XDR-Analyst Quick Quiz — 10 Questions

Question 1

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The time delta between the endpoint and network events exceeds the stitching correlation window. Data stitching relies on consistent identity and endpoint mapping. If the time window between events exceeds the stitching threshold or identifiers like MAC/hostname do not match correctly, stitching may fail.

Answer

The incident score was manually overridden to low

Answer

Alert starring was disabled on the network data source

Answer

Featured fields were not configured for the network logs

Question 2

An analyst needs to customize the Incident View columns to display specific custom IOC tags prominently next to the incident name. Which configuration area in Cortex XDR supports this?

Accepted Answer

Featured fields customization. Featured fields allow administrators to customize which fields are prominently displayed within the Incident View and Alert View grids.

Answer

Alert exclusion rules

Answer

Data stitching parameters

Answer

Incident scoring profile

Question 3

An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?

Accepted Answer

Create an alert exclusion or exception rule. Administrators can create alert tuning or exclusion rules to filter out known benign activities so they do not generate unnecessary raw alerts or incidents.

Answer

Manually star all related alerts

Answer

Increase the data stitching window

Answer

Modify featured fields to hide script alerts

Question 4

Which role-based permission is typically required for an analyst to change the status of an incident from 'New' to 'Under Investigation' in Cortex XDR?

Accepted Answer

Cortex XDR Analyst role. Incident management actions such as status changes and assignment require appropriate analyst or administrator roles with incident handling permissions.

Answer

Data stitching configuration role

Answer

Syslog forwarding administrator

Answer

Collector installation role

Question 5

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

Accepted Answer

New. Newly created incidents default to the 'New' status until an analyst takes ownership and updates the status.

Answer

Closed

Answer

Under Investigation

Answer

Resolved

Question 6

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

Accepted Answer

Cross-data-source data stitching. Data stitching correlates logs from endpoints, networks, and cloud sources using common identifiers like IP addresses, usernames, and timestamps into a cohesive incident.

Answer

Automated alert starring

Answer

Incident score weighting tables

Answer

Featured fields column mapping

Question 7

What is the primary benefit of the raw-alert-to-incident lifecycle consolidation in Cortex XDR?

Accepted Answer

It reduces alert fatigue by grouping related alerts into a single cohesive incident. Consolidating numerous raw alerts into structured incidents reduces alert fatigue by presenting correlated threats as single investigative units.

Answer

It automatically patches vulnerable operating systems on endpoints

Answer

It encrypts raw log data before sending it to syslog servers

Answer

It replaces the need for data collectors and endpoint agents

Question 8

Which TWO attributes are typically displayed by default or through featured fields in the Cortex XDR Incident View grid? (Choose two)

Accepted Answer

Incident Severity and Score. The Incident View grid displays essential incident metadata such as Incident Name/ID, Severity, Status, Score, and custom featured fields.

Answer

Syslog server destination IP ports

Answer

Data stitching algorithm version numbers

Answer

Agent collector installation binaries

Question 9

An incident in Cortex XDR contains dozens of low-priority alerts that were grouped together. The analyst determines that one specific alert within the incident is a false positive while the rest are legitimate threats. What is the best practice for handling this specific raw alert?

Accepted Answer

Mark the specific raw alert as a false positive or dismiss it within the incident view. Analysts can manage individual alerts within an incident, suppressing or tuning specific detectors or marking individual alerts as false positives without discarding the entire incident.

Answer

Change the incident score to zero to hide all alerts

Answer

Delete the entire incident and recreate it manually

Answer

Apply an alert starring filter to exclude the false positive

Question 10

An organization requires that specific custom threat intelligence tags appear as primary columns in the Incident View. How can an administrator achieve this?

Accepted Answer

Configure featured fields to include the custom threat intelligence tags. Featured fields allow administrators to select custom fields and tags to be displayed as columns in the Incident View.

Answer

Create a data stitching rule for threat intelligence

Answer

Set up an alert exclusion exception

Answer

Adjust the incident scoring profile weights