scenario questions

An analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?

An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?

An analyst observes that an incident's score dynamically increases over time as new related alerts are added. Which component of Cortex XDR drives this behavior?

What is the primary purpose of integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR?

An analyst is investigating a Cortex XDR incident that contains alerts from an endpoint infected with malware. The analyst wants to determine which specific process on that endpoint initiated the malicious network connection. Which Cortex XDR feature should the analyst use to view the parent-child process relationships associated with the alert?

An analyst notices that a service account is generating alerts for anomalous login locations. Upon review, the account is used by an automated batch script running from a newly provisioned server. How should the analyst resolve this alert while maintaining security best practices?

An analyst is investigating an ITDR incident in Cortex XDR where an attacker used a compromised service account to create a new domain admin account. The analyst needs to review the sequence of authentication and directory-change events leading to the new account creation. Which Cortex XDR feature provides a chronological, identity-centric timeline for this investigation?

An analyst is reviewing a cloud-based incident in Cortex XDR (such as AWS or Azure activity). Which evidence source provides the primary forensic logs for cloud resource modifications?

An administrator is setting up User Risk Scoring within Cortex XDR. They notice that certain service accounts with high volumes of automated authentications are skewing the risk calculations. How should the administrator handle these service accounts in Cortex XDR to prevent false-positive risk elevations?

An analyst is reviewing a Cortex XDR incident that was created by the correlation engine. The analyst wants to understand why certain alerts were grouped together. Which two factors does the Cortex XDR correlation engine primarily use to stitch alerts into a single incident? (Choose two.)

A security administrator is planning a Cortex XDR deployment for a large enterprise with endpoints in multiple VLANs. The administrator must ensure that the Cortex XDR agents can communicate with the Broker VM and that the Broker VM can reach the Cortex XDR management console. Which TWO network requirements must be met to support this deployment? (Choose two.)

An organization notices that Cortex XDR incidents are being assigned high severity scores primarily due to a noisy network alert rule that triggers frequently on internal port scans. What is the correct administrative workflow to resolve this scoring inflation?

A Cortex XDR analyst is investigating an incident where a user's endpoint was compromised. The analyst needs to determine if the attacker moved laterally to other endpoints by leveraging stolen credentials. Which Cortex XDR data source should the analyst query to identify successful and failed authentication attempts across the environment?

An analyst is investigating a Cortex XDR alert indicating a possible ransomware attack. The analyst wants to isolate the affected endpoint from the network while preserving the ability to remotely investigate and remediate. Which Cortex XDR response action should the analyst take?

An analyst wants to analyze the raw alert data that directly triggered a specific Cortex XDR incident to understand the exact sequence of events before automated grouping occurred. Where in the Cortex XDR console can the analyst view the individual raw alerts associated with an incident?

An analyst wants to flag a particular high-priority incident so that other shift analysts immediately notice it when they log in. What is the most direct feature to use?

An administrator is planning the initial installation of Cortex XDR agents on 500 Windows endpoints. The security policy requires that endpoints authenticate to the Cortex XDR tenant during installation using a shared secret that can be rotated if compromised. Which item must the administrator generate in the Cortex XDR management console before installing the agents?

An administrator wants to ensure that Cortex XDR agents automatically update their software version whenever a new version is released by Palo Alto Networks. Where is this automated agent upgrade setting configured?

When reviewing the Incident View, an analyst notices an incident with an orange severity badge. What does this severity level typically indicate in Cortex XDR?

An analyst identifies a malicious persistence mechanism utilizing a Run registry key. After removing the threat, the analyst wants to verify whether any other machines have this exact registry key populated. Which tool should the analyst use?

When reviewing an incident, an analyst wants to assign ownership to themselves. Which action should the analyst take?

An organization has strict egress filtering rules. Which destination URLs or IP ranges must be whitelisted in the corporate firewall to allow the Cortex XDR agent to communicate with the Cortex XDR cloud service?

An analyst is reviewing identity analytics data in Cortex XDR and notices an impossible travel alert for a user account. Which evidence artifact should the analyst primarily inspect to validate the login locations?

An attacker compromises a domain user account and attempts to enumerate domain admins using native Windows utilities (e.g., 'net group "Domain Admins" /domain'). Which Cortex XDR detection mechanism is specifically designed to catch such reconnaissance behaviors without relying solely on static signatures?

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

An analyst wants to ensure that a newly discovered legitimate application is excluded from Cortex XDR behavioral analysis without compromising overall security. Which THREE steps or considerations are essential? (Choose three)

During incident response, an analyst isolates a host using Cortex XDR. The user on the machine reports that they can no longer reach internal file shares, but the analyst still has visibility and control over the agent. How is this achieved?

What THREE outcomes typically occur when data stitching successfully links a network alert and an endpoint alert? (Choose three)

A security administrator is preparing to install Cortex XDR agents on a large number of Windows endpoints. The administrator wants to ensure that the agents automatically register with the correct Cortex XDR tenant and receive the appropriate policy settings. Which item must be included in the agent installation package or command line to achieve this?

An analyst notices suspicious network connections originating from an unknown process on an endpoint. To block outbound communication for this process without isolating the entire host, what action can be taken?

Which TWO details are typically reviewed when inspecting an alert in the Cortex XDR Incident Viewer? (Choose two)

A Cortex XDR administrator is planning agent deployment for 5,000 Windows endpoints in a data center with restricted internet access. The security team requires that endpoints receive policy updates and upload telemetry without direct outbound internet connectivity. The administrator decides to deploy a Broker VM. Which Cortex XDR component must the Broker VM communicate with to receive policy updates and forward telemetry from agents?

An enterprise is facing credential stuffing attacks targeting its cloud and on-premises applications. Which TWO detection or mitigation strategies within Cortex XDR and integrated tools help address this threat?

An analyst is investigating a Cortex XDR incident that was automatically created from a high-severity alert. The analyst determines that the alert is a false positive and wants to ensure that future identical alerts do not create new incidents. What is the most appropriate action?

Which TWO log sources are commonly ingested into Cortex XDR to support Identity Threat Detection and Response (ITDR)?

Which TWO evidence sources help an analyst investigate whether an unauthorized user accessed a compromised workstation locally? (Choose two)

Which TWO actions are available to an analyst when managing an incident's assignment in Cortex XDR? (Choose two)

An administrator is configuring Active Directory integration with Cortex XDR using the Broker VM. Which TWO prerequisites or components are required to successfully establish User-ID mapping and synchronization?

During incident triage, an analyst notices that two completely separate attacks on different endpoints were merged into a single incident by Cortex XDR. What is the underlying reason for this over-correlation?

An administrator is planning an agent rollout and needs to configure agent profiles in the Cortex XDR management console. Which THREE configuration elements can be defined within an Agent Settings profile?

An analyst is investigating a series of alerts related to a suspicious scheduled task created on a Windows endpoint. They want to determine the user account that created the task and the exact command that was scheduled. Which Cortex XDR data source should the analyst review to find this information?

