Free xdr-analyst sample questions

Correct answer: dataset = xdr_data | filter action_evtlog_event_type = Enum.FileCreated and action_file_path contains 'Downloads' and action_file_name ends_with '.ps1'

This query correctly uses the `xdr_data` dataset, filters for the specific `Enum.FileCreated` event type, checks that the `action_file_path` contains 'Downloads', and uses the `ends_with` function to accurately find files with the '.ps1' extension. This is the most precise and correct syntax among the options.

Correct answer: Causality analysis engine

The Causality Analysis Engine is the core component that processes data from all sources (endpoint, network, cloud, identity) and builds a comprehensive picture of an attack. It identifies relationships between events, such as a process on an endpoint making a network connection that is logged by a firewall, and stitches them together into a unified incident view.

Correct answer: False

The 'Isolate Host' action is designed to block all network traffic *except* for the essential communication between the Cortex XDR agent and the XDR console. This ensures that the analyst maintains control over the isolated endpoint and can perform further actions like running Live Terminal commands, collecting forensic data, or removing the isolation.

Correct answer: The server may not receive new agent versions or security content updates.

When an OS is marked as 'Unsupported', it means Palo Alto Networks no longer develops or tests new agent versions and content for that OS. While the existing agent might continue to function, it will not receive updates, leaving the endpoint increasingly vulnerable to new threats that are addressed in later content versions.

Correct answer: dataset=xdr_data | filter action_network_protocol = 'DNS' | alter query_length = string_length(dns_query_name) | filter query_length > 100 | comp count_distinct(dns_query_name) as unique_queries by actor_process_image_path

This advanced query effectively hunts for DNS tunneling. It filters for DNS events, calculates the length of the DNS query name (where exfiltrated data is often encoded), filters for unusually long queries (e.g., > 100 characters), and then aggregates the count of unique long queries by the process that initiated them. A high count of unique, long queries from a single process is a strong indicator of data exfiltration.

Correct answer: The endpoint policy assigned to the servers has an older content version selected.

Exploit protection modules and other security logic are delivered via content updates, which are versioned separately from the agent software itself. A policy can be configured to use the 'latest' content or pinned to a specific, older version. If the policy is pinned to a content version released before the new module was available, the endpoints will not receive or apply it, even if the agent software is up to date.

Correct answer: Run the `get-file` command, then navigate to the 'Action Center' to download the file.

The correct process is to first initiate the file retrieval from the endpoint using the `get-file` command in the Live Terminal session. Once the agent has successfully uploaded the file to the Cortex XDR backend, the analyst must go to the 'Action Center' to find the completed action and download the retrieved file to their local machine for analysis.

Correct answer: To enrich query results with external or custom data.

Lookup tables are used to enrich data within XQL queries. An analyst can upload a CSV file containing contextual information (e.g., a list of critical assets, user-to-department mappings, or known malicious indicators) and then use the `lookup` command in an XQL query to join this external data with the event data stored in Cortex XDR, providing more meaningful results.

Correct answer: It is a technique commonly used in Kerberoasting attacks to obtain service account password hashes.

Attackers performing a Kerberoasting attack will specifically request a Kerberos ticket for a service account using the weaker RC4-HMAC encryption. Because the ticket is encrypted with a key derived from the service account's password, the attacker can take the ticket offline and use brute-force methods to crack the password. Modern systems default to stronger AES encryption, so a request for RC4 is a strong indicator of this specific attack technique.

Correct answer: A new widget in the dashboard builder powered by an XQL query.

Custom dashboard widgets are powered by XQL queries. The analyst would first construct the appropriate XQL query (e.g., filtering for PowerShell as a child process and aggregating by the parent process) and then use this query as the data source for a new widget within the dashboard management interface, setting the time frame to 'Last 7 Days'.