I85PREP
⌘ K
XDR Analyst study materials
XDR Analyst study resources

XDR Analyst practice questions

One question at a time. Build your XDR Analyst understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Extended Detection and Response (XDR) fundamentals and platform components

Which capability most clearly distinguishes an XDR platform from a traditional EDR product?

  1. Full packet capture retained on the endpoint agent for forensic replay
  2. Signature-based scanning of files stored on managed endpoints
  3. Host isolation and process termination on a single workstation
  4. Native correlation of telemetry across endpoint, network, identity, and cloud sources into unified detections Correct answer.

Explanation

XDR is defined by cross-domain telemetry collection and correlation, producing detections that span endpoint, network, identity, email, and cloud rather than a single sensor type. EDR is centered on endpoint telemetry and response actions. The distinguishing property is therefore the breadth of sources feeding a common analytics layer.

Question 2Extended Detection and Response (XDR) fundamentals and platform components

An analyst wants a single normalized schema so that process, DNS, and authentication events can be queried together. Which XDR platform component provides this?

  1. The data normalization and schema layer Correct answer.
  2. The automated response playbook library
  3. The detection rule engine
  4. The threat intelligence feed connector

Explanation

A normalization layer maps heterogeneous vendor telemetry into a common schema so events from different sources become comparable and jointly queryable. The rule engine consumes that data but does not create the shared field structure. Playbooks and intelligence connectors operate on top of normalized events rather than defining them.

Question 3Extended Detection and Response (XDR) fundamentals and platform components

What is the primary role of a detection rule engine inside an XDR platform?

  1. Storing raw telemetry for long-term retention
  2. Encrypting agent-to-cloud communications
  3. Managing user identities and role-based access to the console
  4. Continuously evaluating ingested events against logic to raise alerts Correct answer.

Explanation

The rule engine applies detection logic, whether signature, behavioral, or correlation-based, to streaming and stored telemetry, generating alerts when conditions match. Storage, access control, and transport encryption are handled by other platform subsystems. Separating these roles is essential when troubleshooting why an expected alert did not fire.

Question 4Extended Detection and Response (XDR) fundamentals and platform components

Which telemetry source is most directly associated with detecting a suspicious OAuth consent grant in an XDR deployment?

  1. Endpoint process creation logs
  2. Network flow records from a perimeter firewall
  3. Email gateway attachment scanning logs
  4. Cloud identity provider audit logs Correct answer.

Explanation

OAuth consent grants are recorded by the identity provider that issues the token, so cloud identity audit logs are the authoritative source for that activity. Endpoint, network flow, and email scanning data may show downstream effects but do not record the grant itself. Analysts should route identity provider audit events into XDR to detect this pattern.

Question 5Extended Detection and Response (XDR) fundamentals and platform components

Which statement best describes the function of a response playbook in an XDR platform?

  1. It maps raw vendor fields into the platform's normalized schema
  2. It defines a predefined sequence of automated and analyst-approved actions triggered by a detection Correct answer.
  3. It stores indicators of compromise retrieved from external feeds
  4. It establishes the retention period for raw telemetry

Explanation

A playbook codifies the response workflow, combining automated steps such as isolating a host with manual approval gates, and is triggered by detections or analyst initiation. Schema mapping, indicator storage, and retention policy are separate platform functions. Playbooks are the mechanism by which XDR moves from alerting to consistent response.

Question 6Extended Detection and Response (XDR) fundamentals and platform components

A SOC deploys XDR agents on servers, workstations, and cloud workloads. Which benefit most directly results from this coverage?

  1. Automatic compliance certification for the covered assets
  2. Correlated process lineage and lateral movement visibility across the estate Correct answer.
  3. Elimination of the need for network-based detection controls
  4. Guaranteed prevention of all ransomware encryption attempts

Explanation

Broad agent coverage gives the platform process lineage, parent-child relationships, and cross-host activity needed to reconstruct lateral movement. No endpoint tool guarantees prevention of every encryption attempt, and network controls still provide value for unmanaged devices. Compliance certification requires assessment processes beyond telemetry collection.

