1.1 Explain the Function of Users, Roles, Log Management, Compliance, and Data Protection in Cortex XDR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the core principle behind Role-Based Access Control (RBAC) in Cortex XDR?

   • AAccess is determined by the user's IP address
   • BAll users have the same level of access regardless of role
   • CUsers are assigned permissions based on their role within the organization
   • DPermissions are granted based on the user's seniority
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has a SOC with two teams: the detection team needs to create and modify alert rules, while the incident response team needs to perform response actions on endpoints. The security manager wants to ensure that no team can perform the other team's functions. What is the most appropriate way to configure this in Cortex XDR?

   • ACreate one custom role that includes all permissions and assign it to all users
   • BUse the built-in Admin role for both teams and rely on user training to avoid misuse
   • CAssign both teams the same custom role with all permissions enabled
   • DCreate two custom roles with specific permissions and assign each team its respective role
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is preparing for a SOC 2 audit and needs to demonstrate that access to Cortex XDR is restricted to authorized personnel and that security events are logged. Which combination of Cortex XDR features should the company use?

   • AData masking and log retention
   • BUser roles and data masking
   • CRBAC and audit logging
   • DEncryption and network segmentation
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A SOC has a strict separation-of-duties policy: the team that creates and modifies alert rules must not be able to perform response actions, and the team that performs response actions must not be able to modify alert rules. The security manager needs to implement this in Cortex XDR while also ensuring that both teams can view alerts. What is the best approach?

   • ACreate two custom roles: one with alert-rule permissions and view access, another with response-action permissions and view access
   • BUse the Admin role for the rule team and the Viewer role for the response team
   • CCreate one custom role with all permissions and assign it to both teams
   • DAssign both teams the Analyst role, which includes both rule creation and response actions
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial institution must comply with PCI DSS, which requires audit trails that capture user access to systems and data. The compliance officer asks the security team to ensure Cortex XDR provides the necessary audit evidence. What should the team do?

   • AExport all logs to a third-party SIEM and disable native logging
   • BEnable audit logging for user activities and administrative changes in Cortex XDR
   • CDisable audit logging to reduce storage costs
   • DRely on endpoint detection logs only, as they capture all user activity
   Reveal Solution Discussion Select an answer first