Certified XDR Analyst (XDR-Analyst) (XDR-Analyst) — Questions 1–75

Endpoint agents capture process creation events, including command-line arguments, so a BIOC matching 'whoami' execution by a domain user requires this process execution telemetry. Network or authentication logs lack the command-level visibility the rule depends on.

Monitoring the target process name for lsass.exe with suspicious access rights directly satisfies the stem's endpoint telemetry criterion. Credential dumping requires a source process opening LSASS with rights such as PROCESS_VM_READ, so correlating target image and granted access mask detects the technique regardless of the dumping tool used.

Cortex XDR's dynamic incident scoring engine recalculates severity as correlated alerts accumulate, so the score rises over time. This component directly satisfies the stem's requirement that the score increase dynamically when new related alerts join the incident.

Microsoft Entra ID logs supply Cortex XDR with cloud authentication telemetry — sign-in events, conditional access outcomes and risky sign-in detections — that endpoint sensors cannot observe. This satisfies the stem's hybrid-environment constraint by correlating identity-layer anomalies with endpoint activity, exposing credential abuse and lateral movement that would otherwise remain invisible.

The Causality Chain view in Cortex XDR visually maps the sequence of processes, including parent-child relationships, that led to an alert. By selecting the alert and opening the Causality Chain, the analyst can trace which process spawned the one that made the malicious network connection, directly answering the question.

Tuning the analytics rule to recognise the new server as an authorised script execution source suppresses the false positive without disabling detection entirely. This satisfies the best-practice constraint of resolving the alert while preserving security coverage, since the service account's legitimate automated behaviour is now baselined rather than ignored.

The User View aggregates an identity's authentication events, directory changes, and related activity into a chronological timeline. For a compromised service account used to create a domain admin, it shows the authentication sequence and the subsequent directory modification in order. This identity-centric lens is exactly what the analyst needs to reconstruct the attack path.

Cloud audit and API activity logs capture control-plane operations such as resource creation, modification and deletion, recorded by the provider's own auditing service. They are the primary forensic record for cloud resource changes, unlike endpoint telemetry or network flow data.

Identity Analytics exclusions or entity classifications remove known service accounts from behavioural risk scoring, so their high-volume automated authentications no longer inflate user risk scores. This directly satisfies the requirement to prevent false-positive risk elevations without disabling analytics for genuine interactive accounts.

The correlation engine analyzes indicators like file hashes, IPs, and domains to identify related activity. When multiple alerts share these indicators, they are likely part of the same attack and are stitched together. This is a primary factor in automatic incident creation.

For agents to connect to the Broker VM, they need to resolve its hostname to an IP address. This requires proper DNS configuration or host file entries. Without DNS resolution, agents cannot locate the Broker VM, leading to communication failures. This is a fundamental network requirement for any service-based communication in Cortex XDR deployments.

Incident severity is computed from contributing alert scores, so a frequently firing internal port-scan rule inflates the total. Tuning or disabling that detector, or adjusting the scoring weight profile, removes the noisy contribution and restores accurate severity ratings.

Authentication logs from the identity provider (such as Active Directory or a SIEM integrated with Cortex XDR) record successful and failed logon attempts, including source and destination hosts. These logs are essential for detecting lateral movement using stolen credentials, as they show which accounts authenticated to which systems and whether the attempts succeeded.

The Isolate Endpoint action in Cortex XDR cuts off all network communication except for the connection to the Cortex XDR management console. This prevents the ransomware from spreading to other systems or communicating with command-and-control servers, while still allowing the analyst to perform remote investigations and remediation via the console.

The Alerts tab on the Incident Details page lists each individual raw alert that was grouped into the incident, preserving pre-grouping event data. This directly satisfies the analyst's need to examine the exact sequence of events before automated correlation occurred.

Starring an incident marks it so it appears highlighted and is easy to locate in incident lists. This gives other shift analysts an immediate visual cue on login, directly satisfying the requirement to flag a high-priority incident.

The agent installation token is a shared secret generated in the Cortex XDR management console and supplied during agent installation. It authenticates the endpoint to the tenant and authorizes agent registration. Because it can be rotated, it satisfies the requirement for a changeable shared secret used at install time.

Agent Settings under Settings > Configurations > Agent Settings > Upgrades holds the automatic upgrade toggle and version targeting, so agents pull new releases without manual intervention. This directly satisfies the administrator's requirement for automatic software version updates.

An orange badge in Cortex XDR's Incident View denotes high severity, indicating an incident with significant potential impact that warrants prompt investigation. This satisfies the stem's scenario by mapping the displayed colour directly to the high-severity classification, distinguishing it from medium (yellow) and low (green) incidents.

