XDR-Engineer Detection And Reporting Practice Test 5 — 15 Questions

Question 1

A Cortex XDR administrator wants to create a custom BIOC rule that detects when a process creates a scheduled task using schtasks.exe with a specific suspicious argument pattern. The rule must trigger only when the parent process is NOT explorer.exe. Which BIOC rule configuration achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a BIOC rule with a process execution event, match on schtasks.exe and the argument pattern, and add a condition that parent_process_name != 'explorer.exe'.. BIOC rules in Cortex XDR support conditions on CEF fields within a single event. For a process execution event, parent_process_name is available, so adding a condition that it does not equal explorer.exe ensures the rule triggers only for the desired parent context. This is the simplest and most direct configuration.

Answer

Create a BIOC rule with a process execution event matching schtasks.exe and the argument, then use a suppression rule to exclude events where parent_process_name equals 'explorer.exe'.

Answer

Create a BIOC rule using a registry event to monitor Task Scheduler registry keys, and filter on the user context to exclude explorer.exe.

Answer

Create a BIOC rule with a process execution event matching schtasks.exe and the argument, then use a correlation rule to join with a second event where parent_process_name is not explorer.exe.

Question 2

An XDR engineer is tuning the noise generated by a custom BIOC rule that fires on process executions containing the string 'powershell'. The engineer wants to suppress alerts only when the parent process is a known software deployment agent and the command line also contains 'Invoke-WebRequest'. Which mechanism should be used to implement this narrowly scoped exception without disabling the rule?

Accepted Answer

Modify the BIOC rule condition to add an exclusion clause matching the deployment agent as parent process and 'Invoke-WebRequest' in the command line.. The most precise way to reduce false positives from a custom BIOC rule is to add an exception clause inside the rule itself, targeting the exact parent-process and command-line combination observed in legitimate activity. This preserves detection for all other powershell executions. Broad suppression mechanisms either do not apply to custom BIOCs or reduce visibility for genuine threats, making them inappropriate for this scenario.

Answer

Configure a suppression window on the BIOC rule so that duplicate alerts from the same endpoint are collapsed within a 24-hour period.

Answer

Disable the BIOC rule temporarily and create a separate lower-severity rule that only matches the legitimate deployment agent behavior.

Answer

Create an Alert Exclusion rule in the Cortex XDR Exclusions policy that matches the BIOC rule name and the deployment agent process.

Question 3

A Cortex XDR engineer needs to reduce alert fatigue caused by a noisy built-in Analytics BIOC. Rather than disabling the rule entirely, the security team wants to keep the detection but suppress matching alerts whenever the triggering process is a known signed internal IT automation binary. Which action should the engineer configure in Cortex XDR?

Accepted Answer

Create an exception (allow list) rule scoped to the BIOC that matches the automation binary's hash or signer, applied at the endpoint policy level.. Exceptions (allow list rules) are the mechanism Cortex XDR provides to suppress specific known-good activity from triggering a BIOC while keeping the detection active for everything else. Scoping by hash, signer, or process path to the trusted automation binary silences the recurring false positives without disabling the rule or blocking legitimate tooling.

Answer

Increase the BIOC's severity threshold so that only high-severity alerts are generated, then close the remaining alerts manually.

Answer

Disable the built-in Analytics BIOC entirely and rely on custom IOC feeds to catch the same behavior.

Answer

Add the automation binary to a malware hash block list so the process is terminated before the BIOC can fire.

Question 4

A detection engineer needs a Cortex XDR alert that fires only when a process writes a suspicious registry Run key and, within the same causality chain, subsequently spawns a script interpreter. The engineer wants the correlation to consider parent-child lineage rather than two unrelated events sharing an endpoint. Which mechanism should be used to express this lineage-aware condition?

Accepted Answer

A Causality Analysis Engine rule that defines the registry write and interpreter spawn as related stages within one process tree.. Lineage-aware correlation in Cortex XDR is expressed through the Causality Analysis Engine, which models process ancestry and event ordering inside a chain. Defining the registry write and interpreter spawn as related stages confines the match to a single process tree. Endpoint-scoped joins, IOC feeds, and count thresholds lack ancestry awareness and cannot enforce the same-chain constraint.

Answer

A scheduled XQL query that joins registry and process events on the endpoint name and runs every five minutes.

Answer

A custom IOC feed containing the registry path and interpreter hash, applied with an AND condition across the environment.

Answer

A BIOC rule scoped to the endpoint that counts both event types and alerts when the combined count exceeds two.

Question 5

A security analyst receives a Cortex XDR alert indicating a possible credential-dumping attempt on a finance workstation. The analyst wants to preserve volatile evidence and prevent the threat from spreading to other hosts while still allowing the incident to be investigated. Which Cortex XDR action should the analyst take on the affected endpoint?

