2.1 Explain the Function of Key Components of Cortex Cloud CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which property is commonly associated with an IP address indicator in Cortex Cloud?

   • AThe geolocation of the IP address
   • BThe user's role in the organization
   • CThe user's password hash
   • DThe associated domain name
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   How does the domain indicator type assist in detecting malicious activity?

   • ABy encrypting DNS queries to protect privacy
   • BBy correlating network traffic with known malicious domains
   • CBy resolving domain names to IP addresses for routing
   • DBy blocking all traffic to domains that are not in the allowlist
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company has just experienced a confirmed security breach. The incident response team needs to quickly identify the scope of the breach, contain the affected workloads, and preserve evidence for legal action. The team uses Cortex Cloud. What is the most appropriate sequence of actions?

   • AAdd the attacker's IP to the asset inventory to block it
   • BGenerate a compliance report to document the breach and present it to legal
   • CUse log management to investigate the breach, apply rules and policies to isolate affected workloads, and preserve logs for evidence
   • DCreate a users indicator type to track the attacker's identity
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst is reviewing an alert that indicates a user account was used to access a sensitive database from an unusual location. The analyst wants to understand the user's normal behavior and whether this access is anomalous. What should the analyst use in Cortex Cloud?

   • AThe IP address indicator type to check if the unusual location is a known malicious IP
   • BThe roles indicator type to see what permissions the user has in the database
   • CThe users indicator type to correlate the user's activity across multiple data sources and establish a baseline
   • DThe asset inventory to see if the database is a managed asset
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the function of the domain indicator type in Cortex Cloud?

   • ATo encrypt traffic between a domain and its users
   • BTo detect and track malicious or suspicious domains
   • CTo manage DNS records for cloud resources
   • DTo assign domain names to IP addresses
   Reveal Solution Discussion Select an answer first