xdr-analyst XDR Analyst Practice Questions

Incident scoring in Cortex XDR combines the severity of individual alerts with other factors, such as the number of alerts, the types of tactics and techniques observed (MITRE ATT&CK), and the criticality of the involved assets. A high score (typically 70-100) indicates a high-confidence, high-impact event that should be prioritized for immediate analysis and response.

The Causality View provides a graphical representation of the attack chain, showing how one process launched another, which in turn created a file or network connection, helping the analyst understand the sequence of events.

By tracing the chain of events backward from the alert, the Causality View helps an analyst quickly identify the initial point of entry or execution—the root cause—of the incident.

Cortex Data Lake provides granular control over data retention. An administrator can set a default retention period (e.g., 90 days) and then create additional, filtered retention rules. In this case, they would create a rule with an XQL filter for authentication events (e.g., dataset = xdr_data and action_evtlog_event_id = 4624) and set the retention period for data matching that filter to 365 days.

This is the most comprehensive and methodologically sound approach. 1. Isolation immediately contains the threat. 2. Blocking the hashes of both the initial dropper and the payload prevents them from running elsewhere. 3. Blocking the C2 domain stops further communication. 4. Proactively hunting for other compromised machines using the observed IOC is a critical step to determine the scope of the breach.

The alter stage is used for data manipulation within the query pipeline. It allows an analyst to create new fields based on calculations or functions (e.g., alter new_field = field_a + field_b), modify existing fields, or remove fields from the results. It is essential for transforming raw data into a more useful format for analysis.

Terminating the specific malicious process is the most precise action. It stops the active threat (the C2 connection) without disrupting the legitimate administrative tool or the server's primary function, thus adhering to the policy against isolation. Blocking the legitimate tool's hash would cause operational disruption. Isolating the host is explicitly forbidden. Adding the IP to a block list is a good secondary step but doesn't stop the already running process.

Adding the signer certificate is a secure and scalable way to trust all applications signed by the internal development team. This avoids having to allow-list every single file hash.

Creating process exceptions for specific directories is a common and effective method to prevent alerts on known-good applications running from a controlled location. This is more targeted than disabling entire modules.

This query correctly uses the xdr_data dataset, filters for the specific Enum.FileCreated event type, checks that the action_file_path contains 'Downloads', and uses the ends_with function to accurately find files with the '.ps1' extension. This is the most precise and correct syntax among the options.

The Causality Analysis Engine is the core component that processes data from all sources (endpoint, network, cloud, identity) and builds a comprehensive picture of an attack. It identifies relationships between events, such as a process on an endpoint making a network connection that is logged by a firewall, and stitches them together into a unified incident view.

The 'Isolate Host' action is designed to block all network traffic except for the essential communication between the Cortex XDR agent and the XDR console. This ensures that the analyst maintains control over the isolated endpoint and can perform further actions like running Live Terminal commands, collecting forensic data, or removing the isolation.