2.1 Explain the Function of Key Components of Cortex Cloud CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 8)

Questions 36–39

1. 36application · medium

   A security operations team is investigating a potential data exfiltration incident that occurred 90 days ago. The team needs to query raw firewall and endpoint logs from that specific time period to trace the attacker's lateral movement. Cortex Cloud has been ingesting logs since deployment. What should the team verify first to ensure the investigation can proceed?

   • AThat the compliance reporting module has a scheduled report covering that date range
   • BThat the rules and policies engine has an alert rule that triggered during that period
   • CThat the log retention policy for the relevant data sources still includes the 90-day-old logs
   • DThat the asset inventory has recorded the endpoint's network location from 90 days ago
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During a threat hunt, an analyst discovers that several endpoints in the environment are communicating with a domain that was registered three days ago. The domain is not in any threat intelligence feed. The analyst wants to determine if this domain is malicious. What should the analyst do in Cortex Cloud?

   • ACheck the asset inventory to see if the domain is listed as a managed asset
   • BAdd the domain's IP address as an IP address indicator and block all traffic to that IP
   • CCreate a domain indicator for the domain and correlate it with other network events to identify suspicious behavior
   • DReview the compliance reports to see if the domain is flagged for policy violations
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security team is planning to use Cortex Cloud for a forensic investigation that will require access to logs from multiple sources, including cloudtrail, firewall, and endpoint logs. The investigation may last several months. What should the team verify about the log management configuration?

   • AThat the asset inventory includes all log sources as managed assets
   • BThat the compliance reports include the log sources in the latest framework assessment
   • CThat the retention period for each log source is long enough to cover the expected investigation timeline
   • DThat the data protection settings mask all sensitive fields in the logs
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is a purpose of categorizing assets in Cortex Cloud's asset inventory?

   • ATo encrypt all assets with the same key
   • BTo provide a list of all users with access to each asset
   • CTo automatically delete unused assets
   • DTo apply appropriate security policies based on asset type
   Reveal Solution Discussion Select an answer first