CCNA Evidence Review And Response Actions Questions

MCQmedium

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

A.Active Directory SYSVOL share

B.Local printer driver cache

C.Local endpoint SAM registry hive

D.Cloud audit and API activity logs

AnswerD

Cloud API activity logs record who performed what action on cloud resources and when.

Why this answer

Cloud infrastructure logs (like AWS CloudTrail or Azure Activity logs) ingested into Cortex XDR provide the audit trail for cloud resource changes.

Practice this question →

MCQmedium

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

A.Syslog server forwarding destination list

B.XQL Search querying registry event tables

C.Cortex XDR Agent installation log

D.GlobalProtect client configuration wizard

AnswerB

XQL search supports querying registry telemetry tables to scope persistence mechanisms across endpoints.

Why this answer

XQL Search allows analysts to query registry modification events across the entire fleet of endpoints to hunt for persistence mechanisms.

Practice this question →

MCQeasy

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

A.Network packet capture (PCAP)

B.Master Boot Record (MBR) analysis

C.Identity and authentication logs

D.Endpoint memory dump

AnswerC

Authentication logs supply the timestamps, source IP addresses, and user identifiers needed to evaluate impossible travel scenarios.

Why this answer

Log data containing IP addresses, user agent strings, and geo-location metadata provides the source of truth for identity analytics and impossible travel alerts.

Practice this question →

Multi-Selecthard

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

Select 3 answers

A.Verify the digital signature and publisher of the application

B.Disable all Cortex XDR agent security modules across the entire enterprise

C.Remove all file access permissions from the operating system kernel

D.Restrict the exception path to the specific application installation directory

E.Test the exception in a staging agent group before applying it organization-wide

AnswersA, D, E

Ensuring the binary is digitally signed by a trusted publisher validates authenticity.

Why this answer

Safe exception implementation involves validating binary integrity, verifying legitimate paths, and testing prior to global deployment.

Practice this question →

MCQmedium

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

A.The agent maintains a dedicated management communication channel to the Cortex XDR server while blocking other network traffic.

B.The host switches to a backup dial-up modem connection.

C.All network traffic is routed through an open public proxy server.

D.The host disables its TCP/IP stack entirely.

AnswerA

Isolation restricts standard network access while preserving the control plane channel for administrative management.

Why this answer

Endpoint isolation blocks all general network traffic while maintaining a secure, dedicated management channel between the Cortex XDR agent and the backend server.

Practice this question →

MCQmedium

An analyst notices suspicious network connections originating from an unknown process on an endpoint. To block outbound communication for this process without isolating the entire host, what action can be taken?

A.Unplug the physical power cable from the workstation

B.Change the local monitor refresh rate

C.Terminate the process and block its file hash or path

D.Reset the enterprise DNS root servers

AnswerC

Terminating the process and blocking its execution prevents the malicious process from running and establishing network sessions.

Why this answer

Network rules or process blocking actions in Cortex XDR can restrict malicious processes from communicating over the network while allowing normal OS operations.

Practice this question →

Multi-Selecteasy

Which TWO details are typically reviewed when inspecting an alert in the Cortex XDR Incident Viewer? (Choose two)

Select 2 answers

A.Timestamp of when the event occurred

B.Local cafeteria lunch receipt totals

C.Alert description and detection rule name

D.Corporate travel booking itineraries

E.Office building parking garage gate codes

AnswersA, C

Timestamps establish the exact timing of the suspicious activity.

Why this answer

Alert inspection involves reviewing detection descriptions, timestamps, affected hosts, and associated MITRE mappings.

Practice this question →

Multi-Selectmedium

Which TWO evidence sources help an analyst investigate whether an unauthorized user accessed a compromised workstation locally? (Choose two)

Select 2 answers

A.Corporate vehicle fleet GPS tracking logs

B.Windows Security Event logs (Event IDs for logon successes and failures)

C.Office cafeteria refrigerator temperature charts

D.Office janitorial cleaning supply invoices

E.User session and authentication telemetry in Cortex XDR

AnswersB, E

Security logs record interactive, RDP, and network logon events.

Why this answer

Local workstation access investigations rely on Windows Security Event logs (Logon/Logoff events) and user session telemetry.

