3.1 Identify and Explain the Use of Key Cortex XDR Elements SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A large enterprise has deployed Cortex XDR sensors on all endpoints, integrated their Palo Alto Networks firewall logs, and connected their Azure Active Directory (AD) logs. An analyst is investigating a potential account compromise. The AD log shows a successful login from a new IP address at 09:00. The firewall log shows an outbound connection from that IP to a known malicious domain at 09:05. The endpoint sensor shows no suspicious activity on the user's workstation during that time. The analyst needs to determine if the user's workstation is compromised or if the credentials are being used from another device. The analyst wants to see all these events in a single chronological view to make this determination. However, the analyst notices that the events from the firewall and AD are not appearing in the same timeline as the endpoint events. What is the most likely reason for this discrepancy, and what should the analyst do to resolve it?

   • AThe endpoint sensor is not collecting data; the analyst should reinstall the sensor on the user's workstation.
   • BThe events occurred at different times; the analyst should manually align the timestamps.
   • CThe firewall and AD logs are not being ingested into Cortex XDR; the analyst should verify the data source integrations are properly configured.
   • DThe user's workstation is not compromised; the analyst should close the investigation.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does behavioral analytics in Cortex XDR identify suspicious activities?

   • ABy comparing current behavior against a baseline of normal activity and flagging significant deviations
   • BBy scanning all files for known malware signatures
   • CBy requiring users to change passwords frequently
   • DBy blocking all traffic from unknown IP addresses
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How are users, artifacts, and assets used in Cortex XDR investigations?

   • AThey are used to store backup copies of critical data
   • BThey are used to automatically block all user access when an alert is generated
   • CThey are used as key entities to enrich context and trace the spread of a threat
   • DThey are only used for reporting purposes and do not aid in investigations
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the role of a baseline in behavioral analytics?

   • ATo provide a list of known malicious IP addresses
   • BTo store all historical logs for compliance purposes
   • CTo define the minimum security requirements for the organization
   • DTo establish a reference point of normal activity against which anomalies are detected
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is deploying Cortex XDR across 500 endpoints. The security team wants to ensure that the sensors collect detailed telemetry—including process execution, network connections, file modifications, and registry changes—and send this data to the Cortex XDR cloud for analysis. The team also wants to be able to perform remote remediation actions, such as isolating a compromised endpoint. What is the primary role of the Cortex XDR sensor in this deployment?

   • ATo collect endpoint telemetry and execute remediation actions
   • BTo establish behavioral baselines
   • CTo provide sandboxing for unknown files
   • DTo correlate logs from multiple sources
   Reveal Solution Discussion Select an answer first