Extended Detection and Response (XDR) MCQs (Multiple-Choice Questions)

1. What is the primary purpose of Extended Detection and Response (XDR)?

1. To replace every computer with a dedicated security appliance
2. To integrate security telemetry across multiple sources for coordinated threat detection and response
3. To manage employee payroll and attendance
4. To provide data storage without monitoring security events

Answer: B) To integrate security telemetry across multiple sources for coordinated threat detection and response

Explanation:

XDR brings together security information from sources such as endpoints, networks, email, cloud services, and identity systems. By correlating these events, it can provide broader visibility into attacks and help security teams investigate and respond to incidents across different layers of the IT environment.

2. What does XDR stand for?

1. External Data Recovery
2. Extended Device Routing
3. Extended Detection and Response
4. Executable Defense Registry

Answer: C) Extended Detection and Response

Explanation:

XDR stands for Extended Detection and Response. The term describes security technologies that extend detection and response capabilities beyond a single source, commonly integrating endpoint, network, identity, email, and cloud security data.

3. Which security technology focuses primarily on detecting and responding to threats on individual devices?

1. Endpoint Detection and Response (EDR)
2. Network Detection and Response (NDR)
3. Data Loss Prevention (DLP)
4. Domain Name System (DNS)

Answer: A) Endpoint Detection and Response (EDR)

Explanation:

EDR monitors endpoint activity, such as process execution, file changes, and suspicious behavior. It supports threat investigation and response actions on devices. XDR can incorporate EDR telemetry alongside information from other security domains to provide a more comprehensive view of an incident.

4. How does XDR generally differ from EDR?

1. XDR monitors only physical servers, while EDR monitors cloud billing
2. EDR always includes every security domain, while XDR covers endpoints only
3. XDR is exclusively a backup technology
4. XDR correlates security information across multiple domains, while EDR focuses primarily on endpoints

Answer: D) XDR correlates security information across multiple domains, while EDR focuses primarily on endpoints

Explanation:

EDR concentrates on endpoint detection and response. XDR expands the scope by correlating telemetry from multiple security layers, depending on the product and integrations available. This broader context can help analysts understand how an attack moves between users, devices, applications, and networks.

5. Which of the following is a common source of telemetry for an XDR platform?

1. Employee vacation calendars only
2. Email security systems
3. Office furniture inventories
4. Printer paper usage reports only

Answer: B) Email security systems

Explanation:

Email security telemetry can reveal phishing messages, suspicious attachments, malicious URLs, and unusual message activity. When combined with endpoint, identity, and network information, email events can help analysts trace an attack from the initial phishing message to subsequent execution or account compromise.

6. What is the role of telemetry in XDR?

1. To provide observations and event data that support detection, investigation, and response
2. To replace authentication systems
3. To prevent all devices from generating logs
4. To store only employee contact information

Answer: A) To provide observations and event data that support detection, investigation, and response

Explanation:

Telemetry consists of information collected from systems, applications, networks, identities, and security tools. XDR uses this data to identify suspicious patterns, correlate related events, reconstruct attack sequences, and support informed response decisions.

7. What is event correlation in XDR?

1. Deleting all events that occur at the same time
2. Converting every security event into an email attachment
3. Connecting related events from different sources to identify a possible incident or attack sequence
4. Assigning random severity values to alerts

Answer: C) Connecting related events from different sources to identify a possible incident or attack sequence

Explanation:

Event correlation identifies relationships among observations, such as a phishing email, a suspicious process on a user's device, and an unusual login. These relationships can help reveal a broader attack that might appear unrelated when each event is examined separately.

8. Which capability helps XDR reduce the number of separate alerts that analysts must investigate?

1. Disabling all security sensors
2. Deleting every low-severity event immediately
3. Generating a new alert for every individual log entry
4. Correlating related alerts and presenting them as a unified incident

Answer: D) Correlating related alerts and presenting them as a unified incident

Explanation:

XDR can group related alerts into a single incident based on shared entities, timing, behaviors, or other relationships. This helps analysts focus on the overall attack sequence rather than investigating every alert independently. The effectiveness depends on data quality and correlation logic.