XQL queries against registry event tables let the analyst search across the entire dataset for the exact Run key value, rather than inspecting endpoints individually. This directly answers whether other machines share the same persistence mechanism.

Assigning the incident to their own user account in the Incident View transfers ownership directly, satisfying the analyst's goal of taking responsibility for the investigation. This action records the analyst as the incident owner, enabling tracking and accountability within the platform's case management workflow.

Cortex XDR agents connect to region-specific tenant FQDNs plus update distribution domains, so whitelisting those exact destinations permits telemetry upload and content updates. This satisfies the strict egress filtering constraint, since broad wildcard ranges would be blocked or unnecessarily permissive.

Identity and authentication logs record each sign-in with source IP, timestamp and geolocation, letting the analyst correlate the two impossible-travel events and confirm whether the locations are genuine. This directly satisfies the stem's requirement to validate login locations, unlike endpoint or network telemetry, which lacks the identity-provider context Microsoft Entra ID sign-in data provides.

BIOC rules analyse command-line arguments and process ancestry behaviourally, so they flag reconnaissance such as net group "Domain Admins" /domain regardless of binary signatures, matching the stem's requirement to detect native-utility enumeration without relying solely on static signatures.

Incident Response > Alerts with an Analytics category filter isolates UBA-generated identity analytics alerts, satisfying the requirement to inspect identity-specific behavioural detections rather than all alert types. Cortex XDR surfaces user behaviour analytics findings within the Analytics category, so filtering there returns exactly the compromised-credential identity alerts the administrator needs.

Confirming the digital signature and publisher proves the binary originates from a trusted vendor and has not been tampered with, so the exclusion targets genuine software rather than masquerading malware. This satisfies the stem's requirement that security not be compromised, since unsigned or spoofed files would otherwise gain a behavioural-analysis bypass.

Isolation blocks network traffic at the endpoint while the agent keeps its own outbound channel to the Cortex XDR server, so the analyst retains visibility and response actions. Internal file shares become unreachable because that traffic is dropped, not the management path.

Stitching correlates network and endpoint telemetry into one narrative, so the resulting timeline spans both domains and reveals the full attack path from initial network activity through endpoint execution. This cross-domain visibility is the outcome that distinguishes stitched data from isolated alerts.

The installation token, sometimes called the installation password, is generated in the Cortex XDR management console and is required for agents to authenticate and register with the correct tenant during installation. It ensures that only authorized endpoints can join the tenant and receive policies. This token is the standard mechanism for bulk agent deployments and is included in the installation package or specified on the command line.

Terminating the process stops the active connection, while blocking its file hash or path prevents the same binary from re-establishing outbound traffic. This satisfies the constraint of blocking communication for that process only, without isolating the host and disrupting unrelated workloads.

The event timestamp establishes the precise point on the attack timeline, letting analysts correlate the alert with surrounding telemetry and satisfy the Incident Viewer's requirement to review when activity occurred. Without it, sequencing causal events across endpoints becomes guesswork, undermining scope assessment during triage.

The Broker VM acts as a relay between endpoints and the Cortex XDR management console. It communicates with the console over HTTPS (TCP 443) to fetch policies and forward telemetry. This allows endpoints with restricted internet access to receive updates and send data through the Broker VM, satisfying the requirement without direct outbound connectivity from each endpoint.

Credential stuffing produces many failed authentications spread across accounts and source IPs; analytics rules correlating high-frequency failures across multiple accounts from distributed IPs surface this pattern. This satisfies the stem's need to detect the attack's defining distribution characteristic.

Creating an exception rule in Cortex XDR allows the analyst to define specific criteria (such as a known benign process, hash, or command line) that will prevent future alerts matching those criteria from generating incidents. This directly addresses the false positive by suppressing the alert at the source, reducing noise and allowing the team to focus on genuine threats. It is the recommended action for confirmed false positives.

Cloud identity provider sign-in logs, such as Microsoft Entra ID, record authentication events, risky sign-ins and conditional access outcomes. Ingesting them gives Cortex XDR the identity telemetry needed to detect and investigate credential-based attacks under ITDR.

Windows Security Event logs record local and interactive logon activity, including Event IDs 4624 and 4625, which capture successful and failed authentication attempts directly on the workstation. This satisfies the stem's requirement to determine whether an unauthorised user gained local access, since these events expose the account, logon type and source of each attempt.

Assigning to a named analyst user account satisfies the stem's requirement for an assignment action, routing incident ownership to an individual within Cortex XDR. This differs from reassigning to a team or changing status, which alter queue or workflow state rather than personal accountability for investigation and resolution.

