3.1 Identify and Explain the Use of Key Cortex XDR Elements SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following best describes how Cortex XDR sensors are deployed in an enterprise environment?

   • AAs a cloud service that runs alongside the organization's existing SIEM
   • BAs a virtual appliance that inspects all network traffic at the perimeter
   • CAs a software agent installed on supported endpoints, typically managed and distributed through the Cortex XDR console
   • DAs a hardware device installed in the data center to monitor server traffic
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is deploying Cortex XDR sensors on a mix of Windows and Linux servers. The security team wants to ensure that the sensors collect process execution data, network connection data, and file integrity monitoring data. The team also wants to be able to perform remote actions such as killing a process or quarantining a file. What is the primary function of the Cortex XDR sensor in this deployment?

   • AEstablish behavioral baselines
   • BCorrelate logs from multiple sources
   • CProvide sandboxing for unknown files
   • DCollect endpoint telemetry and execute response actions
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst receives an alert from Cortex XDR about a suspicious file that was executed on a user's workstation. The analyst needs to determine if the file is malicious, understand what it did on the system, and then take action to prevent further spread. The analyst has already used WildFire to confirm the file is malware. What is the next logical step the analyst should take using Cortex XDR's detection and response mechanisms?

   • AInvestigate the alert using Causality View and then isolate the endpoint
   • BDisable the user's account to prevent further access
   • CRebuild the workstation from scratch immediately
   • DSubmit the file to WildFire again for a second opinion
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a data source that Cortex XDR can use in investigations?

   • ABuilding access control logs
   • BEndpoint telemetry from installed sensors
   • CPhysical security camera feeds
   • DEmployee HR records
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of the Causality View in Cortex XDR?

   • ATo list all users who have logged into a system
   • BTo provide a summary of all alerts in the last 24 hours
   • CTo show the root cause and the chain of events that led to an alert
   • DTo display the network topology of the organization
   Reveal Solution Discussion Select an answer first