XDR-Analyst Timed Practice Test 1 — 10 Questions

Question 1

An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?

10 minute time limit — choose an answer to begin.

Accepted Answer

TCP port 443 for HTTPS API and tenant communication. Broker VM requires outbound HTTPS access on port 443 to communicate with the Cortex XDR tenant cloud backend.

Answer

TCP port 22 for SSH tunnel maintenance

Answer

TCP port 389 and 636 for directory synchronization

Answer

TCP port 6514 for secure syslog ingestion

Question 2

An XDR analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst notices that the network alerts lack associated endpoint process information, even though the same host is involved. What is the most likely cause for this missing correlation?

Accepted Answer

The endpoint telemetry for that host was not ingested or was delayed beyond the stitching window.. Cortex XDR correlates network and endpoint alerts by matching host identifiers and timestamps. If endpoint telemetry is not available or arrives after the stitching window, the network alerts cannot be enriched with process information. This often occurs when endpoints are offline, the agent is not installed, or log forwarding is delayed. Ensuring timely telemetry ingestion is key to maintaining correlation.

Answer

The incident was manually created and does not include automatic stitching.

Answer

The network alerts were generated from a different sensor that does not share endpoint telemetry.

Answer

The network alerts were triggered by a different IP address than the endpoint's IP due to NAT.

Question 3

An analyst needs to change the status of an incident from 'Under Investigation' to 'Resolved' after completing remediation. Which section of the Incident View allows updating the incident status?

Accepted Answer

Incident Header / Status field. Incident metadata such as status, assignment, and severity can be updated directly from the Incident header or details pane.

Answer

BIOC rule creation dialog

Answer

WildFire file submission form

Answer

Agent upgrade wizard

Question 4

A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three regional offices. The company wants to minimize the number of open inbound firewall ports on their network while still allowing agents to receive policy updates and send telemetry. Which deployment consideration should the architect prioritize?

Accepted Answer

Configure the Cortex XDR agents to initiate outbound connections over TCP 443 to the Cortex XDR cloud tenant.. Cortex XDR agents communicate with the cloud tenant by initiating outbound TCP 443 sessions, so no inbound firewall rules are required on the endpoint network. This outbound-only model is the standard deployment pattern and directly fulfills the architect's goal of reducing inbound port exposure while maintaining telemetry and policy delivery.

Answer

Configure agents to communicate with the Cortex XDR server component hosted on-premises over inbound TCP 443.

Answer

Enable inbound TCP 4443 on the perimeter firewall so agents can receive push notifications from the cloud.

Answer

Deploy a Broker VM in each regional office and open inbound TCP 443 from agents to the Broker VM.

Question 5

An analyst is investigating a Cortex XDR incident that contains an alert for a suspicious PowerShell script execution on a Windows endpoint. The analyst wants to see the exact command line and parent process that triggered the alert without leaving the incident view. Which action should the analyst take?

Accepted Answer

Open the alert details pane and review the 'Causality' chain.. The alert details pane in Cortex XDR provides a causality chain that displays the process tree, including command lines and parent-child relationships, for the specific alert. This allows analysts to quickly understand the exact sequence of events that triggered the alert without leaving the incident view. Other methods either require additional steps or do not provide the same level of integrated context.

Answer

Run a query in the Query Builder using the 'process' dataset and filter by the endpoint name.

Answer

Export the incident to a CSV file and search for the PowerShell command line.

Answer

Navigate to the Endpoint Security console and look up the endpoint's recent process history.

Question 6

An XDR Analyst is investigating a newly generated incident in Palo Alto Networks Cortex XDR and notices that multiple disparate alerts from different endpoints and network sensors have been automatically grouped together. Which core mechanism of Cortex XDR is primarily responsible for intelligently grouping these related alerts into a single incident?

Accepted Answer

Incident scoring and analytics correlation engine. Cortex XDR uses a specialized analytics engine and data stitching algorithms to correlate and group related alerts across endpoints, network, and cloud sources into a single incident based on shared indicators of compromise or causality chains.

Answer

Alert starring

Answer

Local Analysis agent configuration

Answer

BIOC rule generation wizard

Question 7

A security team is deploying Cortex XDR agents to 8,000 endpoints across three geographic regions. The network team requires that all agent-to-cloud communication be routed through a controlled, on-premises egress point rather than allowing direct internet access from each endpoint. Which Cortex XDR component should the administrator deploy to satisfy this requirement?

Accepted Answer

Broker VM. The Broker VM is the Cortex XDR component designed to sit inside the customer network and mediate communication between agents and the cloud. When network policy forbids direct internet access from endpoints, routing agent traffic through a Broker VM provides the controlled egress the team requires while preserving telemetry, policy enforcement, and management connectivity.

Answer

Cortex XDR agent installation token

Answer

Cortex XDR Content Update package

Answer

Cortex XDR management console

Question 8

An analyst is investigating a Cortex XDR incident where the alert source is listed as 'XDR Analytics' and the alert contains a MITRE ATT&CK technique mapping. The analyst wants to understand how the alert was generated and what data contributed to it. Which two actions should the analyst take to gain this understanding? (Choose two.)

Accepted Answer

Review the alert's 'Alert Details' pane for the analytics description and contributing events. To understand an XDR Analytics alert, the analyst should review the Alert Details pane for the analytics description and contributing events, and examine the Causality Chain to see the event sequence. These provide the 'why' and 'how' of the alert. Other actions like exporting raw logs, modifying BIOC rules, or counting similar alerts do not directly explain the alert's generation.

Answer

Run a query in the Query Builder to count similar alerts

Answer

Modify the BIOC rule that triggered the alert

Answer

Export the raw endpoint logs from the Cortex XDR agent

Question 9

An analyst is reviewing a Cortex XDR incident that includes alerts from multiple sources. The analyst wants to correlate related alerts to identify a coordinated attack. Which two actions can the analyst take to manually correlate alerts into the incident? (Choose two.)

Accepted Answer

Create a new incident from the alert and then merge it with the existing incident.. Manual correlation in Cortex XDR can be achieved by either adding an alert directly to an incident or by creating a new incident from the alert and merging it. Both methods result in the alert being included in the incident's context, enabling unified analysis. Other actions like changing severity or editing descriptions do not establish the necessary link.

Answer

Modify the alert's severity to match the incident's severity.

Answer

Edit the alert's description to include the incident ID.

Answer

Assign the alert to the same analyst who owns the incident.

Question 10

Which THREE actions can be taken directly or via orchestration within Cortex XDR when responding to an active identity-based attack?

Accepted Answer

Isolating the compromised endpoint from the network. Option B is correct because Cortex XDR can isolate a compromised endpoint from the network, cutting off the attacker's command-and-control and lateral-movement paths while preserving the agent for investigation. Option C is correct because Cortex XDR response actions integrate with identity providers (e.g., Active Directory) to disable the compromised account or force a password reset, terminating the attacker's valid-credential access. Option D is correct because Cortex XDR can quarantine malicious credential-dumping tools (e.g., Mimikatz) found on endpoints, removing the attacker's ability to harvest further credentials. Option A is not a Cortex XDR action since rebuilding a data center's electrical grid is a physical facilities task outside the product's scope. Option E is not a Cortex XDR action because upgrading BIOS firmware on enterprise routers is a hardware/firmware maintenance task unrelated to identity-attack response.

Answer

Rebuilding the physical data center facility electrical grid

Answer

Upgrading the BIOS firmware on enterprise routers