CCNA Evidence Review And Response Actions Questions

The Incident Timeline and Causality view chain alerts, processes and network events into a chronological attack story, exposing forensic artefacts such as executed binaries and registry changes. This satisfies the requirement to surface endpoint forensic evidence within an investigation.

The Incident Details page in Cortex XDR provides a consolidated view of all alerts and associated events for a specific incident, including a timeline that shows the sequence of activities. It aggregates data from multiple sources, such as process executions and network connections, allowing the analyst to see a chronological narrative of the attack. This is the primary workspace for incident investigation.

Process Execution events in the Causality Chain record the full command line and arguments for each process, including the attachment's execution. The analyst can trace the parent email or browser process to the spawned command and read its arguments there.

Reviewing command-line arguments exposes the specific flags used by credential-dumping utilities such as Mimikatz or ProcDump, revealing whether LSASS memory was targeted and which credential stores were accessed. This satisfies the stem's evidence-review constraint by capturing process-level artefacts that reconstruct attacker technique and scope during the incident.

The MITRE ATT&CK tab translates observed behaviours into named tactics and techniques, giving analysts a shared vocabulary for what the attacker did. This mapping satisfies evidence review by contextualising raw alerts within a known framework, aiding scoping, reporting, and identification of coverage gaps.

The Causality Chain reconstructs the parent-child process lineage, showing every process that spawned the suspicious PowerShell execution. This directly satisfies the requirement to review the process hierarchy, unlike the Alert, Incident, or Timeline views, which present detections and events without the ancestral execution path.

Kill Process Tree terminates the specified process together with every descendant it spawned, satisfying the requirement to eliminate the entire malicious process hierarchy on the endpoint. A single-process kill would leave children running and able to persist, whereas this action removes the full tree directly from the Cortex XDR incident view.

Console-level Exceptions under the Cortex XDR Management Console apply to all registered agents, ensuring the penetration testing tool is neither blocked nor alerted on globally. Endpoint-local exclusions would only affect individual hosts, failing the global scope requirement.

Process execution history on the destination host shows what executed after the SMB session arrived, such as remote service creation or file access. Correlating this with the SMB connection timeline confirms whether the connection was used for lateral movement and what actions followed on the target, which is required to validate the intrusion path.

Cortex XDR Live Terminal and script-based response actions let the analyst execute a query on demand across selected endpoints and return output to the console. This provides immediate, auditable confirmation of whether the malicious file remains, without waiting for a scheduled scan, and supports rapid follow-up remediation if the artifact is still present.

The 'Retrieve File' action allows the analyst to download a copy of the PowerShell script from the endpoints for offline analysis. This is crucial for examining the script's contents, obfuscation techniques, and potential payloads. It provides direct evidence of what was executed, which helps determine the script's origin and impact. This action is a standard part of evidence collection in Cortex XDR.

Accessing sensitive resources outside normal working hours and baseline behaviour directly satisfies the compromised-credentials indicator: valid accounts used by an unauthorised party. Cortex XDR baselines each identity's typical access patterns, so deviations in timing or resource scope surface as identity analytics alerts, distinguishing credential misuse from malware-driven activity.

The Causality Chain renders the ordered timeline of activity surrounding a detection, showing which events preceded and followed it. This chronological sequencing satisfies the requirement to understand how the alert unfolded, supporting root-cause analysis rather than merely listing static indicators.

Retrieve File is a Cortex XDR response action that allows analysts to collect a specific file from an endpoint and store it in the Cortex XDR console for offline analysis. It supports Linux, Windows, and macOS endpoints. By specifying the file path, the analyst can obtain the suspicious binary without disrupting the endpoint's operation, enabling deeper forensic examination.

Behavioural alerts fire on process lineage, not file reputation, so a signed-binary exception alone is insufficient. Binding the exception to both the updater's installation path and its valid certificate ensures only that genuine signed binary is exempted, preventing masquerading malware from abusing the exclusion.

A local exception scoped to the specific file hash or path suppresses alerts for that known-benign internal tool while leaving the BIOC rule active for all other endpoints. This satisfies the stem's constraint of preventing future alerts without globally disabling detection coverage.