XDR-Engineer Detection And Reporting — All Questions With Answers

Question 1easymultiple choice

Read the full Detection And Reporting explanation →

An analyst notices that a custom BIOC rule is generating too many false positives during normal software deployments. What is the most appropriate next step in detection engineering for this rule?

Question 2mediummultiple choice

Read the full Detection And Reporting explanation →

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

Question 3easymultiple choice

Read the full Detection And Reporting explanation →

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

Question 4hardmultiple choice

Read the full Detection And Reporting explanation →

A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?

Question 5hardmultiple choice

Read the full Detection And Reporting explanation →

An analyst writes an XQL query to aggregate alert counts by severity and action, but the query returns a parsing syntax error.

dataset = xdr_data | filter causality_actor_process_image_name != null | comp count() by causality_actor_process_image_name

What is the correct XQL syntax correction needed to successfully execute this aggregation?

Question 6mediummultiple choice

Read the full Detection And Reporting explanation →

A security engineer is investigating a potential lateral movement technique using WMI. The engineer wants to query the XDR backend using XQL (XDR Query Language) to search for process executions spawned by wmic.exe across all endpoints. Which XQL dataset should the query target?

Question 7mediummultiple choice

Read the full Detection And Reporting explanation →

An enterprise has deployed Cortex XDR agents across Windows and Linux hosts. A security engineer notices that a specific custom BIOC rule is triggering successfully on Windows endpoints but fails to fire on Linux endpoints despite identical malicious commands being executed. What is the most likely cause?

Question 8easymultiple choice

Read the full Detection And Reporting explanation →

An administrator wants to create a custom BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR to detect unexpected execution of PowerShell scripts downloading files from the internet. Which tool within the Cortex XDR management console should the administrator use to write and test this logic?

Question 9easymultiple choice

Read the full Detection And Reporting explanation →

An analyst wants to view the complete Attack Story (causality chain) of an incident to understand how an initial phishing email led to credential dumping. Where in the Cortex XDR console should the analyst navigate?

Question 10easymultiple choice

Read the full network assurance explanation →

An administrator wants to verify whether Cortex XDR successfully collected telemetry from a newly installed agent. Which reporting or query tool can be used to quickly list all active agents and their last seen timestamp?

Question 11hardmultiple choice

Read the full Detection And Reporting explanation →

An engineer is writing an XQL query to investigate rare process executions. The query needs to calculate the distinct count of endpoints where each process image name was executed, filtering out processes that appeared on more than 50 hosts. Which XQL snippet correctly implements this filter after aggregation?

Question 12mediummultiple choice

Read the full Detection And Reporting explanation →

An organization requires all custom BIOC alerts to be automatically tagged with the label 'Tier-3-Investigation' and assigned directly to a specific escalation group. Where can an administrator configure this automatic handling?

Question 13mediummultiple choice

Read the full Detection And Reporting explanation →

An organization utilizes custom correlation rules in Cortex XDR. An engineer needs to export these custom BIOC rules to backup configurations or migrate them to another Cortex XDR tenant. Which administrative feature supports this?

Question 14mediummultiple choice

Read the full Detection And Reporting explanation →

An analyst is investigating an alert generated by Analytics where a user account executed an unusual command. The analyst wants to view all other actions performed by that same user across any endpoint during a 24-hour window. Which query technique in XQL best fulfills this requirement?

Question 15hardmultiple choice

Read the full network assurance explanation →

An administrator wants to configure local log retention settings and verify the ingestion rate of raw endpoint telemetry within Cortex XDR. Where can the administrator monitor platform license consumption and data ingestion metrics?

Question 16easymultiple choice

Read the full Detection And Reporting explanation →

An organization needs to forward all Cortex XDR incidents and alerts to an external SIEM platform in real time. Which Cortex XDR feature should the administrator configure?

Question 17mediummultiple choice

Read the full Detection And Reporting explanation →

An administrator created a new BIOC detection rule, but test alerts are not appearing in the Incident triage view. Upon checking the rule status, it is active and enabled. What is a common reason why a valid BIOC rule might fail to generate alerts?

