. Together, these actions allow the analyst to understand the script's origin, execution parameters, and impact across endpoints. The other options are either containment or detection measures that do not directly collect the needed evidence.

Answer

Initiate a full antivirus scan on the endpoints.

Answer

Isolate the endpoints from the network immediately.

Answer

Review the endpoints' Windows Event Logs for PowerShell operational events.

Question 16

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

Accepted Answer

Utilize asset criticality scoring profiles to elevate key asset visibility. Option D is correct because Cortex XDR lets administrators configure featured fields, which add custom columns to the Incident View so that specific metadata relevant to their environment is displayed directly in the incident grid. Option C is correct because asset criticality scoring profiles assign criticality values to assets, and this criticality metadata is surfaced in the Incident View to elevate the visibility of incidents involving key or high-value assets. Option A is incorrect because deleting inactive data collectors only removes unused collector entries and does not customize or enhance incident metadata visibility. Option B is incorrect because automatically starring every raw alert would simply flag all alerts indiscriminately and does not add or customize metadata columns in the Incident View. Option E is incorrect because data stitching rules determine how alerts are correlated into incidents, not how the incident grid is sorted or which metadata columns are shown.

Answer

Delete inactive data collectors to clear queue clutter

Answer

Enable automatic alert starring for every raw alert

Answer

Change data stitching rules to alter incident grid sorting

Question 17

An administrator is planning a Cortex XDR deployment and must choose the appropriate agent installation methods for a mix of Windows and macOS endpoints. The administrator wants to minimize manual effort and support remote users who are not on the corporate network. Which TWO installation methods should the administrator select? (Choose two.)

Accepted Answer

Distribute the agent installer via a software deployment tool such as Microsoft Endpoint Configuration Manager. Automated deployment through software deployment tools for Windows and MDM for macOS allows the administrator to install Cortex XDR agents at scale, including for remote users, without manual intervention. These methods ensure consistent configuration and central tracking, while manual or email-based approaches increase effort and risk.

Answer

Require users to download the agent from the Cortex XDR management console and install it themselves

Answer

Deploy the agent only to endpoints that are on the corporate network and postpone remote users

Answer

Send each user an email with the agent installer and installation token, asking them to run it manually

Question 18

Which TWO features in Cortex XDR assist analysts in communicating identity threat findings to stakeholders or compliance auditors?

Accepted Answer

Scheduled and on-demand reporting templates for incident summaries and user risk. Option A is correct because Cortex XDR provides scheduled and on-demand reporting templates that summarize incidents and user risk, giving analysts a repeatable way to present identity threat findings to stakeholders and auditors. Option D is correct because Cortex XDR allows incidents and related data to be exported or shared in formats such as PDF or CSV, which supports evidence handoff and compliance review. Options B, C, and E are incorrect because BIOS flashing, live packet generation, and hard drive partitioning are not Cortex XDR features for communicating identity threat findings; they are unrelated to reporting or audit workflows.

Answer

Automated BIOS flashing utility

Answer

Live packet generator

Answer

Hard drive partition editor

Question 19

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Accepted Answer

Windows Scheduled Tasks. Option C is correct because Windows Scheduled Tasks are a common APT persistence mechanism, allowing malware to execute on a schedule or at logon/boot, and Cortex XDR telemetry captures task creation and modification events (e.g., schtasks.exe, Task Scheduler operational logs). Option D is correct because creating or modifying Windows Services (e.g., via sc.exe, New-Service, or service DLL hijacking) enables persistence by launching malicious code at system startup, and Cortex XDR records service installation and configuration changes. Option E is correct because Registry Run and RunOnce keys (HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce) are classic autostart locations that Cortex XDR monitors for registry modifications tied to persistence. Options A and B are incorrect because office desk relocation requests and breakroom coffee machine maintenance schedules are physical facilities matters with no relation to host-based persistence or endpoint telemetry.

Answer

Office desk relocation requests

Answer

Breakroom coffee machine maintenance schedules

Question 20

An administrator is setting up a new Cortex XDR tenant and preparing for initial onboarding. Which TWO administrative tasks must be completed during the initial planning and setup phase?

Accepted Answer

Configure administrator user accounts and assign appropriate Role-Based Access Control (RBAC) roles. Option D is correct because during initial Cortex XDR tenant onboarding, the administrator must create administrator user accounts and assign the appropriate RBAC roles so that different teams (e.g., SOC analysts, responders, admins) get only the permissions they need. Option E is correct because onboarding requires generating Agent Installation Packages (with the tenant/registration token) and defining Settings profiles so endpoints can be enrolled and managed consistently. Option A is incorrect because Cortex XDR agents are prebuilt binaries; no custom assembly code per CPU architecture is written by the administrator. Option B is incorrect because Cortex XDR is an endpoint detection and response platform and does not require physically replacing core switches with Palo Alto Networks firewalls. Option C is incorrect because disabling cloud logging would defeat Cortex XDR's telemetry ingestion and analytics rather than being a required setup task.

Answer

Manually write custom assembly code for every endpoint CPU architecture

Answer

Physically replace all enterprise core switches with Palo Alto Networks firewalls

Answer

Disable all cloud logging features to prevent data ingestion