3.1 Identify and Explain the Use of Key Cortex XDR Elements SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is NOT a typical data source for Cortex XDR investigations?

   • ANetwork traffic logs from firewalls
   • BEndpoint process execution data
   • CEmployee performance review documents
   • DCloud service audit logs
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is examining an alert for a suspicious executable that was downloaded and executed on a user's laptop. The analyst needs to determine the original process that initiated the download and trace every subsequent action taken by the executable, including any child processes it spawned and files it modified. Which Cortex XDR investigation feature provides this specific root-cause-to-impact mapping?

   • ALog Stitching
   • BWildFire Integration
   • CBehavioral Analytics
   • DCausality View
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security operations center (SOC) is handling a critical incident. An alert was generated for a suspicious PowerShell command on a server. The analyst investigates and finds that the PowerShell command downloaded and executed a payload. The analyst submits the payload to WildFire, which returns a verdict of 'malicious'. The analyst then uses the Causality View to see that the PowerShell command was spawned by a scheduled task that was created by a compromised user account. The analyst needs to remediate the incident. The analyst has already isolated the server. What is the most important next step in the remediation process?

   • ADelete the scheduled task and remove the malicious payload from the server.
   • BDisable the compromised user account and investigate how it was compromised.
   • CRun a full antivirus scan on the server to ensure no other malware is present.
   • DRebuild the server from scratch to ensure it is clean.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During an investigation of a potential insider threat, an analyst needs to gather evidence from multiple sources: the user's workstation activity, the network firewall logs showing their outbound connections, and the cloud access logs from their Office 365 account. The analyst wants to view all this data in a single investigation interface to correlate the user's actions across all environments. Which Cortex XDR data source capability enables this comprehensive investigation?

   • AWildFire Integration
   • BData Sources in Investigations
   • CBehavioral Analytics
   • DCausality View
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does WildFire integrate with Cortex XDR to enhance detection of unknown threats?

   • ABy replacing the need for endpoint sensors on all devices
   • BBy automatically blocking all files that are not in the local cache
   • CBy providing a VPN for secure remote access
   • DBy providing a sandboxing service that returns a verdict for suspicious files, which Cortex XDR uses to update detection and prevention
   Reveal Solution Discussion Select an answer first