Practice this question →

Multi-Selecteasy

Which TWO actions are available to an analyst when managing an incident's assignment in Cortex XDR? (Choose two)

Select 2 answers

A.Assign the incident to a specific analyst user account

B.Update corporate stock market ticker symbols

C.Re-route office mail delivery to a new address

D.Change corporate office building security guard shifts

E.Assign the incident to a specific SOC analyst group or tier

AnswersA, E

Assignment ensures ownership and accountability for investigating the incident.

Why this answer

Incidents can be assigned to specific analysts or SOC user groups for investigation and accountability.

Practice this question →

MCQmedium

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

A.DNS Flushing

B.DHCP Lease Renewal

C.Static Route Addition

D.Remediate Action (Cleanup)

AnswerD

The Remediate action automatically rolls back changes made by malicious processes, including file drops and registry edits.

Why this answer

Remediation in Cortex XDR can automatically clean up artifacts such as created files, registry modifications, and processes associated with a malicious execution.

Practice this question →

Multi-Selecthard

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Select 3 answers

A.Office desk relocation requests

B.Breakroom coffee machine maintenance schedules

C.Windows Scheduled Tasks

D.Windows Services creation and modification

E.Registry Run and RunOnce keys

AnswersC, D, E

Scheduled tasks execute malicious payloads at specified times or system triggers.

Why this answer

Common endpoint persistence mechanisms include Run keys, scheduled tasks, and Windows services.

Practice this question →

MCQeasy

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

A.Disk Encryption status panel

B.Agent Health dashboard

C.BIOC Policy editor

D.User Investigation view

AnswerD

User Investigation is specifically designed to correlate activities and alerts tied to a specific user identity.

Why this answer

The User Investigation view in Cortex XDR aggregates user activity, authentication events, and associated alerts across endpoints and cloud environments.

Practice this question →

MCQeasy

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

A.DHCP Server status log

B.File Details / WildFire Analysis tab

C.DNS query statistics panel

D.Printer queue management interface

AnswerB

File inspection views display comprehensive WildFire sandbox analysis results, behaviors, and verdicts.

Why this answer

The WildFire analysis report and verdict are accessible directly from the file details or alert inspection panel within Cortex XDR.

Practice this question →

Multi-Selecthard

An organization wants to configure Cortex XDR to automatically respond to high-severity ransomware alerts. Which THREE elements must be correctly configured to ensure successful automated mitigation? (Choose three)

Select 3 answers

A.Response Playbook configured with ransomware detection triggers

B.Manual adjustment of office lighting dimmer switches

C.Manual postal mail notification to external regulatory bodies

D.Appropriate response actions defined in the playbook (e.g., Isolate Endpoint, Kill Process)

E.Active management connectivity between endpoints and the Cortex XDR backend

AnswersA, D, E

Playbooks must be configured to listen for and trigger on ransomware detection alerts.

Why this answer

Automated ransomware mitigation requires active agent connectivity, properly configured response playbooks, and appropriate containment actions such as isolation or process termination.

Practice this question →

MCQhard

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

A.The endpoint agent must be online and connected to receive the command.

B.The user must manually approve every automated step in the playbook.

C.The endpoint must have local administrative privileges disabled.

D.The endpoint must be running a legacy operating system without secure boot.

AnswerA

Real-time remediation actions require an active management connection between the backend and the endpoint agent.

Why this answer

Automated response playbooks require the Cortex XDR agent to be actively connected and online to receive and execute commands such as isolation or file quarantine.

Practice this question →

Multi-Selecthard

When conducting a comprehensive post-incident review and remediation verification in Cortex XDR, which THREE actions should an analyst perform? (Choose three)

Select 3 answers

A.Review and document lessons learned, updating detection rules or playbooks as needed

B.Verify that all compromised endpoints report healthy agent status and no active malicious processes

C.Permanently uninstall Cortex XDR agents from all enterprise endpoints

D.Ensure that temporary containment measures (like endpoint isolation) are lifted once remediation is complete

E.Delete all historical telemetry databases to save disk space permanently

AnswersA, B, D

Post-incident analysis improves future defenses and detection engineering.

Why this answer

Post-incident review includes verifying threat eradication, ensuring agent health, and updating detection rules or exceptions.

Practice this question →

MCQeasy

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

A.It automatically upgrades endpoint operating system licenses.

B.It deletes duplicate log files to save storage space.

C.It reduces alert fatigue by grouping related alerts into a single attack storyline.

D.It provisions new virtual machines for containment.

AnswerC

Incident correlation aggregates disparate telemetry into unified incidents to reflect the broader campaign.

