How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the XDR-Analyst exam, each with detailed explanations and wrong-answer analysis.

How should I approach XDR-Analyst scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified XDR Analyst (XDR-Analyst) questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Certified XDR Analyst (XDR-Analyst) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

XDR-Analyst

exam code

Palo Alto Networks

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Full question →

Which TWO attributes are typically displayed by default or through featured fields in the Cortex XDR Incident View grid? (Choose two)

A
Incident Severity and Score
Severity and score are core attributes displayed for triage.
B
Syslog server destination IP ports
Why wrong: Syslog ports are configured in data forwarding settings.
C
Incident ID and Name
Incident identifiers and names are primary columns in the view.
D
Data stitching algorithm version numbers
Why wrong: Algorithm version numbers are backend system details not shown in the grid.
E
Agent collector installation binaries
Why wrong: Binaries are managed in endpoint deployment views.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related XDR-Analyst topic practice pages

Alert Lifecycle And Incident Correlation practice questions

Planning And Installation practice questions

Evidence Review And Response Actions practice questions

Identity Threat Detection And Response practice questions

XDR-Analyst fundamentals practice questions

XDR-Analyst scenario practice questions

XDR-Analyst troubleshooting practice questions

Practice scenarios

Which TWO attributes are typically displayed by default or through featured fields in the Cortex XDR Incident View grid? (Choose two)

Which TWO mechanisms are used by Cortex XDR to prevent alert fatigue during the raw-alert-to-incident lifecycle? (Choose two)

Which TWO factors directly influence how Cortex XDR calculates the overall severity score of an incident? (Choose two)

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

During an investigation, an analyst examines the Causality Chain and Incident Graph. What THREE key insights do these visualization tools provide into the incident lifecycle? (Choose three)

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

Which TWO actions can an analyst perform to manage and highlight specific findings during an incident investigation in Cortex XDR? (Choose two)

What THREE conditions can cause data stitching failures between network logs and endpoint telemetry in Cortex XDR? (Choose three)

What THREE criteria are evaluated by Cortex XDR when determining whether incoming raw alerts should be grouped into an existing incident or spawn a new one? (Choose three)

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

Which TWO actions can an administrator take to tune incident scoring for high-value assets? (Choose two)

When managing the alert lifecycle in Cortex XDR, analysts can perform various triage and prioritization tasks. Which THREE features or options are available to analysts when managing active incidents and alerts? (Choose three)

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

An administrator needs to configure automated incident response actions in Cortex XDR. Which THREE components are critical for building a successful automated response workflow? (Choose three)

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

Which TWO automated or manual response actions can be executed directly on an endpoint from the Cortex XDR Incident Response toolbox? (Choose two)

When reviewing identity alerts in Cortex XDR, which TWO anomalous behaviors might indicate compromised credentials? (Choose two)