An analyst is investigating an alert that shows a service account was used to log into multiple servers in quick succession. The analyst suspects lateral movement. Which evidence would best support this hypothesis?

The logon events show the same account authenticating to multiple servers within a short time

The service account has administrative privileges on one server

The service account's password was recently changed

The servers have the same patch level

What is a causality chain in the context of XDR incident investigation?

A list of all network connections made by a single host

A chronological list of all alerts generated by the XDR platform

A visual representation of the organization's network topology

A sequence of linked events that shows how an attack progressed from initial entry to its final impact

What is the primary purpose of creating a timeline during an incident investigation?

To understand the sequence and timing of events to identify the attack's progression and speed

To replace the need for a causality chain

To assign blame to specific users for the incident

To provide a summary of the organization's security posture

An analyst is investigating an alert that shows a user account was used to log into a server and then execute a privilege escalation command. The analyst suspects the account was compromised. Which combination of evidence would best confirm the compromise and reveal the attack's progression?

The user's recent password changes and the server's patch level

The process tree showing the privilege escalation command and the user's group memberships

The authentication log showing the logon method and the subsequent command execution events

The source IP address of the logon and the user's typical login times

An analyst is creating a timeline for an incident and has events from multiple sources: endpoint logs, network logs, and authentication logs. The analyst notices that the timestamps from different sources are not synchronized. What should the analyst do to ensure the timeline is accurate?

Use the timestamps as they are, since they are all from the same organization

Normalize the timestamps to a common time zone and account for clock skew

Discard events that have inconsistent timestamps

Rely on the event with the most recent timestamp as the start of the timeline

Palo Alto NetworksCertified XDR Analyst

Domain 2Objective 1

2.1 Review and Investigate Alert Evidence XDR-ANALYST Practice Questions (Page 5)

Part of the Incident Handling and Response domain, which accounts for 34% of the XDR-ANALYST exam.

33questions here

7free pages

8concepts

34%of the exam

Questions 21–25

21application · medium
An analyst is investigating an alert that shows a service account was used to log into multiple servers in quick succession. The analyst suspects lateral movement. Which evidence would best support this hypothesis?
Select an answer first
22foundation · easy
What is a causality chain in the context of XDR incident investigation?
Select an answer first
23foundation · easy
What is the primary purpose of creating a timeline during an incident investigation?
Select an answer first
24expert · hard
An analyst is investigating an alert that shows a user account was used to log into a server and then execute a privilege escalation command. The analyst suspects the account was compromised. Which combination of evidence would best confirm the compromise and reveal the attack's progression?
Select an answer first
25application · medium
An analyst is creating a timeline for an incident and has events from multiple sources: endpoint logs, network logs, and authentication logs. The analyst notices that the timestamps from different sources are not synchronized. What should the analyst do to ensure the timeline is accurate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XDR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XDR-ANALYST” is a trademark of its owner, used for identification only.