An administrator is planning a Cortex XDR agent rollout for 2,500 Windows servers that reside in a data center with no direct internet access. All outbound traffic must traverse an explicit forward proxy. The administrator wants agents to register successfully with the Cortex XDR cloud tenant. What should the administrator do first?

An administrator is planning to install Cortex XDR agents on a large fleet of Windows endpoints and wants to ensure the installation can proceed without manual intervention on each host. Which approach best supports a silent, unattended installation?

An analyst wants to quickly identify all alerts related to a specific external IP address across multiple incidents without opening each incident individually. Which feature in the Cortex XDR console should the analyst use?

An analyst determines that a compromised endpoint is beaconing to a known malicious domain. The analyst wants to immediately stop the endpoint from reaching that domain while keeping the rest of the host's business traffic intact. Which Cortex XDR response action should the analyst choose?

A Cortex XDR administrator wants to review which user accounts have the highest identity risk based on recent authentication anomalies and privilege changes. The administrator needs a consolidated view that ranks users by their accumulated risk indicators across the environment. Which Cortex XDR feature should the administrator open to obtain this ranked list of at-risk identities?

Which TWO metrics or components are typically included in a user's risk score calculation within Cortex XDR's identity analytics?

During an investigation, a Cortex XDR analyst notices that an endpoint generated a high volume of network connection events to a suspicious external IP address. The analyst wants to isolate the host from the network while still allowing the Cortex XDR agent to communicate with the console for continued investigation. Which Cortex XDR response action should the analyst use?

An analyst notices that a malicious binary dropped multiple secondary payloads and modified registry keys. The analyst decides to initiate a remediation action to undo these changes. Which Cortex XDR capability supports automatic remediation of file drops and registry modifications?

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint spawned a child process with a suspicious command line. The analyst wants to see the exact parent-child process relationship and the full command line of the parent process to determine if this is a true positive. Which pane in the Cortex XDR Alert view provides this information?

An analyst is investigating an advanced persistent threat (APT) that established persistence using multiple techniques. Which THREE persistence mechanisms should the analyst specifically check via Cortex XDR telemetry? (Choose three)

Which architectural component acts as the central repository for all Cortex XDR telemetry, logs, and behavioral data?

An analyst is reviewing a Cortex XDR incident where a suspicious PowerShell script was executed on an endpoint. The analyst wants to see the exact command-line arguments that were passed to PowerShell at the time of execution. Which Cortex XDR feature should the analyst use to find this information?

When configuring Cortex XDR agent permissions on macOS, what step is necessary due to macOS security restrictions (Transparency, Consent, and Control - TCC)?

An analyst wants to view all security events associated with a specific user account across multiple devices over the last 7 days. Which Cortex XDR module provides user-centric investigation capabilities?

What role does the Cortex XDR Broker VM play regarding Active Directory and ITDR log collection?

An administrator is planning a Cortex XDR rollout for a multinational company. Legal requires that endpoint telemetry from one region remain within that region's cloud tenant and never be visible to administrators in other regions. Which planning consideration is most critical to satisfy this data-residency requirement?

An analyst is investigating an alert and wants to check if the file was analyzed by WildFire. Where in the Cortex XDR console can the analyst view the WildFire sandbox verdict and analysis report?

An organization wants to configure Cortex XDR to automatically respond to high-severity ransomware alerts. Which THREE elements must be correctly configured to ensure successful automated mitigation? (Choose three)

An analyst is investigating an incident and needs to quickly view customized columns containing threat actor attribution tags in the incident grid. Which feature must be configured to show these columns?

What is the primary function of Cortex XDR Agent prevention modules (such as Anti-Malware and Exploit Protection)?

When configuring a Response Playbook in Cortex XDR to automatically remediate an incident, what condition must be met for the playbook to execute successfully on an endpoint?

Which role-based permission is typically required for an analyst to change the status of an incident from 'New' to 'Under Investigation' in Cortex XDR?

An analyst is reviewing a Cortex XDR alert where a process on a Windows endpoint wrote a suspicious executable to a network share. To determine whether the file was previously seen and analyzed by Palo Alto Networks WildFire, which action should the analyst take from the alert's causality view?

An administrator is configuring Broker VM network settings and firewall rules in a secure data center zone. Which THREE traffic flows must be permitted through internal firewalls for the Broker VM to function correctly?

A Cortex XDR administrator is planning the installation of agents on endpoints that are behind a web proxy that requires authentication. The administrator needs to ensure that the agents can communicate with the Cortex XDR cloud through the proxy. What should the administrator configure in the agent installation settings?

When conducting a comprehensive post-incident review and remediation verification in Cortex XDR, which THREE actions should an analyst perform? (Choose three)

An analyst is reviewing an incident in Cortex XDR and wants to add a note explaining the steps taken during the investigation. Where should the analyst add this note?

An administrator is planning the deployment of Broker VM instances across a multi-site enterprise network. Which TWO best practices should be followed when planning Broker VM deployments?

What is the status of an incident in Cortex XDR immediately after it is automatically created by the correlation engine?

A Cortex XDR analyst is building an ITDR detection strategy for an environment using Microsoft Entra ID and on-premises Active Directory. The analyst wants to identify identity-based attacks that span both cloud and on-premises authentication. Which TWO Cortex XDR data sources provide the authentication telemetry needed to correlate cloud sign-ins with on-premises logons? (Choose two.)

An analyst receives an incident containing multiple related alerts across different machines. What is the primary benefit of the Cortex XDR Incident Viewer grouping these alerts together?

An analyst is investigating a Cortex XDR incident that includes both endpoint and network alerts. They notice that the incident's timeline shows a gap between a network alert indicating a suspicious outbound connection and a subsequent endpoint alert for process execution. The analyst suspects that the two alerts are related but were not stitched into the same incident. What is the most likely reason for the failure to correlate these alerts into a single incident?

An administrator notices that legitimate administrative scripts are repeatedly generating low-level behavioral alerts, cluttering the incident queue. How should the administrator handle these raw alerts within the lifecycle framework?

An XDR Analyst is investigating a newly generated incident in Palo Alto Networks Cortex XDR and notices that multiple disparate alerts from different endpoints and network sensors have been automatically grouped together. Which core mechanism of Cortex XDR is primarily responsible for intelligently grouping these related alerts into a single incident?

Which TWO factors directly influence how Cortex XDR calculates the overall severity score of an incident? (Choose two)

What THREE conditions can cause data stitching failures between network logs and endpoint telemetry in Cortex XDR? (Choose three)

A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three geographic regions. The security team wants to minimize the number of external firewall rules required for agent-to-cloud communication while still allowing the agents to receive policy updates and upload telemetry. Which component should the architect deploy in each region to aggregate and forward agent traffic to the Cortex XDR cloud tenant?