Question 18hardmultiple choice

Read the full Detection And Reporting explanation →

An analyst wants to write an advanced XQL query that correlates network connection events with process execution events using a common join key (`causality_id`). Which XQL command operator is used to combine two datasets based on a matching field?

Question 19mediummultiple choice

Read the full Detection And Reporting explanation →

An analyst is reviewing an incident where a suspicious process spawned a child process. The analyst wants to check if any other endpoint in the enterprise has ever executed this exact child process image file name combined with a specific command-line argument. Which search method is most efficient?

Question 20hardmultiple choice

Read the full Detection And Reporting explanation →

An organization experiences repeated false positive alerts from a specific legitimate administrative script that matches a built-in Cortex XDR behavioral Analytics detection. How should the administrator handle this built-in detection alert to prevent future false positives without disabling protection entirely?

Question 21easymultiple choice

Read the full Detection And Reporting explanation →

An analyst is reviewing an incident and wants to quickly export the raw artifact details and event logs associated with the specific alert for offline sharing. Which feature in the Incident View should the analyst use?

Question 22mediummultiple choice

Read the full Detection And Reporting explanation →

An administrator wants to ensure that all critical severity alerts generated in Cortex XDR are immediately brought to the attention of the SOC by triggering an audible notification and high-priority banner in the console. Where are console notification preferences managed?

Question 23mediummultiple choice

Read the full Detection And Reporting explanation →

An analyst notices that an endpoint has been isolated due to a severe security incident, but investigation reveals the alert was a false positive. What is the correct procedure to restore network connectivity to the endpoint?

Question 24hardmultiple choice

Read the full Detection And Reporting explanation →

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

Question 25hardmultiple choice

Read the full network assurance explanation →

An organization uses Cortex XDR to ingest cloud audit logs (such as AWS CloudTrail) alongside endpoint telemetry. An analyst wants to write an XQL query to search for AWS console login failures across the `aws_cloudtrail_raw` dataset. Which XQL structure properly targets cloud logs and filters for failed logins?

Question 26easymultiple choice

Read the full Detection And Reporting explanation →

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

Question 27mediummultiple choice

Read the full Detection And Reporting explanation →

An administrator wants to configure role-based access control (RBAC) so that a newly formed tier-1 SOC team can view incidents and run XQL queries, but cannot modify firewall rules, agent settings, or create custom BIOC rules. Where should the administrator configure this role?

Question 28mediummulti select

Read the full Detection And Reporting explanation →

An administrator is configuring custom BIOC rules in Cortex XDR. Which TWO elements are mandatory when defining a new BIOC rule? (Choose two)

Question 29mediummulti select

Read the full Detection And Reporting explanation →

An analyst is investigating an incident in Cortex XDR and wants to gather more forensic data from an endpoint. Which TWO live response actions can the analyst execute directly from the Cortex XDR console? (Choose two)

Question 30mediummulti select

Read the full Detection And Reporting explanation →

An engineer is writing an XQL query to investigate endpoint activity. Which TWO commands are valid XQL query operators used for data manipulation and shaping? (Choose two)

Question 31hardmulti select

Read the full network assurance explanation →

An administrator is configuring log forwarding to an external SIEM using Syslog. Which THREE configuration parameters must typically be defined to establish the Syslog destination successfully? (Choose three)

Question 32hardmulti select

Read the full Detection And Reporting explanation →

An organization wants to configure granular reporting and alerting based on MITRE ATT&CK techniques. Within Cortex XDR, which THREE methods or views allow security teams to analyze detections mapped against the MITRE ATT&CK framework? (Choose three)

Question 33hardmulti select

Read the full Detection And Reporting explanation →

An administrator is managing custom IOC (Indicator of Compromise) feeds in Cortex XDR. Which THREE file formats or ingestion methods are supported when importing custom IOC indicators? (Choose three)

Question 34mediummulti select

Read the full Detection And Reporting explanation →

An administrator is designing a scheduled report distribution list in Cortex XDR. Which TWO formats can be selected when generating and exporting scheduled reports? (Choose two)