User-ID mapping requires querying AD user and group objects, so a dedicated service account with read permissions is essential. Without these read rights, the Broker VM cannot enumerate identities for synchronisation, directly satisfying the stem's prerequisite for User-ID mapping.

Shared NAT gateway IP addresses act as Cortex XDR correlation anchors, so unrelated attacks traversing the same egress point within the correlation window are fused into one incident. This satisfies the stem's over-correlation constraint: the shared identifier is infrastructure, not a genuine attacker artefact linking the two endpoints.

Proxy settings are a genuine Agent Settings profile element, letting you direct agent traffic through a specified server for communication traversal. This satisfies the rollout constraint by ensuring endpoints in restricted network segments can reach Cortex XDR management and telemetry services without direct internet egress.

Cortex XDR collects scheduled task events that include details such as the task name, the user account that created or modified the task, and the command or script that is scheduled to run. This is the most direct data source for the analyst's needs.

When endpoints lack direct internet access, the Cortex XDR agent must be told how to reach the cloud through the explicit proxy. Supplying the proxy address and port during installation or through policy allows the agent to establish its outbound TCP 443 session and complete registration with the tenant, which is the prerequisite for all subsequent functionality.

Cortex XDR Windows agents are distributed as an MSI, and the installation token can be supplied as a command-line parameter so the package installs silently through a software distribution tool. This enables unattended installation across a large fleet without requiring a technician to touch each endpoint.

The Alerts View supports filtering and free-text search across all alerts, letting the analyst query the external IP address directly and see every matching alert regardless of incident grouping. This satisfies the stem's constraint of avoiding per-incident inspection, since results span multiple incidents in one consolidated table.

The Block List lets analysts block specific domains, IP addresses, or file hashes across endpoints without isolating hosts. Adding the malicious domain stops the beaconing while leaving all other traffic untouched, which matches the requirement to disrupt only the threat and preserve business connectivity.

The Identity Analytics dashboard consolidates identity telemetry and presents users ranked by accumulated risk indicators, including authentication anomalies and privilege changes. It is purpose-built for the user-centric risk overview the administrator needs, unlike incident or endpoint views that organize data around alerts or hosts.

Cortex XDR's identity analytics aggregates behavioural analytics alerts into each user's risk score, weighting both the severity assigned to each triggered alert and how many alerts fired. This directly satisfies the stem's requirement for metrics included in the calculation, since alert volume and severity are the core inputs driving the score.

Cortex XDR isolation blocks network traffic to and from the endpoint, cutting off command-and-control and lateral movement, while allowing the agent to maintain its channel to the console. This matches the requirement exactly, letting the analyst continue collecting evidence and issuing response actions while the host is contained.

Remediate Action (Cleanup) automatically reverses the malicious binary's file drops and registry modifications, satisfying the stem's requirement to undo both change types. Cortex XDR's remediation engine quarantines dropped payloads and restores altered registry keys to their prior state, without manual analyst intervention.

The Causality Chain pane visually maps the sequence of process executions (parent-child relationships) and includes command-line arguments for each process. This is the correct location to trace how a suspicious child process was spawned and to view the full command line of the parent, enabling the analyst to assess the attack chain.

Scheduled Tasks provide a native Windows persistence mechanism that survives reboots, letting an APT re-execute payloads without user interaction. Cortex XDR telemetry captures task creation, modification and execution events, so the analyst can correlate suspicious task actions with other persistence artefacts across endpoints.

Cortex Data Lake is the cloud-hosted repository where Cortex XDR stores telemetry, logs and behavioural data from endpoints, networks and cloud sources. It centralises this data for correlation, detection and investigation, satisfying the requirement for a central repository.

The Causality Chain in Cortex XDR shows the sequence of processes and their relationships, including the command-line arguments used when each process was launched. By examining the Process Execution History within the Causality Chain, the analyst can see the exact PowerShell command line, including all arguments. This is the most direct way to retrieve that specific detail.

Approving System Extensions, Full Disk Access, and Network Filter permissions directly satisfies TCC's requirement that user consent be granted before an agent can monitor protected resources. Cortex XDR's kernel-level visibility depends on these three approvals, which MDM can push silently or users must grant manually, otherwise the agent runs with degraded telemetry.

The User Investigation view aggregates activity by identity rather than by endpoint, correlating events for one account across multiple devices over a chosen period. This satisfies the user-centric, seven-day, multi-device requirement by presenting a consolidated timeline of that account's security events.

The Broker VM is deployed on-premises to collect syslog, WMI and Active Directory logs, then forwards them to Cortex XDR for ITDR analysis. It satisfies the requirement to ingest directory and identity telemetry that cloud-only collection cannot reach directly.