Which TWO pieces of information are displayed in the Incident summary dashboard of Cortex XDR? (Choose two)

An analyst is reviewing a Cortex XDR identity alert where a user authenticated with a valid password but from a device that has never been associated with that user. The analyst wants to assess whether the account's privileges make this a high-risk event. Which Cortex XDR data source provides the user's group memberships and role assignments to support this assessment?

An analyst is investigating a potential data exfiltration incident. They have identified a suspicious external IP address that the endpoint communicated with. To gather more context, they want to see all historical network connections involving that IP address across the organization. Which Cortex XDR capability should the analyst use?

When managing exclusions and exceptions in Cortex XDR, which THREE best practices should an analyst follow to maintain security posture? (Choose three)

A Cortex XDR analyst receives a critical incident for an endpoint that was quarantined by the organization months ago but is still generating new alerts. The analyst wants to quickly verify whether the endpoint has had any recent network activity that could indicate the alerts are from a live but unmanaged device. Which Cortex XDR feature should the analyst use to view the latest network connections associated with that endpoint?

An incident in Cortex XDR contains dozens of low-priority alerts that were grouped together. The analyst determines that one specific alert within the incident is a false positive while the rest are legitimate threats. What is the best practice for handling this specific raw alert?

A Cortex XDR administrator wants the platform to automatically disable a user account in Active Directory when an identity alert indicates confirmed active credential compromise, without analyst intervention. Which Cortex XDR capability should the administrator configure to achieve this?

Which TWO features in Cortex XDR assist an analyst in scoping an incident across the entire enterprise? (Choose two)

An analyst is investigating a Cortex XDR incident involving a Windows endpoint. The analyst needs to retrieve a copy of a suspicious executable from the endpoint's disk to submit to WildFire for further analysis, without executing the file locally. Which response action should the analyst use?

When reviewing an incident in Cortex XDR, which TWO types of artifacts are commonly available for inspection within the alert details? (Choose two)

An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?

An administrator is preparing to deploy Cortex XDR agents using an enterprise software deployment tool (such as SCCM or Intune). Where can the administrator download the appropriate installation packages (.msi or .pkg) from the Cortex XDR management console?

An analyst needs to gather a memory dump and running process list from a remote endpoint for deep forensic analysis. Which Cortex XDR feature enables this collection?

An administrator needs to deploy Cortex XDR agents to a fleet of Linux servers running Ubuntu 20.04. Before executing the installation script, which prerequisite package must be verified as installed on the Linux endpoints to ensure kernel module or Extended Berkeley Packet Filter (eBPF) support functions correctly?

During an ITDR investigation, an analyst sees a Cortex XDR identity alert: a privileged user authenticated successfully to three different SaaS applications from two countries within 12 minutes. MFA was satisfied via push notification on each attempt. The analyst needs to determine whether this is a legitimate VPN egress or a session-token replay. Which Cortex XDR identity data point best distinguishes session-token theft from legitimate travel?

An administrator is planning a Cortex XDR deployment for a network that uses a forward proxy requiring authentication for all outbound traffic. Endpoints run Windows and must communicate with the Cortex XDR cloud tenant. Which planning configuration will allow agents to reach the cloud through the proxy without per-user credentials?

An analyst is reviewing a Cortex XDR incident and wants to identify which endpoints are affected and what user accounts were involved. Which TWO pieces of information can be directly obtained from the Incident Details page to help with this assessment? (Choose two.)

An organization wants to ensure that all administrative logon sessions are closely monitored for anomalous behaviors in Cortex XDR. Where should the administrator configure custom behavioral alert thresholds for privileged users?

An organization experiences a Golden Ticket attack. How does Cortex XDR's identity analytics engine typically detect this type of Kerberos ticket manipulation?

Which TWO tasks can be performed directly from the Incident View in Cortex XDR? (Choose two)

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

An administrator is preparing to install Cortex XDR agents on 500 Windows servers. The security policy requires that the endpoint be automatically associated with the correct tenant and that agents report to the management console without manual per-endpoint registration. What must the administrator obtain from the Cortex XDR management console before starting the installation?

What is the primary function of the Cortex XDR Agent Support File collection tool?

Which dashboard widget type in Cortex XDR is best suited for tracking the volume of open incidents over time across different severity levels?

An administrator is reviewing the Cortex XDR system requirements and architecture. Which TWO statements accurately describe the Broker VM architecture?

An analyst is investigating an incident where a malicious file was dropped via email. Which TWO evidence artifacts should the analyst inspect to correlate the email vector with the endpoint execution? (Choose two)

An analyst notices that a Cortex XDR incident contains alerts from three different endpoints that are not related to the same attack. The analyst wants to manually split these unrelated alerts into separate incidents to improve tracking. Which action should the analyst take within the incident view?

After containing a malware outbreak, an analyst needs to document the incident in Cortex XDR. The analyst wants to add a note summarizing the root cause and remediation steps to the incident for future reference. Which action should the analyst take?

An administrator is preparing to install the Cortex XDR Agent on enterprise endpoints using a pre-installation script. Which THREE checks should be performed on the target endpoints before executing the installation?

An administrator is troubleshooting a failed Cortex XDR agent installation on a Windows endpoint. Which THREE log locations or troubleshooting methods should the administrator examine to determine the root cause of the installation failure?

Which TWO mechanisms are used by Cortex XDR to prevent alert fatigue during the raw-alert-to-incident lifecycle? (Choose two)

An analyst is reviewing an XQL query designed to hunt for suspicious account creation followed by immediate group membership escalation in Active Directory. Which XQL construct is used to join Active Directory event datasets based on a common security identifier (SID)?

An administrator is planning a Cortex XDR deployment where agents will be installed on endpoints that have no direct internet access and will rely on a Broker VM for connectivity. Which TWO planning tasks are required to ensure the agents can register and communicate through the Broker VM? (Choose two.)

Which TWO actions can an analyst take when closing an incident in Cortex XDR? (Choose two)

What is the primary function of the Cortex XDR Content Updates delivered automatically to endpoints?

An analyst wants to create a robust incident response workflow in Cortex XDR that incorporates both manual analyst review and automated remediation. Which THREE capabilities support this integrated approach? (Choose three)

An administrator is designing a disaster recovery and high availability strategy for Broker VM deployments in a large enterprise. Which THREE practices ensure high availability and resilience for Broker VM services?

A security operations manager is planning to deploy Cortex XDR agents to 2,000 endpoints. The manager wants to ensure that the agents can receive the latest detection content and policy updates automatically without manual intervention. Which Cortex XDR feature should the manager verify is enabled to meet this requirement?

A security analyst receives a Cortex XDR incident that was automatically created from multiple alerts. The analyst wants to assign the incident to a specific team member for further investigation. Which action should the analyst take?

After containing a ransomware incident on a Windows endpoint, an analyst needs to preserve volatile evidence for later forensic analysis before the endpoint is reimaged. Which Cortex XDR response action should the analyst use to capture a snapshot of the endpoint's memory and running processes?