Question 35hardmulti select

Read the full Detection And Reporting explanation →

An analyst is troubleshooting a complex multi-stage attack in Cortex XDR. Which THREE analytical tools or views in the console help reconstruct the sequence of events across endpoints? (Choose three)

Question 36mediummulti select

Read the full Detection And Reporting explanation →

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

Question 37mediummulti select

Read the full Detection And Reporting explanation →

An administrator is setting up alert notification rules in Cortex XDR. Which TWO delivery channels can be configured to notify security personnel when high-severity incidents occur? (Choose two)

Question 38hardmulti select

Read the full Detection And Reporting explanation →

An engineer is configuring Data Export Service (DES) to stream Cortex XDR logs to a cloud storage bucket. Which THREE cloud storage providers are natively supported destinations for DES? (Choose three)

Question 39mediummultiple choice

Read the full Detection And Reporting explanation →

An engineer needs to write an XQL query to search for all events where a process named "cmd.exe" spawned a process named "powershell.exe". Which XQL dataset and query structure should be used?

Question 40easymultiple choice

Read the full Detection And Reporting explanation →

An administrator wants to create a new BIOC rule to detect suspicious process execution in Cortex XDR. Which menu path should the administrator navigate to in the Cortex XDR console?

Question 41hardmulti select

Read the full Detection And Reporting explanation →

An administrator wants to ensure high availability and proper auditing of user activities within the Cortex XDR management console. Which THREE administrative auditing features are available? (Choose three)

Question 42hardmultiple choice

Read the full Detection And Reporting explanation →

An administrator is designing a custom Alert-based BIOC rule in Cortex XDR. The requirement is to trigger an alert only when three distinct failed login events occur within a 5-minute window from the same source IP address. How should the aggregation and time window be configured?

Question 43easymultiple choice

Read the full Detection And Reporting explanation →

Where within the Cortex XDR console should an administrator configure scheduled reporting to automatically email executive summaries to stakeholders on a weekly basis?

Question 44hardmultiple choice

Read the full network assurance explanation →

An organization wants to ingest custom syslog data from a third-party firewall into Cortex XDR and build detection rules around it. Which feature enables parsing and structuring this unformatted log data so it can be queried effectively using XQL?

Question 45mediummultiple choice

Read the full Detection And Reporting explanation →

An analyst is investigating an incident and notices that a custom Analytics BIOC rule generated too many false positives due to a legitimate administrative tool. What is the recommended method to tune this rule without completely disabling it?

Question 46mediummulti select

Read the full Detection And Reporting explanation →

Which TWO of the following capabilities are provided by Cortex XDR Behavioral Threat Analytics (Analytics BIOCs)? (Choose two)

Question 47hardmulti select

Read the full Detection And Reporting explanation →

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

Question 48mediummultiple choice

Read the full Detection And Reporting explanation →

When creating a widget for a custom dashboard in Cortex XDR, an analyst wants to display a visual trend of total alert counts categorized by severity over the last 30 days. Which data source and visualization type are most appropriate?

Question 49hardmulti select

Read the full Detection And Reporting explanation →

An investigator is analyzing an advanced threat campaign using the Cortex XDR Incident View and reporting tools. Which THREE elements are typically included in an exported Incident Report PDF generated from Cortex XDR? (Choose three)

Question 1easymultiple choice

Read the full Detection And Reporting explanation →

An analyst notices that a custom BIOC rule is generating too many false positives during normal software deployments. What is the most appropriate next step in detection engineering for this rule?

Question 2mediummultiple choice

Read the full Detection And Reporting explanation →

An analyst wants to create a customized dashboard widget in Cortex XDR that displays the top 10 endpoints generating the highest volume of alerts over the last 7 days. Where should the analyst configure this widget?

Question 3easymultiple choice

Read the full Detection And Reporting explanation →

An administrator needs to schedule a weekly PDF report of all critical endpoint incidents to email to the security operations team. Which Cortex XDR feature should be used to accomplish this?