Accepted Answer

Isolate the endpoint from the network using the Cortex XDR isolation action. Isolation is the containment action that stops network propagation without destroying the ability to investigate, because the Cortex XDR agent maintains its management channel during isolation. Process termination, hash blocklisting, and reimaging either fail to contain the threat fully or destroy the volatile evidence needed for the investigation.

Answer

Terminate the suspicious process tree and wait for the next scheduled scan

Answer

Restore the workstation from the most recent backup image

Answer

Add the file hash to the blocklist and close the alert as a true positive

Question 6

A security analyst wants to review all alerts that were generated on a specific endpoint over the past 30 days and see which ones were already resolved versus still open. Which Cortex XDR view should the analyst open to accomplish this?

Accepted Answer

The Alerts view filtered by the endpoint hostname and a 30-day time range, using the Status column to distinguish resolved from open alerts.. The Alerts view is the purpose-built interface for reviewing individual alerts with their metadata, including status. Applying a hostname filter and a 30-day time range narrows the list to the endpoint of interest, and the Status column immediately distinguishes resolved from open alerts without requiring custom queries or navigating unrelated consoles.

Answer

The Endpoint Management console filtered by the host, showing agent status and last-seen timestamps for the device.

Answer

The Query Center with a dataset of alerts, using XQL to project hostname, timestamp, and severity fields only.

Answer

The Incidents view filtered by the endpoint hostname, showing the status of each associated incident.

Question 7

An analyst builds a custom dashboard widget in Cortex XDR that shows the count of alerts grouped by MITRE ATT&CK technique. The widget works, but the team also wants a second widget that shows the same alert counts split by the assigned alert owner so managers can track workload. The analyst wants to reuse the existing query with minimal changes. Which adjustment should the analyst make to the widget's XQL query?

Accepted Answer

Add a second field to the existing comp count() aggregation so the results are grouped by both technique and owner.. Grouping in XQL happens inside the aggregation stage, so adding the owner field to the same comp count() that already groups by technique yields counts per technique-and-owner pair. This reuses the existing query with a single-field edit, producing the workload view managers need without restructuring the pipeline.

Answer

Change the widget type from a table to a pie chart and rely on the visualization to separate results by owner.

Answer

Replace comp count() with a dedup stage on the technique field so each technique appears only once.

Answer

Wrap the existing query in a join statement that merges the alert table with itself on the technique field.

Question 8

A security operations team wants Cortex XDR to push high-severity alerts into their existing ticketing platform automatically, without an analyst manually exporting each incident. Which TWO built-in integration capabilities allow Cortex XDR to deliver alerts to an external system? (Choose two.)

Accepted Answer

Enabling a Cortex XDR API key and calling the public REST endpoints to poll incidents on a schedule.. Automated external delivery in Cortex XDR is achieved through supported integration surfaces: forwarding alerts to an external destination and using the authenticated public REST API to retrieve incidents programmatically. Both are documented, secure, and designed for machine consumption. Console scraping, agent database sharing, and mailbox parsing are unsupported and insecure, so they fail the requirement.

Answer

Publishing the XDR console URL with embedded credentials so the ticketing tool can scrape the incident table.

Answer

Relying on the built-in email notification for every alert and letting the ticketing platform parse the mailbox.

Answer

Exporting the local agent database and mounting it on the ticketing server as a shared volume.

Question 9

A Cortex XDR engineer is asked to reduce alert fatigue from a built-in Analytics BIOC that fires on legitimate administrative activity in the environment, while preserving detection of the malicious behavior the rule targets. The engineer must keep the rule active and avoid weakening coverage for genuinely malicious activity. Which TWO actions should the engineer take? (Choose two.)

Accepted Answer

Add a Cortex XDR alert exclusion that filters out the known-good activity based on its specific attributes. Reducing false positives while preserving detection requires narrowly scoped suppression of the known-good activity, either through a rule exception or an attribute-based alert exclusion. Disabling the rule, altering severity, or starving telemetry either eliminates detection for the malicious behavior or fails to address the specific noisy pattern.

Answer

Raise the rule's severity threshold so that only critical-severity variants trigger alerts

Answer

Disable the built-in Analytics BIOC entirely and rely on generic malware signatures to catch the technique

Answer

Lower the agent data collection profile on affected endpoints to reduce the telemetry feeding the rule

Question 10

A Cortex XDR engineer is configuring the alert notification path so that high-severity incidents reach the on-call SOC analyst quickly. The team wants notifications delivered to an external collaboration platform and also wants an automated action to run when the alert fires. Which TWO Cortex XDR capabilities should the engineer configure to meet these requirements? (Choose two.)

Accepted Answer

Create a script or playbook action and bind it to the alert through a playbook that triggers on the matching alert condition.. External notification integrations attached to alert notification rules handle delivery to collaboration platforms, while playbooks bound to alert conditions provide automated action execution. Together they cover both the notification and the automated response requirements without altering detection coverage or endpoint scan settings.