A Cortex XDR analyst receives an ITDR alert indicating a user account performed a Kerberoasting attack against multiple service principal names. The analyst wants to quickly identify every host and process that requested the service tickets to scope the incident. Which Cortex XDR capability should the analyst use?

Which TWO attributes are typically displayed by default or through featured fields in the Cortex XDR Incident View grid? (Choose two)

A Cortex XDR analyst is reviewing an endpoint alert and wants to capture volatile evidence from the affected host before initiating remediation. The analyst decides to run a live terminal session on the endpoint through the Cortex XDR console. Which statement accurately describes the capability and limitation of this live terminal session?

A Cortex XDR analyst receives an alert that a privileged account was added to the Domain Admins group outside of a change window. The analyst wants to immediately review the account's recent activity and the group membership change in a single identity-focused investigation context. Where should the analyst navigate to review this identity event alongside the account's related activity?

An analyst is performing advanced threat hunting in Cortex XDR using XQL. Which THREE clauses or functions are commonly used when constructing analytical queries for evidence review? (Choose three)

An analyst wants to prevent Cortex XDR from generating alerts on a specific signature-based detection (such as a known vulnerability scanner tool) across a specific endpoint group. Where should this exclusion be created?

Which TWO data sources can Cortex XDR leverage to build comprehensive user identity behavior profiles for ITDR? (Choose two)

When sizing a Broker VM instance for an environment collecting high-volume syslog and Active Directory logs, which hardware resource is most critical to scale appropriately?

An administrator needs to automate a remediation workflow so that whenever a specific critical alert severity is triggered, Cortex XDR automatically runs a script to collect forensic artifacts. Where must this automation be configured?

An organization requires that specific custom threat intelligence tags appear as primary columns in the Incident View. How can an administrator achieve this?

A Cortex XDR analyst is building an ITDR detection strategy for a hybrid environment where attackers frequently abuse legitimate credentials rather than malware. The analyst needs to select identity behaviors that should generate high-fidelity alerts because they strongly indicate credential misuse rather than normal user activity. (Choose two.)

An analyst is reviewing a Cortex XDR alert for a suspicious process on a Windows endpoint. They need to determine the parent process that spawned the suspicious executable to understand the attack chain. Which Cortex XDR feature or view should the analyst use to see the process lineage and related causality information?

An analyst writes an XQL query to investigate lateral movement. Which dataset table in Cortex XDR contains comprehensive network connection telemetry across endpoints?

An analyst discovers that a malicious payload communicated with an external Command and Control (C2) server. Which TWO evidence sources should the analyst review to identify the C2 communication details? (Choose two)

A Cortex XDR administrator is preparing to deploy agents to 200 Linux servers in a demilitarized zone (DMZ). The administrator needs to select a deployment method that supports automated, scalable installation without manual intervention on each server. Which deployment method should the administrator use?

What is the primary benefit of using Cortex XDR's identity correlation engine when triaging incidents?

Which TWO details does the Cortex XDR Incident Graph display during evidence review? (Choose two)

An analyst is reviewing a Cortex XDR incident and wants to identify all alerts within the incident that are mapped to the 'Execution' tactic in the MITRE ATT&CK framework. Which TWO methods can the analyst use to achieve this? (Choose two.)

A Cortex XDR analyst receives an alert for 'Suspicious LDAP Query' from a workstation. The query targeted the 'adminCount' attribute on multiple user objects. The analyst suspects an attacker is using AD reconnaissance to find privileged accounts. Which Cortex XDR feature should the analyst use to quickly visualize the scope of this reconnaissance and identify other affected hosts?

An analyst is reviewing a Cortex XDR incident and wants to quickly see which alerts are associated with the incident and their current status. Where should the analyst look?

What THREE criteria are evaluated by Cortex XDR when determining whether incoming raw alerts should be grouped into an existing incident or spawn a new one? (Choose three)

An analyst needs to change the status of an incident from 'Under Investigation' to 'Resolved' after completing remediation. Which section of the Incident View allows updating the incident status?

Which TWO forensic logs or artifacts are most valuable when investigating a suspected ransomware attack on an endpoint? (Choose two)

An administrator is setting up syslog log collection on a Broker VM. By default, which UDP and TCP port does the Broker VM Syslog collector listen on for incoming syslog messages from network devices?

An organization experiences a false positive alert caused by a legitimate administrative script executed via PowerShell. The analyst wants to create an exception that applies specifically to this script's command-line arguments without whitelisting PowerShell entirely. What type of exception should be configured?

Which THREE features of Cortex XDR assist an analyst in conducting a deep-dive forensic investigation into an identity-based alert?

A security team is planning a Cortex XDR deployment for a small business with 250 endpoints and no existing on-premises security infrastructure. The administrator must decide how to retrieve and distribute the endpoint agent installer. Which Cortex XDR capability should be used to obtain the installer package directly from the management console?

An administrator is configuring a Proxy setting for Cortex XDR agents deployed in a segmented network zone that requires all HTTP/HTTPS traffic to traverse an explicit web proxy. Where is the proxy configuration defined for the Cortex XDR agent?

An analyst needs to verify whether Active Directory audit policies are correctly configured to supply Cortex XDR with the necessary event logs for Identity Threat Detection and Response. Which Windows Event ID range contains the core authentication and credential validation events required by Cortex XDR ITDR?

An administrator configures a custom data stitching rule to correlate custom application logs with endpoint events. After deployment, no new incidents are formed from these logs. What is the most critical factor to verify when troubleshooting custom stitching rules?

An analyst is investigating a suspected pass-the-ticket attack where an attacker injects a stolen Kerberos ticket into memory. Which endpoint telemetry data collected by the Cortex XDR Agent helps identify abnormal process behavior related to ticket injection tools (such as Mimikatz 'kerberos::ptt')

An analyst is investigating a Cortex XDR incident involving a suspicious process on a Windows endpoint. The analyst wants to gather volatile evidence from the endpoint before taking containment actions. Which TWO response actions can be used to collect volatile evidence? (Choose two.)

A Cortex XDR analyst is building an ITDR detection strategy for a hybrid environment where attackers frequently abuse valid credentials. Which TWO identity risk signals should the analyst prioritize to detect credential misuse rather than credential theft? (Choose two.)

An analyst is investigating a suspicious user account that accessed sensitive internal shares outside of normal business hours. Which Cortex XDR feature enables the analyst to review all actions taken by this user across endpoints and cloud services in a chronological timeline?

An enterprise ingests telemetry from both Cortex XDR agents and third-party firewall logs. What mechanism allows Cortex XDR to combine these disparate data sources into a unified incident view representing a single attack vector?

A Cortex XDR analyst is investigating repeated failed authentications against a domain controller from a single workstation. The failures are followed by one success from the same workstation, after which the account begins accessing file shares it has never touched before. The analyst needs to preserve the identity context while correlating the authentication events with subsequent file activity. Which Cortex XDR capability should the analyst use to pivot from the authentication events to the related endpoint activity?