Question 4hardmultiple choice

Read the full Detection And Reporting explanation →

A security engineer is building a Port Scanning BIOC detection rule. The rule needs to evaluate multiple sequential network connection failures from the same source IP within a rolling 60-second window. Which rule configuration type must the engineer select?

Question 5hardmultiple choice

Read the full Detection And Reporting explanation →

An analyst writes an XQL query to aggregate alert counts by severity and action, but the query returns a parsing syntax error.

dataset = xdr_data | filter causality_actor_process_image_name != null | comp count() by causality_actor_process_image_name

What is the correct XQL syntax correction needed to successfully execute this aggregation?

Question 6mediummultiple choice

Read the full Detection And Reporting explanation →

A security engineer is investigating a potential lateral movement technique using WMI. The engineer wants to query the XDR backend using XQL (XDR Query Language) to search for process executions spawned by wmic.exe across all endpoints. Which XQL dataset should the query target?

Question 7mediummultiple choice

Read the full Detection And Reporting explanation →

An enterprise has deployed Cortex XDR agents across Windows and Linux hosts. A security engineer notices that a specific custom BIOC rule is triggering successfully on Windows endpoints but fails to fire on Linux endpoints despite identical malicious commands being executed. What is the most likely cause?

Question 8easymultiple choice

Read the full Detection And Reporting explanation →

An administrator wants to create a custom BIOC (Behavioral Indicator of Compromise) rule in Cortex XDR to detect unexpected execution of PowerShell scripts downloading files from the internet. Which tool within the Cortex XDR management console should the administrator use to write and test this logic?

Question 9easymultiple choice

Read the full Detection And Reporting explanation →

An analyst wants to view the complete Attack Story (causality chain) of an incident to understand how an initial phishing email led to credential dumping. Where in the Cortex XDR console should the analyst navigate?

Question 10easymultiple choice

Read the full network assurance explanation →

An administrator wants to verify whether Cortex XDR successfully collected telemetry from a newly installed agent. Which reporting or query tool can be used to quickly list all active agents and their last seen timestamp?

Question 11hardmultiple choice

Read the full Detection And Reporting explanation →

An engineer is writing an XQL query to investigate rare process executions. The query needs to calculate the distinct count of endpoints where each process image name was executed, filtering out processes that appeared on more than 50 hosts. Which XQL snippet correctly implements this filter after aggregation?

Question 12mediummultiple choice

Read the full Detection And Reporting explanation →

An organization requires all custom BIOC alerts to be automatically tagged with the label 'Tier-3-Investigation' and assigned directly to a specific escalation group. Where can an administrator configure this automatic handling?

Question 13mediummultiple choice

Read the full Detection And Reporting explanation →

An organization utilizes custom correlation rules in Cortex XDR. An engineer needs to export these custom BIOC rules to backup configurations or migrate them to another Cortex XDR tenant. Which administrative feature supports this?

Question 14mediummultiple choice

Read the full Detection And Reporting explanation →

An analyst is investigating an alert generated by Analytics where a user account executed an unusual command. The analyst wants to view all other actions performed by that same user across any endpoint during a 24-hour window. Which query technique in XQL best fulfills this requirement?

Question 15hardmultiple choice

Read the full network assurance explanation →

An administrator wants to configure local log retention settings and verify the ingestion rate of raw endpoint telemetry within Cortex XDR. Where can the administrator monitor platform license consumption and data ingestion metrics?

Question 16easymultiple choice

Read the full Detection And Reporting explanation →

An organization needs to forward all Cortex XDR incidents and alerts to an external SIEM platform in real time. Which Cortex XDR feature should the administrator configure?

Question 17mediummultiple choice

Read the full Detection And Reporting explanation →

An administrator created a new BIOC detection rule, but test alerts are not appearing in the Incident triage view. Upon checking the rule status, it is active and enabled. What is a common reason why a valid BIOC rule might fail to generate alerts?

