Evidence Review And Response Actions

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

A Cortex XDR analyst is investigating an incident where a user's endpoint was compromised. The analyst needs to determine if the attacker moved laterally to other endpoints by leveraging stolen credentials. Which Cortex XDR data source should the analyst query to identify successful and failed authentication attempts across the environment?

An analyst is investigating a Cortex XDR alert indicating a possible ransomware attack. The analyst wants to isolate the affected endpoint from the network while preserving the ability to remotely investigate and remediate. Which Cortex XDR response action should the analyst take?

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

An analyst notices suspicious network connections originating from an unknown process on an endpoint. To block outbound communication for this process without isolating the entire host, what action can be taken?

Which TWO details are typically reviewed when inspecting an alert in the Cortex XDR Incident Viewer? (Choose two)

Which TWO evidence sources help an analyst investigate whether an unauthorized user accessed a compromised workstation locally? (Choose two)

Which TWO actions are available to an analyst when managing an incident's assignment in Cortex XDR? (Choose two)

An analyst is investigating a series of alerts related to a suspicious scheduled task created on a Windows endpoint. They want to determine the user account that created the task and the exact command that was scheduled. Which Cortex XDR data source should the analyst review to find this information?

An analyst determines that a compromised endpoint is beaconing to a known malicious domain. The analyst wants to immediately stop the endpoint from reaching that domain while keeping the rest of the host's business traffic intact. Which Cortex XDR response action should the analyst choose?

During an investigation, a Cortex XDR analyst notices that an endpoint generated a high volume of network connection events to a suspicious external IP address. The analyst wants to isolate the host from the network while still allowing the Cortex XDR agent to communicate with the console for continued investigation. Which Cortex XDR response action should the analyst use?

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint spawned a child process with a suspicious command line. The analyst wants to see the exact parent-child process relationship and the full command line of the parent process to determine if this is a true positive. Which pane in the Cortex XDR Alert view provides this information?

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

An analyst is reviewing a Cortex XDR incident where a suspicious PowerShell script was executed on an endpoint. The analyst wants to see the exact command-line arguments that were passed to PowerShell at the time of execution. Which Cortex XDR feature should the analyst use to find this information?

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

An organization wants to configure Cortex XDR to automatically respond to high-severity ransomware alerts. Which THREE elements must be correctly configured to ensure successful automated mitigation? (Choose three)

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint wrote a suspicious executable to a network share. To determine whether the file was previously seen and analyzed by Palo Alto Networks WildFire, which action should the analyst take from the alert's causality view?

When conducting a comprehensive post-incident review and remediation verification in Cortex XDR, which THREE actions should an analyst perform? (Choose three)

An analyst is reviewing an incident in Cortex XDR and wants to add a note explaining the steps taken during the investigation. Where should the analyst add this note?

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

Which TWO pieces of information are displayed in the Incident summary dashboard of Cortex XDR? (Choose two)

An analyst is investigating a potential data exfiltration incident. They have identified a suspicious external IP address that the endpoint communicated with. To gather more context, they want to see all historical network connections involving that IP address across the organization. Which Cortex XDR capability should the analyst use?

When managing exclusions and exceptions in Cortex XDR, which THREE best practices should an analyst follow to maintain security posture? (Choose three)

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

An analyst is investigating a Cortex XDR incident involving a Windows endpoint. The analyst needs to retrieve a copy of a suspicious executable from the endpoint's disk to submit to WildFire for further analysis, without executing the file locally. Which response action should the analyst use?

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

An analyst is reviewing a Cortex XDR incident and wants to identify which endpoints are affected and what user accounts were involved. Which TWO pieces of information can be directly obtained from the Incident Details page to help with this assessment? (Choose two.)

An analyst is investigating an incident where a malicious file was dropped via email. Which TWO evidence artifacts should the analyst inspect to correlate the email vector with the endpoint execution? (Choose two)

After containing a malware outbreak, an analyst needs to document the incident in Cortex XDR. The analyst wants to add a note summarizing the root cause and remediation steps to the incident for future reference. Which action should the analyst take?