An administrator is planning a Cortex XDR agent rollout to a large fleet of Windows endpoints whose users are frequently offline and connect through a restricted proxy. The administrator needs the agents to receive new content and policy updates without user intervention and without direct internet egress from each endpoint. Which deployment planning consideration best addresses this requirement?

A Cortex XDR analyst is investigating a suspected pass-the-hash attack. The attacker has captured an NTLM hash and is using it to authenticate to multiple servers without knowing the plaintext password. Which Cortex XDR data source would most directly reveal the anomalous NTLM authentication events indicating this attack?

Which log source is essential for Cortex XDR to track successful and failed interactive logon events on Windows workstations for ITDR analysis?

During an investigation, an analyst discovers that a raw alert was generated by a legitimate software update tool. To prevent this specific alert from triggering future incidents across all endpoints, how should the analyst proceed within the lifecycle management framework?

When planning a Cortex XDR deployment, an administrator must select the appropriate deployment method for endpoints. Which TWO methods are officially supported for mass-deploying the Cortex XDR agent across a Windows enterprise domain?

During a live investigation, an analyst needs to isolate a Windows endpoint from the network while preserving the ability to run response actions and pull files for forensic review. Which Cortex XDR action best satisfies this requirement?

An analyst determines that a malicious file was executed on multiple endpoints within the environment. Using the Cortex XDR Query Builder (XQL Search), how can the analyst quickly locate all other instances of this specific file across the organization?

An administrator is planning a large Cortex XDR agent rollout across 5,000 endpoints in a distributed network. Before starting, the administrator must confirm the network prerequisites that allow agents to register with the Cortex XDR management console and receive content updates. Which TWO network requirements must be satisfied? (Choose two.)

An analyst is reviewing a Cortex XDR incident that contains multiple alerts from different endpoints. The analyst wants to identify the root cause and determine the scope of the attack. Which TWO actions should the analyst take to achieve this? (Choose two.)

When planning Cortex XDR agent deployments across heterogeneous operating systems, which TWO operating systems are officially supported by Palo Alto Networks for agent installation?

During an investigation, a Cortex XDR analyst observes that a user account successfully authenticated to a server and then, within seconds, accessed a credential store file on that server. The analyst wants to determine whether the account's credentials were subsequently used from a different host. Which Cortex XDR data should the analyst examine to trace whether the stolen credentials were reused elsewhere?

An analyst is investigating a Cortex XDR incident and wants to add a note to the incident timeline to document the steps taken so far. Where in the Cortex XDR console can the analyst add this note?

An administrator needs to configure automated incident response actions in Cortex XDR. Which THREE components are critical for building a successful automated response workflow? (Choose three)

An analyst is configuring a Response Playbook in Cortex XDR to handle automated containment. Which THREE actions can be automated within the playbook workflow? (Choose three)

An enterprise wants to ensure that all incidents with a score above 80 are automatically escalated and assigned to a Tier-3 incident response queue. Where should an administrator configure this routing logic?

An analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst wants to see a visual representation of how the alerts are related over time to better understand the attack progression. Which Cortex XDR feature should the analyst use?

An administrator wants to configure automated response actions for high-severity ITDR alerts indicating active credential compromise. Which Cortex XDR feature allows automated actions such as disabling the compromised user account in Active Directory?

An administrator is deploying the Cortex XDR Agent on a fleet of corporate laptops. Which component must be installed or configured in the environment to serve as the local communication proxy and log collector for remote agents deployed outside the corporate network?

Which TWO actions can an analyst perform to manage and highlight specific findings during an incident investigation in Cortex XDR? (Choose two)

An analyst is investigating a Cortex XDR incident that contains several alerts from different endpoints. The analyst wants to quickly identify the root cause alert that initiated the incident and understand the sequence of events. Which feature in the incident details view provides a chronological timeline of all related alerts and activities?

Where can an administrator view the overall identity risk posture score across all users within the Cortex XDR management console?

An analyst is investigating an incident and wants to export the full incident report and associated artifact list for compliance reporting. Which option should the analyst select in Cortex XDR?

While reviewing a compromised host in the Cortex XDR Incident Viewer, an analyst wants to isolate the endpoint from the network to prevent lateral movement while maintaining administrative access. Which response action should the analyst initiate?

An analyst is examining a Cortex XDR incident that includes a high-severity alert for a suspicious process execution. The analyst wants to determine the parent process that spawned the suspicious process and the command line arguments used. Which Cortex XDR feature should the analyst use to obtain this information?

Which THREE key components or features in Cortex XDR contribute directly to identifying and investigating compromised user credentials?

An ITDR rule in Cortex XDR triggers due to impossible travel detected for a user account. Upon investigation, the analyst discovers the source IP belongs to a corporate VPN egress node. How should the analyst prevent future false positives for this known infrastructure?

A security engineer notices that raw alerts from a third-party firewall are successfully ingested into Cortex XDR but fail to correlate into existing endpoint incidents. Upon inspection, it is discovered that the firewall logs lack internal NAT translation details. How does this impact the raw-alert-to-incident lifecycle?

When an endpoint is isolated during an incident response action in Cortex XDR, which TWO types of network traffic are generally permitted to ensure continued management and minimal disruption? (Choose two)

A company is planning its first Cortex XDR deployment and wants to confirm which component is responsible for centrally storing endpoint telemetry, running analytics, and delivering policy to agents. Which component fulfills this role?

A Cortex XDR administrator wants to ensure that when an identity-based attack is detected, the platform can automatically disable the compromised user account in the identity provider. Which integration must be configured to enable this automated response?

An analyst is reviewing a Cortex XDR incident involving a Windows endpoint that exhibited suspicious registry modifications. The analyst needs to determine whether a persistence mechanism was established by a specific process. Which Cortex XDR evidence source should the analyst review to see the registry key path, the value data written, and the process that performed the modification?

During incident investigation, an analyst identifies an unauthorized script executed via WMI (Windows Management Instrumentation). Which TWO telemetry artifacts should the analyst examine to trace the activity? (Choose two)

During the raw-alert-to-incident lifecycle, an alert is generated by a custom BIOC (Behavioral Indicator of Compromise). At what point does this raw alert transition into an actionable incident?

When investigating an endpoint compromise, an analyst suspects DLL sideloading was used to execute malicious code. Which TWO telemetry indicators should the analyst examine? (Choose two)

When managing the alert lifecycle in Cortex XDR, analysts can perform various triage and prioritization tasks. Which THREE features or options are available to analysts when managing active incidents and alerts? (Choose three)

An analyst reviewing a Cortex XDR identity incident sees that a user's account successfully authenticated from an unfamiliar ASN at 02:00, immediately followed by creation of a new mail forwarding rule and a password reset. The user confirms they were asleep and did not perform these actions. Which conclusion and immediate priority are most appropriate?