Question 18hardmultiple choice

Read the full Detection And Reporting explanation →

An analyst wants to write an advanced XQL query that correlates network connection events with process execution events using a common join key (`causality_id`). Which XQL command operator is used to combine two datasets based on a matching field?

Question 19mediummultiple choice

Read the full Detection And Reporting explanation →

An analyst is reviewing an incident where a suspicious process spawned a child process. The analyst wants to check if any other endpoint in the enterprise has ever executed this exact child process image file name combined with a specific command-line argument. Which search method is most efficient?

Question 20hardmultiple choice

Read the full Detection And Reporting explanation →

An organization experiences repeated false positive alerts from a specific legitimate administrative script that matches a built-in Cortex XDR behavioral Analytics detection. How should the administrator handle this built-in detection alert to prevent future false positives without disabling protection entirely?

Question 21easymultiple choice

Read the full Detection And Reporting explanation →

An analyst is reviewing an incident and wants to quickly export the raw artifact details and event logs associated with the specific alert for offline sharing. Which feature in the Incident View should the analyst use?

Question 22mediummultiple choice

Read the full Detection And Reporting explanation →

An administrator wants to ensure that all critical severity alerts generated in Cortex XDR are immediately brought to the attention of the SOC by triggering an audible notification and high-priority banner in the console. Where are console notification preferences managed?

Question 23mediummultiple choice

Read the full Detection And Reporting explanation →

An analyst notices that an endpoint has been isolated due to a severe security incident, but investigation reveals the alert was a false positive. What is the correct procedure to restore network connectivity to the endpoint?

Question 24hardmultiple choice

Read the full Detection And Reporting explanation →

An advanced threat actor executes a living-off-the-land technique using certutil.exe to decode a malicious payload. The built-in Analytics engine generates an alert. The security team wants to understand how the Analytics engine derived this finding by reviewing the underlying behavioral logic or heuristics associated with the alert ID. Where can an engineer review the definition and rule logic of built-in Analytics detectors?

Question 25hardmultiple choice

Read the full network assurance explanation →

An organization uses Cortex XDR to ingest cloud audit logs (such as AWS CloudTrail) alongside endpoint telemetry. An analyst wants to write an XQL query to search for AWS console login failures across the `aws_cloudtrail_raw` dataset. Which XQL structure properly targets cloud logs and filters for failed logins?

Question 26easymultiple choice

Read the full Detection And Reporting explanation →

An analyst is investigating an open incident in Cortex XDR and determines that the activity is benign and authorized. What is the appropriate action to close the incident and document the resolution?

Question 27mediummultiple choice

Read the full Detection And Reporting explanation →

An administrator wants to configure role-based access control (RBAC) so that a newly formed tier-1 SOC team can view incidents and run XQL queries, but cannot modify firewall rules, agent settings, or create custom BIOC rules. Where should the administrator configure this role?

Question 28mediummulti select

Read the full Detection And Reporting explanation →

An administrator is configuring custom BIOC rules in Cortex XDR. Which TWO elements are mandatory when defining a new BIOC rule? (Choose two)

Question 29mediummulti select

Read the full Detection And Reporting explanation →

An analyst is investigating an incident in Cortex XDR and wants to gather more forensic data from an endpoint. Which TWO live response actions can the analyst execute directly from the Cortex XDR console? (Choose two)

Question 30mediummulti select

Read the full Detection And Reporting explanation →

An engineer is writing an XQL query to investigate endpoint activity. Which TWO commands are valid XQL query operators used for data manipulation and shaping? (Choose two)

Question 31hardmulti select

Read the full network assurance explanation →

An administrator is configuring log forwarding to an external SIEM using Syslog. Which THREE configuration parameters must typically be defined to establish the Syslog destination successfully? (Choose three)

Question 32hardmulti select

Read the full Detection And Reporting explanation →

An organization wants to configure granular reporting and alerting based on MITRE ATT&CK techniques. Within Cortex XDR, which THREE methods or views allow security teams to analyze detections mapped against the MITRE ATT&CK framework? (Choose three)