Answer

Raise the alert severity threshold in the BIOC so that only critical alerts are generated for the on-call team.

Answer

Increase the endpoint agent heartbeat interval so alerts are reported to the management console more frequently.

Answer

Enable the built-in malware signature pack and schedule a daily scan on all endpoints in the policy.

Question 11

A junior analyst needs a quick count of how many alerts each severity produced over the last seven days to prepare a management summary. Which Cortex XDR capability is the most direct way to obtain this aggregated view without writing complex query logic?

Accepted Answer

Use a predefined dashboard widget that charts alert counts grouped by severity over a selectable time range.. Prebuilt dashboard widgets are purpose-designed to aggregate and visualize alert counts by severity across a chosen time range. They require no query authoring and update as data changes, making them the fastest route to a management summary. Manual tallies, raw telemetry exports, and agent logs all add effort without improving the result.

Answer

Export all raw endpoint telemetry to a CSV and pivot the severity column in a spreadsheet.

Answer

Open the Incidents view, filter by the last seven days, and manually tally severities from the list.

Answer

Enable verbose logging on each agent and review the local log files for severity tags.

Question 12

An engineer is tuning a custom BIOC rule that triggers on suspicious command-line patterns. During a red-team exercise the rule failed to fire even though the malicious command was executed. Review shows the rule matched on a process image name that the attacker replaced with a renamed copy of the same binary. Which adjustment best restores detection while limiting false positives?

Accepted Answer

Rewrite the rule to match on the command-line arguments and parent process behavior instead of the executable image name.. Detection that depends on a specific executable name breaks when an attacker renames the binary, because the image name changes while behavior does not. Re-anchoring the rule on command-line arguments and parent process behavior restores coverage across renames and keeps the condition specific. Hash indicators, severity tuning, and monitor-only mode do not address the underlying matching weakness.

Answer

Enable the rule in monitor-only mode so the renamed binary is logged without generating an alert.

Answer

Lower the rule's severity threshold so that weaker matches still generate an alert.

Answer

Add the original binary's hash to a custom IOC feed and alert on any hash match across the environment.

Question 13

A security analyst is reviewing an incident in Cortex XDR and wants to understand the sequence of events that led to a detection, including which process launched which child process and how the activity unfolded over time. Which Cortex XDR feature should the analyst use to view this ordered chain of related events?

Accepted Answer

The Causality Chain view of the associated alert, which shows the process tree and event sequence leading to the detection.. The Causality Chain presents the ordered process tree and related events that generated an alert, giving the analyst the timeline and lineage needed to understand how activity unfolded. Administrative, device control, and licensing views contain configuration or peripheral data and cannot reconstruct the detection sequence.

Answer

The license and entitlement page, which shows which Cortex XDR modules are enabled for the tenant.

Answer

The endpoint's device control log, which lists USB and peripheral device connections.

Answer

The policy audit log, which records administrative changes made to endpoint policies over time.

Question 14

A Cortex XDR engineer is tuning detection coverage and wants to know which MITRE ATT&CK techniques the organization's current endpoint policies and analytics are actually detecting, so gaps can be prioritized. Which Cortex XDR capability should the engineer use to map existing detections to ATT&CK techniques and visualize coverage?

Accepted Answer

A coverage or ATT&CK mapping view that correlates analytics and BIOCs to ATT&CK techniques and highlights techniques with no associated detections.. ATT&CK mapping correlates deployed analytics and BIOCs with adversary techniques and can highlight techniques with no associated detections, which is exactly what the engineer needs to prioritize tuning. Scan scheduling, agent versioning, and retention settings describe operational or storage state and cannot reveal technique-level detection coverage.

Answer

The agent version report, which shows which endpoint agent builds are installed across the fleet.

Answer

The endpoint scan scheduler, which lists when each endpoint last completed a full malware scan.

Answer

The data retention setting, which controls how long raw endpoint events are stored before deletion.

Question 15

An XDR engineer is investigating an incident where an alert shows a suspicious scheduled task created on a server. The engineer wants to determine whether the same process that created the task also initiated outbound network connections within the same causality chain. Which Cortex XDR capability should the engineer use to trace this relationship?

Accepted Answer

Open the alert's Causality View to pivot from the scheduled task creation process to its child network events within the same process tree.. The Causality View is designed to show the process tree and linked events sharing a causality ID, which is exactly the relationship needed to connect the process that created a scheduled task to any network connections it initiated. Filtering network data by hostname and time alone cannot establish that link, and the other modules address different questions.

Answer

Check the Threat Intelligence module for any known IOCs matching the server's outbound destination IP addresses.

Answer

Review the Endpoint Management audit log for the server to see which user account created the scheduled task.

Answer

Run an XQL query against the network_story dataset filtered only by the server hostname and the incident time window.