Free XDR-Analyst Practice Test Questions and Answers (2026)

The primary function of lookup tables in Cortex XDR is to enrich internal data with external context. Analysts can upload external data, such as threat intelligence feeds, asset inventories, or user directories, as a CSV file. This creates a lookup table that can then be used in XQL queries to correlate with and add valuable context to the data collected by Cortex XDR. This process is crucial for enhancing investigations by, for example, mapping an IP address from an alert to a known malicious actor or identifying the owner of a compromised asset.

The Scheduled Queries feature in Cortex XDR is designed to automate threat hunting. It allows analysts to save an XQL (XDR Query Language) query and configure it to run automatically at predefined intervals (e.g., hourly, daily). This transforms a manual, point-in-time hunting exercise into a continuous, automated detection mechanism. If the query returns results, indicating a potential threat or policy violation, Cortex XDR can be configured to generate an alert. This proactive approach ensures that emerging threats matching the query logic are identified without constant manual effort.

Cortex XDR, particularly through its Host Insights module, identifies vulnerabilities on endpoints by their Common Vulnerabilities and Exposures (CVE) identifiers. A primary remediation suggestion is to apply the necessary security patches to fix these vulnerabilities. This process is vendor-agnostic because the patch must be obtained from the specific software vendor (e.g., Microsoft, Adobe, Oracle) whose product is vulnerable. This action addresses the root cause of a potential exploit, which is a fundamental goal of effective security remediation.

In the Cortex XDR console, "starring" an alert is a manual action performed by an analyst. This action applies a visual star icon to the alert, serving as a flag to mark it as important, requiring follow-up, or needing further attention. It is a triage and workflow management feature that helps analysts and security teams prioritize and organize their investigation efforts within the alerts table. This action does not change the alert's status, severity, or its relationship to an incident; it is purely a user-applied indicator of significance.

Cortex XDR provides identity-based alerts through its Identity Analytics engine, which leverages User and Entity Behavior Analytics (UEBA). A fundamental prerequisite for this capability is the integration with directory services, such as Microsoft Active Directory. By synchronizing user, group, and computer account information, Cortex XDR can build behavioral profiles for users and entities. The Identity Analytics engine then analyzes this data, along with endpoint and network activity, to detect anomalous behaviors and identity-based threats like credential-based attacks or insider threats, subsequently generating specific identity-based alerts.

The "Featured fields" in Cortex XDR are a curated set of the most important attributes displayed at the top of the Incident and Alert Views. Their primary purpose is to provide a quick summary of key information, such as the involved user, host, severity, and alert sources. This allows a security analyst to rapidly assess the context and significance of an event, enabling faster and more efficient triage and initial investigation without having to immediately parse through all the underlying raw data.

Forensic data from affected hosts provides the most direct and comprehensive insight into the root cause of an attack. The Cortex XDR agent collects detailed endpoint activity, including process creations, file modifications, registry changes, and network connections. This rich dataset is processed by the Causality Analysis Engine to construct a visual process tree or "causality chain." This chain explicitly maps the sequence of events, allowing an analyst to trace the attack back to its initial point of entry and understand the exact actions taken by the adversary, thereby revealing the root cause.

Forensic investigation in Cortex XDR focuses on analyzing evidence to understand the scope and impact of a security incident. Analyzing memory dumps (or live memory via tools like Live Terminal) for malicious processes is a core forensic technique to identify active threats. Similarly, reviewing registry changes is fundamental to uncovering malware persistence mechanisms and configuration alterations. Cortex XDR provides the necessary data and tools, such as the Causality View and Live Terminal, to perform these specific investigative activities directly on the endpoint.

The Cortex XDR Query Library is a central repository designed to enhance analyst efficiency and collaboration. Its primary benefits are allowing analysts to save complex or frequently used XQL (XDR Query Language) queries for quick reuse, eliminating the need to rebuild them from scratch. Additionally, the library facilitates teamwork by enabling analysts to share these saved queries with other users within the same Cortex XDR instance. This ensures consistency in investigation methods and allows junior analysts to leverage the expertise of senior team members.

The integration of dashboards, reports, and Host Insights in Cortex XDR provides a unified and comprehensive security posture overview for a Security Operations Center (SOC). Dashboards offer at-a-glance visibility into detections and incidents. Host Insights enriches this data with deep contextual information about assets, including their vulnerabilities, installed software, and patch levels. Reports allow for the summarization and distribution of this correlated data. This combination creates a holistic view, enabling analysts to quickly connect active threats with vulnerable assets, prioritize responses effectively, and understand the overall risk landscape.