9. What is the main function of behavioral analytics in XDR?

1. To detect unusual activity that may indicate malicious behavior
2. To calculate employee salaries
3. To remove all historical security records
4. To guarantee that every attack is detected

Answer: A) To detect unusual activity that may indicate malicious behavior

Explanation:

Behavioral analytics examines patterns of activity to identify deviations from expected behavior. For example, an account accessing unusual resources or a process launching unexpected commands may warrant investigation. Unusual activity is not automatically malicious, so context and validation remain important.

10. Which component can provide XDR with information about suspicious communication between internal devices and external systems?

1. Human resources management software
2. Network Detection and Response (NDR)
3. Word-processing software
4. Desktop wallpaper management

Answer: B) Network Detection and Response (NDR)

Explanation:

NDR analyzes network traffic and related network telemetry to identify suspicious communication patterns, potential command-and-control activity, lateral movement, and other threats. XDR can correlate these observations with endpoint and identity events to improve incident investigation.

11. What is the primary purpose of a Security Operations Center (SOC)?

1. To manage only office hardware purchases
2. To design websites for external customers
3. To monitor, investigate, and coordinate responses to cybersecurity threats
4. To maintain employee attendance records exclusively

Answer: C) To monitor, investigate, and coordinate responses to cybersecurity threats

Explanation:

A SOC brings together people, processes, and technologies for security monitoring and incident response. XDR can support SOC operations by correlating security data, prioritizing incidents, presenting investigative context, and enabling coordinated response actions.

12. How can XDR help detect a phishing attack?

1. By analyzing only the computer's screen resolution
2. By ignoring email and identity information
3. By automatically assuming every external message is malicious
4. By correlating suspicious email activity with URL access, endpoint execution, and unusual account behavior

Answer: D) By correlating suspicious email activity with URL access, endpoint execution, and unusual account behavior

Explanation:

XDR can connect email detections with subsequent user and device activity. For example, a suspicious message may be followed by a click on a malicious URL, execution of a downloaded file, and an unusual authentication event. Correlating these signals helps analysts understand the attack's progression.

13. What is the purpose of automated response in XDR?

1. To perform predefined actions against detected threats according to configured policies
2. To eliminate the need for security policies
3. To disable every device whenever an alert occurs
4. To replace all incident investigation with manual data entry

Answer: A) To perform predefined actions against detected threats according to configured policies

Explanation:

Automated response can perform actions such as isolating an endpoint, disabling a compromised account, blocking a malicious domain, or quarantining a message. Actions should be carefully scoped, validated, and logged to avoid disrupting legitimate business operations.

14. Which action is an example of endpoint containment through XDR?

1. Increasing the brightness of the user's monitor
2. Isolating a compromised workstation from the network while preserving approved management access
3. Deleting all security logs from the endpoint
4. Changing the organization's public website design

Answer: B) Isolating a compromised workstation from the network while preserving approved management access

Explanation:

Endpoint isolation restricts a device's network communication to help prevent an attacker from moving laterally or communicating with external infrastructure. Depending on the platform, approved management or remediation channels may remain available so security teams can investigate and recover the device.

15. What is the purpose of an incident timeline in XDR?

1. To record only the number of computers in an office
2. To replace all endpoint telemetry
3. To arrange related events chronologically to help reconstruct an incident
4. To prevent analysts from investigating earlier activity

Answer: C) To arrange related events chronologically to help reconstruct an incident

Explanation:

An incident timeline organizes events such as logins, process execution, network connections, and file activity by time. It helps analysts determine how an incident began, what happened afterward, which assets were affected, and where containment or recovery actions may be needed.

