3.3 Identify Use Cases in Which an Organization Would Benefit from Cortex XDR Compared to an Endpoint Detection and Response (EDR) Solution SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When would an organization benefit from consolidating multiple security tools into Cortex XDR?

   • AWhen the organization uses separate tools for endpoint, network, and cloud detection, leading to alert fatigue and complex workflows.
   • BWhen the organization has a single security tool that covers all needs.
   • CWhen the organization has no security operations team.
   • DWhen the organization wants to increase the number of security vendors.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which organizational need would most strongly justify choosing Cortex XDR over a traditional EDR?

   • AThe need for a simple antivirus solution for a small number of endpoints.
   • BThe need to manage on-premises servers only, with no cloud or network visibility requirements.
   • CThe need for visibility and correlation across endpoints, network, and cloud environments.
   • DThe need to replace a legacy firewall.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security operations center (SOC) is understaffed and receives hundreds of alerts daily from their EDR. Most alerts are false positives, but when a real incident occurs, the analysts must manually isolate affected endpoints, collect forensic data, and block malicious indicators across multiple tools. The SOC manager wants to reduce the time to respond to confirmed incidents. Which Cortex XDR feature would most directly help?

   • AA more accurate alert triage system that only generates alerts for confirmed malicious activity
   • BA dashboard that shows all alerts from the EDR in a single view, making it easier for analysts to prioritize
   • CAutomated response playbooks that can isolate endpoints, block indicators, and gather forensics without manual intervention
   • DA built-in threat intelligence feed that automatically blocks all known malicious IPs before they reach the endpoint
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security architect is comparing Cortex XDR with a traditional EDR for a new deployment. The organization has a strong endpoint security posture but is concerned about threats that involve network traffic between endpoints and cloud services. They also want to reduce the number of security tools they manage. Which architectural difference between Cortex XDR and EDR is most relevant to this decision?

   • ACortex XDR only uses machine learning, while EDR uses signature-based detection
   • BCortex XDR requires a dedicated on-premises server, while EDR is always cloud-based
   • CCortex XDR uses a cloud-native architecture that ingests and correlates data from multiple sources, while EDR is typically limited to endpoint telemetry
   • DCortex XDR replaces the firewall, while EDR does not
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which type of threat is more likely to be detected by Cortex XDR than by a traditional EDR?

   • AA brute-force attack on a single server's login
   • BA phishing email that is blocked by the email gateway
   • CA simple malware infection on a single endpoint
   • DA multi-stage attack where an endpoint is compromised and then uses network traffic to move laterally to a cloud workload
   Reveal Solution Discussion Select an answer first