CCNA Evidence Review And Response Actions Questions

Cloud audit and API activity logs capture control-plane operations such as resource creation, modification and deletion, recorded by the provider's own auditing service. They are the primary forensic record for cloud resource changes, unlike endpoint telemetry or network flow data.

Authentication logs from the identity provider (such as Active Directory or a SIEM integrated with Cortex XDR) record successful and failed logon attempts, including source and destination hosts. These logs are essential for detecting lateral movement using stolen credentials, as they show which accounts authenticated to which systems and whether the attempts succeeded.

The Isolate Endpoint action in Cortex XDR cuts off all network communication except for the connection to the Cortex XDR management console. This prevents the ransomware from spreading to other systems or communicating with command-and-control servers, while still allowing the analyst to perform remote investigations and remediation via the console.

XQL queries against registry event tables let the analyst search across the entire dataset for the exact Run key value, rather than inspecting endpoints individually. This directly answers whether other machines share the same persistence mechanism.

Identity and authentication logs record each sign-in with source IP, timestamp and geolocation, letting the analyst correlate the two impossible-travel events and confirm whether the locations are genuine. This directly satisfies the stem's requirement to validate login locations, unlike endpoint or network telemetry, which lacks the identity-provider context Microsoft Entra ID sign-in data provides.

Confirming the digital signature and publisher proves the binary originates from a trusted vendor and has not been tampered with, so the exclusion targets genuine software rather than masquerading malware. This satisfies the stem's requirement that security not be compromised, since unsigned or spoofed files would otherwise gain a behavioural-analysis bypass.

Isolation blocks network traffic at the endpoint while the agent keeps its own outbound channel to the Cortex XDR server, so the analyst retains visibility and response actions. Internal file shares become unreachable because that traffic is dropped, not the management path.

Terminating the process stops the active connection, while blocking its file hash or path prevents the same binary from re-establishing outbound traffic. This satisfies the constraint of blocking communication for that process only, without isolating the host and disrupting unrelated workloads.

The event timestamp establishes the precise point on the attack timeline, letting analysts correlate the alert with surrounding telemetry and satisfy the Incident Viewer's requirement to review when activity occurred. Without it, sequencing causal events across endpoints becomes guesswork, undermining scope assessment during triage.

Windows Security Event logs record local and interactive logon activity, including Event IDs 4624 and 4625, which capture successful and failed authentication attempts directly on the workstation. This satisfies the stem's requirement to determine whether an unauthorised user gained local access, since these events expose the account, logon type and source of each attempt.

Assigning to a named analyst user account satisfies the stem's requirement for an assignment action, routing incident ownership to an individual within Cortex XDR. This differs from reassigning to a team or changing status, which alter queue or workflow state rather than personal accountability for investigation and resolution.

Cortex XDR collects scheduled task events that include details such as the task name, the user account that created or modified the task, and the command or script that is scheduled to run. This is the most direct data source for the analyst's needs.

The Block List lets analysts block specific domains, IP addresses, or file hashes across endpoints without isolating hosts. Adding the malicious domain stops the beaconing while leaving all other traffic untouched, which matches the requirement to disrupt only the threat and preserve business connectivity.

Cortex XDR isolation blocks network traffic to and from the endpoint, cutting off command-and-control and lateral movement, while allowing the agent to maintain its channel to the console. This matches the requirement exactly, letting the analyst continue collecting evidence and issuing response actions while the host is contained.

Remediate Action (Cleanup) automatically reverses the malicious binary's file drops and registry modifications, satisfying the stem's requirement to undo both change types. Cortex XDR's remediation engine quarantines dropped payloads and restores altered registry keys to their prior state, without manual analyst intervention.

The Causality Chain pane visually maps the sequence of process executions (parent-child relationships) and includes command-line arguments for each process. This is the correct location to trace how a suspicious child process was spawned and to view the full command line of the parent, enabling the analyst to assess the attack chain.

Scheduled Tasks provide a native Windows persistence mechanism that survives reboots, letting an APT re-execute payloads without user interaction. Cortex XDR telemetry captures task creation, modification and execution events, so the analyst can correlate suspicious task actions with other persistence artefacts across endpoints.

The Causality Chain in Cortex XDR shows the sequence of processes and their relationships, including the command-line arguments used when each process was launched. By examining the Process Execution History within the Causality Chain, the analyst can see the exact PowerShell command line, including all arguments. This is the most direct way to retrieve that specific detail.

