3.3 Identify Use Cases in Which an Organization Would Benefit from Cortex XDR Compared to an Endpoint Detection and Response (EDR) Solution SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which use case would benefit from Cortex XDR's integrated visibility into cloud workloads, which EDR lacks?

   • AManaging patch compliance for endpoints
   • BBlocking a known malicious IP address at the firewall
   • CDetecting a malicious script running in a cloud virtual machine that communicates with a command-and-control server over the network
   • DMonitoring file integrity on a single on-premises server
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which type of threat is best addressed by Cortex XDR's cross-data analytics rather than EDR?

   • AA threat that uses a phishing email to compromise an endpoint, then uses that endpoint to move laterally across the network and into a cloud environment
   • BA threat that is only visible in cloud audit logs
   • CA threat that is only visible in firewall logs
   • DA threat that only affects a single endpoint's memory
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is using a traditional EDR, a separate network detection and response (NDR) tool, and a cloud workload protection platform (CWPP) for their Azure environment. The security team is overwhelmed by the number of alerts and the effort required to correlate them. They are considering Cortex XDR to consolidate. Which outcome would be the most significant benefit of this consolidation?

   • AEliminating the need for any other security product, including firewalls and identity management
   • BReducing the number of tools the team must learn and manage, while improving detection through unified data correlation
   • CProviding a single dashboard for all security operations, including vulnerability management and compliance
   • DAutomatically patching all vulnerabilities across endpoints and cloud workloads
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an incident response, a security team discovers that a compromised endpoint is communicating with a malicious IP, and the same IP is also being accessed from a cloud workload. The team currently uses an EDR that only shows endpoint alerts. They need to investigate the full scope of the incident across both environments and then respond. Which Cortex XDR feature would streamline this investigation and response?

   • AAn automated script that manually collects logs from both environments and correlates them in a spreadsheet
   • BA unified incident view that shows alerts from both the endpoint and the cloud workload, with the ability to initiate response actions from the same console
   • CA separate console for cloud alerts that the analyst must switch to, but with a shared dashboard
   • DA feature that only isolates the endpoint but leaves the cloud workload untouched
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a fundamental architectural difference between Cortex XDR and traditional EDR solutions?

   • ACortex XDR collects and analyzes data from multiple sources, while traditional EDR focuses primarily on endpoint telemetry.
   • BCortex XDR is a network firewall, while traditional EDR is an endpoint agent.
   • CCortex XDR only uses signature-based detection, while traditional EDR uses behavioral analytics.
   • DCortex XDR requires an on-premises server, while traditional EDR is always cloud-delivered.
   Reveal Solution Discussion Select an answer first