Which TWO actions can an analyst take when closing an incident in Cortex XDR? (Choose two)

An analyst wants to create a robust incident response workflow in Cortex XDR that incorporates both manual analyst review and automated remediation. Which THREE capabilities support this integrated approach? (Choose three)

After containing a ransomware incident on a Windows endpoint, an analyst needs to preserve volatile evidence for later forensic analysis before the endpoint is reimaged. Which Cortex XDR response action should the analyst use to capture a snapshot of the endpoint's memory and running processes?

A Cortex XDR analyst is reviewing an endpoint alert and wants to capture volatile evidence from the affected host before initiating remediation. The analyst decides to run a live terminal session on the endpoint through the Cortex XDR console. Which statement accurately describes the capability and limitation of this live terminal session?

An analyst is performing advanced threat hunting in Cortex XDR using XQL. Which THREE clauses or functions are commonly used when constructing analytical queries for evidence review? (Choose three)

An analyst wants to prevent Cortex XDR from generating alerts on a specific signature-based detection (such as a known vulnerability scanner tool) across a specific endpoint group. Where should this exclusion be created?

An administrator needs to automate a remediation workflow so that whenever a specific critical alert severity is triggered, Cortex XDR automatically runs a script to collect forensic artifacts. Where must this automation be configured?

An analyst is reviewing a Cortex XDR alert for a suspicious process on a Windows endpoint. They need to determine the parent process that spawned the suspicious executable to understand the attack chain. Which Cortex XDR feature or view should the analyst use to see the process lineage and related causality information?

An analyst writes an XQL query to investigate lateral movement. Which dataset table in Cortex XDR contains comprehensive network connection telemetry across endpoints?

An analyst discovers that a malicious payload communicated with an external Command and Control (C2) server. Which TWO evidence sources should the analyst review to identify the C2 communication details? (Choose two)

Which TWO details does the Cortex XDR Incident Graph display during evidence review? (Choose two)

An analyst needs to change the status of an incident from 'Under Investigation' to 'Resolved' after completing remediation. Which section of the Incident View allows updating the incident status?

Which TWO forensic logs or artifacts are most valuable when investigating a suspected ransomware attack on an endpoint? (Choose two)

An organization experiences a false positive alert caused by a legitimate administrative script executed via PowerShell. The analyst wants to create an exception that applies specifically to this script's command-line arguments without whitelisting PowerShell entirely. What type of exception should be configured?

An analyst is investigating a Cortex XDR incident involving a suspicious process on a Windows endpoint. The analyst wants to gather volatile evidence from the endpoint before taking containment actions. Which TWO response actions can be used to collect volatile evidence? (Choose two.)

During a live investigation, an analyst needs to isolate a Windows endpoint from the network while preserving the ability to run response actions and pull files for forensic review. Which Cortex XDR action best satisfies this requirement?

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

An analyst is investigating a Cortex XDR incident and wants to add a note to the incident timeline to document the steps taken so far. Where in the Cortex XDR console can the analyst add this note?

An administrator needs to configure automated incident response actions in Cortex XDR. Which THREE components are critical for building a successful automated response workflow? (Choose three)

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

An analyst is investigating an incident and wants to export the full incident report and associated artifact list for compliance reporting. Which option should the analyst select in Cortex XDR?

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

When an endpoint is isolated during an incident response action in Cortex XDR, which TWO types of network traffic are generally permitted to ensure continued management and minimal disruption? (Choose two)

An analyst is reviewing a Cortex XDR incident involving a Windows endpoint that exhibited suspicious registry modifications. The analyst needs to determine whether a persistence mechanism was established by a specific process. Which Cortex XDR evidence source should the analyst review to see the registry key path, the value data written, and the process that performed the modification?