16. What is the relationship between XDR and Security Information and Event Management (SIEM)?

1. SIEM is exclusively a backup system
2. XDR and SIEM are identical technologies in every implementation
3. XDR cannot consume information from logs
4. SIEM generally emphasizes log collection and correlation, while XDR emphasizes integrated detection and response across supported security domains

Answer: D) SIEM generally emphasizes log collection and correlation, while XDR emphasizes integrated detection and response across supported security domains

Explanation:

SIEM platforms typically aggregate and analyze logs and security events from many sources. XDR focuses on cross-domain threat detection, investigation, and response, often using deeply integrated telemetry and actions. Some products overlap in functionality, and organizations may use both technologies together.

17. What is a key difference between native XDR and open XDR?

1. Native XDR commonly relies on integrations within one vendor's ecosystem, while open XDR emphasizes integrating products from multiple vendors
2. Native XDR cannot detect threats
3. Open XDR can use only one endpoint sensor
4. Both terms describe backup storage formats

Answer: A) Native XDR commonly relies on integrations within one vendor's ecosystem, while open XDR emphasizes integrating products from multiple vendors

Explanation:

Native XDR often provides tightly integrated capabilities across a vendor's security portfolio. Open XDR emphasizes collecting and correlating data from multiple vendors' products. Exact definitions and integration capabilities vary by provider, so product architecture should be evaluated rather than relying on labels alone.

18. Why is identity telemetry important in XDR?

1. It provides information only about display settings
2. It helps detect suspicious logins, privilege changes, and potential account compromise
3. It eliminates the need for endpoint monitoring
4. It prevents all password-related attacks automatically

Answer: B) It helps detect suspicious logins, privilege changes, and potential account compromise

Explanation:

Identity telemetry includes authentication events, access requests, privilege changes, and account activity. Correlating this data with endpoint and network events can reveal compromised credentials, suspicious account use, and attempts to access sensitive resources.

19. How can cloud security telemetry improve XDR investigations?

1. By replacing every cloud access policy
2. By preventing the use of cloud applications
3. By providing context about cloud activity, workload behavior, and suspicious access
4. By guaranteeing that cloud misconfigurations cannot occur

Answer: C) By providing context about cloud activity, workload behavior, and suspicious access

Explanation:

Cloud telemetry can include audit logs, identity events, workload activity, configuration changes, and application access. XDR can correlate these signals with endpoint and network events to investigate attacks that cross on-premises and cloud environments.

20. What is a security playbook in an XDR environment?

1. A document listing employee entertainment activities
2. A list of unrelated hardware purchases
3. A collection of application passwords
4. A predefined workflow for investigating or responding to particular security events

Answer: D) A predefined workflow for investigating or responding to particular security events

Explanation:

A security playbook defines repeatable steps for handling specific scenarios, such as phishing, malware detection, or compromised accounts. Playbooks may include enrichment, investigation, approval, containment, and recovery steps, helping teams respond consistently.

21. What does SOAR stand for in cybersecurity?

1. Security Orchestration, Automation, and Response
2. System Operations and Resource Allocation
3. Secure Online Access Registry
4. Software Optimization and Recovery

Answer: A) Security Orchestration, Automation, and Response

Explanation:

SOAR platforms coordinate security tools, automate repeatable tasks, and support incident response workflows. XDR products may include SOAR-like capabilities or integrate with separate SOAR platforms to perform actions across security technologies.

22. Why should automated XDR actions include safeguards?

1. To ensure that every suspicious event shuts down the entire organization
2. To reduce the risk of false positives causing unnecessary disruption to legitimate systems or users
3. To prevent analysts from reviewing incident outcomes
4. To remove audit trails from automated actions

Answer: B) To reduce the risk of false positives causing unnecessary disruption to legitimate systems or users

Explanation:

Automated actions can affect business-critical systems. Confidence thresholds, approval requirements, exception lists, role-based permissions, testing, and audit logs help control the risks of incorrectly isolating devices, disabling accounts, or blocking legitimate traffic.