Why this answer

Incident grouping correlates related alerts into a single incident based on causality and shared artifacts, reducing alert fatigue and providing a cohesive attack narrative.

Practice this question →

Multi-Selecteasy

Which TWO pieces of information are displayed in the Incident summary dashboard of Cortex XDR? (Choose two)

Select 2 answers

A.Overall incident severity distribution

B.Cellular phone network tower signal strengths

C.Local employee salary payroll database records

D.Total number of affected hosts and endpoints

E.Commercial airline flight booking schedules

AnswersA, D

Severity breakdown helps triage high-priority incidents.

Why this answer

The Incident summary provides high-level metrics such as total incident count, severity distribution, and affected host counts.

Practice this question →

Multi-Selecthard

When managing exclusions and exceptions in Cortex XDR, which THREE best practices should an analyst follow to maintain security posture? (Choose three)

Select 3 answers

A.Share internal exception hashes publicly on open social media channels

B.Scope exceptions as narrowly as possible (e.g., specific hash and path)

C.Document the business justification and ticket reference for every exception created

D.Periodically review and audit existing exceptions to ensure they are still necessary

E.Disable all default Cortex XDR BIOC rules globally upon deployment

AnswersB, C, D

Narrow scoping prevents overly broad exceptions from creating security blind spots.

Why this answer

Effective exception management requires scoping rules tightly, documenting justifications, and reviewing exceptions periodically.

Practice this question →

Multi-Selecteasy

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

Select 2 answers

A.Mouse pointer speed settings

B.Audio speaker volume mixer

C.Global Indicator Search / Threat Hunting

D.Physical keyboard backlight color adjuster

E.XQL Search (Query Builder)

AnswersC, E

Threat hunting features allow checking if a hash or IP appears anywhere in the environment.

Why this answer

Enterprise scoping is accomplished using XQL search and global threat hunting tools.

Practice this question →

Multi-Selecteasy

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

Select 2 answers

A.IP Connection (Source/Destination IP and Port)

B.Physical RAM stick serial number

C.Office printer cartridge ink level

D.File hash (SHA-256)

E.BIOS manufacturer date

AnswersA, D

Network connection artifacts are routinely recorded and displayed for alerts involving network activity.

Why this answer

Cortex XDR incident and alert views capture various telemetry artifacts, notably file hashes and network connection details.

Practice this question →

MCQmedium

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

A.Retrieve File and Forensic File Collection

B.Global Protect Tunnel Inspection

C.Agent Upgrade Schedule

D.WildFire Submission Policy

AnswerA

Forensic and file retrieval features allow pulling artifacts from the endpoint for offline or deep inspection.

Why this answer

Cortex XDR allows analysts to trigger forensic data collection, including file retrieval and process information, directly from the incident response tools.

Practice this question →

Multi-Selectmedium

An analyst is investigating an incident where a malicious file was dropped via email. Which TWO evidence artifacts should the analyst inspect to correlate the email vector with the endpoint execution? (Choose two)

Select 2 answers

A.Employee dental insurance benefit claim forms

B.Office building elevator maintenance inspection reports

C.Email gateway logs (sender, recipient, subject, and attachment name/hash)

D.Corporate cafeteria recipe preparation guidelines

E.Endpoint file drop and process execution events matching the attachment hash

AnswersC, E

Email logs identify how the malicious attachment entered the organization.

Why this answer

Correlating email vectors with endpoint execution involves analyzing email gateway logs and endpoint file drop events.

Practice this question →

Multi-Selecteasy

Which TWO actions can an analyst take when closing an incident in Cortex XDR? (Choose two)

Select 2 answers

A.Conduct an employee annual performance review meeting

B.Order replacement laptops for all company employees

C.Add resolution notes detailing remediation steps taken

D.Assign a resolution status (e.g., Resolved - True Positive, Resolved - False Positive)

E.Initiate a physical factory reset of the datacenter cooling system

AnswersC, D

Notes provide historical context and documentation for future audits.

Why this answer

Incidents can be closed with specific resolution statuses and closing notes to document the outcome.

Practice this question →

Multi-Selecthard

An analyst wants to create a robust incident response workflow in Cortex XDR that incorporates both manual analyst review and automated remediation. Which THREE capabilities support this integrated approach? (Choose three)

Select 3 answers

A.Incident Queue and manual triage tools for analyst review

B.Automated physical destruction of endpoint motherboard circuits

C.Manual replacement of physical office windows

D.Exceptions management for tuning and suppressing verified false positives

E.Response Playbooks for automated containment and artifact collection

AnswersA, D, E

Analyst review tools enable human-in-the-loop validation and investigation.