Question 7Extended Detection and Response (XDR) fundamentals and platform components

Which XDR component is responsible for enriching raw events with geolocation, asset criticality, and known-bad indicator context?

  1. The ingestion pipeline's parsing stage
  2. The agent updater service
  3. The enrichment and context service Correct answer.
  4. The alert triage queue

Explanation

Enrichment services attach additional context, such as asset criticality, geolocation, and threat intelligence matches, to events and alerts so analysts can prioritize. Parsing standardizes structure but does not add external context. Triage queues and agent updaters serve workflow and maintenance roles respectively.

Question 8Extended Detection and Response (XDR) fundamentals and platform components

Which outcome best indicates that XDR detections are properly tuned rather than overly noisy?

  1. Every raw event generates a corresponding alert for full coverage
  2. All detections are disabled except vendor signature matches
  3. Alerts are routed only to a shared mailbox without ownership
  4. Alert volume is dominated by high-fidelity detections that analysts confirm as actionable Correct answer.

Explanation

Effective tuning produces alerts that mostly correspond to genuine, actionable activity, keeping analyst workload sustainable. Alerting on every event creates unmanageable noise, and disabling behavioral detections removes the value of XDR correlation. Routing alerts without clear ownership also undermines response accountability.

Question 9Extended Detection and Response (XDR) fundamentals and platform components

An alert shows a workstation contacting a newly registered domain, and the same domain appears in proxy logs from three other subnets within ten minutes. Which XDR strength is being demonstrated?

  1. Agent self-protection against tampering
  2. Cross-source correlation that links endpoint and network evidence into one incident Correct answer.
  3. Host-based memory scanning of the initiating process
  4. Static file reputation scoring of downloaded binaries

Explanation

The platform joined endpoint telemetry with proxy logs across multiple subnets, revealing a pattern no single sensor would show alone. That is the core cross-source correlation value of XDR. Memory scanning, file reputation, and agent tamper protection are narrower sensor capabilities that do not explain the multi-subnet linkage.

Question 10Extended Detection and Response (XDR) fundamentals and platform components

A detection rule references a normalized field that is populated only by one EDR vendor's parser. What is the most likely consequence when a second vendor's endpoint data is onboarded?

  1. The rule will silently miss activity from the second vendor's hosts Correct answer.
  2. The rule will fire correctly for both vendors because normalization guarantees identical fields
  3. The platform will automatically rewrite the rule to use the correct field
  4. Ingestion will be blocked until the rule is deleted

Explanation

If a rule depends on a vendor-specific field rather than a normalized one, hosts whose parser maps data differently will not match, producing silent coverage gaps. Normalization only helps when rules reference the shared schema. Platforms generally do not auto-rewrite logic, and ingestion continues regardless.

Question 11Extended Detection and Response (XDR) fundamentals and platform components

During triage, an analyst sees an alert where a finance user's token was used from two countries within five minutes. Which XDR data combination most directly supports confirming credential theft?

  1. Vulnerability scan results joined with patch deployment records
  2. Firewall bandwidth graphs joined with DHCP lease history
  3. Email gateway spam scores joined with DNS sinkhole logs
  4. Identity provider sign-in logs joined with endpoint process events on the user's device Correct answer.

Explanation

Impossible-travel style token reuse is confirmed by correlating identity provider sign-in records with endpoint activity that shows how the token may have been harvested. Bandwidth, spam score, and vulnerability data do not establish token misuse. The identity-plus-endpoint join is the canonical XDR pattern for credential theft confirmation.

Question 12Extended Detection and Response (XDR) fundamentals and platform components

An XDR alert fires on a script interpreter spawning a child process that makes an outbound connection. Which additional context most improves the analyst's ability to judge maliciousness?

  1. The user's department cost center
  2. The endpoint's total installed RAM
  3. The number of agents deployed in the region
  4. The parent process command line and the reputation of the destination domain Correct answer.

