XDR-Analyst Identity Threat Detection And Response Practice Question
Which THREE key identity-based threat behaviors are typically detected and flagged by Cortex XDR Identity Analytics? (Choose three)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Abnormal privilege escalation or group membership changes
Cortex XDR Identity Analytics detects anomalies such as impossible travel, brute-force or password spray attacks, and unusual privilege escalations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Abnormal privilege escalation or group membership changes
Why this is correct
Unauthorized additions to privileged groups (like Domain Admins) are flagged as high-severity identity threats.
- ✓
Password spray and brute-force attempts
Why this is correct
Identity analytics flags repetitive failed login patterns across multiple accounts or single accounts.
- ✗
Corrupted sector errors on mechanical hard drives
Why it's wrong here
Hardware health metrics are monitored by endpoint storage diagnostics, not identity analytics.
- ✗
Standard browser bookmark synchronization
Why it's wrong here
Browser synchronization is routine user activity and not an identity threat behavior.
- ✓
Impossible travel sign-ins
Why this is correct
Impossible travel detects logins from geographically distant locations in an unrealistically short time.
About these practice questions
One of 210 original XDR-Analyst practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Palo Alto Networks exam blueprint
This XDR-Analyst practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XDR-Analyst exam.