Cortex XDR's custom incident scoring rules allow organizations to tailor incident prioritization to their specific environment and security needs. These rules can modify an incident's score based on various criteria. By creating rules that increase the score for specific alert categories (e.g., malware, ransomware), analysts can adjust the perceived severity. Similarly, rules can be configured to significantly raise the score for any alerts involving predefined business-critical assets (like domain controllers or executive laptops), ensuring these incidents receive immediate attention. This helps security teams focus their efforts on the most significant threats to the organization.

The Cortex XDR causality chain is a fundamental analysis tool that provides a visual, chronological narrative of an incident. It automatically stitches together disparate activities—such as process executions, file modifications, and network connections—into a single, comprehensible graph. This allows an analyst to quickly identify the root cause of an alert, trace the sequence of malicious or suspicious events, and understand the full scope and impact of an attack without manually correlating logs from different sources.

The timeline view in Cortex XDR is a fundamental tool for incident investigation. It organizes all associated alerts and events into a chronological sequence. This presentation allows an analyst to follow the progression of an attack step-by-step, from the initial alert to subsequent activities. By visualizing the events in the order they occurred, analysts can effectively reconstruct the attack flow, understand the attacker's methodology, and identify the full scope of the incident.

The 'Disabled' operational state in Cortex XDR indicates that the agent is installed on the endpoint, but its protection capabilities have been intentionally deactivated. An administrator typically disables an agent for troubleshooting or maintenance, which stops the agent from enforcing its security policy. In this state, the endpoint is vulnerable as the agent is not actively monitoring, preventing, or reporting security events. The agent remains installed and can be re-enabled by an administrator to resume protection.

Cortex Query Language (XQL) provides several aggregation functions to perform calculations and summarize data from query results. The COUNT() function is used to return the number of results in a specified field or for the entire dataset. The SUM() function calculates the total value of a numeric field across the results. Both are fundamental aggregation functions used for data analysis within XQL. Functions like PATCH() or REMEDIATE() are not part of the XQL syntax; they represent response actions available within the Cortex XDR platform, separate from the data querying process.

Cortex XDR integrates with Cortex XSOAR (Security Orchestration, Automation, and Response) to enable automated responses to threats. When Cortex XDR generates an alert or an incident that meets specific criteria, it can trigger a corresponding playbook in XSOAR. A playbook is a predefined, automated workflow that executes a series of response actions, such as isolating an endpoint, quarantining files, or blocking malicious indicators on a firewall. This integration allows security teams to automate repetitive tasks, accelerate response times, and ensure consistent handling of security events without manual intervention.

Prevention Profiles in Cortex XDR are specifically designed to configure the agent's threat prevention capabilities. This includes creating rules and defining actions for malware, exploits, and behavioral threats. Malware blocking rules are a core component of the Malware Protection module within a Prevention Profile.

In contrast, an Agent Settings Profile (formerly known as an Extension Profile) is used to manage the operational settings of the Cortex XDR agent and to enable and assign policies for add-on modules. Host Firewall and Device Control are examples of such modules, which have their own dedicated policy types that are applied to endpoints via an Agent Settings Profile.

The xdrdata dataset is the primary and most comprehensive data source within Cortex XDR. It serves as the central repository for all raw, low-level telemetry collected from various sensors, including Cortex XDR agents on endpoints and data from firewalls. This dataset contains granular event logs such as process executions, network connections, file activities, and registry modifications. Security analysts use the XDR Query Language (XQL) to directly query this raw data for in-depth threat hunting, incident investigation, and the creation of custom detection rules.

Indicator of Compromise (IOC) hunting is a proactive security process focused on searching for known malicious artifacts within an environment. When building a hunting query in Cortex XDR using the Query Builder or XQL, the primary focus is on these specific indicators. These indicators are atomic pieces of evidence, such as known malicious file hashes (MD5, SHA256), IP addresses, or domain names associated with threat actors or malware campaigns. The query is constructed to search through endpoint and network data logs to find any matches for these IOCs, which would signify a potential compromise.

The Cortex XDR incident score is a numerical value from 0-100 designed to help analysts prioritize their work by indicating the potential risk of an incident. The score is influenced by two primary factors. First, the severity levels of the alerts within the incident are a key determinant, with the score being heavily weighted by the highest severity alert. Second, the number of correlated alerts that constitute the incident provides critical context about the scope and scale of the potential attack. A larger number of correlated alerts suggests a more widespread or persistent threat, which in turn influences the overall score and priority.