Explanation

Command-line arguments reveal what the script was instructed to do, and destination reputation indicates whether the connection is known-bad. Together they let the analyst distinguish administrative automation from malicious staging. Hardware, cost center, and deployment counts do not bear on the behavior's intent.

Question 13Extended Detection and Response (XDR) fundamentals and platform components

A team wants automated host isolation to occur only after an analyst approves it. Which playbook design satisfies this requirement?

  1. A scheduled report summarizing isolation candidates
  2. A detection rule that disables the endpoint agent
  3. A fully automated playbook with no approval step
  4. A playbook with a manual approval gate before the isolation action Correct answer.

Explanation

Inserting a manual approval gate before the containment action preserves human judgment while still automating the surrounding workflow. Fully automated playbooks act without review, disabling the agent removes visibility rather than containing the host, and reports do not execute response.

Question 14Extended Detection and Response (XDR) fundamentals and platform components

Which scenario best illustrates why XDR requires cloud workload telemetry in addition to endpoint agent data?

  1. A printer on the office network sends unencrypted management traffic
  2. A user opens a malicious macro in a document on a managed laptop
  3. A vendor releases a firmware update for a network switch
  4. A container escapes its namespace and spawns a cryptominer on a node without a supported endpoint agent Correct answer.

Explanation

Container and serverless environments often lack traditional endpoint agents, so runtime telemetry from the cloud control plane and workload sensors is required to see the escape and miner. The macro case is covered by endpoint telemetry, and printer traffic and firmware updates are unrelated to workload runtime visibility.

Question 15Extended Detection and Response (XDR) fundamentals and platform components

An analyst must explain why an XDR platform flagged a benign administrative script as suspicious. Which platform feature is most useful for documenting the reasoning behind the detection?

  1. The rule's detection logic and the specific field values that matched Correct answer.
  2. The console's color theme settings
  3. The license expiration date
  4. The agent's installation timestamp

Explanation

Explaining a detection requires showing the logic that fired and the exact field values that satisfied it, which supports both analyst justification and future tuning. Installation timestamps, UI preferences, and licensing have no bearing on why a rule matched. This traceability is central to defensible XDR operations.

Question 16Extended Detection and Response (XDR) fundamentals and platform components

A SOC observes that an XDR rule fires thousands of times daily on a legitimate backup process. What is the most appropriate tuning action?

  1. Increase the alert severity so analysts notice it more
  2. Disable all endpoint telemetry from backup servers
  3. Delete the rule entirely to eliminate the noise
  4. Add a narrowly scoped exclusion for the known backup binary and command pattern Correct answer.

Explanation

A narrow exclusion scoped to the specific binary and command pattern suppresses the known-good behavior while preserving detection for other activity. Deleting the rule removes coverage, disabling telemetry creates blind spots, and raising severity worsens the noise problem. Precision is the guiding principle in tuning.

Question 17Extended Detection and Response (XDR) fundamentals and platform components

Which data source in an XDR deployment is most appropriate for detecting data exfiltration over an approved cloud storage service?

  1. Wireless access point channel utilization metrics
  2. Printer spooler event logs
  3. Cloud access security broker or SaaS audit logs showing upload volume and destination Correct answer.
  4. Endpoint antivirus signature update logs

Explanation

Exfiltration to a sanctioned SaaS service is visible in CASB or SaaS audit logs that record uploads, volumes, and destinations tied to user identity. Signature update logs, spooler events, and wireless metrics do not describe data movement to cloud storage. This illustrates why XDR ingests SaaS audit telemetry.

Question 18Extended Detection and Response (XDR) fundamentals and platform components

An XDR platform ingests a massive volume of raw events but analysts complain they cannot find related activity quickly. Which platform capability most directly addresses this?

  1. A larger endpoint agent installation package
  2. More frequent agent heartbeat intervals
  3. A searchable data lake with indexed normalized fields and saved hunting queries Correct answer.
  4. Additional email distribution lists for alerts

Explanation

Fast investigation depends on indexed, normalized storage plus saved queries that let analysts pivot across sources. Agent package size, heartbeat frequency, and distribution lists affect deployment and notification, not investigative speed. Hunt efficiency is a data platform property, not an agent property.