Why this answer

Integrated workflows utilize incident management queues, automated response playbooks, and granular exception tuning.

Practice this question →

Multi-Selecthard

An analyst is performing advanced threat hunting in Cortex XDR using XQL. Which THREE clauses or functions are commonly used when constructing analytical queries for evidence review? (Choose three)

Select 3 answers

A.fields command to select and display specific attributes or columns

B.reboot operating system kernel function

C.filter command to narrow down results based on specific criteria

D.format hard drive command to wipe the query storage engine

E.dataset command to specify the telemetry table (e.g., dataset = xdr_data)

AnswersA, C, E

The fields command projects specific columns of interest in the output table.

Why this answer

XQL queries utilize clauses like dataset filtering, field projection (fields), and aggregation (alt / dedup / count) to analyze telemetry.

Practice this question →

MCQhard

An analyst wants to prevent Cortex XDR from generating alerts on a specific signature-based detection (such as a known vulnerability scanner tool) across a specific endpoint group. Where should this exclusion be created?

A.In the individual user's operating system environment variables

B.By modifying the BIOS firmware on the endpoint group

C.Exceptions settings page, scoping the rule to the target endpoint group

D.Through the global firewall packet filter configuration

AnswerC

Scoping exceptions to specific groups ensures targeted suppression without disabling protections globally.

Why this answer

Exceptions in Cortex XDR can be scoped to specific agent groups and detection types via the Exceptions management interface.

Practice this question →

MCQhard

An administrator needs to automate a remediation workflow so that whenever a specific critical alert severity is triggered, Cortex XDR automatically runs a script to collect forensic artifacts. Where must this automation be configured?

A.Response Playbooks -> Playbook Designer

B.Agent Settings -> Granular Control

C.Security Information and Event Management (SIEM) forwarder

D.Data Collection rules

AnswerA

Response Playbooks allow the definition of automated workflows and script executions triggered by alert criteria.

Why this answer

Automated response actions linked to specific alerts and incident triggers are managed via Response Playbooks within Cortex XDR or integrated Cortex XSOAR.

Practice this question →

MCQhard

An analyst writes an XQL query to investigate lateral movement. Which dataset table in Cortex XDR contains comprehensive network connection telemetry across endpoints?

A.user_identity_mapping

B.cloud_storage_bucket_policy

C.agent_upgrade_history

D.network_event (or xdr_data filtering network events)

AnswerD

Network event telemetry tables record inbound and outbound connections made by processes on endpoints.

Why this answer

The xdr_data table or network_event dataset tables in Cortex XDR store parsed network session and connection telemetry.

Practice this question →

Multi-Selectmedium

An analyst discovers that a malicious payload communicated with an external Command and Control (C2) server. Which TWO evidence sources should the analyst review to identify the C2 communication details? (Choose two)

Select 2 answers

A.Local office printer toner cartridge status

B.Employee parking permit registration forms

C.Network connection event logs (Destination IP, port, and connection duration)

D.Corporate conference room booking calendars

E.DNS query logs showing domain names resolved by the endpoint

AnswersC, E

Network event logs record outbound connection destinations and ports used for C2.

Why this answer

C2 communications are investigated using network connection telemetry and DNS request history logs.

Practice this question →

Multi-Selecteasy

Which TWO details does the Cortex XDR Incident Graph display during evidence review? (Choose two)

Select 2 answers

A.Key attack entities such as suspicious files, IP addresses, and user accounts

B.Corporate parking lot lighting schedules

C.Relationships between alerts, endpoints, and malicious artifacts

D.Office desk chair ergonomic adjustment instructions

E.Breakroom microwave operational wattage ratings

AnswersA, C

Nodes in the graph represent distinct entities like IPs, users, and hashes.

Why this answer

The Incident Graph visually maps relationships between alerts, endpoints, users, and files involved in an incident.

Practice this question →

MCQeasy

An analyst needs to change the status of an incident from 'Under Investigation' to 'Resolved' after completing remediation. Which section of the Incident View allows updating the incident status?

A.BIOC rule creation dialog

B.Incident Header / Status field

C.WildFire file submission form

D.Agent upgrade wizard

AnswerB

The incident status field in the header allows analysts to update the lifecycle state of the incident.

