3.3 Identify Use Cases in Which an Organization Would Benefit from Cortex XDR Compared to an Endpoint Detection and Response (EDR) Solution SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is deciding whether to invest in Cortex XDR or stick with their current EDR. They have a well-staffed SOC that is comfortable with the EDR and has built custom detections. However, they are seeing an increase in attacks that involve cloud services, and they are struggling to correlate endpoint alerts with cloud activity. They also want to reduce the number of tools they use. Which factor should be the primary driver for adopting Cortex XDR?

   • AThe requirement to deploy an agent to cloud workloads, which the EDR cannot do
   • BThe need for cross-environment correlation to detect attacks that span endpoints and cloud, which the EDR cannot provide
   • CThe desire to replace their SIEM with Cortex XDR to reduce costs
   • DThe need to improve endpoint detection accuracy by using a different machine learning model
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is evaluating whether to replace their traditional EDR with Cortex XDR. They have a mature security stack that includes a next-generation firewall (NGFW) from another vendor, a cloud access security broker (CASB) for SaaS applications, and a SIEM that aggregates logs from all sources. Their primary concern is improving detection of threats that span on-premises endpoints and their AWS workloads. The security team is already proficient with their current tools. Which factor should most influence their decision to adopt Cortex XDR?

   • ACortex XDR can replace the SIEM, reducing the need for a separate log management solution
   • BCortex XDR is the only solution that can detect threats in AWS workloads
   • CCortex XDR's agent is lighter than their current EDR agent, improving endpoint performance
   • DCortex XDR's native integration with their existing NGFW and CASB provides correlated detection across endpoint, network, and cloud without requiring custom SIEM logic
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does Cortex XDR's investigation workflow differ from a traditional EDR's workflow?

   • ACortex XDR provides a unified incident view that includes endpoint, network, and cloud data, while EDR investigations are limited to endpoint artifacts.
   • BCortex XDR only provides raw logs without any context, while EDR provides rich context.
   • CCortex XDR's investigation is performed on-premises, while EDR is cloud-based.
   • DCortex XDR requires manual correlation of logs from different tools, while EDR automates everything.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When evaluating whether to adopt Cortex XDR instead of an EDR, which factor is most important to consider?

   • AThe organization's budget for security tools.
   • BThe organization's preference for on-premises versus cloud deployment.
   • CThe number of endpoints in the organization.
   • DThe organization's existing infrastructure and the need for visibility across multiple security domains.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is investigating a series of alerts that appear to be part of a coordinated attack. The EDR has flagged several endpoints with suspicious PowerShell activity, but each alert is treated as a separate incident. The team suspects that the PowerShell activity is related to a larger campaign that involves network reconnaissance and data staging in a cloud storage account. They want to confirm the relationship and respond as a single incident. Which Cortex XDR capability would enable this?

   • AUsing the EDR's built-in incident grouping feature that automatically combines all PowerShell alerts
   • BManually reviewing each alert and creating a case in the SIEM to correlate them
   • CBlocking all PowerShell activity on the endpoints to stop the attack
   • DCorrelating the PowerShell events with network and cloud activity to group them into a single incident based on shared indicators and behavior
   Reveal Solution Discussion Select an answer first