Question 19Extended Detection and Response (XDR) fundamentals and platform components

A detection requires correlating a phishing email delivery, a subsequent endpoint browser download, and a later identity sign-in from a new location. Which XDR design element makes this possible?

  1. Agent-side packet capture stored only locally
  2. Independent per-product dashboards with no shared keys
  3. A shared entity model that links user, host, and message identifiers across sources Correct answer.
  4. Manual spreadsheet tracking by the analyst

Explanation

Correlating email, endpoint, and identity events requires a shared entity model where user, host, and message identifiers resolve to common entities. Isolated dashboards, local-only capture, and manual tracking cannot automatically join the chain. The entity model is what enables XDR to tell a single story across domains.

Question 20Extended Detection and Response (XDR) fundamentals and platform components

Which metric best reflects whether XDR response automation is functioning as intended?

  1. The average console page load latency
  2. The count of detection rules available in the content library
  3. The percentage of triggered playbooks that completed their intended action within the target time Correct answer.
  4. The total number of agents installed in the estate

Explanation

Automation health is measured by whether triggered playbooks actually completed their intended actions within expected timeframes. Agent counts, rule library size, and UI latency describe coverage, content, and interface performance rather than response execution. Measuring completion exposes broken integrations and permission failures.

Question 21Extended Detection and Response (XDR) fundamentals and platform components

An analyst finds that an XDR alert's process tree is truncated at the parent, showing only the immediate child. Which platform limitation should be investigated first?

  1. The threat intelligence feed subscription tier
  2. The console user's role permissions
  3. The endpoint sensor's process tracking configuration or event loss during collection Correct answer.
  4. The retention period for email logs

Explanation

Truncated process trees usually stem from sensor configuration that limits lineage depth or from dropped events during collection. Intelligence tier, role permissions, and email retention do not affect how process ancestry is recorded. Confirming sensor settings and ingestion health is the correct first step.

Question 22Extended Detection and Response (XDR) fundamentals and platform components

An organization wants XDR detections to account for assets running unsupported operating systems that cannot host an agent. Which approach best maintains coverage?

  1. Rely on network-based sensors and vulnerability data to model risk for those assets Correct answer.
  2. Assume those assets are low risk because they are unmanaged
  3. Install the agent anyway and accept frequent crashes
  4. Exclude those assets from all monitoring to avoid false positives

Explanation

Assets that cannot run an agent still generate network traffic and appear in vulnerability scans, so network sensors and exposure data provide the visibility that endpoint telemetry cannot. Excluding them, forcing incompatible installs, or assuming low risk all create unmonitored exposure. XDR coverage should be designed around sensor feasibility per asset class.

Question 23Extended Detection and Response (XDR) fundamentals and platform components

Two XDR rules produce separate alerts for the same underlying intrusion, one from identity data and one from endpoint data. What does this most likely indicate about the platform's correlation configuration?

  1. The rules should both be deleted to prevent duplication
  2. The identity provider is sending duplicate events by design
  3. Entity resolution or alert deduplication is not linking the shared user and host identifiers Correct answer.
  4. The endpoint sensor is malfunctioning and should be reinstalled

Explanation

When identity and endpoint detections describe the same intrusion but remain separate, the platform is failing to resolve shared identifiers into one incident. That points to entity resolution or deduplication configuration rather than sensor failure. Deleting the rules would remove legitimate detections instead of fixing correlation.

Question 24Extended Detection and Response (XDR) fundamentals and platform components

A regulated firm must prove that XDR automated containment actions are auditable. Which platform capability is most essential?

  1. A weekly summary email of top detections
  2. Agent auto-update enabled on all endpoints
  3. A dashboard showing real-time alert counts by severity
  4. Immutable action logs recording the triggering detection, approver, timestamp, and executed action Correct answer.