Because the installation token binds an endpoint to a specific tenant during enrollment, issuing region-specific tokens ensures agents land only in the tenant that satisfies the data-residency rule. This prevents cross-region visibility of telemetry and is the most direct control for enforcing the legal requirement at deployment time.

The WildFire Analysis tab within File Details presents the sandbox verdict and full behavioural report for the submitted file, satisfying the analyst's need to confirm whether WildFire analysed it. Verdicts and reports are surfaced only through this file-centric view, not through alert or endpoint panes.

Automated mitigation only fires when a playbook is bound to ransomware detection triggers, so the alert severity and issue type map to that workflow. Without this trigger binding, high-severity ransomware alerts generate notifications but no automated response actions execute.

Featured fields configuration defines which custom attributes, including threat actor attribution tags, appear as columns in the incident grid. Enabling the relevant featured field surfaces those tags directly, satisfying the requirement to view customised attribution columns without opening each incident.

Cortex XDR Agent prevention modules operate inline on the endpoint, intercepting malicious activity and blocking execution of malware, exploits, and ransomware before damage occurs. This satisfies the requirement for active blocking and remediation rather than detection-only telemetry.

Cortex XDR response actions are delivered through the endpoint agent, so the agent must be online and connected for the playbook to receive and run the remediation command. An offline or disconnected endpoint cannot accept the instruction, causing execution to fail.

The Cortex XDR Analyst role grants built-in incident management permissions, including modifying incident status and assigning cases. This directly satisfies the stem's requirement to move an incident from 'New' to 'Under Investigation', since that transition is a standard analyst workflow action rather than an administrative configuration task.

WildFire verdicts are keyed to the SHA-256 hash, and Cortex XDR surfaces them directly in the file details panel of the causality view. Clicking the report shows the verdict, behavior summary, and MITRE techniques without leaving the investigation context, which is exactly what an analyst needs to confirm whether the binary is known malware before escalating containment.

Inbound Syslog on TCP/UDP 514 (or custom ports) is required because the Broker VM's Syslog collector receives event data from network devices, satisfying the stem's internal firewall flow requirement. Without this inbound rule, log ingestion fails and Cortex XDR cannot correlate network telemetry.

When a web proxy requires authentication, the Cortex XDR agent must be configured with the proxy address, port, and valid credentials to authenticate. This allows the agent to establish a connection through the proxy to the Cortex XDR cloud. The credentials can be specified in the agent profile or installation command line, depending on the deployment method.

Documenting lessons learned and updating detection rules or playbooks closes the feedback loop, converting incident findings into improved future detection and response. This satisfies the remediation verification requirement by ensuring systemic gaps identified during review are corrected rather than left to recur.

The Incident Notes section allows analysts to document their investigation steps, findings, and remediation actions directly within the incident. This note is visible to other analysts and is part of the incident record, ensuring that the investigation history is preserved and collaborative.

Placing Broker VMs at each remote site lets them collect and forward endpoint telemetry locally, so only filtered metadata traverses the WAN. This directly satisfies the stem's multi-site constraint by cutting bandwidth consumption and latency versus centralising all traffic.

The correlation engine assigns the New status the moment it generates an incident automatically, before any analyst triage or ownership occurs. This distinguishes it from later states such as Under Investigation or Resolved, which require human action. New simply marks an unassigned, freshly created incident awaiting review.

Entra ID sign-in and audit logs supply cloud authentication events, including conditional access outcomes, MFA results, and application access. Ingesting them through the Cortex XDR cloud identity connector lets the platform correlate cloud sign-ins with on-premises activity. Without this telemetry, the analyst cannot see cloud-side identity attacks or link them to Active Directory logons.

Grouping related alerts into one attack storyline lets the analyst investigate the whole chain of activity across machines rather than triaging each alert separately, directly reducing alert fatigue while preserving the causal links between the constituent alerts.

Cortex XDR stitches alerts into incidents by matching common entities like hostnames, IP addresses, or usernames. If the network alert does not contain a host identifier that matches the endpoint's hostname or IP, the correlation engine cannot link them. This is a common cause of correlation failures, especially when network telemetry lacks endpoint context or uses NAT.

An alert exclusion rule suppresses matching low-level behavioural alerts before they reach the incident queue, directly addressing the clutter constraint. Because the scripts are legitimate and already triaged as benign, excluding them by known signature preserves analyst capacity without disabling the underlying detection logic for genuine threats.

Cortex XDR's correlation engine applies analytics and incident scoring to cluster alerts sharing entities, timelines or causality chains, producing one grouped incident. This satisfies the stem's requirement for intelligent grouping of disparate endpoint and network alerts, which raw alert ingestion alone cannot achieve.