Free xdr-analyst sample questions

Correct answer: Terminate the malicious PowerShell process.

Terminating the specific malicious process is the most precise action. It stops the active threat (the C2 connection) without disrupting the legitimate administrative tool or the server's primary function, thus adhering to the policy against isolation. Blocking the legitimate tool's hash would cause operational disruption. Isolating the host is explicitly forbidden. Adding the IP to a block list is a good secondary step but doesn't stop the already running process.

Correct answers: Add the digital certificate signer of the internal tools to the allow list.; Create process exceptions for the parent directories where custom tools are executed.

Adding the signer certificate is a secure and scalable way to trust all applications signed by the internal development team. This avoids having to allow-list every single file hash.

Creating process exceptions for specific directories is a common and effective method to prevent alerts on known-good applications running from a controlled location. This is more targeted than disabling entire modules.

Correct answer: dataset = xdr_data | filter action_evtlog_event_type = Enum.FileCreated and action_file_path contains 'Downloads' and action_file_name ends_with '.ps1'

This query correctly uses the `xdr_data` dataset, filters for the specific `Enum.FileCreated` event type, checks that the `action_file_path` contains 'Downloads', and uses the `ends_with` function to accurately find files with the '.ps1' extension. This is the most precise and correct syntax among the options.

Correct answer: Causality analysis engine

The Causality Analysis Engine is the core component that processes data from all sources (endpoint, network, cloud, identity) and builds a comprehensive picture of an attack. It identifies relationships between events, such as a process on an endpoint making a network connection that is logged by a firewall, and stitches them together into a unified incident view.

Correct answer: False

The 'Isolate Host' action is designed to block all network traffic *except* for the essential communication between the Cortex XDR agent and the XDR console. This ensures that the analyst maintains control over the isolated endpoint and can perform further actions like running Live Terminal commands, collecting forensic data, or removing the isolation.

Correct answer: The server may not receive new agent versions or security content updates.

When an OS is marked as 'Unsupported', it means Palo Alto Networks no longer develops or tests new agent versions and content for that OS. While the existing agent might continue to function, it will not receive updates, leaving the endpoint increasingly vulnerable to new threats that are addressed in later content versions.

Correct answer: dataset=xdr_data | filter action_network_protocol = 'DNS' | alter query_length = string_length(dns_query_name) | filter query_length > 100 | comp count_distinct(dns_query_name) as unique_queries by actor_process_image_path

This advanced query effectively hunts for DNS tunneling. It filters for DNS events, calculates the length of the DNS query name (where exfiltrated data is often encoded), filters for unusually long queries (e.g., > 100 characters), and then aggregates the count of unique long queries by the process that initiated them. A high count of unique, long queries from a single process is a strong indicator of data exfiltration.

Correct answer: The endpoint policy assigned to the servers has an older content version selected.

Exploit protection modules and other security logic are delivered via content updates, which are versioned separately from the agent software itself. A policy can be configured to use the 'latest' content or pinned to a specific, older version. If the policy is pinned to a content version released before the new module was available, the endpoints will not receive or apply it, even if the agent software is up to date.

Correct answer: Run the `get-file` command, then navigate to the 'Action Center' to download the file.

The correct process is to first initiate the file retrieval from the endpoint using the `get-file` command in the Live Terminal session. Once the agent has successfully uploaded the file to the Cortex XDR backend, the analyst must go to the 'Action Center' to find the completed action and download the retrieved file to their local machine for analysis.

Correct answer: To enrich query results with external or custom data.

Lookup tables are used to enrich data within XQL queries. An analyst can upload a CSV file containing contextual information (e.g., a list of critical assets, user-to-department mappings, or known malicious indicators) and then use the `lookup` command in an XQL query to join this external data with the event data stored in Cortex XDR, providing more meaningful results.