Why this answer

Incident metadata such as status, assignment, and severity can be updated directly from the Incident header or details pane.

Practice this question →

Multi-Selectmedium

Which TWO forensic logs or artifacts are most valuable when investigating a suspected ransomware attack on an endpoint? (Choose two)

Select 2 answers

A.File system activity logs showing rapid mass file modifications or extensions

B.Visitor badge sign-in sheets

C.Cafeteria menu rotation schedules

D.Office desk assignment floor plans

E.Process execution logs revealing attempts to delete Volume Shadow Copies (e.g., vssadmin delete shadows)

AnswersA, E

Mass file encryption typically results in high-volume file modification and extension renaming events.

Why this answer

Ransomware investigations rely heavily on file activity logs (mass modifications/renaming) and volume shadow copy deletion logs.

Practice this question →

MCQhard

An organization experiences a false positive alert caused by a legitimate administrative script executed via PowerShell. The analyst wants to create an exception that applies specifically to this script's command-line arguments without whitelisting PowerShell entirely. What type of exception should be configured?

A.Agent removal exception

B.Global file hash exception

C.Network connection exclusion

D.Command-line profile exception

AnswerD

Command-line exceptions allow granular tuning by evaluating the exact parameters passed to the utility.

Why this answer

Command-line argument exceptions allow administrators to filter out specific benign invocations of legitimate administrative tools like PowerShell while retaining full detection coverage.

Practice this question →

MCQmedium

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

A.Run an XQL Search querying the dataset for the specific file_sha256 value.

B.Review the Global Protect gateway traffic logs for file downloads.

C.Create a new BIOC rule and wait for the file to be executed again.

D.Export the Windows Event logs from a single machine and compare manually.

AnswerA

Querying xdr_data for the file hash is the standard threat-hunting method to scope file prevalence.

Why this answer

XQL Search allows analysts to query dataset tables such as xdr_data using the file_sha256 field to hunt for presence across all onboarded endpoints.

Practice this question →

Multi-Selecthard

An administrator needs to configure automated incident response actions in Cortex XDR. Which THREE components are critical for building a successful automated response workflow? (Choose three)

Select 3 answers

A.Corporate cafeteria catering menu pricing sheets

B.Physical server room air conditioning coolant levels

C.Playbook actions and logic steps (such as quarantine or enrichment)

D.Integration configurations (connecting Cortex XDR with XSOAR or other tools)

E.Trigger conditions (such as incident severity or specific alert types)

AnswersC, D, E

Actions define what tasks the automation performs when triggered.

Why this answer

Automated response workflows require triggers (alerts/incidents), playbook logic/steps, and integration targets or response actions.

Practice this question →

Multi-Selecthard

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

Select 3 answers

A.Quarantine File

B.Isolate Endpoint

C.Physically replace damaged endpoint motherboard hardware

D.Collect forensic investigation package from the host

E.Update the corporate website DNS homepage banner

AnswersA, B, D

Playbooks can automatically quarantine malicious files identified across endpoints.

Why this answer

Playbooks support automated containment and investigative tasks such as endpoint isolation, file quarantine, and artifact gathering.

Practice this question →

MCQeasy

An analyst is investigating an incident and wants to export the full incident report and associated artifact list for compliance reporting. Which option should the analyst select in Cortex XDR?

A.Export Incident report

B.Format hard drive

C.Reboot endpoint agent

D.Purge telemetry database

AnswerA

Exporting the incident generates a structured report containing the details required for compliance and record-keeping.

Why this answer

The export incident functionality allows security analysts to download comprehensive reports containing alerts, artifacts, and investigation notes.

Practice this question →

MCQmedium

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

A.Disable User

B.Isolate Endpoint

C.Kill Process Tree

D.Quarantine File

AnswerB

Isolate Endpoint cuts off network traffic to and from the host, preventing lateral movement, while preserving the management channel for remediation.

Why this answer

Isolate Endpoint allows an administrator to sever the network connection of a compromised host while retaining Cortex XDR agent communication and administrative troubleshooting access.