The User Investigation view aggregates activity by identity rather than by endpoint, correlating events for one account across multiple devices over a chosen period. This satisfies the user-centric, seven-day, multi-device requirement by presenting a consolidated timeline of that account's security events.

The WildFire Analysis tab within File Details presents the sandbox verdict and full behavioural report for the submitted file, satisfying the analyst's need to confirm whether WildFire analysed it. Verdicts and reports are surfaced only through this file-centric view, not through alert or endpoint panes.

Automated mitigation only fires when a playbook is bound to ransomware detection triggers, so the alert severity and issue type map to that workflow. Without this trigger binding, high-severity ransomware alerts generate notifications but no automated response actions execute.

Cortex XDR response actions are delivered through the endpoint agent, so the agent must be online and connected for the playbook to receive and run the remediation command. An offline or disconnected endpoint cannot accept the instruction, causing execution to fail.

WildFire verdicts are keyed to the SHA-256 hash, and Cortex XDR surfaces them directly in the file details panel of the causality view. Clicking the report shows the verdict, behavior summary, and MITRE techniques without leaving the investigation context, which is exactly what an analyst needs to confirm whether the binary is known malware before escalating containment.

Documenting lessons learned and updating detection rules or playbooks closes the feedback loop, converting incident findings into improved future detection and response. This satisfies the remediation verification requirement by ensuring systemic gaps identified during review are corrected rather than left to recur.

The Incident Notes section allows analysts to document their investigation steps, findings, and remediation actions directly within the incident. This note is visible to other analysts and is part of the incident record, ensuring that the investigation history is preserved and collaborative.

Grouping related alerts into one attack storyline lets the analyst investigate the whole chain of activity across machines rather than triaging each alert separately, directly reducing alert fatigue while preserving the causal links between the constituent alerts.

The Incident summary dashboard aggregates incidents by severity, showing counts and proportions across critical, high, medium and low. This severity distribution gives analysts an immediate view of incident landscape, satisfying the requirement for information displayed on that dashboard.

XQL Search allows the analyst to query historical network connection events across all endpoints, filtering by the suspicious IP address to see all related communications. This provides the broad, organization-wide context needed to assess the scope of the exfiltration and identify other affected endpoints.

Narrow scoping limits an exclusion to a specific hash and path, so only that known-good file bypasses detection. This satisfies the stem's best-practise requirement by minimising the blind spot, preventing attackers from reusing a broad folder, wildcard or process-name exclusion.

Global Indicator Search hunts known IOCs across all onboarded endpoints and telemetry, returning every host or user matching the artefact. This directly satisfies the enterprise-wide scoping constraint by revealing the incident's full footprint beyond one endpoint.

Retrieve File is the Cortex XDR response action that pulls a specified file from the endpoint's filesystem back to the Cortex XDR console or a designated location, allowing the analyst to obtain the sample without running it. This matches the scenario's requirement to copy the executable for WildFire submission while avoiding local execution, as the action only reads and transfers the file.

Cortex XDR alert details surface network artefacts, including source and destination IP addresses with associated ports, letting analysts pivot to identify command-and-control or lateral-movement traffic. This satisfies the requirement for inspectable connection-level evidence within the incident view.

Forensic File Collection targets live endpoint artefacts, capturing volatile memory and the running process list remotely without disrupting the host. This satisfies the deep forensic requirement, unlike Retrieve File, which pulls individual files from disk rather than volatile memory state.

The Incident Details page also displays the user accounts that were active or associated with the alerts in the incident. This helps analysts understand which credentials may be compromised and to take appropriate containment actions, such as disabling accounts or forcing password resets.

Email gateway logs record the sender, recipient, subject, and attachment name or hash, letting the analyst tie the delivered message to the file observed executing on the endpoint. Matching those hashes confirms the email vector caused the endpoint activity.

The Incident Details page in Cortex XDR includes a Notes section where analysts can add free-text comments to an incident. This is the intended place to document findings, root cause, and remediation steps for future reference. Adding a note here ensures the information is stored with the incident and visible to other analysts reviewing the case.

Resolution notes capture the remediation steps taken before closure, providing an audit trail of containment and eradication actions. This satisfies the requirement to document analyst activity within the incident record, supporting later review and knowledge transfer.