During data stitching across endpoints and networks, what THREE core attributes does Cortex XDR typically leverage to correlate disparate logs into a single incident? (Choose three)

An analyst reviewing an incident sees an indicator labeled as an 'IP Connection'. What information does this artifact provide?

An administrator is planning an automated mass deployment of Cortex XDR agents using Microsoft Group Policy Objects (GPO). Which file format is required for GPO-based installations on Windows endpoints?

When sorting incidents in the Cortex XDR console to find the most severe threats first, which attribute is most commonly used?

An analyst is reviewing a Cortex XDR incident that contains a 'Behavioral Threat' alert for a process that spawned a child process with suspicious command-line arguments. The analyst wants to see the full process lineage, including the parent process, command line, and the user account that initiated it, to determine if this is a false positive. Which Cortex XDR feature should the analyst use to obtain this information?

What is the primary benefit of the raw-alert-to-incident lifecycle consolidation in Cortex XDR?

While reviewing an incident involving suspicious lateral movement, an analyst notices that an adversary utilized compromised service account credentials. The analyst wants to use Cortex XDR response actions to immediately contain the threat without shutting down the entire domain controller. Which ITDR-related action can be executed directly from the Cortex XDR console for a compromised user account?

An analyst is reviewing a raw alert that was generated by Cortex XDR analytics. The alert indicates suspicious behavior, but no incident was created. What is the most likely explanation?

A security operations manager wants analysts to quickly see, for any user in Cortex XDR, a consolidated timeline of authentication events, accessed resources, and associated alerts across the environment. Which Cortex XDR feature should analysts use to obtain this per-user consolidated view?

A Cortex XDR analyst is investigating a suspected credential dumping attack on a Windows endpoint. The attacker used a tool that accessed LSASS memory to extract credentials. Which Cortex XDR capability would most directly detect this activity by monitoring for unauthorized access to LSASS?

An administrator is configuring the Broker VM via the CLI configuration wizard and needs to establish secure connectivity back to the Cortex XDR tenant. Which outbound TCP port and protocol must be allowed through the enterprise firewall from the Broker VM to ensure successful registration and synchronization?

An administrator is deploying Cortex XDR agents in a Linux environment and needs to ensure that the agent does not interfere with a critical custom database application. Which feature should the administrator configure to exclude specific directories or processes from agent inspection?

Which TWO views in Cortex XDR are primarily used to monitor overall alert and incident status across the SOC? (Choose two)

What is the primary purpose of the Cortex XDR agent installation token (or installation password)?

An analyst is reviewing a Cortex XDR incident where an attacker used a legitimate remote monitoring and management (RMM) tool to maintain persistence. The analyst wants to identify all endpoints where the same RMM tool has been installed and running over the past 30 days. Which Cortex XDR capability should the analyst use?

An XDR analyst is reviewing a Cortex XDR incident that includes alerts from both endpoint and network sensors. The analyst notices that the network alerts lack associated endpoint process information, even though the same host is involved. What is the most likely cause for this missing correlation?

A security architect is planning a Cortex XDR deployment for a company with 6,000 endpoints spread across three regional offices. The company wants to minimize the number of open inbound firewall ports on their network while still allowing agents to receive policy updates and send telemetry. Which deployment consideration should the architect prioritize?

An analyst is investigating a Cortex XDR incident that contains an alert for a suspicious PowerShell script execution on a Windows endpoint. The analyst wants to see the exact command line and parent process that triggered the alert without leaving the incident view. Which action should the analyst take?

What is the primary purpose of starring an alert within an incident details pane?

A security team is deploying Cortex XDR agents to 8,000 endpoints across three geographic regions. The network team requires that all agent-to-cloud communication be routed through a controlled, on-premises egress point rather than allowing direct internet access from each endpoint. Which Cortex XDR component should the administrator deploy to satisfy this requirement?

Which THREE indicators collected by Cortex XDR endpoint agents are crucial for identifying post-exploitation credential harvesting activities on a host?

An analyst is investigating a Cortex XDR incident where the alert source is listed as 'XDR Analytics' and the alert contains a MITRE ATT&CK technique mapping. The analyst wants to understand how the alert was generated and what data contributed to it. Which two actions should the analyst take to gain this understanding? (Choose two.)

An analyst is reviewing a Cortex XDR incident that includes alerts from multiple sources. The analyst wants to correlate related alerts to identify a coordinated attack. Which two actions can the analyst take to manually correlate alerts into the incident? (Choose two.)

Which THREE actions can be taken directly or via orchestration within Cortex XDR when responding to an active identity-based attack?

Which TWO automated or manual response actions can be executed directly on an endpoint from the Cortex XDR Incident Response toolbox? (Choose two)

An analyst is investigating a Cortex XDR incident where the same alert appears multiple times with different timestamps. The analyst wants to understand why the alert was duplicated. Which factor is most likely responsible for the duplicate alerts within the incident?

A Cortex XDR analyst sees an alert for a user account that authenticated successfully from an unfamiliar ASN, then immediately triggered a privileged role assignment in Azure AD. Which Cortex XDR capability should the analyst use FIRST to correlate the identity activity with endpoint and network telemetry in a single timeline?

When configuring exceptions in Cortex XDR to suppress false positives, which THREE parameters can typically be leveraged to define the exception scope? (Choose three)

An analyst wants to ensure that any file evaluated with a specific SHA-256 hash is immediately blocked from execution across all endpoints managed by Cortex XDR, regardless of its WildFire verdict. Where should this hash be added?

An administrator is planning a Cortex XDR deployment for a hospital network with strict change-control and limited maintenance windows. Before rolling agents out to clinical workstations, the administrator must validate that the deployment will not disrupt critical medical applications. Which TWO planning activities best reduce the risk of application conflicts during the rollout? (Choose two.)

An organization is setting up a Broker VM instance to support Active Directory User-ID integration and log forwarding. Which authentication mechanism must the administrator configure to pair the newly deployed Broker VM with the Cortex XDR management console?

A Cortex XDR incident contains 15 alerts that were automatically stitched together. The analyst determines that 3 of these alerts are false positives caused by a legitimate administrative script. The analyst wants to remove these 3 alerts from the incident without affecting the other 12 alerts. What is the correct action?

When deploying and troubleshooting the integration between Cortex XDR and Active Directory for ITDR, which TWO steps or configurations are critical to ensure successful telemetry collection? (Choose two)

An administrator wants to ensure that incidents generated by alerts involving domain controllers are always assigned a 'Critical' score. Which setting should be modified?

An administrator is configuring data stitching and alert correlation rules in Cortex XDR to improve incident prioritization. Which TWO actions are best practices to ensure high-fidelity alert grouping and accurate incident scoring? (Choose two)

A Cortex XDR analyst is investigating an identity alert where a helpdesk technician account successfully authenticated to 14 different workstations within 3 minutes, each logon using explicit credentials rather than interactive console logon. The account has no associated change ticket. Which identity-based detection concept best explains why Cortex XDR raised this as a high-severity alert?