Explanation

Auditability requires a durable record tying each containment action to its trigger, the approving identity, timing, and the exact action taken. Dashboards, auto-update settings, and summary emails provide operational visibility but not defensible action provenance. Immutable logging is the control that satisfies the requirement.

Question 25Extended Detection and Response (XDR) fundamentals and platform components

An XDR deployment ingests telemetry from five regions, but detections consistently fire hours late in two of them. Which component should be examined first?

  1. The ingestion pipeline's buffering, parsing throughput, and regional connectivity to the platform Correct answer.
  2. The endpoint agent's license allocation
  3. The console's saved query library
  4. The detection rule's severity assignment

Explanation

Regional detection latency typically originates in the ingestion path, where buffering backlogs, parser throughput limits, or degraded connectivity delay events before rules can evaluate them. Severity settings, saved queries, and license allocation affect presentation and entitlement, not event timeliness. Tracing the pipeline end to end isolates the bottleneck.

Question 26Extended Detection and Response (XDR) fundamentals and platform components

Which capability most clearly distinguishes an XDR platform from a standalone EDR product?

  1. Signature-based scanning of files stored on managed endpoints
  2. Full disk encryption enforcement across managed laptops
  3. Host isolation triggered manually by a SOC analyst
  4. Native correlation of endpoint, identity, email, and network telemetry into unified detections Correct answer.

Explanation

XDR is defined by consolidating telemetry across multiple security control planes (endpoint, identity, email, network, cloud) and correlating it natively, rather than analyzing a single domain. EDR focuses primarily on endpoint process and file activity. The other options describe single-domain or unrelated capabilities.

Question 27Extended Detection and Response (XDR) fundamentals and platform components

An analyst wants to know how the XDR platform decides that an alert is critical versus low priority. Which component governs that decision?

  1. The endpoint agent's heartbeat interval
  2. The detection rule's severity mapping and risk scoring model Correct answer.
  3. The log retention period configured for cold storage
  4. The number of analysts assigned to the shift

Explanation

Prioritization in XDR comes from severity assigned by detection logic combined with risk scoring that weighs asset criticality, identity privilege, and indicator confidence. Agent heartbeat, retention, and staffing affect operations but do not determine an alert's computed severity.

Question 28Extended Detection and Response (XDR) fundamentals and platform components

Which statement best describes the role of a normalization schema such as ECS or OCSF in an XDR platform?

  1. It maps vendor-specific fields into common field names so detections work across heterogeneous sources Correct answer.
  2. It stores raw logs indefinitely for legal hold purposes
  3. It replaces the need for detection rules by auto-classifying all events
  4. It encrypts telemetry in transit between agents and the collector

Explanation

Normalization schemas define shared field names and structures so that a single detection can query endpoint, network, and cloud data regardless of the originating vendor. They do not encrypt traffic, eliminate detection logic, or handle retention policy.

Question 29Extended Detection and Response (XDR) fundamentals and platform components

A SOC wants XDR alerts to include the business owner and criticality of each affected host. Which dependency must be in place first?

  1. An asset inventory integrated with or ingested by the XDR platform Correct answer.
  2. Endpoint agents configured in detect-only mode
  3. A separate SIEM with its own correlation rules
  4. A packet capture appliance on every network segment

Explanation

Asset context such as ownership and criticality must come from an authoritative inventory, typically via CMDB or asset-management integration. Without that mapping the platform cannot attach business context to alerts. Packet capture, a separate SIEM, and agent mode do not supply ownership data.

Question 30Extended Detection and Response (XDR) fundamentals and platform components

An XDR platform ingests identity logs showing a successful MFA prompt followed within seconds by a mailbox rule creation from a new IP address. Which XDR strength does this scenario most directly demonstrate?