Practice this question →

Multi-Selectmedium

When an endpoint is isolated during an incident response action in Cortex XDR, which TWO types of network traffic are generally permitted to ensure continued management and minimal disruption? (Choose two)

Select 2 answers

A.Unrestricted peer-to-peer torrent file sharing traffic

B.Communication channel between the Cortex XDR agent and the management server

C.Personal social media video streaming broadcasts

D.Traffic to defined exceptions or management infrastructure (such as DNS/Active Directory if configured)

E.Public online gaming multiplayer connections

AnswersB, D

The management channel must remain open so administrators can control and un-isolate the agent.

Why this answer

Endpoint isolation blocks general network traffic while permitting communication with the Cortex XDR server and essential domain services if configured.

Practice this question →

Multi-Selectmedium

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

Select 2 answers

A.Bluetooth peripheral pairing histories

B.Process execution telemetry showing WmiPrvSE.exe spawning child processes

C.Local monitor color calibration profiles

D.Desktop wallpaper image file paths

E.WMI event subscription and consumer logs

AnswersB, E

WmiPrvSE.exe spawning unusual child processes indicates WMI-based execution.

Why this answer

WMI activity generates specific process execution and WMI event consumer telemetry logs.

Practice this question →

Multi-Selectmedium

When investigating an endpoint compromise, an analyst suspects DLL sideloading was used to execute malicious code. Which TWO telemetry indicators should the analyst examine? (Choose two)

Select 2 answers

A.File path analysis verifying whether the DLL resides in the application directory rather than System32

B.Company cafeteria seating arrangement charts

C.DLL load events showing unsigned or unexpected DLLs loaded into legitimate processes

D.Corporate gym equipment maintenance logs

E.Office parking garage barrier arm position logs

AnswersA, C

Checking load paths reveals if the application loaded a rogue DLL locally before looking in system directories.

Why this answer

DLL sideloading investigations involve reviewing DLL load events and checking file paths and digital signatures of loaded binaries.

Practice this question →

MCQeasy

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

A.Software license expiration dates

B.Network connection details including source, destination, port, and protocol

C.Hardware temperature and fan speed metrics

D.Local user account password complexity settings

AnswerB

IP connection artifacts capture network session metadata for forensic review.

Why this answer

An IP connection artifact details network communication telemetry, including source IP, destination IP, port, and protocol used during the event.

Practice this question →

Multi-Selecteasy

Which TWO actions can be performed directly from the Cortex XDR Incident Details page when reviewing evidence? (Choose two)

Select 2 answers

A.Order office catering supplies for the team meeting

B.Update incident status and assignment

C.Schedule routine commercial window washing

D.View alert timelines and associated artifacts

E.Calibrate the office thermostat temperature

AnswersB, D

Analysts can manage workflow metadata directly from the details page.

Why this answer

The Incident Details page allows analysts to view alert timelines, examine artifacts, and change incident status.

Practice this question →

Multi-Selecteasy

Which TWO views in Cortex XDR are primarily used to monitor overall alert and incident status across the SOC? (Choose two)

Select 2 answers

A.Commercial shipping logistics tracking application

B.Local operating system task manager

C.Dashboards (providing high-level metrics and widget summaries)

D.Incident View / Incident Queue

E.Office water cooler maintenance portal

AnswersC, D

Dashboards summarize security posture, alert trends, and agent health.

Why this answer

SOC monitoring dashboards and incident queues provide visibility into enterprise security status.

Practice this question →

Multi-Selectmedium

Which TWO automated or manual response actions can be executed directly on an endpoint from the Cortex XDR Incident Response toolbox? (Choose two)

Select 2 answers

A.Upgrade BIOS firmware

B.Calibrate display resolution

C.Reimage Operating System kernel

D.Isolate Endpoint

E.Quarantine File

AnswersD, E

Isolate Endpoint is a core containment action available in the Cortex XDR response toolbox.

Why this answer

Cortex XDR provides direct endpoint response capabilities such as endpoint isolation and file quarantine.

Practice this question →

Multi-Selecthard

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

Select 3 answers

A.File Path and Command-Line arguments

B.Local user keyboard layout language

C.Digital Signature / Certificate information

D.Endpoint CPU temperature threshold

E.File Hash (SHA-256)

AnswersA, C, E

Path and command-line parameters allow precise scoping for administrative scripts or tools.

Why this answer

Cortex XDR supports granular exception configuration using file hashes, digital signatures, and file paths or command-line arguments.

Practice this question →

MCQhard

An analyst wants to ensure that any file evaluated with a specific SHA-256 hash is immediately blocked from execution across all endpoints managed by Cortex XDR, regardless of its WildFire verdict. Where should this hash be added?

