5.7 Explain the Features and Functionality of Cortex XDR CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst notices a series of alerts for a single workstation that, taken individually, appear benign: a PowerShell script that queries Active Directory, a scheduled task creation, and an outbound connection to a rarely-used IP. The analyst wants to determine if these events are part of a coordinated attack. Which Cortex XDR capability should the analyst use to correlate these events into a single incident?

   • ACreate a correlation rule that groups the events by host and time window
   • BEnable the endpoint's local logging to capture more detail
   • CUse the IOC management console to add the IP as a malicious indicator
   • DRun a WildFire analysis on the PowerShell script
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which step is part of the investigation workflow in Cortex XDR?

   • ARun a vulnerability scan on the entire network
   • BTriage alerts to determine which ones require further investigation
   • CDeploy new endpoint agents to all workstations
   • DConfigure firewall rules to block malicious IP addresses
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company uses Palo Alto Networks next-generation firewalls and Cortex XDR. The security team wants to share threat intelligence between the firewall and Cortex XDR to improve detection. Which feature should the team enable?

   • AThe cloud email security integration
   • BThe Cortex XDR agent's local logging
   • CThe bidirectional integration between Cortex XDR and the firewall
   • DThe firewall's built-in antivirus signatures
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which statement best describes the primary purpose of Cortex XDR?

   • ATo replace traditional firewalls by filtering all network traffic at the perimeter
   • BTo provide a cloud-based backup and disaster recovery service for critical servers
   • CTo manage patch deployment and software updates for endpoints only
   • DTo provide a centralized platform for detecting and responding to threats across endpoints, network, and cloud data
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An analyst is investigating an alert that shows a legitimate business application attempting to modify a registry key that is also a known persistence technique. The application is used by the finance department and cannot be taken offline. The analyst needs to determine if this is a true positive or a false positive. Which approach should the analyst take?

   • AIgnore the alert because the application is known to be legitimate
   • BCheck the process tree and command-line arguments to see if the application is running as expected
   • CImmediately quarantine the application's executable file
   • DAdd the registry key to the block list to prevent any modification
   Reveal Solution Discussion Select an answer first