  1. Using file reputation to block known malware binaries
  2. Enforcing password complexity through directory policy
  3. Correlating identity and email telemetry to surface post-authentication attacker behavior Correct answer.
  4. Segmenting the network to limit lateral movement

Explanation

Combining identity events with email configuration changes lets the platform recognize a suspicious sequence that neither source alone would flag convincingly. This is cross-domain correlation of identity and email telemetry. File reputation, password policy, and segmentation are separate controls.

Question 31Extended Detection and Response (XDR) fundamentals and platform components

Which XDR data source is most useful for attributing a suspicious outbound connection to the specific user account that initiated it?

  1. NetFlow records collected at the perimeter firewall
  2. Identity provider authentication and session logs joined to endpoint process telemetry Correct answer.
  3. Cloud storage access logs from the object store
  4. DNS query logs from the recursive resolver

Explanation

Attribution to a user requires joining identity session data to the endpoint process that made the connection, which is exactly the cross-source join XDR enables. NetFlow and DNS show traffic but not the accountable account, and object store logs cover storage access rather than arbitrary outbound connections.

Question 32Extended Detection and Response (XDR) fundamentals and platform components

A detection engineer writes a rule against a normalized field, but events from one email gateway arrive with that field empty. What is the most appropriate next step?

  1. Add a second rule that fires only when the field is empty
  2. Lower the rule severity so the gap is less visible
  3. Inspect the gateway's parser mapping and correct the field extraction before relying on the rule Correct answer.
  4. Disable the rule until every source is upgraded to the same vendor

Explanation

Empty normalized fields usually indicate a parser mapping or extraction problem for that specific integration. Fixing the parser restores coverage for all rules using that field. Disabling the rule, alerting on emptiness, or hiding severity does not recover the missing data.

Question 33Extended Detection and Response (XDR) fundamentals and platform components

Which design choice best allows a single XDR detection to work across on-premises and multi-cloud workloads?

  1. Rely on hostname conventions to infer the cloud provider
  2. Write the rule against normalized cloud audit and endpoint fields rather than provider-specific keys Correct answer.
  3. Restrict the rule to a single region where the schema is stable
  4. Duplicate the rule once per cloud provider with hard-coded field names

Explanation

Portable detections are written against normalized fields that the platform populates consistently across providers. Duplicating rules per provider multiplies maintenance, region restriction reduces coverage, and hostname conventions are unreliable identifiers.

Question 34Extended Detection and Response (XDR) fundamentals and platform components

An XDR platform offers both built-in curated detections and a custom rule language. What is the primary tradeoff a SOC should weigh?

  1. Custom rules cannot use normalized fields and are limited to raw logs
  2. Curated content is maintained by the vendor but may not reflect the organization's environment, while custom rules fit local context but require ongoing tuning Correct answer.
  3. Curated content always produces fewer false positives than any custom rule
  4. Built-in detections stop working once custom rules are enabled

Explanation

Vendor-maintained detections benefit from continuous research updates but are generic, whereas custom rules encode environment-specific logic at the cost of ownership and tuning effort. The two coexist, and custom rules can use normalized fields.

Question 35Extended Detection and Response (XDR) fundamentals and platform components

Which XDR component is responsible for executing a containment action such as disabling a user account after a high-confidence detection?

  1. The dashboard visualization widget
  2. The normalization parser for identity events
  3. The response orchestration layer invoking an API action against the identity provider Correct answer.
  4. The data lake's cold storage tier

Explanation

Automated or analyst-approved containment is carried out by the response orchestration layer, which calls APIs on the relevant control plane such as the identity provider or endpoint agent. Storage tiers, parsers, and dashboards do not perform actions.

Question 36Extended Detection and Response (XDR) fundamentals and platform components

A SOC notices that XDR alerts reference file hashes and process names but never show which email delivered the initial payload. Which telemetry gap should be investigated first?

  1. The identity provider is not sending authentication logs
  2. Email gateway or mail security integration is missing or not forwarding message events Correct answer.
  3. Endpoint agents are not reporting process creation events
  4. The firewall is not exporting NetFlow records

Explanation

Absence of delivery context points to a missing or broken email integration, since message and attachment events would otherwise be available for correlation. Endpoint, identity, and NetFlow gaps would manifest as missing process, login, or traffic data rather than missing email context.

