1.1 Explain the Function of Users, Roles, Log Management, Compliance, and Data Protection in Cortex XDR SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security administrator is concerned about sensitive data being exposed in Cortex XDR logs when analysts view them. The administrator wants to ensure that credit card numbers are not visible in log entries, but the data must still be available for forensic analysis. What should the administrator configure?

   • ANetwork segmentation to restrict log access
   • BData masking to hide credit card numbers in logs
   • CLog retention to limit exposure time
   • DEncryption of logs at rest
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security administrator needs to ensure that Cortex XDR logs are protected from unauthorized access during transmission from endpoints to the cloud. What should the administrator verify is enabled?

   • ATLS encryption for data in transit
   • BLog retention policies
   • CData masking for sensitive fields
   • DRBAC for endpoint users
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company must comply with GDPR, which requires protecting personal data and demonstrating accountability. The security team wants to use Cortex XDR to support GDPR compliance. What should the team do?

   • ARestrict all user access to the Admin role
   • BUse only encryption for all data
   • CDisable logging to minimize data collection
   • DEnable audit logging and data masking for personal data
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company is subject to a regulatory requirement that mandates log retention for 18 months. However, the company's Cortex XDR tenant has a maximum retention period of 12 months. The security team must find a way to meet the requirement without losing the ability to search historical logs. What should the team do?

   • ADisable log retention to store logs indefinitely
   • BExport logs to an external SIEM or data lake that supports 18-month retention and search
   • CIncrease the Cortex XDR retention period to 18 months
   • DUse data masking to preserve logs longer
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A healthcare organization uses Cortex XDR and must protect sensitive patient data stored in logs. The security team wants to ensure that only authorized personnel can view the actual patient identifiers in log entries, while other analysts see masked values. What should the team implement?

   • AData masking based on user roles
   • BNetwork segmentation for log storage
   • CLog retention policies
   • DEncryption of logs at rest
   Reveal Solution Discussion Select an answer first