23. What is alert fatigue in a Security Operations Center?

1. A condition in which analysts become overwhelmed by excessive alerts and may overlook important threats
2. A method for improving network bandwidth
3. A technique for automatically validating every alert
4. A process for reducing the number of monitored systems to zero

Answer: A) A condition in which analysts become overwhelmed by excessive alerts and may overlook important threats

Explanation:

Alert fatigue can occur when analysts face too many low-value, repetitive, or false-positive alerts. XDR can help by correlating events, prioritizing incidents, adding context, and reducing duplicate investigations, although poor tuning can still create excessive alerts.

24. Which metric can help evaluate the speed of threat detection in an XDR environment?

1. Number of monitors connected to the SOC
2. Total size of the security team's office
3. Mean Time to Detect (MTTD)
4. Number of installed desktop wallpapers

Answer: C) Mean Time to Detect (MTTD)

Explanation:

MTTD measures the average time required to detect an incident after it begins, according to the organization's measurement definition. A lower MTTD can indicate faster detection, but teams should also evaluate detection quality, incident severity, and the risk of false positives.

25. What does Mean Time to Respond (MTTR) commonly measure in security operations?

1. The number of network devices purchased annually
2. The amount of data stored in a log archive
3. The time required to create a user account
4. The average time taken to respond to an incident, according to a defined measurement method

Answer: D) The average time taken to respond to an incident, according to a defined measurement method

Explanation:

In security operations, MTTR is often used for mean time to respond or remediate, although terminology varies between organizations. Defining the start and end points clearly helps teams assess whether investigation, containment, and remediation processes are improving.

26. What is threat hunting in an XDR environment?

1. Proactively searching integrated telemetry for suspicious activity that existing detections may have missed
2. Disabling all security data collection
3. Replacing every investigation with an automatic shutdown
4. Searching only for known malicious filenames without context

Answer: A) Proactively searching integrated telemetry for suspicious activity that existing detections may have missed

Explanation:

Threat hunting uses hypotheses, intelligence, and telemetry to look for potential compromise that has not generated an existing alert. XDR can support hunting by making related endpoint, identity, network, email, and cloud information available for investigation.

27. How can machine learning contribute to XDR?

1. By guaranteeing that every event is classified correctly
2. By identifying patterns or anomalies that may indicate malicious activity
3. By eliminating the need for security data
4. By replacing all access controls

Answer: B) By identifying patterns or anomalies that may indicate malicious activity

Explanation:

Machine-learning techniques can help identify suspicious patterns, unusual behavior, and relationships within large volumes of telemetry. Their outputs require contextual evaluation because models may generate false positives or miss novel threats.

28. What is the purpose of a risk score assigned to an XDR incident?

1. To indicate the physical size of the affected device
2. To determine the employee's salary
3. To help prioritize investigation based on factors such as severity, confidence, asset importance, and observed behavior
4. To guarantee the exact financial impact of an attack

Answer: C) To help prioritize investigation based on factors such as severity, confidence, asset importance, and observed behavior

Explanation:

Incident scoring helps analysts decide which events require urgent attention. Depending on the product, scoring may consider detection severity, related events, asset criticality, threat intelligence, and behavioral context. A score is a prioritization aid rather than a guarantee of actual impact.

29. What is a major challenge when deploying XDR across multiple security products?

1. Different products may use incompatible data formats, schemas, APIs, or integration methods
2. Security products never generate telemetry
3. Every vendor uses exactly the same data model
4. Integration removes the need for identity management

Answer: A) Different products may use incompatible data formats, schemas, APIs, or integration methods

Explanation:

Cross-vendor integration may require data normalization, connector configuration, API permissions, and consistent entity mapping. Incomplete integrations can reduce visibility or prevent reliable event correlation, so organizations should validate data coverage and integration reliability.