Question 37Extended Detection and Response (XDR) fundamentals and platform components

Which statement best explains why XDR platforms emphasize detection of behavioral sequences rather than only static indicators?

  1. Static indicators are prohibited by most regulatory frameworks
  2. Behavioral rules require no telemetry beyond DNS logs
  3. Sequence detection eliminates the need for any indicator feeds
  4. Attackers can change hashes and domains cheaply, but the sequence of actions needed to achieve their goal is harder to alter Correct answer.

Explanation

Indicators like hashes and domains are trivially rotated, whereas behavioral chains such as credential access followed by lateral movement remain necessary for the attacker's objective. Behavioral detection complements rather than replaces indicator feeds and still depends on rich telemetry.

Question 38Extended Detection and Response (XDR) fundamentals and platform components

An XDR platform reports a detection on a server, but the analyst cannot see the parent process because the agent was installed after the process started. Which limitation of endpoint telemetry does this illustrate?

  1. Normalization strips parent process identifiers from all events
  2. Endpoint agents cannot record process creation at all
  3. Detection rules ignore servers by default
  4. Telemetry is only captured for activity that occurs while the sensor is running and enabled Correct answer.

Explanation

Endpoint sensors observe events from the moment they are active, so activity predating installation or occurring during a sensor outage is invisible. This is a coverage-window limitation, not a schema or rule limitation.

Question 39Extended Detection and Response (XDR) fundamentals and platform components

A SOC wants to measure whether XDR detections produce actionable rather than overwhelming output. Which measurement approach is most defensible?

  1. Track the proportion of alerts that analysts close as true positive with a documented response action, alongside alerts per rule Correct answer.
  2. Measure the average CPU utilization of endpoint agents
  3. Count the total number of raw events ingested per day
  4. Report the number of integrations configured in the platform

Explanation

Actionability is best assessed by the ratio of alerts leading to a confirmed finding and a response, segmented by rule so noisy detections are identifiable. Event volume, agent CPU, and integration counts describe platform scale rather than detection quality.

Question 40Extended Detection and Response (XDR) fundamentals and platform components

An organization runs XDR with automated containment enabled. Which control most directly limits the blast radius if a detection misfires?

  1. Scoping containment actions to defined asset groups with approval gates for high-impact actions Correct answer.
  2. Enabling verbose debug logging on all agents
  3. Increasing the log retention period to one year
  4. Adding more analysts to the overnight shift

Explanation

Blast radius is governed by the scope of permitted actions and the approval requirements attached to them, so restricting containment to specific asset groups and gating destructive actions limits collateral damage. Retention, logging verbosity, and staffing do not constrain automated actions.

Question 41Endpoint security and endpoint detection and response

In endpoint detection and response, what is the primary purpose of continuous telemetry collection from endpoints?

  1. To automatically patch operating system vulnerabilities without approval
  2. To replace the need for antivirus signature updates on managed hosts
  3. To enforce disk encryption compliance across the fleet
  4. To maintain a searchable record of process, file, network, and registry activity for detection and investigation Correct answer.

Explanation

EDR platforms continuously record rich endpoint events so analysts can hunt, detect, and reconstruct incidents after the fact. Signature updates, patching, and encryption enforcement are separate controls handled by other tooling.

Question 42Endpoint security and endpoint detection and response

An analyst wants to detect a process that spawns a child process it does not normally create, such as a word processor launching a command shell. Which EDR data source is most directly suited to this detection?

  1. Disk free-space metrics
  2. Process creation events with parent-child lineage Correct answer.
  3. User login audit logs
  4. Firewall rule hit counters

Explanation

Process creation telemetry typically includes the parent process image and command line, enabling lineage-based detections. This is the canonical way to spot anomalous parent-child relationships like Office spawning cmd.exe.

Question 43Endpoint security and endpoint detection and response

What does a behavioral detection rule in EDR primarily rely on, in contrast to a signature-based detection?

