XDR-Analyst Timed Practice Test 3 — 10 Questions

Question 1

During incident triage, an analyst notices that two completely separate attacks on different endpoints were merged into a single incident by Cortex XDR. What is the underlying reason for this over-correlation?

10 minute time limit — choose an answer to begin.

Accepted Answer

Shared common identifiers such as a NAT gateway IP address within the correlation window. Over-correlation typically occurs when disparate alerts share a common indicator (such as a shared NAT gateway IP address or a generic proxy server) within the same time window, tricking the stitching engine.

Answer

All alerts were manually starred by an analyst

Answer

The incident scoring threshold was set too low

Answer

Featured fields were configured to group by IP subnet

Question 2

An analyst is investigating an incident and needs to quickly view customized columns containing threat actor attribution tags in the incident grid. Which feature must be configured to show these columns?

Accepted Answer

Featured fields configuration. Featured fields allow security teams to customize grid views with specific metadata fields relevant to their operational needs.

Answer

Data stitching parameters

Answer

Raw alert priority rules

Answer

Incident scoring weights

Question 3

An analyst wants to flag a particular high-priority incident so that other shift analysts immediately notice it when they log in. What is the most direct feature to use?

Accepted Answer

Incident starring. Starring an incident marks it for visibility and easy filtering across the SOC team.

Answer

Alert exclusion rule

Answer

Syslog forwarding profile

Answer

Data stitching configuration

Question 4

An analyst wants to filter the Incident View to show only incidents that have been bookmarked by members of the SOC team. Which filter criterion should be applied?

Accepted Answer

Starred incidents filter. Cortex XDR supports filtering incidents by starred status to isolate bookmarked items.

Answer

Incident score range filter

Answer

Featured fields filter

Answer

Data stitching status filter

Question 5

When sorting incidents in the Cortex XDR console to find the most severe threats first, which attribute is most commonly used?

Accepted Answer

Incident Score / Severity. The Incident Score (or severity) is the primary metric used to sort and prioritize incidents in the incident queue.

Answer

Data stitching identifier

Answer

Featured field display order

Answer

Agent version number

Question 6

An organization notices that Cortex XDR incidents are being assigned high severity scores primarily due to a noisy network alert rule that triggers frequently on internal port scans. What is the correct administrative workflow to resolve this scoring inflation?

Accepted Answer

Tune or disable the noisy detector rule, or adjust scoring weight profiles. To fix scoring inflation caused by noisy rules, administrators should tune or disable the specific detector rule or adjust scoring weights rather than ignoring incidents.

Answer

Star all alerts generated by the port scan rule

Answer

Hide the port scan column using featured fields

Answer

Enable data stitching overrides for internal ports

Question 7

A security engineer notices that raw alerts from a third-party firewall are successfully ingested into Cortex XDR but fail to correlate into existing endpoint incidents. Upon inspection, it is discovered that the firewall logs lack internal NAT translation details. How does this impact the raw-alert-to-incident lifecycle?

Accepted Answer

It breaks data stitching because internal and external IP mappings cannot be reconciled. Data stitching relies heavily on accurate IP addresses, ports, and timestamps. Missing NAT information breaks the link between internal endpoints and external network traffic, preventing correlation.

Answer

It forces the incident score to default to maximum

Answer

It causes all firewall alerts to be automatically starred

Answer

It triggers featured fields to hide the firewall data source

Question 8

An administrator configures a custom data stitching rule to correlate custom application logs with endpoint events. After deployment, no new incidents are formed from these logs. What is the most critical factor to verify when troubleshooting custom stitching rules?

Accepted Answer

That the custom log fields correctly map to shared schema identifiers like user or IP. Custom data stitching rules require exact field matching (such as matching keys, timestamps, and identifiers) between the custom log schema and the XDR schema.

Answer

That featured fields are enabled for the custom schema

Answer

That the incident score is locked at maximum

Answer

That all incoming custom logs are starred by default

Question 9

An analyst observes that an incident's score dynamically increases over time as new related alerts are added. Which component of Cortex XDR drives this behavior?

Accepted Answer

The dynamic incident scoring engine. The Cortex XDR incident scoring engine recalculates the overall incident score dynamically as new telemetry and raw alerts are stitched and added to the incident context.

Answer

The manual analyst assignment workflow

Answer

The log collector retention policy

Answer

The featured fields rendering engine

Question 10

An administrator wants to ensure that incidents generated by alerts involving domain controllers are always assigned a 'Critical' score. Which setting should be modified?

Accepted Answer

Asset criticality groups and incident scoring rules. Scoring profiles or asset criticality rules allow administrators to assign specific score modifiers based on asset groups like domain controllers.

Answer

Alert starring default policy

Answer

Data stitching time window

Answer

Featured fields display mapper