30. Why is data normalization important in XDR?

1. It removes all security event details
2. It guarantees that every vendor's detection logic is identical
3. It converts all telemetry into images
4. It helps represent information from different sources in a consistent structure for correlation and analysis

Answer: D) It helps represent information from different sources in a consistent structure for correlation and analysis

Explanation:

Different security tools may represent timestamps, usernames, device identifiers, IP addresses, and event types differently. Normalization maps these fields into consistent structures, improving the ability to correlate related observations across products and systems.

31. What is the purpose of entity resolution in XDR?

1. To identify when different records refer to the same user, device, or other entity
2. To create a separate identity for every event regardless of context
3. To delete all records associated with users
4. To disable device inventory collection

Answer: A) To identify when different records refer to the same user, device, or other entity

Explanation:

Entity resolution connects records that refer to the same underlying object, even when identifiers differ between systems. For example, a device hostname, endpoint identifier, and network address may need to be associated correctly for an incident timeline to be accurate.

32. Why is time synchronization important for XDR event correlation?

1. It guarantees that every alert is a true positive
2. It helps establish the correct sequence of events collected from different systems
3. It removes the need for event timestamps
4. It increases the storage capacity of the SIEM

Answer: B) It helps establish the correct sequence of events collected from different systems

Explanation:

XDR may combine events from endpoints, cloud services, identity systems, and network devices. If their clocks or timestamp handling differ significantly, analysts may misinterpret the order of events. Reliable time synchronization and timestamp normalization improve incident reconstruction.

33. What is the primary benefit of integrating identity and endpoint telemetry in XDR?

1. It eliminates the need for user authentication
2. It prevents all malware from reaching a device
3. It can connect suspicious account activity with potentially compromised devices and processes
4. It ensures that every login is legitimate

Answer: C) It can connect suspicious account activity with potentially compromised devices and processes

Explanation:

Identity telemetry may reveal unusual authentication, privilege escalation, or account misuse, while endpoint telemetry may reveal malicious processes or persistence mechanisms. Correlating these sources can help determine whether suspicious account activity is associated with a compromised endpoint.

34. What is the purpose of an audit trail for XDR response actions?

1. To remove accountability for automated decisions
2. To prevent incident responders from reviewing past actions
3. To store only the final alert title
4. To record what actions were performed, when they occurred, and which user or system initiated them

Answer: D) To record what actions were performed, when they occurred, and which user or system initiated them

Explanation:

Audit trails help analysts review containment, remediation, and configuration changes. They support accountability, troubleshooting, compliance, and post-incident analysis, particularly when response actions are automated or distributed across multiple security products.

35. Which approach is most appropriate when XDR detects suspicious activity on a business-critical server?

1. Assess the threat and business impact, then apply a suitable containment action under the incident response process
2. Immediately shut down every server without investigation
3. Ignore the alert because critical servers cannot be compromised
4. Delete all evidence before determining the cause

Answer: A) Assess the threat and business impact, then apply a suitable containment action under the incident response process

Explanation:

Response actions should account for both security risk and operational impact. A critical server may require carefully coordinated isolation, traffic restrictions, credential revocation, or other containment measures. Evidence preservation and recovery planning should also be considered.

36. What is the purpose of integrating vulnerability information into XDR investigations?

1. To guarantee that all vulnerabilities have been exploited
2. To provide context about exposed systems and weaknesses that may affect incident severity
3. To eliminate the need for patch management
4. To prevent analysts from reviewing affected assets

Answer: B) To provide context about exposed systems and weaknesses that may affect incident severity

Explanation:

Vulnerability information can help analysts determine whether an affected asset has weaknesses relevant to the observed activity. When combined with exploit evidence, asset criticality, and exposure, it can improve prioritization and guide remediation. A known vulnerability does not automatically mean it has been exploited.

37. How can XDR support ransomware investigations?

1. By guaranteeing that encrypted data can always be recovered without backups
2. By automatically paying the ransom
3. By correlating suspicious processes, file changes, authentication events, and network activity
4. By disabling all security monitoring during an incident

Answer: C) By correlating suspicious processes, file changes, authentication events, and network activity

Explanation:

Ransomware investigations often require identifying the initial access method, malicious execution, lateral movement, and systems affected. XDR can connect endpoint, identity, network, and other telemetry to help responders contain the threat and assess its scope.

