5.7 Explain the Features and Functionality of Cortex XDR CYBERSECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team uses Cortex XDR and also has a third-party SIEM. The team wants to send Cortex XDR alerts to the SIEM for centralized monitoring. Which Cortex XDR feature should the team use?

   • AThe WildFire analysis report
   • BThe endpoint isolation feature
   • CThe correlation rule editor
   • DThe SIEM integration via the Cortex XDR API or a syslog forwarder
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is reviewing an alert that was generated by a correlation rule. The alert includes multiple events from different endpoints. The team wants to understand the root cause of the incident. Which Cortex XDR feature should the team use?

   • AThe Alerts View
   • BThe Integration View
   • CThe Assets View
   • DThe Causality View
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During an incident response, an analyst identifies a malicious process that is running on multiple endpoints. The analyst has confirmed the process is not needed for business operations. The analyst wants to stop the process on all affected endpoints immediately and prevent it from running again. Which Cortex XDR action should the analyst take?

   • AAdd the process hash to the block list and terminate the process on each endpoint
   • BDisable the local firewall on the affected endpoints
   • CRun a new WildFire analysis on the process to confirm it is malicious
   • DQuarantine the file associated with the process on one endpoint
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which detection method is used by Cortex XDR to identify threats by comparing activity to a baseline of normal behavior?

   • AReputation-based detection
   • BHeuristic analysis
   • CSignature-based detection
   • DBehavioral analytics
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How can Cortex XDR integrate with third-party tools to enhance response capabilities?

   • ABy requiring all third-party tools to be installed on the same server as Cortex XDR
   • BBy using APIs to trigger actions in security orchestration, automation, and response (SOAR) platforms
   • CBy manually exporting logs from third-party tools and importing them into Cortex XDR
   • DBy replacing the third-party tool's agent with the Cortex XDR agent
   Reveal Solution Discussion Select an answer first