  1. Patterns of action over time rather than a static byte pattern of known malware Correct answer.
  2. The digital certificate used to sign the binary
  3. A static file name blacklist maintained by the vendor
  4. A hash of the executable matched against a threat feed

Explanation

Behavioral rules describe sequences or combinations of actions, such as credential dumping followed by archive creation, rather than matching known file bytes. This lets them catch novel variants that signatures miss.

Question 44Endpoint security and endpoint detection and response

Which endpoint event type is most useful for identifying persistence established through a Windows service?

  1. Printer spooler job logs
  2. Browser history entries
  3. Service creation events recorded by the EDR sensor Correct answer.
  4. Screen resolution change events

Explanation

Service installation creates a durable autostart mechanism, and many EDR sensors log service creation with the binary path and account. That event directly exposes the persistence mechanism and the executable involved.

Question 45Endpoint security and endpoint detection and response

An EDR alert shows a process making an outbound connection to an unfamiliar IP address on port 443. What is the most appropriate next investigative step?

  1. Pivot on the process image and command line, then check whether the destination is associated with known malicious infrastructure Correct answer.
  2. Immediately reimage the host without collecting evidence
  3. Disable all outbound network access for the entire organization
  4. Ignore the alert because port 443 is always benign

Explanation

Analysts should enrich the alert with process context and threat intelligence on the destination before deciding on containment. Port 443 is commonly abused, so the port alone tells you nothing about intent.

Question 46Endpoint security and endpoint detection and response

What is the role of a sensor in an EDR architecture?

  1. It stores the organization's threat intelligence feed
  2. It performs network packet capture at the perimeter
  3. It collects and forwards endpoint activity data to the management platform Correct answer.
  4. It provides the analyst-facing case management interface

Explanation

The sensor, or agent, runs on the endpoint and is responsible for capturing events and sending them to the backend. Analytics, case management, and perimeter capture are handled elsewhere.

Question 47Endpoint security and endpoint detection and response

Which of the following best describes isolated containment in an EDR product?

  1. The endpoint is powered off automatically
  2. The endpoint's disk is encrypted and the key is escrowed
  3. The endpoint keeps its sensor connection to the EDR platform but other network traffic is blocked Correct answer.
  4. The endpoint is removed from the asset inventory

Explanation

Containment typically restricts network communication while preserving the management channel so analysts can continue investigating and later release the host. Powering off or encrypting the disk are different actions with different consequences.

Question 48Endpoint security and endpoint detection and response

A fileless attack that injects code into a running process is best detected by which EDR capability?

  1. Static file scanning of the download folder
  2. Memory and process behavior monitoring Correct answer.
  3. Registry backup comparison
  4. Disk defragmentation logs

Explanation

Fileless techniques leave little on disk, so detection depends on inspecting in-memory activity such as suspicious remote thread creation or anomalous API calls. Static file scanning will not see code that never lands as a file.

Question 49Endpoint security and endpoint detection and response

An analyst observes a process repeatedly reading the Windows LSASS memory. Which attack technique does this most likely indicate?

  1. Ransomware encryption
  2. Credential dumping Correct answer.
  3. Data exfiltration over DNS
  4. Living-off-the-land discovery

Explanation

LSASS holds authentication material, and tools that read its memory are typically harvesting credentials. Encryption, discovery, and exfiltration would show different behavioral patterns.

Question 50Endpoint security and endpoint detection and response

A detection rule fires on powershell.exe launched with an encoded command parameter. Why do analysts treat this as high signal?

  1. Encoded commands obscure intent and are commonly used to evade command-line logging and string-based detection Correct answer.
  2. The encoded parameter is required by the operating system
  3. PowerShell cannot be used for legitimate administration
  4. Encoded commands always fail to execute on modern Windows hosts

Explanation

Base64-encoded PowerShell hides the actual script from casual inspection and simple string rules, making it a favorite for attackers. It is not inherently malicious, so context and decoded content still matter.