3.1 Identify and Explain the Use of Key Cortex XDR Elements SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a key detection and response capability of Cortex XDR?

   • AReplacing the need for a SIEM by storing all logs indefinitely
   • BOnly providing detection without any response capabilities
   • CGenerating alerts based on correlated telemetry and providing remediation actions such as isolating an endpoint
   • DAutomatically patching all vulnerabilities on endpoints
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary role of WildFire in the Cortex XDR ecosystem?

   • ATo provide a cloud-based sandboxing service that analyzes unknown files and generates threat intelligence
   • BTo act as a firewall that blocks all network traffic from unknown sources
   • CTo provide a user interface for managing firewall rules
   • DTo store all endpoint logs for compliance purposes
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An analyst is investigating an alert for a ransomware infection on a server. The Causality View shows that the initial infection vector was a malicious document opened by a user, which spawned a PowerShell script, which then downloaded and executed the ransomware binary. The ransomware binary then encrypted files on the server and attempted to spread to other servers via SMB. The analyst needs to identify all affected assets and understand the full scope of the attack. The analyst has already isolated the original server. What is the most important next step the analyst should take to fully understand the scope of the attack and prevent further spread?

   • AImmediately shut down all servers in the environment to prevent further spread.
   • BUse the Causality View to identify all child processes and files created by the ransomware, then check other servers for similar activity.
   • CReset the password of the user who opened the malicious document.
   • DSubmit the ransomware binary to WildFire for analysis.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is investigating an alert where a user's credentials were used to log into a server, and then a file was accessed and exfiltrated. The analyst needs to understand the full context: who the user is, what assets they have access to, and what artifacts (files) were involved. The analyst wants to pivot from the alert to see all related information about the user, the specific file, and the server in one place. Which Cortex XDR investigation entities should the analyst use to enrich the investigation?

   • ALog Stitching
   • BBehavioral Analytics
   • CWildFire Integration
   • DUsers, Artifacts, and Assets
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is an 'artifact' in the context of Cortex XDR investigations?

   • AA file, hash, or other piece of evidence associated with an alert
   • BA user account that has been compromised
   • CA network device such as a firewall or router
   • DA security policy that governs access
   Reveal Solution Discussion Select an answer first