5.7 Explain the Features and Functionality of Cortex XDR CYBERSECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security analyst is investigating an alert that shows a process making outbound connections to a known command-and-control (C2) server. The process is a legitimate system utility. The analyst wants to confirm the alert and determine the scope of the compromise. Which action should the analyst take?

   • AQuarantine the legitimate system utility
   • BImmediately block the C2 server IP in the firewall
   • CIgnore the alert because the process is a legitimate system utility
   • DUse the Causality View to see the process tree and identify the parent process
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is responding to an alert that indicates a malicious file was downloaded and executed on a user's endpoint. The analyst wants to remove the file and prevent it from running again. Which Cortex XDR action should the analyst take?

   • AIsolate the endpoint from the network
   • BTerminate the process associated with the file
   • CAdd the file hash to the block list
   • DQuarantine the file
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which component is a core part of the Cortex XDR architecture?

   • APanorama Management Server
   • BGlobalProtect Gateway
   • CPrisma Access Cloud
   • DCortex Data Lake
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How does Cortex XDR primarily collect endpoint telemetry?

   • ABy deploying a network tap that mirrors all endpoint traffic
   • BBy installing a lightweight agent on supported endpoints
   • CBy using Active Directory group policy to push scripts that collect data
   • DBy querying the Windows Event Log over the network using WMI
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A small company with 50 endpoints wants to improve its security posture by detecting advanced threats that evade traditional antivirus. The company has no dedicated security team and wants a solution that provides visibility across endpoints, network, and cloud without deploying multiple separate products. Which approach best aligns with these requirements?

   • ADeploy Cortex XDR agents on all endpoints and use the cloud-delivered console to manage detection and response
   • BInstall a traditional antivirus product on each endpoint and rely on its signature updates
   • CUse only the firewall logs to detect threats and manually investigate alerts
   • DPurchase a separate network firewall, endpoint protection, and cloud security product and manage them independently
   Reveal Solution Discussion Select an answer first