How should I use these Identity Threat Detection And Response practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

XDR-Analyst · topic practice

Identity Threat Detection And Response practice questions

Q: Can I practise just Identity Threat Detection And Response questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Identity Threat Detection And Response domain.

Practise Certified XDR Analyst (XDR-Analyst) Identity Threat Detection And Response practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Identity Threat Detection And Response

Practice 10 questions Browse domain →

What the exam tests

What to know about Identity Threat Detection And Response

Identity Threat Detection And Response questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Identity Threat Detection And Response exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Identity Threat Detection And Response questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Identity Threat Detection And Response explanation →

While investigating a lateral movement attack, an analyst notices suspicious Kerberos ticket-granting service (TGS) requests in Cortex XDR log queries. Which XQL dataset contains the parsed domain controller event logs required to investigate this potential Kerberos-based attack?

Trap 1: dataset = endpoint_security_identity

This dataset name is not a standard Cortex XQL schema.

Trap 2: dataset = pan_wmi_raw

pan_wmi_raw is not the standard dataset for parsed domain controller logs.

Trap 3: dataset = xdr_data | filter event_simple_name =…

Event simple names vary, but the correct dataset for normalized AD logs is typically agent_log or specific parsed identity datasets.

Study all Identity Threat Detection And Response common traps →

A
dataset = endpoint_security_identity
Why wrong: This dataset name is not a standard Cortex XQL schema.
B
dataset = pan_wmi_raw
Why wrong: pan_wmi_raw is not the standard dataset for parsed domain controller logs.
C
dataset = xdr_data | filter action_dataset = "active_directory_raw"
Parsed Active Directory and Domain Controller logs ingested via Broker VM are queryable under specific authentication and AD datasets in XQL.
D
dataset = xdr_data | filter event_simple_name = "Win-Security-Kerberos-Service-Ticket"
Why wrong: Event simple names vary, but the correct dataset for normalized AD logs is typically agent_log or specific parsed identity datasets.

Identity Threat Detection And Response practice questions

What to know about Identity Threat Detection And Response

Common Identity Threat Detection And Response exam traps

Identity Threat Detection And Response questions

While investigating a lateral movement attack, an analyst notices suspicious Kerberos ticket-granting service (TGS) requests in Cortex XDR log queries. Which XQL dataset contains the parsed domain controller event logs required to investigate this potential Kerberos-based attack?

An administrator wants to write an XQL query to detect potential Pass-the-Hash activity by evaluating anomalous NTLM authentication events compared against a user's historical baseline. Which XQL function is best suited for statistical deviation analysis?

When investigating advanced Active Directory attacks such as DCSync or DCShadow using Cortex XDR, which TWO primary indicators or event logs should an analyst look for?

When constructing an advanced XQL query to investigate credential access and lateral movement, which TWO syntax structures or functions are correctly formatted for filtering and aggregation?

An analyst needs to create a BIOC (Behavioral Indicator of Compromise) rule to detect suspicious use of 'whoami' execution by an authenticated domain user. Which data source should the rule evaluate?

An analyst is configuring a BIOC rule to detect credential dumping via LSASS memory access. Which event characteristic must be monitored within the endpoint telemetry criteria?

An organization wants to enrich Cortex XDR alerts with Active Directory context. Which component must be properly configured and running to collect user and group metadata for ITDR correlation?

When investigating an identity-based alert in Cortex XDR, what information does the User View provide to the analyst?

An administrator is reviewing compromised credentials in Cortex XDR. Where should they navigate to inspect identity analytics alerts specifically generated by user behavior analytics (UBA)?

An analyst is reviewing an identity incident where an attacker performed a Kerberoasting attack. Which log source ingested by Cortex XDR is most critical for detecting requests for service tickets against high-privilege service principal names (SPNs)?

What is the primary purpose of integrating Microsoft Entra ID (formerly Azure AD) logs into Cortex XDR?

An organization experiences a Golden Ticket attack. How does Cortex XDR's identity analytics engine typically detect this type of Kerberos ticket manipulation?

An ITDR rule in Cortex XDR triggers due to impossible travel detected for a user account. Upon investigation, the analyst discovers the source IP belongs to a corporate VPN egress node. How should the analyst prevent future false positives for this known infrastructure?

An analyst is investigating a suspicious user account that accessed sensitive internal shares outside of normal business hours. Which Cortex XDR feature enables the analyst to review all actions taken by this user across endpoints and cloud services in a chronological timeline?

Where can an administrator view the overall identity risk posture score across all users within the Cortex XDR management console?

An administrator wants to configure automated response actions for high-severity ITDR alerts indicating active credential compromise. Which Cortex XDR feature allows automated actions such as disabling the compromised user account in Active Directory?

An organization notices an increase in adversary reconnaissance using BloodHound to map Active Directory permissions. Which data telemetry in Cortex XDR can help detect the enumeration queries associated with this activity?

Which log source is essential for Cortex XDR to track successful and failed interactive logon events on Windows workstations for ITDR analysis?

What is the primary benefit of using Cortex XDR's identity correlation engine when triaging incidents?

Track your progress over time

Start a Identity Threat Detection And Response only practice session

Related XDR-Analyst topic practice pages

Alert Lifecycle And Incident Correlation practice questions

Planning And Installation practice questions

Evidence Review And Response Actions practice questions

Identity Threat Detection And Response practice questions

XDR-Analyst fundamentals practice questions

XDR-Analyst scenario practice questions

XDR-Analyst troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid