5.7 Explain the Features and Functionality of Cortex XDR CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which action is a response capability provided by Cortex XDR?

   • AIsolating an endpoint from the network to contain a threat
   • BUpdating antivirus signatures on all endpoints
   • CChanging user passwords for all domain accounts
   • DRebuilding the operating system on a compromised server
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations center (SOC) uses a third-party ticketing system for incident management. The team wants to automatically create a ticket when Cortex XDR generates a high-severity alert. Which Cortex XDR feature should the team configure?

   • AA manual export of alerts to a CSV file that is imported into the ticketing system
   • BA correlation rule that sends an email to the SOC manager
   • CAn integration with the ticketing system via the Cortex XDR API or a built-in connector
   • DA WildFire analysis that generates a report for the ticketing system
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which data source can Cortex XDR ingest to enhance visibility beyond endpoints?

   • ARouter configuration backups from network devices
   • BFirewall logs from Palo Alto Networks next-generation firewalls
   • CDNS zone transfer logs from external DNS servers
   • DPrinter spooler logs from print servers
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is reviewing an alert generated by Cortex XDR that indicates a user downloaded a file from the internet and executed it. The file is not flagged by traditional antivirus signatures. The analyst needs to determine if the file is malicious. Which Cortex XDR feature should the analyst use to get a quick verdict?

   • AReview the process tree to see what the file did after execution
   • BCheck the file's reputation in the threat intelligence feed
   • CSubmit the file to WildFire for dynamic analysis
   • DAdd the file hash to the block list to prevent further execution
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is evaluating Cortex XDR and wants to understand how it collects data from endpoints. The company has both Windows and Linux servers. Which statement accurately describes the data collection process?

   • AThe Cortex XDR agent is installed on each endpoint and collects telemetry such as process, network, and file activity
   • BCortex XDR collects data only from cloud workloads, not on-premises servers
   • CCortex XDR collects data only from the network firewall, not from endpoints
   • DCortex XDR requires a separate agent for each operating system type
   Reveal Solution Discussion Select an answer first