A.Hash Blocklist in Cortex XDR

B.Network interface promiscuous mode toggle

C.Agent debug log level selector

D.Cortex XSOAR integration ticket template

AnswerA

Adding a hash to the Blocklist ensures prevention agents intercept and block execution regardless of dynamic analysis.

Why this answer

Blocking specific file hashes across all endpoints is accomplished by adding the hash to the Hash Blocklist under Response or Malware Protection settings.

Practice this question →

MCQeasy

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

A.To verify the hardware specifications of the endpoint

B.To determine how the attacker established persistence on the system

C.To analyze the local user group membership policies

D.To inspect the network throughput limits of the adapter

AnswerB

Scheduled tasks are a primary Windows mechanism for maintaining persistence across reboots.

Why this answer

Attackers frequently use scheduled tasks for persistence, allowing malicious code or scripts to run automatically at specific times or system events.

Practice this question →

Multi-Selecthard

An analyst is investigating an alert involving suspicious PowerShell execution. To thoroughly review the evidence, which THREE investigative steps should the analyst take within Cortex XDR? (Choose three)

Select 3 answers

A.Examine the exact command-line arguments passed to powershell.exe

B.Check the physical desk phone extension number of the user

C.Review the Causality Chain to identify which parent process spawned PowerShell

D.Verify the physical building entry badge reader logs

E.Inspect network connections initiated by the PowerShell process

AnswersA, C, E

Command lines often contain encoded scripts, downloaded payloads, or execution bypass flags.

Why this answer

PowerShell investigations require reviewing command-line arguments, parent process lineage, and spawned child processes or network connections.

Practice this question →

Multi-Selectmedium

When responding to a malware alert, an analyst decides to quarantine the offending file. Which TWO outcomes occur when Cortex XDR performs a file quarantine? (Choose two)

Select 2 answers

A.All network routers in the enterprise data center are reset.

B.Running processes associated with the file are terminated.

C.The computer's power supply unit is permanently disabled.

D.The file is moved from its original location to a secure quarantine folder on the endpoint.

E.The endpoint operating system hard drive is physically wiped clean.

AnswersB, D

Quarantine action halts active execution of the file before securing it.

Why this answer

Quarantine terminates the running process instance (if applicable) and moves the file binary from its original path to a secure, encrypted quarantine location on the endpoint.

Practice this question →

Multi-Selecteasy

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

Select 2 answers

A.Incident Timeline / Causality view

B.Corporate gym membership roster

C.File Details / Forensic File Collection view

D.Cloud printer ink supply level gauge

E.Cafeteria food inventory management sheet

AnswersA, C

Timelines and causality views display forensic event sequences.

Why this answer

Forensic data and file details are accessible via the File Details view and forensic collection reports.

Practice this question →

MCQmedium

An analyst is investigating a suspected phishing attack and needs to review the command line arguments passed to a suspicious email attachment execution. Where can the analyst find this evidence in Cortex XDR?

A.Hardware asset inventory list

B.Agent network proxy configuration file

C.DNS server cache table

D.Process Execution details within the Causality Chain

AnswerD

Process execution nodes in the Causality Chain display command line arguments, user context, and parent-child relationships.

Why this answer

The Process Execution view and Causality Chain record the exact command line arguments passed when a process is spawned.

Practice this question →

Multi-Selectmedium

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

Select 2 answers

A.Verify employee cafeteria badge swipe access times

B.Check the office HVAC temperature logs

C.Analyze cafeteria point-of-sale receipt records

D.Review command-line arguments for utility tools utilized during the attack

E.Inspect process access events targeting LSASS.exe

AnswersD, E

Command lines often reveal specific parameters used for dumping credentials or exporting registry hives.

Why this answer

Credential dumping investigations involve analyzing process access telemetry and examining associated endpoint logs.

Practice this question →

MCQeasy

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

A.It provides network routing tables for the compromised subnet.

B.It maps the behaviors observed in the incident to known attacker tactics and techniques.

C.It automatically downloads security patches from vendor repositories.

D.It lists the hardware warranty status of the affected device.

AnswerB

MITRE ATT&CK mapping standardizes terminology around adversary Tactics, Techniques, and Procedures.

Why this answer

The MITRE ATT&CK tab maps detected tactics and techniques to the standard framework, helping analysts understand attacker behavior and TTPs.