An analyst reviewing an incident in Cortex XDR notices a suspicious scheduled task created by an attacker. What is the primary purpose of examining the scheduled task evidence?

An analyst investigating a ransomware incident on a Windows endpoint needs to determine which process originally created the malicious executable that was later detected. The analyst opens the Cortex XDR Causality Chain view for the alert. Which element of the Causality Chain directly identifies the parent process responsible for spawning the malicious file?

An analyst notices that a Cortex XDR incident contains alerts from two different endpoints that appear to be part of the same attack campaign. The analyst wants to confirm that the incidents are linked by a common threat actor. Which Cortex XDR feature provides a graphical representation of the relationships between alerts, endpoints, and indicators of compromise (IOCs) to help identify such connections?

An analyst is investigating an alert involving suspicious PowerShell execution. To thoroughly review the evidence, which THREE investigative steps should the analyst take within Cortex XDR? (Choose three)

An administrator is planning a Cortex XDR deployment in an environment where endpoints reside behind a web proxy that performs SSL inspection. During a pilot, agents fail to register with the management console even though outbound TCP 443 is permitted. The administrator must adjust the plan so agents can communicate through the proxy. Which action should the administrator take?

An analyst is reviewing a Cortex XDR alert for a suspicious PowerShell script that was executed on a Windows endpoint. The analyst wants to gather additional context about the script's execution. Which TWO data sources are available directly in the Cortex XDR alert details to help understand the script's behavior? (Choose two.)

An administrator is designing a Cortex XDR deployment for a company with a main data center and a remote branch office connected by a low-bandwidth WAN link. The branch has 200 endpoints that must remain manageable even if the WAN link fails temporarily. Which deployment consideration best supports this requirement?

You are configuring integration between Cortex XDR and an external Identity Provider (IdP) to ingest user authentication logs for ITDR. Which component is primarily responsible for securely forwarding these IdP telemetry logs to the Cortex XDR data lake?

An analyst is reviewing a Cortex XDR incident where an endpoint has been compromised by malware that established persistence via a scheduled task. The analyst wants to remove the scheduled task remotely. Which response action should the analyst use?

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

An incident responder is investigating a complex incident in Cortex XDR and needs to examine the raw alert-to-incident lifecycle and data stitching relationships. Which THREE components or views in the Cortex XDR console should the responder utilize to thoroughly analyze this data? (Choose three)

When responding to a malware alert, an analyst decides to quarantine the offending file. Which TWO outcomes occur when Cortex XDR performs a file quarantine? (Choose two)

Which TWO views or tabs in Cortex XDR provide insight into forensic artifacts collected from endpoints? (Choose two)

An administrator is reviewing a newly generated incident in Cortex XDR and notices that multiple low-severity alerts from different endpoints have been grouped together. Which mechanism is primarily responsible for this automated grouping?

A Cortex XDR analyst is examining an alert where a user account successfully authenticated from two different countries within a 10-minute window. The analyst suspects impossible travel. Which Cortex XDR feature would provide a visual representation of the user's login locations and times to confirm this?

A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?

During an ITDR investigation, an analyst observes that a service account authenticated to a domain controller and then created a new computer object. The analyst wants to determine whether this is a known attack technique involving directory object manipulation. Which Cortex XDR analytic or rule category is MOST relevant to this behavior?

An analyst is investigating a security incident and needs to review the timeline of events that occurred on a compromised endpoint. The analyst wants to see a chronological list of all alerts, process executions, and network connections related to the incident. Which Cortex XDR view should the analyst use?

During incident triage, an analyst notices that a Cortex XDR incident contains alerts from both a Windows endpoint and a Linux server. The analyst wants to see the specific MITRE ATT&CK techniques associated with each alert to understand the adversary's tactics. Where can the analyst find this information?

An administrator is planning a Cortex XDR deployment across multiple sites, including a remote office with limited internet bandwidth. The administrator wants to minimize WAN traffic for agent updates and threat intelligence lookups. Which Cortex XDR component should be deployed at the remote office to achieve this?

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

A Cortex XDR analyst is building an identity threat detection strategy for a hybrid environment with on-premises Active Directory and cloud identity. Which TWO telemetry sources should the analyst prioritize ingesting to detect credential abuse and anomalous authentication across both environments? (Choose two.)

An analyst is investigating a suspected phishing attack and needs to review the command line arguments passed to a suspicious email attachment execution. Where can the analyst find this evidence in Cortex XDR?

When analyzing a complex multi-stage attack in Cortex XDR, an analyst examines the Causality Chain. How does the Causality Chain assist in understanding the raw-alert-to-incident lifecycle?

During an identity investigation in Cortex XDR, an analyst observes a service account performing a Kerberoasting-style request pattern: multiple TGS requests for accounts with Service Principal Names, followed by an anomalous LDAP query enumerating domain admins. The service account normally runs a backup job nightly. Which interpretation should guide the analyst's next action?

Which TWO actions should an analyst take when conducting evidence review for a suspected credential dumping incident? (Choose two)

An organization notices an increase in credential dumping attacks against local Active Directory environments. They want to configure Cortex XDR Identity Analytics to trigger high-severity alerts when abnormal Kerberos ticket requests (such as potential Silver or Golden ticket activities) are detected. Where should the analyst enable or tune these specific identity behavior analytics rules?

When reviewing incident details in Cortex XDR, an analyst sees the 'MITRE ATT&CK' tab. What value does this tab provide during evidence review?

Which TWO states represent valid stages in the standard lifecycle of an incident within Cortex XDR? (Choose two)

While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?

Which THREE key identity-based threat behaviors are typically detected and flagged by Cortex XDR Identity Analytics? (Choose three)

An administrator is planning agent deployment in an air-gapped environment (no direct internet access to the public cloud). How do Cortex XDR agents receive content updates and policy changes in this scenario?

During an investigation, an analyst examines the Causality Chain and Incident Graph. What THREE key insights do these visualization tools provide into the incident lifecycle? (Choose three)

Which THREE configuration steps are required to ensure Cortex XDR successfully correlates endpoint events with Active Directory user identities?

An analyst is investigating an endpoint alert in Cortex XDR and needs to review the process hierarchy that led to the execution of a suspicious PowerShell command. Which Cortex XDR view should the analyst examine?

An analyst is investigating a Cortex XDR incident and wants to correlate alerts from different endpoints that share the same file hash. The analyst needs to quickly find all other incidents that contain this hash to assess the scope of the campaign. Which Cortex XDR feature should the analyst use?

An analyst wants to terminate a malicious process and all of its spawned child processes across a targeted endpoint directly from the Cortex XDR incident view. Which response action accomplishes this?

Which TWO methods can an administrator use to customize or enhance the visibility of metadata in the Cortex XDR Incident View? (Choose two)

An administrator is planning a Cortex XDR deployment and must choose the appropriate agent installation methods for a mix of Windows and macOS endpoints. The administrator wants to minimize manual effort and support remote users who are not on the corporate network. Which TWO installation methods should the administrator select? (Choose two.)