Question 33hardmulti select

Read the full Detection And Reporting explanation →

An administrator is managing custom IOC (Indicator of Compromise) feeds in Cortex XDR. Which THREE file formats or ingestion methods are supported when importing custom IOC indicators? (Choose three)

Question 34mediummulti select

Read the full Detection And Reporting explanation →

An administrator is designing a scheduled report distribution list in Cortex XDR. Which TWO formats can be selected when generating and exporting scheduled reports? (Choose two)

Question 35hardmulti select

Read the full Detection And Reporting explanation →

An analyst is troubleshooting a complex multi-stage attack in Cortex XDR. Which THREE analytical tools or views in the console help reconstruct the sequence of events across endpoints? (Choose three)

Question 36mediummulti select

Read the full Detection And Reporting explanation →

An analyst is reviewing the Endpoint Management module in Cortex XDR. Which TWO pieces of status information are visible for each enrolled agent? (Choose two)

Question 37mediummulti select

Read the full Detection And Reporting explanation →

An administrator is setting up alert notification rules in Cortex XDR. Which TWO delivery channels can be configured to notify security personnel when high-severity incidents occur? (Choose two)

Question 38hardmulti select

Read the full Detection And Reporting explanation →

An engineer is configuring Data Export Service (DES) to stream Cortex XDR logs to a cloud storage bucket. Which THREE cloud storage providers are natively supported destinations for DES? (Choose three)

Question 39mediummultiple choice

Read the full Detection And Reporting explanation →

An engineer needs to write an XQL query to search for all events where a process named "cmd.exe" spawned a process named "powershell.exe". Which XQL dataset and query structure should be used?

Question 40easymultiple choice

Read the full Detection And Reporting explanation →

An administrator wants to create a new BIOC rule to detect suspicious process execution in Cortex XDR. Which menu path should the administrator navigate to in the Cortex XDR console?

Question 41hardmulti select

Read the full Detection And Reporting explanation →

An administrator wants to ensure high availability and proper auditing of user activities within the Cortex XDR management console. Which THREE administrative auditing features are available? (Choose three)

Question 42hardmultiple choice

Read the full Detection And Reporting explanation →

An administrator is designing a custom Alert-based BIOC rule in Cortex XDR. The requirement is to trigger an alert only when three distinct failed login events occur within a 5-minute window from the same source IP address. How should the aggregation and time window be configured?

Question 43easymultiple choice

Read the full Detection And Reporting explanation →

Where within the Cortex XDR console should an administrator configure scheduled reporting to automatically email executive summaries to stakeholders on a weekly basis?

Question 44hardmultiple choice

Read the full network assurance explanation →

An organization wants to ingest custom syslog data from a third-party firewall into Cortex XDR and build detection rules around it. Which feature enables parsing and structuring this unformatted log data so it can be queried effectively using XQL?

Question 45mediummultiple choice

Read the full Detection And Reporting explanation →

An analyst is investigating an incident and notices that a custom Analytics BIOC rule generated too many false positives due to a legitimate administrative tool. What is the recommended method to tune this rule without completely disabling it?

Question 46mediummulti select

Read the full Detection And Reporting explanation →

Which TWO of the following capabilities are provided by Cortex XDR Behavioral Threat Analytics (Analytics BIOCs)? (Choose two)

Question 47hardmulti select

Read the full Detection And Reporting explanation →

An administrator is configuring XQL scheduled alerts in Cortex XDR. Which THREE parameters must be defined when setting up a scheduled XQL rule to generate alerts? (Choose three)

Question 48mediummultiple choice

Read the full Detection And Reporting explanation →

When creating a widget for a custom dashboard in Cortex XDR, an analyst wants to display a visual trend of total alert counts categorized by severity over the last 30 days. Which data source and visualization type are most appropriate?

Question 49hardmulti select

Read the full Detection And Reporting explanation →

An investigator is analyzing an advanced threat campaign using the Cortex XDR Incident View and reporting tools. Which THREE elements are typically included in an exported Incident Report PDF generated from Cortex XDR? (Choose three)