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

When investigating an endpoint compromise, an analyst suspects DLL sideloading was used to execute malicious code. Which TWO telemetry indicators should the analyst examine? (Choose two)

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

An analyst is reviewing a Cortex XDR incident that contains a 'Behavioral Threat' alert for a process that spawned a child process with suspicious command-line arguments. The analyst wants to see the full process lineage, including the parent process, command line, and the user account that initiated it, to determine if this is a false positive. Which Cortex XDR feature should the analyst use to obtain this information?

Which TWO views in Cortex XDR are primarily used to monitor overall alert and incident status across the SOC? (Choose two)

An analyst is reviewing a Cortex XDR incident where an attacker used a legitimate remote monitoring and management (RMM) tool to maintain persistence. The analyst wants to identify all endpoints where the same RMM tool has been installed and running over the past 30 days. Which Cortex XDR capability should the analyst use?

Which TWO automated or manual response actions can be executed directly on an endpoint from the Cortex XDR Incident Response toolbox? (Choose two)

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

An analyst wants to ensure that any file evaluated with a specific SHA-256 hash is immediately blocked from execution across all endpoints managed by Cortex XDR, regardless of its WildFire verdict. Where should this hash be added?

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

An analyst investigating a ransomware incident on a Windows endpoint needs to determine which process originally created the malicious executable that was later detected. The analyst opens the Cortex XDR Causality Chain view for the alert. Which element of the Causality Chain directly identifies the parent process responsible for spawning the malicious file?

An analyst is investigating an alert involving suspicious PowerShell execution. To thoroughly review the evidence, which THREE investigative steps should the analyst take within Cortex XDR? (Choose three)

An analyst is reviewing a Cortex XDR alert for a suspicious PowerShell script that was executed on a Windows endpoint. The analyst wants to gather additional context about the script's execution. Which TWO data sources are available directly in the Cortex XDR alert details to help understand the script's behavior? (Choose two.)

An analyst is reviewing a Cortex XDR incident where an endpoint has been compromised by malware that established persistence via a scheduled task. The analyst wants to remove the scheduled task remotely. Which response action should the analyst use?

When responding to a malware alert, an analyst decides to quarantine the offending file. Which TWO outcomes occur when Cortex XDR performs a file quarantine? (Choose two)

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

An analyst is investigating a security incident and needs to review the timeline of events that occurred on a compromised endpoint. The analyst wants to see a chronological list of all alerts, process executions, and network connections related to the incident. Which Cortex XDR view should the analyst use?

An analyst is investigating a suspected phishing attack and needs to review the command line arguments passed to a suspicious email attachment execution. Where can the analyst find this evidence in Cortex XDR?

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

During an investigation of a suspected data exfiltration incident, an analyst observes that a finance workstation initiated an outbound SMB connection to an unfamiliar internal host on port 445 at 02:14. The analyst wants to determine whether lateral movement occurred before sensitive files were staged. Which TWO Cortex XDR evidence sources should the analyst review to correlate the SMB session with the originating process and the remote endpoint's activity? (Choose two.)

After containing a malware outbreak, a Cortex XDR analyst needs to verify that the malicious file was removed from all affected endpoints. The analyst wants to confirm the current state of the endpoints without waiting for the next scheduled scan. Which Cortex XDR action allows the analyst to query endpoint file system state on demand and return results to the console?

An analyst is reviewing a Cortex XDR incident involving a suspicious PowerShell script that was executed on multiple endpoints. The analyst needs to gather evidence to determine the script's origin and impact. Which TWO actions should the analyst take to collect relevant evidence from the endpoints? (Choose two.)

When reviewing identity alerts in Cortex XDR, which TWO anomalous behaviors might indicate compromised credentials? (Choose two)

An analyst is reviewing the Causality Chain for an alert. Which TWO key insights does this view provide? (Choose two)

An analyst is reviewing a Cortex XDR incident involving a compromised Linux server. The analyst needs to retrieve the contents of a suspicious file located at /tmp/malware.bin from the endpoint for further analysis. Which response action should the analyst use?

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

An analyst identifies a custom, benign internal tool that is continuously flagged by a BIOC rule in Cortex XDR. To prevent future alerts without disabling the entire rule globally, what is the best practice method to create an exception?