Which TWO features in Cortex XDR assist analysts in communicating identity threat findings to stakeholders or compliance auditors?

An analyst is investigating a Cortex XDR incident where the automatic correlation engine grouped alerts based on a shared causality ID. The analyst discovers that one alert in the incident actually belongs to a different attack on the same endpoint. What should the analyst do to correct the incident grouping?

Cortex XDR stitches together data from multiple telemetry sources to form a cohesive incident. An analyst notices that network logs from a third-party firewall are generating alerts, but they are not stitching correctly with the endpoint alerts for the same compromised host. What is the most likely cause of this stitching failure in the raw-alert-to-incident lifecycle?

An organization uses Cortex XDR and wants to ensure that a known internal penetration testing tool is never blocked or alerted upon by Cortex XDR protection modules. Where should the exclusion be defined to affect all agents globally?

A security team is planning its first Cortex XDR deployment and must decide how to group endpoints so that different prevention policies apply to servers versus user workstations. Which planning action should the administrator take first?

A security analyst suspects an account compromise after noticing multiple rapid logins from geographically distant IP addresses within minutes. Which Cortex XDR feature automatically aggregates these related anomalous authentication indicators into a single incident?

What action should an analyst take in Cortex XDR when an incident investigation is fully complete and all remediation steps have been verified?

A Cortex XDR analyst is responding to an alert indicating a Golden Ticket attack. The attacker has compromised the KRBTGT account hash and is forging Kerberos ticket-granting tickets (TGTs) to maintain persistent access. Which TWO Cortex XDR capabilities are most effective for detecting and investigating this attack? (Choose two.)

When reviewing identity analytics alerts in Cortex XDR, which THREE behavioral anomalies are typically flagged by the UBA engine as potential indicators of a compromised account?

An administrator is setting up a new Cortex XDR tenant and preparing for initial onboarding. Which TWO administrative tasks must be completed during the initial planning and setup phase?

During an investigation of a suspected data exfiltration incident, an analyst observes that a finance workstation initiated an outbound SMB connection to an unfamiliar internal host on port 445 at 02:14. The analyst wants to determine whether lateral movement occurred before sensitive files were staged. Which TWO Cortex XDR evidence sources should the analyst review to correlate the SMB session with the originating process and the remote endpoint's activity? (Choose two.)

After containing a malware outbreak, a Cortex XDR analyst needs to verify that the malicious file was removed from all affected endpoints. The analyst wants to confirm the current state of the endpoints without waiting for the next scheduled scan. Which Cortex XDR action allows the analyst to query endpoint file system state on demand and return results to the console?

An analyst is reviewing a Cortex XDR incident involving a suspicious PowerShell script that was executed on multiple endpoints. The analyst needs to gather evidence to determine the script's origin and impact. Which TWO actions should the analyst take to collect relevant evidence from the endpoints? (Choose two.)

When reviewing identity alerts in Cortex XDR, which TWO anomalous behaviors might indicate compromised credentials? (Choose two)

An analyst is investigating an incident where an attacker leveraged compromised credentials to establish persistence via Active Directory object manipulation. Which TWO Active Directory event logs or actions captured by ITDR monitoring should the analyst examine?

An enterprise ingests proxy logs and endpoint telemetry into Cortex XDR. An analyst notices that web traffic alerts for a specific user are not correlating with the user's endpoint malware alerts. What is a common prerequisite for successful identity-based data stitching across network and endpoint sources?

An administrator is configuring a Broker VM to act as a Syslog collector for third-party network devices. Which configuration step must be performed within the Cortex XDR console after deploying the Broker VM to enable the Syslog Collector app?

An analyst is investigating an incident and needs to determine whether lateral movement occurred between two endpoints. Which Cortex XDR feature provides the visual connection between these assets within the incident?

A Cortex XDR analyst is investigating an alert where a domain user account triggered the 'First Seen Kerberos Service Ticket Request for User' BIOC. The user normally works in the finance department and has never requested a service ticket for the SQL service before. The analyst wants to determine if this activity is a precursor to a Kerberoasting attack. Which Cortex XDR data source would provide the most direct evidence of the service ticket encryption type and the requested Service Principal Name (SPN)?

An analyst is reviewing the Causality Chain for an alert. Which TWO key insights does this view provide? (Choose two)

An analyst is reviewing a Cortex XDR incident involving a compromised Linux server. The analyst needs to retrieve the contents of a suspicious file located at /tmp/malware.bin from the endpoint for further analysis. Which response action should the analyst use?

Which THREE actions are appropriate when an analyst determines that a recurring raw alert is a confirmed false positive and wishes to prevent future incident pollution? (Choose three)

Where in the Cortex XDR console can an analyst review the complete lifecycle timeline of an incident, from initial raw alert generation to final resolution?

An analyst wants to filter the Incident View to show only incidents that have been bookmarked by members of the SOC team. Which filter criterion should be applied?

An analyst identifies that a legitimate software updater is triggering behavioral alerts due to spawning child processes typical of Living-off-the-Land binaries. To prevent alerts for this specific signed binary when executed from its legitimate path, what exception configuration is recommended?

An analyst observes that a series of benign network scans from an internal vulnerability scanner are creating raw alerts that constantly merge into active security incidents, artificially inflating their severity. What is the recommended method to prevent vulnerability scanner activity from corrupting incident lifecycles?

An administrator needs to customize the incident queue to show the 'OS Version' column for all displayed incidents. Which configuration interface should be accessed?

An administrator is planning a Cortex XDR agent rollout and needs to decide how to distribute the agent installer to 2,000 Windows endpoints without manually touching each machine. The organization already uses Microsoft Configuration Manager (SCCM) and Microsoft Intune for software deployment. Which approach best fits the planning requirement?

An analyst identifies a custom, benign internal tool that is continuously flagged by a BIOC rule in Cortex XDR. To prevent future alerts without disabling the entire rule globally, what is the best practice method to create an exception?

A security administrator is preparing to deploy Cortex XDR agents to a fleet of Windows endpoints. Before installation, the administrator must ensure that the endpoints meet the minimum operating system requirements for the Cortex XDR agent. Which of the following is a valid supported Windows operating system for the Cortex XDR agent?

Which TWO types of user accounts are critical to monitor closely for privilege abuse and anomalous behavior within an ITDR program?

An analyst needs to quickly identify all incidents in Cortex XDR that are related to a specific MITRE ATT&CK technique, such as T1059 (Command and Scripting Interpreter). What is the most efficient way to find these incidents?

An analyst is triaging a Cortex XDR incident that contains a mix of high and low severity alerts. The analyst wants to quickly identify which alerts are most critical to address first. Which column in the Incident View's Alerts tab should the analyst sort by to prioritize alerts based on their potential impact?