6.6 Explain the Features and Functionality of Cortex Solutions CYBERSECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which feature of Cortex XSOAR supports case management by allowing analysts to track the status, severity, and assignment of an incident?

   • AIncident fields and status tracking
   • BData normalization
   • CThreat intelligence feeds
   • DPlaybook automation
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During an incident, an analyst needs to run a command on an endpoint to collect forensic data and share the output with the team in real time. Which XSOAR feature allows this action to be executed and the results shared in a collaborative space?

   • AIncident layout with custom fields
   • BWar room with the ability to run commands and share outputs
   • CThreat intelligence management
   • DPlaybook builder
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team wants to automate incident response, but they are concerned about losing human oversight. They want automation to handle repetitive tasks, but they require a human to approve any action that could impact production systems. How can they achieve this in Cortex XSOAR?

   • AUse playbooks that automatically execute all actions without interruption
   • BConfigure the war room to require analyst presence before any action
   • CDisable all automation and handle incidents manually
   • DDesign playbooks with manual approval steps for high-impact actions
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In Cortex XSOAR, what is a playbook?

   • AA report that summarizes security incidents over a period
   • BA list of approved software applications for the organization
   • CA collection of indicators of compromise (IOCs) for threat intelligence
   • DA visual representation of an automated incident response workflow
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team needs to identify all internet-facing assets that could be entry points for attackers, prioritize them based on risk, and provide actionable remediation steps to asset owners. Which Cortex solution and feature combination should they use?

   • ACortex Xpanse with a playbook that automates firewall rule changes
   • BCortex Xpanse with attack surface discovery and risk assessment
   • CCortex XSOAR with incident response playbooks
   • DCortex XSIAM with data ingestion and analytics
   Reveal Solution Discussion Select an answer first