Practice this question →

MCQeasy

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

A.Action Center

B.Audit Log

C.BIOC Rules Manager

D.Causality Chain

AnswerD

The Causality Chain explicitly shows the lineage of processes, including the triggering parent process and subsequent child executions.

Why this answer

The Causality Chain in Cortex XDR provides a graphical representation of the process tree, showing the chronological sequence of events, parent-child process relationships, and associated artifacts that led to an execution.

Practice this question →

MCQmedium

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

A.Retrieve File

B.Block File Hash

C.Kill Process Tree

D.Isolate Endpoint

AnswerC

Kill Process Tree stops the parent process and all child processes spawned underneath it.

Why this answer

The 'Kill Process Tree' action terminates the targeted process along with all descendant processes spawned by it, ensuring complete neutralization of the threat tree.

Practice this question →

MCQhard

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

A.Syslog forwarding rules

B.Cortex XDR Management Console under Exceptions

C.User Identity mapping rules

D.Local Windows Registry on each endpoint

AnswerB

Centralized exceptions are configured in the Cortex XDR console under the Exceptions or Profiles section to apply globally or to specific groups.

Why this answer

Global exclusions and exceptions in Cortex XDR are managed centrally under Response -> Exceptions or Agent Settings, ensuring organization-wide application.

Practice this question →

MCQhard

An analyst is investigating an alert where an attacker attempted credential dumping via LSASS. To understand the exact API calls and techniques used by the process, which evidence source within Cortex XDR provides low-level OS event telemetry?

A.Causality Graph and raw telemetry event streams

B.Firewall Security Policy rules

C.Email Gateway spam filter logs

D.Cloud Storage bucket policies

AnswerA

Raw telemetry and the Causality Graph capture granular OS events such as process access and API interactions.

Why this answer

Cortex XDR endpoint telemetry records low-level operating system events, including DLL loads, process creations, and API monitoring events via kernel/user-mode hooks.

Practice this question →

Multi-Selectmedium

When reviewing identity alerts in Cortex XDR, which TWO anomalous behaviors might indicate compromised credentials? (Choose two)

Select 2 answers

A.Accessing sensitive resources outside normal working hours and baseline behavior

B.Connecting a standard corporate wired Ethernet cable

C.Impossible travel logins from geographically distant locations within minutes

D.Printing a standard business document to the local office printer

E.Routine login from the user's assigned office desktop during regular business hours

AnswersA, C

Behavioral anomalies include unusual access hours or atypical data access volumes.

Why this answer

Identity analytics look for unusual access patterns such as impossible travel or abnormal login times.

Practice this question →

Multi-Selecteasy

An analyst is reviewing the Causality Chain for an alert. Which TWO key insights does this view provide? (Choose two)

Select 2 answers

A.The physical location of the server room containing the host

B.The corporate email distribution list membership

C.The chronological sequence of events associated with the detection

D.The power consumption wattage of the CPU

E.The parent-child process relationship leading to the alert

AnswersC, E

Events in the Causality Chain are displayed chronologically to show the attack progression.

Why this answer

The Causality Chain illustrates the process lineage and the temporal sequence of events leading to an alert.

Practice this question →

MCQhard

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

A.Configuring a network port forwarding rule

B.Deleting the software updater from all endpoints

C.Signed binary exception with path and certificate verification

D.Disabling all behavioral monitoring on the subnet

AnswerC

Verifying the digital signature and legitimate path prevents unauthorized binaries from bypassing detection while silencing the known good tool.

Why this answer

Signed binary exceptions combined with valid certificate verification and file path checks allow legitimate administrative or updater tools to operate without generating alerts.

Practice this question →

MCQhard

An analyst identifies a custom, benign internal tool that is continuously flagged by a BIOC rule in Cortex XDR. To prevent future alerts without disabling the entire rule globally, what is the best practice method to create an exception?

A.Modify the Agent Settings profile to stop reporting all file execution events.

B.Disable the BIOC rule globally in the Profiles page.

C.Create a local exception using the specific file hash or path within the Exceptions management page.

D.Delete the alert from the Incident View to prevent re-triggering.

AnswerC

Targeted exceptions using file hashes or signatures prevent false positives while maintaining the detection efficacy of the overarching rule.

Why this answer

Creating an exception using file hash or digital signature parameters directly from the alert context ensures targeted suppression without weakening the broader BIOC rule effectiveness.

Practice this question →