The Incident Queue holds alerts for analyst review, and its manual triage tools let analysts investigate, assign and escalate incidents before automation runs. This provides the human-review half of the integrated workflow the question requires.

Cortex XDR includes a response action to collect a memory dump from an endpoint. This action captures volatile memory, including running processes and loaded modules, in a forensically sound manner. It is the appropriate built-in capability for preserving volatile evidence before reimaging, and it can be initiated directly from the incident or endpoint view.

Cortex XDR Live Terminal gives the analyst an interactive shell on the endpoint for triage and evidence collection, such as listing processes or reading memory-backed data. All commands and output are captured in the action audit log, which preserves chain of custody. It does not grant unlimited persistence; it is a session-based, logged capability intended for investigation rather than long-term administration.

The fields command projects specific columns of interest in the output table.

Exceptions settings hold signature-based exclusions and let you scope them to a specific endpoint group, so the vulnerability scanner detection stops alerting only on those endpoints. Configuring it elsewhere, such as a BIOC or alert rule, would not suppress that signature globally for the group.

Playbook Designer under Response Playbooks defines trigger conditions and automated actions, so a critical-severity alert can invoke a script that collects forensic artifacts without analyst intervention. This satisfies the automation requirement; endpoint policy rules and alert exclusions cannot execute remediation scripts conditionally on severity.

Causality View in Cortex XDR visually maps the process lineage, showing parent-child relationships and the sequence of events that led to an alert. This is exactly what the analyst needs to trace which process spawned the suspicious executable and understand the attack chain.

The network_event dataset captures raw network connection telemetry from endpoints, including source and destination IP addresses, ports, and protocols. This satisfies the stem's requirement for comprehensive network connection data to investigate lateral movement, as it records the actual traffic flows between hosts rather than relying on inferred or aggregated event data.

Network connection events record destination IP, port and connection duration, directly exposing the C2 channel's endpoint and session behaviour. Reviewing them satisfies the stem's requirement to identify C2 communication details that DNS logs alone cannot confirm.

The Incident Graph surfaces the concrete artefacts involved, letting analysts pivot across suspicious files, IP addresses, and user accounts tied to the incident. Naming these attack entities satisfies the evidence-review requirement by exposing the actors and indicators an investigator needs to scope and validate the compromise.

The Incident Header displays the current status and provides the Status field control, letting the analyst transition the incident from Under Investigation to Resolved after remediation. This is the section where incident status updates are performed.

Rapid mass file modification or extension changes is the signature behaviour of ransomware encryption, directly evidencing the attack's impact on the endpoint. This satisfies the stem's ransomware investigation focus by capturing the encryption event itself.

A command-line profile exception matches on the specific command-line arguments used by the legitimate script, so only that invocation is excluded from detection. This avoids whitelisting PowerShell broadly, preserving coverage against malicious PowerShell activity elsewhere.

Get Network Connections is a response action that lists active network connections on the endpoint, including local and remote addresses and ports. This is volatile evidence because network connections change rapidly and are lost upon reboot or process termination. Collecting this data before containment helps the analyst understand command-and-control or lateral movement activity.

Network Isolation blocks inbound and outbound traffic except for the Cortex XDR management channel, which keeps the agent reachable so analysts can still execute response actions, retrieve files, and run scripts. This directly matches the requirement of cutting the host off from the attacker while preserving investigative access.

Hashing the file yields a unique file_sha256 value, so querying the relevant dataset for that hash returns every endpoint where the identical file was observed. This pivots from one detection to all instances organisation-wide without relying on filenames.

The Incident Details page in Cortex XDR includes a Notes section where analysts can add free-text notes to document their investigation. These notes are timestamped and become part of the incident timeline, providing a record of actions and findings. This is the standard place to add such documentation directly within the incident context.

Playbook actions and logic steps define the conditional branching and tasks, such as quarantining endpoints or enriching indicators, that constitute the automated response itself. They satisfy the requirement for executable workflow logic within Cortex XDR.

Quarantine File is an executable containment action that moves or blocks a malicious file on the endpoint through the Cortex XDR agent. This satisfies the automated containment requirement by neutralising the threat artefact without requiring analyst action.

Export Incident report produces the complete incident record plus its associated artefact list, satisfying the compliance requirement for a full report. Other export choices cover only partial data, such as isolated artefacts or filtered tables, so they would omit required detail.

