20+ practice questions focused on Evidence Review And Response Actions — one of the most tested topics on the Certified XDR Analyst (XDR-Analyst) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Evidence Review And Response Actions PracticeAn analyst is investigating an alert where an attacker attempted credential dumping via LSASS. To understand the exact API calls and techniques used by the process, which evidence source within Cortex XDR provides low-level OS event telemetry?
Explanation: Cortex XDR endpoint telemetry records low-level operating system events, including DLL loads, process creations, and API monitoring events via kernel/user-mode hooks.
Which TWO actions can be performed directly from the Cortex XDR Incident Details page when reviewing evidence? (Choose two)
Explanation: Option B is correct because the Incident Details page in Cortex XDR provides incident management controls that let analysts change the incident's status (for example, New, Under Investigation, or Resolved) and reassign the incident to a different user or owner directly from that view. Option D is correct because the Incident Details page surfaces the alert timeline and the associated artifacts (such as involved endpoints, files, processes, and network indicators) so investigators can review the evidence without leaving the incident context. The remaining options (A, C, and E) are unrelated office-facilities tasks—catering, window washing, and thermostat calibration—and have no function within the Cortex XDR console or its incident workflow.
During an investigation, an analyst needs to isolate a compromised endpoint from the network while still allowing the Cortex XDR agent to communicate with the management console for remediation. Which Cortex XDR response action should the analyst use?
Explanation: Network Quarantine is designed to isolate an endpoint by restricting its network communication to only the Cortex XDR management console and essential services. This allows the analyst to maintain control and perform remediation while preventing lateral movement or data exfiltration, which is exactly what the scenario demands.
During a Cortex XDR investigation, an analyst sees an alert for a suspicious process that spawned from a Microsoft Word document. The analyst needs to determine whether the process made any network connections after execution. Which Cortex XDR capability should the analyst use to correlate the process activity with network events?
Explanation: Causality View is the correct tool because it automatically maps process lineage and associated network connections, allowing an analyst to see if a suspicious process initiated any outbound connections. It provides a graphical timeline and process tree that correlates events, which is essential for understanding the scope of an attack. Other options either do not provide historical network correlation or require manual effort without the visual context.
An analyst is reviewing a Cortex XDR incident that involves a malicious PowerShell script executed on multiple endpoints. To effectively contain and remediate the threat, which TWO response actions can the analyst take directly from the Cortex XDR Incident Response view? (Choose two.)
Explanation: The Incident Response view in Cortex XDR provides immediate response actions such as running remediation scripts and isolating endpoints via Network Quarantine. These actions can be applied to multiple affected endpoints directly, allowing the analyst to contain and remediate the malicious PowerShell script efficiently.
+15 more Evidence Review And Response Actions questions available
Practice all Evidence Review And Response Actions questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Evidence Review And Response Actions. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Evidence Review And Response Actions questions on the XDR-Analyst frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Evidence Review And Response Actions is tested as part of the Certified XDR Analyst (XDR-Analyst) blueprint. Practicing with targeted Evidence Review And Response Actions questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free XDR-Analyst practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Evidence Review And Response Actions is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Evidence Review And Response Actions practice session with instant scoring and detailed explanations.
Start Evidence Review And Response Actions Practice →