3.1 Identify and Explain the Use of Key Cortex XDR Elements SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations team receives an alert from a Cortex XDR sensor about an unknown executable running on several endpoints. The file has not been seen before in the environment, and no local signature matches it. The team needs to determine if the file is malicious by observing its behavior in a controlled environment before deciding on a response. Which Cortex XDR element should the team use to accomplish this?

   • ACausality View
   • BWildFire Integration
   • CBehavioral Analytics
   • DLog Stitching
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company has a strict policy that no unknown files should be executed on endpoints without prior approval. A user downloads a file from the internet and executes it. The Cortex XDR sensor detects the file as unknown and sends it to WildFire for analysis. WildFire returns a verdict of 'malicious' after 5 minutes. Meanwhile, the file has already executed on the endpoint and is attempting to make outbound connections. The analyst needs to respond quickly. The analyst has confirmed the file is malicious via WildFire. What is the most effective immediate response action the analyst should take to minimize the impact?

   • AIsolate the endpoint immediately to prevent further outbound connections and lateral movement.
   • BKill the malicious process and delete the file.
   • CWait for the WildFire analysis to complete before taking any action.
   • DDisable the user's network access at the switch level.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of the alert generation process in Cortex XDR?

   • ATo automatically delete all suspicious files without user intervention
   • BTo notify security analysts of potential threats that require investigation
   • CTo provide a summary of all network traffic for the day
   • DTo replace the need for human analysts in the security operations center
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does log stitching improve the efficiency of security investigations?

   • ABy storing all logs in a single database for faster query performance
   • BBy reducing the number of alerts generated by the system
   • CBy providing a unified view of related events, eliminating the need to manually correlate data from multiple sources
   • DBy automatically remediating all detected threats without analyst intervention
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is investigating a potential data breach. The analyst has access to endpoint telemetry showing file access on a user's workstation, network logs showing data transfers to an external IP, and cloud logs showing downloads from a cloud storage service. The analyst wants to determine if the data exfiltration was initiated from the user's workstation or from a cloud account. Which data sources should the analyst combine to make this determination?

   • AEndpoint and cloud data sources only
   • BCloud and network data sources only
   • CEndpoint and network data sources only
   • DEndpoint, network, and cloud data sources
   Reveal Solution Discussion Select an answer first