3.3 Identify Use Cases in Which an Organization Would Benefit from Cortex XDR Compared to an Endpoint Detection and Response (EDR) Solution SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What detection advantage does Cortex XDR's correlation across multiple data sources provide over EDR?

   • AIt can identify threats that span endpoints, network, and cloud, which might be missed when looking at each source in isolation.
   • BIt only uses signature-based detection to avoid false positives.
   • CIt eliminates the need for any endpoint agent.
   • DIt focuses on a single data source to reduce complexity.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   How does Cortex XDR provide extended visibility compared to an endpoint-only EDR?

   • ABy relying solely on firewall logs for detection
   • BBy using a single sensor that captures all network traffic
   • CBy installing agents on every server and workstation in the environment
   • DBy collecting and analyzing data from network traffic, cloud workloads, and endpoints
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team at a financial services firm is investigating a series of suspicious outbound connections from a user's workstation to a known command-and-control (C2) domain. The workstation's EDR shows the process that initiated the connection, but the team cannot see the full network path, the destination server's response, or whether other hosts on the same subnet are communicating with the same domain. The firm also runs workloads in AWS and Azure. Which Cortex XDR capability would most directly address this visibility gap?

   • AUsing the EDR's built-in network connection map to trace the full path of the C2 communication
   • BConfiguring the cloud provider's native monitoring to alert on outbound traffic from the workstation
   • CDeploying the Cortex XDR agent to all endpoints and enabling the built-in firewall
   • DIntegrating Cortex XDR with the firm's network sensors and cloud security tools to collect and correlate network and cloud data alongside endpoint data
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How can Cortex XDR help an organization meet compliance requirements more effectively than a traditional EDR?

   • ABy centralizing security data from multiple sources, making it easier to produce comprehensive audit reports.
   • BBy guaranteeing that all compliance requirements are met.
   • CBy providing a built-in compliance scanner for all regulations.
   • DBy automatically encrypting all data at rest.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which operational challenge is best addressed by adopting Cortex XDR instead of a traditional EDR?

   • AThe need to maintain an on-premises server for log storage.
   • BThe need to switch between multiple consoles to investigate an incident that spans endpoint, network, and cloud.
   • CThe need to deploy agents to every endpoint.
   • DThe need to train analysts on multiple different user interfaces.
   Reveal Solution Discussion Select an answer first