38. Why should an organization validate XDR detections before enabling aggressive automated response?

1. To ensure that alerts are never reviewed by analysts
2. To eliminate the need for incident classification
3. To prevent security tools from generating logs
4. To evaluate detection quality and reduce the risk of disrupting legitimate operations

Answer: D) To evaluate detection quality and reduce the risk of disrupting legitimate operations

Explanation:

Detection rules may produce false positives or behave differently across environments. Testing them against representative activity and defining appropriate thresholds can reduce the risk of incorrectly disabling accounts, isolating critical devices, or blocking legitimate services.

39. What is a key consideration when selecting an XDR solution?

1. Its telemetry coverage, integration capabilities, detection quality, response options, and fit with organizational requirements
2. The color of its user interface alone
3. Whether it can operate without any security data
4. The number of marketing terms used in its documentation

Answer: A) Its telemetry coverage, integration capabilities, detection quality, response options, and fit with organizational requirements

Explanation:

An XDR platform should be evaluated against the organization's technology environment, security objectives, operational capacity, and existing tools. Important factors include data coverage, cross-domain correlation, automation safeguards, investigation workflows, scalability, licensing, and vendor integration limitations.

40. What is a potential limitation of an XDR platform that relies on a single vendor's ecosystem?

1. It cannot detect endpoint threats
2. Integration with security products from other vendors may be more limited than expected
3. It never supports automated response
4. It cannot process security telemetry

Answer: B) Integration with security products from other vendors may be more limited than expected

Explanation:

A tightly integrated vendor ecosystem can simplify deployment and improve data sharing among supported products. However, organizations using other security tools may face connector limitations, reduced feature parity, or additional integration work. Actual capabilities vary by provider and product edition.

41. Why is data retention important in an XDR deployment?

1. It guarantees that every attack can be attributed
2. It prevents analysts from examining past events
3. It determines how long telemetry remains available for investigations, threat hunting, and compliance needs
4. It eliminates the need for data protection policies

Answer: C) It determines how long telemetry remains available for investigations, threat hunting, and compliance needs

Explanation:

Retained telemetry allows analysts to investigate incidents that may have started days or weeks before detection. Retention periods should balance investigation requirements, legal obligations, privacy, storage costs, and the need to protect sensitive security data.

42. What is a major privacy consideration when deploying XDR?

1. Security telemetry may contain sensitive user, device, communication, or behavioral information that requires appropriate protection
2. Security telemetry never contains personal or confidential information
3. All collected data must be published publicly
4. Privacy controls prevent security monitoring from being useful

Answer: A) Security telemetry may contain sensitive user, device, communication, or behavioral information that requires appropriate protection

Explanation:

XDR can collect extensive information about accounts, applications, devices, and network activity. Organizations should apply access controls, appropriate retention policies, data minimization, auditing, and applicable privacy requirements when collecting and analyzing telemetry.

43. How can XDR help identify lateral movement?

1. By monitoring only the screen brightness of a workstation
2. By correlating authentication events, remote connections, process activity, and access to other systems
3. By disabling all internal network communication permanently
4. By examining only the organization's public website

Answer: B) By correlating authentication events, remote connections, process activity, and access to other systems

Explanation:

Lateral movement occurs when an attacker moves from one system or account to others within an environment. XDR can connect unusual authentication patterns, remote administration activity, suspicious process execution, and access to additional assets to help detect and investigate this behavior.

44. What is the purpose of integrating threat intelligence into XDR?

1. To ensure that every indicator is always accurate
2. To replace all internal telemetry
3. To prevent analysts from investigating unfamiliar activity
4. To add context about known malicious indicators, threat actors, and attack techniques

Answer: D) To add context about known malicious indicators, threat actors, and attack techniques

Explanation:

Threat intelligence can enrich detections with information about malicious infrastructure, malware, campaigns, and adversary techniques. This context may help prioritize alerts and guide investigations, but intelligence must be evaluated for freshness, relevance, confidence, and false-positive risk.

