298 questions with instant explanations, domain breakdown, and wrong-answer analysis. Built for the real exam.
This is exactly what you see during practice — question, options, and a full explanation after you answer.
A security analyst wants to prioritize incidents by highlighting critical cases that require immediate executive visibility. Which feature should the analyst use to flag these specific incidents in the Incident View?
Incident starring in Cortex XDR is a manual flag that analysts apply to specific incidents to mark them as noteworthy — for example, for executive visibility or follow-up. Starred incidents can be filtered and surfaced in dashboards, making them easy to track. This is the intende…Read full explanation
While investigating an alert in Cortex XDR, an analyst notices that a network-layer alert and an endpoint-layer alert have not been stitched into the same incident despite sharing the same internal IP address and user account. What is the most likely cause of this behavior?
Cortex XDR stitches alerts into incidents by correlating on shared featured fields (such as IP, user, hostname) within a defined time window. If the endpoint event and the network event occur too far apart in time, the correlation engine will not merge them, so they appear as sep…Read full explanation
During the raw-alert-to-incident lifecycle, an alert is generated by a custom BIOC (Behavioral Indicator of Compromise). At what point does this raw alert transition into an actionable incident?
When a raw alert triggers, Cortex XDR evaluates it against existing open incidents or creates a new incident based on correlation and stitching logic, moving it into the Incident View.
Questions are tagged by exam domain. Practice a specific domain or mix them all.
Answer at your own pace. Explanation and domain tag shown immediately after each answer.
Countdown timer starts immediately. Results and domain scores shown at the end — just like the real exam.
Full explanations on every question
Not just the right answer — you get exactly why each wrong option is wrong, so you learn the concept, not the answer.
Domain score breakdown
After each session see your score by exam domain so you know exactly where to focus study time.
100% free, forever
No subscription, no trial, no email wall. Start a session in under 10 seconds.
Exam-style questions
Scenario-based, precise wording, realistic distractors — written to match what you actually see on exam day.