3.3 Identify Use Cases in Which an Organization Would Benefit from Cortex XDR Compared to an Endpoint Detection and Response (EDR) Solution SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has a hybrid infrastructure with on-premises servers and workloads in Google Cloud Platform (GCP). They are using a traditional EDR that only monitors endpoints. Recently, they discovered that a threat actor was able to move from an on-premises endpoint to a GCP storage bucket by using stolen credentials. The EDR detected the initial compromise but could not see the lateral movement to the cloud. Which Cortex XDR capability would provide the necessary visibility?

   • AIngesting and correlating GCP audit logs and cloud workload telemetry with endpoint data to detect the full attack path
   • BConfiguring the GCP console to send alerts to the EDR's dashboard
   • CDeploying the EDR agent to the GCP storage bucket to monitor access
   • DUsing the EDR's network monitoring to see traffic between the on-premises endpoint and GCP
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which compliance-related benefit is specific to Cortex XDR compared to EDR?

   • AThe ability to include network and cloud activity in security reports for auditors.
   • BThe ability to store logs for exactly 90 days.
   • CThe ability to perform vulnerability scans on endpoints.
   • DThe ability to automatically generate compliance certificates.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is investigating a potential data breach. The EDR shows that a user's endpoint downloaded a file from a phishing email, but the analyst cannot determine if the file was uploaded to an external cloud service because the EDR does not log network traffic. The company uses Office 365 and has a CASB that logs cloud activity. Which Cortex XDR capability would help the analyst see the full picture?

   • AReviewing the Office 365 audit logs directly, without any integration with the EDR
   • BUsing the EDR's built-in file integrity monitoring to track the file's location
   • CIngesting and correlating CASB logs with endpoint data to see if the file was uploaded to a cloud service
   • DChecking the endpoint's browser history to see if the user visited the cloud service
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A healthcare organization must comply with HIPAA, which requires them to maintain an audit trail of access to protected health information (PHI) and report security incidents. They currently use an EDR that only logs endpoint events. The compliance team needs to demonstrate that they have visibility into network traffic and cloud storage access related to PHI. Which Cortex XDR capability would most help meet this requirement?

   • AAutomated deletion of PHI data from endpoints to reduce the scope of compliance
   • BIntegration with the EDR's existing logs to create a single report for all compliance needs
   • CA built-in compliance scanner that automatically generates HIPAA reports without any configuration
   • DCentralized data collection and reporting that includes endpoint, network, and cloud activity, providing a comprehensive audit trail
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why would an organization with significant cloud and network traffic benefit from Cortex XDR over EDR?

   • ACortex XDR only works in cloud environments.
   • BCortex XDR can replace the cloud provider's native security tools.
   • CCortex XDR provides a built-in firewall to block malicious traffic.
   • DCortex XDR can correlate network traffic with cloud workload activity to detect threats that span both environments.
   Reveal Solution Discussion Select an answer first