45. What is the benefit of integrating XDR with ticketing or case-management systems?

1. It can help create, assign, track, and document incident investigations and response tasks
2. It removes the need for incident ownership
3. It automatically proves every alert is malicious
4. It replaces all technical detection capabilities

Answer: A) It can help create, assign, track, and document incident investigations and response tasks

Explanation:

Ticketing and case-management integrations help teams assign responsibilities, document findings, track remediation, and maintain an audit trail. Linking XDR incidents to operational workflows can improve coordination between SOC analysts, IT teams, and other stakeholders.

46. Why should XDR response workflows be tested regularly?

1. To ensure that response workflows never change
2. To remove every approval step regardless of risk
3. To verify that integrations, permissions, conditions, and response actions work as intended
4. To guarantee that every future incident will be identical

Answer: C) To verify that integrations, permissions, conditions, and response actions work as intended

Explanation:

Security integrations and response procedures can break after software updates, configuration changes, or permission changes. Regular testing helps confirm that workflows trigger correctly, preserve evidence, respect approval requirements, and perform the intended actions without unnecessary disruption.

47. An XDR platform detects a suspicious login followed by unusual access to sensitive files. What is the most appropriate next step?

1. Assume the activity is legitimate because authentication succeeded
2. Correlate identity and file-access telemetry, assess the risk, and investigate whether the account is compromised
3. Delete all authentication logs immediately
4. Disable every user account in the organization without assessing the incident

Answer: B) Correlate identity and file-access telemetry, assess the risk, and investigate whether the account is compromised

Explanation:

A successful login does not necessarily indicate legitimate activity. Analysts should review the account's normal behavior, login context, accessed resources, and other related events. If compromise is suspected, the team can follow its response process to contain the account and protect affected data.

48. Which metric can help measure how effectively XDR reduces the burden of duplicate alerts?

1. The number of keyboards used by analysts
2. The total size of the office network rack
3. The number of operating systems installed on employee laptops
4. The reduction in duplicate alerts or separate investigations after event correlation

Answer: D) The reduction in duplicate alerts or separate investigations after event correlation

Explanation:

Tracking duplicate alerts and investigations can help determine whether correlation and incident grouping reduce repetitive work. This measure should be considered alongside detection accuracy, incident severity, missed threats, analyst workload, and response quality.

49. An organization uses endpoint, email, and identity security tools. A phishing message is followed by a malicious process on a laptop and an unusual login from the same user's account. Which XDR capability is most valuable in this situation?

1. Cross-domain correlation that links the email, endpoint, and identity events into a related investigation
2. Deleting all email records as soon as a message is delivered
3. Monitoring endpoint activity without considering identity or email information
4. Disabling all user authentication permanently

Answer: A) Cross-domain correlation that links the email, endpoint, and identity events into a related investigation

Explanation:

The sequence may indicate a phishing-driven compromise. Correlating email delivery, process execution, and authentication events helps analysts reconstruct the possible attack path, identify affected assets, and determine appropriate containment and remediation actions.

50. An XDR platform receives 1,200 security alerts in one day. After correlation, it groups these alerts into 150 incidents. If analysts fully investigate 120 of those incidents by the end of the day, what percentage of the correlated incidents has been investigated?

1. 10%
2. 12.5%
3. 80%
4. 90%

Answer: C) 80%

Explanation:

Total correlated incidents = 150.

Incidents investigated = 120.

Percentage investigated = (Investigated incidents / Total correlated incidents) × 100.

Percentage investigated = (120 / 150) × 100.

Percentage investigated = 0.8 × 100 = 80%.

Therefore, analysts investigated 80% of the correlated incidents by the end of the day. This metric describes investigation completion, not the accuracy of detections or the percentage of threats successfully contained.