3.1 Identify and Explain the Use of Key Cortex XDR Elements SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company's endpoints typically run a standard set of business applications, and network traffic patterns are consistent during business hours. The security team wants to configure Cortex XDR to automatically flag unusual behavior, such as a workstation making connections to a new external IP at 3:00 AM or a user launching a never-before-seen application. Which Cortex XDR capability should the team rely on to detect these deviations from the norm?

   • ACausality View
   • BBehavioral Analytics
   • CLog Stitching
   • DWildFire Integration
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary role of a Cortex XDR sensor deployed on an endpoint?

   • ATo replace the firewall and enforce all network security policies at the endpoint
   • BTo continuously collect endpoint telemetry and forward it to the Cortex XDR cloud for analysis
   • CTo provide a user interface for security analysts to manage alerts
   • DTo store all endpoint logs locally for a minimum of one year before uploading
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In the Causality View, what does the 'root cause' typically represent?

   • AThe event that generated the most number of logs
   • BThe most severe event in the chain, regardless of when it occurred
   • CThe final action taken by the attacker before the alert was generated
   • DThe initial event or action that started the chain of events leading to the alert
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company has deployed Cortex XDR with Behavioral Analytics enabled. The analytics engine has established baselines for each endpoint. One endpoint, used by a developer, typically runs a specific set of development tools and connects to a known set of internal servers. Recently, the developer started using a new build tool that connects to an external repository. The Behavioral Analytics engine flags this as an anomaly. The analyst investigates and confirms the new tool is legitimate. However, the analyst is concerned that the baseline will be permanently skewed by this legitimate activity, causing future anomalies to be missed. What is the most appropriate action for the analyst to take?

   • AReset the baseline for the endpoint so it learns the new tool as normal behavior.
   • BDisable Behavioral Analytics for that specific endpoint to prevent future false positives.
   • CIgnore the alert and take no action, as the activity is legitimate.
   • DManually add the new tool and external repository to an allowlist so the analytics engine does not flag it as anomalous in the future.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of log stitching in Cortex XDR?

   • ATo encrypt logs so they cannot be read by unauthorized users
   • BTo delete duplicate logs automatically
   • CTo combine logs from different sources into a single, unified timeline for a given event or session
   • DTo compress log data to reduce storage costs
   Reveal Solution Discussion Select an answer first