Certified XDR Analyst (XDR-Analyst) (XDR-Analyst) — Questions 1–75

An analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?

An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?

An analyst observes that an incident's score dynamically increases over time as new related alerts are added. Which component of Cortex XDR drives this behavior?

What is the primary purpose of integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR?

An analyst notices that a service account is generating alerts for anomalous login locations. Upon review, the account is used by an automated batch script running from a newly provisioned server. How should the analyst resolve this alert while maintaining security best practices?

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

An administrator is setting up User Risk Scoring within Cortex XDR. They notice that certain service accounts with high volumes of automated authentications are skewing the risk calculations. How should the administrator handle these service accounts in Cortex XDR to prevent false-positive risk elevations?

An organization notices that Cortex XDR incidents are being assigned high severity scores primarily due to a noisy network alert rule that triggers frequently on internal port scans. What is the correct administrative workflow to resolve this scoring inflation?

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

An analyst wants to flag a particular high-priority incident so that other shift analysts immediately notice it when they log in. What is the most direct feature to use?

Which TWO features assist an analyst in prioritizing which incidents to investigate first within the Cortex XDR console? (Choose two)

An administrator wants to ensure that Cortex XDR agents automatically update their software version whenever a new version is released by Palo Alto Networks. Where is this automated agent upgrade setting configured?

When reviewing the Incident View, an analyst notices an incident with an orange severity badge. What does this severity level typically indicate in Cortex XDR?

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

When reviewing an incident, an analyst wants to assign ownership to themselves. Which action should the analyst take?

An organization has strict egress filtering rules. Which destination URLs or IP ranges must be whitelisted in the corporate firewall to allow the Cortex XDR agent to communicate with the Cortex XDR cloud service?

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

An attacker compromises a domain user account and attempts to enumerate domain admins using native Windows utilities (e.g., 'net group "Domain Admins" /domain'). Which Cortex XDR detection mechanism is specifically designed to catch such reconnaissance behaviors without relying solely on static signatures?

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

What THREE outcomes typically occur when data stitching successfully links a network alert and an endpoint alert? (Choose three)

An analyst notices suspicious network connections originating from an unknown process on an endpoint. To block outbound communication for this process without isolating the entire host, what action can be taken?

Which TWO details are typically reviewed when inspecting an alert in the Cortex XDR Incident Viewer? (Choose two)

An enterprise is facing credential stuffing attacks targeting its cloud and on-premises applications. Which TWO detection or mitigation strategies within Cortex XDR and integrated tools help address this threat?

Which TWO log sources are commonly ingested into Cortex XDR to support Identity Threat Detection and Response (ITDR)?

Which TWO evidence sources help an analyst investigate whether an unauthorized user accessed a compromised workstation locally? (Choose two)

Which TWO actions are available to an analyst when managing an incident's assignment in Cortex XDR? (Choose two)

An administrator is configuring Active Directory integration with Cortex XDR using the Broker VM. Which TWO prerequisites or components are required to successfully establish User-ID mapping and synchronization?

During incident triage, an analyst notices that two completely separate attacks on different endpoints were merged into a single incident by Cortex XDR. What is the underlying reason for this over-correlation?

An administrator is planning an agent rollout and needs to configure agent profiles in the Cortex XDR management console. Which THREE configuration elements can be defined within an Agent Settings profile?

An administrator is troubleshooting a Broker VM that has lost connectivity to the Cortex XDR cloud tenant. After logging into the Broker VM CLI, which command should the administrator use to test connectivity and troubleshoot DNS/HTTPS communication to the cloud backend?

An analyst wants to quickly identify all alerts related to a specific external IP address across multiple incidents without opening each incident individually. Which feature in the Cortex XDR console should the analyst use?

Which TWO metrics or components are typically included in a user's risk score calculation within Cortex XDR's identity analytics?

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Which architectural component acts as the central repository for all Cortex XDR telemetry, logs, and behavioral data?

When configuring Cortex XDR agent permissions on macOS, what step is necessary due to macOS security restrictions (Transparency, Consent, and Control - TCC)?

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

What role does the Cortex XDR Broker VM play regarding Active Directory and ITDR log collection?

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

An organization wants to configure Cortex XDR to automatically respond to high-severity ransomware alerts. Which THREE elements must be correctly configured to ensure successful automated mitigation? (Choose three)

An analyst is investigating an incident and needs to quickly view customized columns containing threat actor attribution tags in the incident grid. Which feature must be configured to show these columns?

What is the primary function of Cortex XDR Agent prevention modules (such as Anti-Malware and Exploit Protection)?

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

Which role-based permission is typically required for an analyst to change the status of an incident from 'New' to 'Under Investigation' in Cortex XDR?

An administrator is configuring Broker VM network settings and firewall rules in a secure data center zone. Which THREE traffic flows must be permitted through internal firewalls for the Broker VM to function correctly?

When conducting a comprehensive post-incident review and remediation verification in Cortex XDR, which THREE actions should an analyst perform? (Choose three)

An administrator is planning the deployment of Broker VM instances across a multi-site enterprise network. Which TWO best practices should be followed when planning Broker VM deployments?

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?

An XDR Analyst is investigating a newly generated incident in Palo Alto Networks Cortex XDR and notices that multiple disparate alerts from different endpoints and network sensors have been automatically grouped together. Which core mechanism of Cortex XDR is primarily responsible for intelligently grouping these related alerts into a single incident?

Which TWO factors directly influence how Cortex XDR calculates the overall severity score of an incident? (Choose two)

What THREE conditions can cause data stitching failures between network logs and endpoint telemetry in Cortex XDR? (Choose three)

Which TWO pieces of information are displayed in the Incident summary dashboard of Cortex XDR? (Choose two)

When managing exclusions and exceptions in Cortex XDR, which THREE best practices should an analyst follow to maintain security posture? (Choose three)

An incident in Cortex XDR contains dozens of low-priority alerts that were grouped together. The analyst determines that one specific alert within the incident is a false positive while the rest are legitimate threats. What is the best practice for handling this specific raw alert?

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?

An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

An administrator needs to deploy Cortex XDR agents to a fleet of Linux servers running Ubuntu 20.04. Before executing the installation script, which prerequisite package must be verified as installed on the Linux endpoints to ensure kernel module or Extended Berkeley Packet Filter (eBPF) support functions correctly?

An organization wants to ensure that all administrative logon sessions are closely monitored for anomalous behaviors in Cortex XDR. Where should the administrator configure custom behavioral alert thresholds for privileged users?

An organization experiences a Golden Ticket attack. How does Cortex XDR's identity analytics engine typically detect this type of Kerberos ticket manipulation?

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

What is the primary function of the Cortex XDR Agent Support File collection tool?

Which dashboard widget type in Cortex XDR is best suited for tracking the volume of open incidents over time across different severity levels?

An administrator is reviewing the Cortex XDR system requirements and architecture. Which TWO statements accurately describe the Broker VM architecture?

An analyst is investigating an incident where a malicious file was dropped via email. Which TWO evidence artifacts should the analyst inspect to correlate the email vector with the endpoint execution? (Choose two)

An administrator is planning network bandwidth utilization for Cortex XDR agents deployed across 10,000 endpoints. Which mechanism does Cortex XDR use to minimize WAN bandwidth consumption during content updates and software upgrades?

An administrator is preparing to install the Cortex XDR Agent on enterprise endpoints using a pre-installation script. Which THREE checks should be performed on the target endpoints before executing the installation?

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which THREE log locations or troubleshooting methods should the administrator examine to determine the root cause of the installation failure?