1.1 Explain the Function of Users, Roles, Log Management, Compliance, and Data Protection in Cortex XDR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations center (SOC) manager wants to grant a new analyst the ability to view and investigate alerts but not modify prevention policies or manage user accounts. The analyst should also be able to create custom alert rules. Which Cortex XDR role should the manager assign?

   • AAdmin
   • BTrusted Agent
   • CAnalyst
   • DViewer
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC supervisor wants to delegate the ability to manage Cortex XDR user accounts and roles to a senior analyst, but the supervisor does not want the senior analyst to be able to view or modify security policies. Which built-in role should the supervisor assign?

   • AViewer
   • BUser Manager
   • CAnalyst
   • DAdmin
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security administrator needs to protect sensitive data in Cortex XDR logs while still allowing forensic analysts to perform deep investigations. The administrator also wants to ensure that only senior investigators can see unmasked data. What should the administrator configure?

   • AData masking with role-based exceptions for senior investigators
   • BEncryption of logs with a key held only by senior investigators
   • CLog retention policies that delete sensitive data after a short period
   • DNetwork segmentation to restrict access to logs
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of user roles in Cortex XDR?

   • ATo automatically assign licenses to all users in the organization
   • BTo manage the physical security of the data center hosting Cortex XDR
   • CTo define the permissions and access controls that determine what actions a user can perform
   • DTo encrypt all data stored in the Cortex XDR cloud
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security operations center is implementing Cortex XDR and needs to design a solution that meets multiple requirements: least privilege access, auditability for compliance, protection of sensitive data, and the ability to investigate historical incidents. The team must balance these requirements without overburdening administrators. What is the most effective design?

   • AImplement RBAC with custom roles, enable audit logging, configure data masking, and set retention to meet compliance needs
   • BEnable data masking and set retention, but disable audit logging to reduce overhead
   • CUse only encryption and network segmentation
   • DUse the Admin role for all users and rely on audit logging
   Reveal Solution Discussion Select an answer first