Isolate Endpoint enforces a host-based network containment policy, blocking all traffic except the Cortex XDR management channel, so the analyst retains administrative control while lateral movement is prevented. This directly satisfies the stem's dual requirement: network isolation with preserved administrative access for investigation.

The Cortex XDR agent must retain its management server connection during isolation, otherwise the endpoint cannot receive updated policies or be released from isolation. Permitting this channel satisfies the stem's requirement for continued management while blocking broader network traffic.

Registry modification events in Cortex XDR capture the registry key path, value name, value data, and the process that performed the write. Filtering by the process name isolates the activity of the suspicious process and shows exactly what persistence configuration was created, which directly answers whether a persistence mechanism was established and by which process.

WMI script execution runs through the WmiPrvSE.exe provider host, so process telemetry capturing that host spawning children such as PowerShell or cmd.exe exposes the actual payload command line and parent-child chain, satisfying the need to trace execution beyond the initial WMI trigger.

DLL sideloading exploits Windows search order: a malicious DLL placed beside a legitimate executable loads before the genuine System32 copy. Verifying the DLL's directory therefore exposes the hijack, satisfying the stem's requirement to identify sideloading telemetry rather than generic process or network indicators.

An IP Connection artifact records the observed network connection, listing source and destination IP addresses alongside the port and protocol used. This gives the analyst the specific communication details needed to assess whether the traffic is malicious or expected.

The Causality Chain view in Cortex XDR visually maps the sequence of process executions, showing parent-child relationships, command lines, and user context. It is specifically designed to help analysts understand the root cause and full context of an alert by tracing the process tree backward and forward, which directly answers the need to see lineage and initiating user.

Dashboards aggregate high-level metrics and widget summaries across the environment, giving analysts a consolidated view of alert volumes, incident counts and severity trends. This satisfies the requirement to monitor overall SOC alert and incident status, complementing the case-focused incident view.

XQL (Extended Query Language) allows analysts to search across all collected endpoint telemetry, including process execution and installed applications, over a specified time range. By writing a query that filters for the RMM tool's process name or hash across the last 30 days, the analyst can identify all endpoints where it has been installed and running. This is the most direct and flexible method for this type of threat hunting.

Isolate Endpoint is a direct endpoint response action in the Cortex XDR Incident Response toolbox, severing network communication to contain a compromised host. It executes on the endpoint itself, satisfying the requirement for an action run directly against the device.

File Path and Command-Line arguments scope an exception to the exact executable location and its invocation parameters, so only matching activity is suppressed. This satisfies the need to narrow false-positive suppression precisely, avoiding broad exclusions that would hide genuine threats.

Adding the SHA-256 hash to the Cortex XDR Hash Blocklist enforces a static, verdict-independent block, so execution is denied across all managed endpoints even when WildFire returns benign or no verdict. This directly satisfies the stem's requirement to block by hash regardless of the WildFire result.

Scheduled tasks survive reboots and run automatically, so attackers use them to maintain a foothold after initial compromise. Examining the task's action, trigger and author reveals the persistence mechanism, satisfying the stem's requirement to establish how the attacker retained access rather than merely detecting the initial intrusion.

In the Cortex XDR Causality Chain, each process node is linked to the process that spawned it, so the node directly above the malicious process is its parent. Reviewing that ancestor reveals the exact executable, command line, and user context that launched the payload, which is the precise evidence needed to trace initial execution.

Command-line arguments reveal the actual script, encoded payload or download cradle executed, distinguishing benign administrative use from malicious activity. Cortex XDR captures this telemetry in the process execution event, letting the analyst reconstruct exactly what powershell.exe was instructed to run.

Cortex XDR captures network connection events associated with the process, showing remote IP addresses, ports, and protocols. This data is available in the alert details or causality view. It helps identify command-and-control communication or data exfiltration attempts. Analysts can correlate these connections with threat intelligence to assess maliciousness.

Run Script allows the analyst to execute a custom script on the endpoint, such as a PowerShell or Bash script, to delete the scheduled task. Cortex XDR provides built-in scripts or the ability to upload custom ones. This is the appropriate action when a specific response action for scheduled tasks is not available, giving flexibility to remediate the persistence mechanism.

Quarantine terminates any running processes tied to the offending file, preventing further execution or malicious activity on the endpoint. This containment action satisfies the scenario's requirement to stop active malware, alongside isolating the file itself.